Privacy Policy

We are committed to respecting your privacy and protecting your personal data. This privacy policy (“Policy”) sets out how we use data relating to you and applies to all use of your personal data by Secret Mode Limited, a company registered in England and Wales under company number 12912552 and with registered office at 32 Jessops Riverside, Brightside Lane, Sheffield, United Kingdom, S9 2RX (“Secret Mode”. “we”, “us” or “our”). Secret Mode is the controller for the personal data processed subject to this Privacy Policy.

This Policy applies to personal data we may collect from you, or that you provide to us, through or in connection the game Snake Pass (“Game”). This Policy also applies for our websites where we make this Policy available, including www.snake-pass.com (the "Website"). Our Game and Website are together the “Services”. Please read the Policy carefully to understand our views and practices regarding your personal data. This Policy sets out the basis on which personal data will be processed by us, pursuant to the Services, and describes how we use, disclose and otherwise process this personal data, and explains the rights you have regarding your personal data processed by us. If you are a California resident, please be sure to review Section 13 below for important information about our privacy practices and your rights under California privacy laws.

1. HOW WE COLLECT AND USE YOUR PERSONAL DATA

We collect personal data directly from players and other users (collectively, “Users”) of our Services, automatically related to the use of the Services, and in some cases, from third parties (such as operators of certain third-party services that we use). The information we collect about Users varies depending upon the circumstances, such as the Services used.

Information We Collect from You. Generally, we collect your personal information on a voluntary basis. However, if you decline to provide certain personal information that is marked mandatory, you may not be able to access certain Services or we may be unable to provide our Services or fully respond to your inquiry. In general, we may collect the following personal information from you:

• Support / enquiry information and other communications: When you send us communications regarding the Services, we collect and maintain a record of your contact details, communications and our responses.

Information We Collect and Receive from Third Parties. We may collect and receive personal information about you from third parties, as explained below.

• Vendors and providers: We may engage vendors and work with other partners to provide services to us or to Users on our behalf (such as payment processors, digital storefronts such as Steam and the Nintendo eshop, cloud hosting and services providers).

Information We Collect Automatically About Your Usage and Activities. We collect personal information about how you use the Services and interact with us and others, such as information we derive about you and your use of the Game. Such information includes:

• ‘Events’ related to Game usage: When you use our Game we collect information, such as progress, achievement of a milestone and the occurrence of other particular events during your Game usage (such as Game installation/uninstallation).

2. PURPOSES AND LEGAL BASES FOR PROCESSING YOUR DATA

While the purposes for which we may process personal information will vary depending upon the circumstances, in general, we use personal information for the business and commercial purposes set forth in this section. In this section, we also explain the legal bases for which we process personal information about Users, as required by the EU General Data Protection Regulation (the "GDPR"), UK GDPR, UK Data Protection Act 2018 (“UK DPA”) and other similar laws.

Legal Bases for Processing. Pursuant to the GDPR, the UK DPA, and other similar laws, in general, we process your personal information for the following legal bases:

• Performance of our contract with you: The personal information we collect may be used to perform our agreements with you, including our Terms of Use and other terms and conditions applicable to the Services you use.

• To comply with a legal obligation to which we are subject: The personal information we collect may be processed in order to comply with the law and our legal obligations.

• For our legitimate business interests: We may process personal information in furtherance of our legitimate business interests in protecting, maintaining and improving the Services; developing new games, features and services; marketing and promoting our Services (including by profiling and marketing to Users); and to generally operate and improve our business.

• With your consent: We may process personal information about you based on your consent, for example (where required by law) to send you marketing communications, surveys, news, updates and other communications. In addition, where required by applicable law, we will obtain your consent to this Policy and our collection, use and disclosure of your personal information. Users may be able to withdraw their consent at any time in accordance with applicable laws. For information on how revoke your consent, please see Section 6 below.

Purposes of Use and Processing. In general, we process your personal data for the following purposes:

• Providing our Services and related support: Including to operate our Services; to administer contests, programs and promotions; to communicate with Users about their access to and use of our Services; to respond to User inquiries; to provide troubleshooting and other technical support; and for other customer service and support purposes. (Legal basis: performance of our contract with you; and for our legitimate business interests)

• Protecting the integrity of the Services: to facilitate software updates; to secure of our systems and the Services; to prevent hacking, cheats and spamming; to enforce our Terms of Use and other applicable terms; and to protect the rights and safety of Users. (Legal basis: performance of our contract with you; compliance with laws; and for our legitimate business interests)

• Analyzing and improving the Services and our business: Including to better understand how Users access and use our Services; to evaluate and improve the Services and our business operations; to develop new games, features, offerings and services; to conduct surveys and other evaluations; and for other research and analytical purposes. (Legal basis: our legitimate business interests)

• Securing and protecting our business: Including to protect and secure our business operations, assets, Services, network and information and technology resources; to investigate, prevent, detect and take action regarding fraud, unauthorized access, situations involving potential threats to the rights or safety of any person or third party, or other unauthorized activities or misconduct (Legal basis: our legitimate business interests and/or compliance with laws)

• Defending our legal rights: Including to manage and respond to actual and potential legal disputes and claims, and to otherwise establish, defend or protect our rights or interests, including in the context of anticipated or actual litigation with Users or third parties. (Legal basis: our legitimate business interests and/or compliance with laws; in Brazil, this also includes the exercise of rights in judicial, administrative or arbitration proceedings in accordance with applicable laws)

• Auditing, reporting, corporate governance, and internal operations: Including relating to financial, tax and accounting audits; audits and assessments of our operations, privacy, security and financial controls, risk, and compliance with legal obligations; our general business, accounting, record keeping and legal functions; to maintain appropriate business records; to enforce company policies and procedures. (Legal basis: our legitimate business interests and/or compliance with laws)

• Complying with legal obligations: To comply with applicable legal or regulatory obligations, including as part of a judicial proceeding; to respond to a subpoena, warrant, court order, or other legal process; or as part of an investigation or request, whether formal or informal, from law enforcement or a governmental authority. (Legal basis: our legitimate business interests and/or compliance with laws)

3. DISCLOSURE OF YOUR PERSONAL DATA

We may share your personal data with third parties as set forth below:

• Affiliates and group members: We may disclose your personal data to a member of our corporate group in order to carry out the processing set forth in this Policy. For example. for purposes of assisting us to market our Services and games, conduct analytics, research and demographic studies, develop and improve the Services, and to help us improve and tailor the Services we provide. Our subsidiary or affiliate companies are subject to this Policy when they use your personal information. We may share your personal information with our parent company Sumo Group Limited and its subsidiaries (the “Sumo Group”), but we will not share your personal data with our ultimate parent, Tencent Holdings Ltd., a public company listed on the Stock Exchange of Hong Kong (SEHK: 0700) and headquartered in China or any of Tencent Holdings Ltd.’s affiliates outside the Sumo Group.

• Stores and platforms: We may also disclose your personal data, to the extent necessary, to game / application stores or platforms (such as Steam and the Nintendo eshop) if that is reasonably necessary to the provision of the Services, for example, to fulfil an order you make or in order to investigate or prevent fraud. Such platforms and stores may also process your information in order to provide you with cross-device access to your current position in the Game and your in-Game progression, for example.

• Where legally required: In addition, we may disclose your personal data to the extent that we are required to do so by law (which may include to government bodies and law enforcement agencies); in connection with any legal proceedings or prospective legal proceedings; and to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention).

• Enforcement: We may also disclose your personal information to third parties in order to enforce or apply the terms of agreements, to investigate potential breaches, or to protect the rights, property or safety of us, our personnel or customers, or others.

• With Consent: We may also disclose your personal data to other affiliated or third parties where you have consented or requested that we do so.

4. DATA RETENTION

We will only hold data about you for as long as necessary, bearing in mind the purpose for which that data was collected, or as otherwise described in this Policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

5. USER RIGHTS AND CHOICES

We give Users several easy-to-use ways to access, amend and exercise their choices and rights regarding their personal information.

Subject to the conditions set out in the applicable law, Users may have the following rights regards our processing of their personal information:

• Right of access. If you ask us, we will confirm whether we are processing your personal information and, if necessary, provide you with a copy of that personal information (along with certain other details).

• Right to correction (rectification). If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it corrected. If you are entitled to have information corrected and if we have shared your personal information with others, we will let them know about the rectification where possible.

• Right to erasure. You can ask us to delete your personal information in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you request that we delete your personal information, we may do so by deleting your account(s) with us. Brazilian Users may also request the anonymization, blocking or erasure of unnecessary or excessive personal information, or personal information processed in violation of the LGPD.

• Right to restrict (block) processing. You can ask us to restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information or you object to our use or stated legal basis.

• Right to data portability. You have the right, in certain circumstances, to receive a copy of personal information we have obtained from you in a structured, commonly used and machine-readable format, and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

• Right to object. Where our processing is on the basis of our legitimate interests (other than marketing purposes), we must stop such processing unless we have compelling legitimate grounds that override your interest or where we need to process it for the establishment, exercise or defense of legal claims. Where we are relying on our legitimate interests (other than marketing), we believe that we have a compelling interest in such processing, but we will individually review each request and related circumstances.

• Right to object to marketing. You can ask us to stop processing your personal information to the extent we do so on the basis of our legitimate interests for marketing purposes. If you do so, we will stop such processing for our marketing purposes.

• Right not to be subject to automated decision-making. You have the right not to be subject to a decision when it is based on automatic processing if it produces a legal effect or similarly significantly affects you, unless it is necessary for entering into or performing a contract between us. Secret Mode does not engage in automated decision-making. Brazilian Users may also request the revision of any decision made solely on the basis of automatic processing, to the extent such decision affects your interests and applies to our Services.

• Right to withdraw your consent. In the event your personal information is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Brazilian Users also have the right to be informed about the consequences of denying or withdrawing consent.

• Right to lodge a complaint. You also have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal information infringes the law.

Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data. Please contact us using the information set out above, in Section 13. Contact Details, if you wish to exercise any of your rights or if you have any enquiries or complaints regarding the processing of your personal information by us.

Submitting a Privacy Request. Privacy requests should be directed to our privacy team as set forth below. Please keep in mind that certain Services will not be available if you withdraw your consent, or otherwise delete or object to our processing of certain personal information. We will respond to your request in accordance with applicable law, and we will inform you if we do not intend to comply with your request.

Additional Information for Users for California Residents. In Section 11 , we provide additional information as required under California privacy laws. Users in California, should review this section for more information regarding their rights under these respective laws.

6. SECURITY

We have implemented technical and organisational to safeguard the personal information we collect and process about Users. However, no website, online service, or internet transmission is completely secure. Thus, we cannot guarantee that unauthorized access, hacking, data loss, or other breaches will never occur. We urge you to take steps to keep your personal information safe, such as choosing a strong password and keeping it private, enabling multifactor authentication (where available), as well as logging out of your User account, and closing your web browser when finished using the Services.

7. INTERNATIONAL DATA TRANSFERS

We have servers, operations and service providers in the European Union, the United States and other jurisdictions; some of these jurisdictions (including the United States) may not provide equivalent data protection laws as your home jurisdiction. We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it, including through appropriate written data processing terms and/or data transfer agreements where necessary. Such appropriate safeguards may include standard data protection clauses adopted by a data protection regulator and approved by the European Commission, such as the European Commission’s standard contractual clauses, or other appropriate measures.

If you would like to find out more about these safeguards or if you have any other queries or comments in relation to this Policy, please let us know by emailing us at as set forth in the Contact Us section below.

8. CHILDREN

We do not use the Services to knowingly solicit data from or market to children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at info@secretmode.games. We will delete such information within a reasonable time.

9. THIRD PARTY LINKS

If you follow a link from the Service to any third party websites, you should be aware that those websites may have their own privacy policies. We do not accept any responsibility or liability for those websites. Please check the policies of any third party websites before submitting any personal data to those websites.

10. UPDATES TO THIS PRIVACY POLICY

We may make changes to this Policy in the future, which will be posted on this page. You should check this page from time to time to ensure you are aware of any changes. Where appropriate we may notify you of changes, such as by email.

11. CONTACT US

You may contact us regarding this Policy or submit a privacy request to us at:

Email: info@secretmode.games

12. ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

Below, we provide information, as required under California privacy laws, including the California Consumer Privacy Act ("CCPA"), which requires that we provide California residents certain specific information about how we handle their personal information, whether collected online or offline. This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments or other personal information that is subject to an exemption under the CCPA.

Categories of Personal Information We Collect and Disclose. Our collection, use and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. We may collect personal information from the following sources:

• Our affiliates and subsidiaries

• Third-party platforms

• Third-party sites and services

• Social networks

• Operating systems and platforms

• Our vendors and service providers

Below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we may collect, sell, and disclose to others for a business purpose. We collect and disclose this personal information for the purposes described in Section 2 and Section 3 of this Policy. We do not sell the personal information of California residents.

Personal Information Collected

Category of Personal Information Collected #1: Customer Records

Uses: Includes your account and profile information and customer records that contain personal information, such as username, name, demographics, , customer service and support tickets and records), and other information individuals provide us in order to register for, access or purchase our Services.

Categories of Third Parties to Whom We May Disclose this Information. None.

Category of Personal Information Collected #2. Usage Data

Uses. Includes information regarding your interactions with our Services and our marketing emails and other usage data related to your use of the Services, such as language and preferences, game-play statistics, scores, achievements, rankings, time spent playing, click paths, game profile, preferences.

Categories of Third Parties to Whom We May Disclose this Information. None.

Category of Personal Information Collected #3. Inferences

Uses. Includes inferences drawn from other personal information that we collect to create a profile based on your account and activities, that reflect your preferences, characteristics, behaviour, attitude and abilities related to the Services.

Categories of Third Parties to Whom We May Disclose this Information. None.

California Residents' Rights. California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.

Do-Not-Sell. California residents have the right to opt-out of our sale of their personal information. We do not sell personal information about California residents. Requests to Delete. Subject to certain exceptions, California residents have the right to, at no charge, request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies.

Request to Know. California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including the:

• categories of personal information collected;

• categories of sources of personal information;

• business and/or commercial purposes for collecting and selling their personal information;

• categories of third parties/with whom we have disclosed or shared their personal information;

• categories of personal information that we have disclosed or shared with a third party for a business purpose; and

• categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party.

• California residents may make a Request to Know up to twice every 12 months.

Submitting Requests to Know and Delete. Requests to Know and Requests to Delete may be submitted online or by email at info@secretmode.games.

When you submit a request to know or a request to delete, we will take steps to verify your request by matching the information provided by you with the information we have in our records. You must complete all required fields on our webform (or otherwise provide us with this information via the above email address) and verify your access to the registered email address for your account, in order to verify your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual by contacting us in writing at the contact information set forth above, in Section 13. Contact Details; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent. We will respond to verifiable requests received from California residents as required by law.

Right to Non-Discrimination. The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents' data.

Financial Incentives. California residents have the right to be notified of any financial incentives offers and their material terms, the right to opt-out of such incentives at any time and may not be included in such incentives without their prior informed opt-in consent. Where we offer any financial incentives under the CCPA, we will notify you in advance of the material terms of such incentives and your related rights, before we obtain your consent to such incentives.

For more information about our privacy practices, you may contact us as set forth above, in Section 12.