Xsolla ZK, Inc.'s Global Privacy Notice

Effective: February 3, 2025

Xsolla ZK, Inc. provides, among other things, a backpack of virtual items on the blockchain. Xsolla ZK, Inc. (“Xsolla ZK,” “we,” “us” or “our”) knows your personal information is important. As a result, we process your personal information responsibly and in accordance with applicable laws and regulations. We appreciate the trust you place in us when you use our products and services, and when you visit our websites.

This Global Privacy Notice (“Global Privacy Notice”) applies exclusively to Users of the Xsolla ZK product, its associated services and the landing page where the product is directly offered (e.g., https://xsolla.com/zk) (collectively, the “Services”). This Global Privacy Notice describes how we process the Personal Information collected when you access the Services. This Global Privacy Notice also tells you about your rights and choices with respect to your Personal Information, including how you can contact us if you have any questions or concerns. When you leave the Services, this Global Privacy Notice no longer applies. Any subsequent website, application or service you access is subject to its own terms of service and privacy notice and not this Global Privacy Notice. Other subdomains or services related to "Xsolla" may be subject to different privacy policies if those sites, products or services provide links to their respective privacy notices.

In this Global Privacy Notice, "Personal Information" means any information relating to an identified or identifiable natural living individual. Please read this Global Privacy Notice carefully. If you do not agree with any part of this Global Privacy Notice, you should not access or use any part of the Services. If you change your mind in the future, you must immediately stop using the Services. You may exercise your rights in relation to your Personal Information as set out in this Global Privacy Notice and you may contact us at any time regarding those rights using the methods described in the “Contact Us” section below.

1. Our Relationship With You

Xsolla ZK is the entity that provides the Services and determines the purpose and the means of processing your Personal Information. You are subject to the Terms of Use of the Services. This means that Xsolla ZK is the entity that provides the Services and determines the purpose and the means of processing your Personal Information, or other similar designation under law. The Services can be used by organizations or by individual Users. If you are using the Services on behalf of your organization, your organization owns the associated accounts and may take certain actions in respect to your access or abilities to use the Services.

2. Personal Information We Collect

When you visit the Services, we collect:

• a. Technical information that is used to deliver the contents and Services and for other purposes as described below.
• b. Information that you provide to us.

Personal Information You Provide to Us

We collect a variety of information that you provide to us. The specific types of information we collect will depend upon your engagement with the Services. Some Personal Information that you provide to us is required for the use of the Services. However other Personal Information is optional.

• Account and Profile Information: Certain Services require you to create an account or profile. If you create an account or profile to use the Services, we collect Personal Information to allow you to use these Services. When you sign up, you may provide us with your name, password, email address, mobile phone number, job title, account history or other information necessary to create and maintain your account or maintain your account or profile.
• Contact Information and Other Information You Choose to Provide: You can provide a variety of information during your interactions with us, such as through emails or other communications. When you contact us via a website contact form, email or other means, you provide us with Personal Information such as your name and contact details, and the content of your communications with us.
• Support Information: When you request technical support services, we will process your Personal Information such as your name and contact details used to contact us, as well as information regarding reasons for your support request, support provided and any additional information provided in that context.
• Financial Information: If you purchase our Services, you will need to provide payment information. We will use that information solely for fulfilling your purchase request.
• Other Information: You may provide us with additional information associated with your use of the Services such as wallet addresses. If you decide to use the Services offered, we may collect and store content and information created or uploaded by you.

For certain Services we may require additional Personal Information in order to verify identity or provide Services. We will inform you if this is necessary.

Information Collected Automatically

We may automatically collect certain information due to your use of the Services. We use this information to enable basic functionality of the Services. We strive where possible to ensure collected information is de-identified, aggregated and/or anonymized.

• Single Sign-On Through Internet Service Providers: When using single sign-in servers to connect to our Services, we may collect Personal Information from internet service providers. Your interactions with these tools are governed by the privacy notices of the corresponding platform.
• Device and Usage Information: When you access and use the Services, including in limited circumstances when you engage with our relevant support platforms to make a request or where you require support from us, we may receive and store information about your interactions. This may include information such as date/time stamps, usage information and statistics, your internet protocol (IP) address, location (e.g., city or state), hardware and software information (including operating system version and type), browser type, device identifiers, device event information, crash data, cookie data and your interactions with the Services. This information could be used to identify you or your device.
• Cookies and Similar Technologies: When you access the Services, we may collect Personal Information via cookies, pixel tags, or similar technologies on the Services (collectively referred to as “Cookies”). For more information on our use of Cookies, please read our Cookie Policy.
• Location Information: When using Services general location information inferred from IP address may be collected.
• Information from Other Sources: We may collect information about Users from third parties such as marketing partners or researchers.

3. How We Use Personal Information We Collect

We process your Personal Information based on several legal grounds, including: your consent where required (e.g., for marketing), performance of a contract (e.g., providing our Services), compliance with legal obligations (e.g., responding to regulatory inquiries), and legitimate interests (e.g., improving our Services and ensuring security). Please review the detailed information on how we use your Personal Information below:

• To create an account/profile if required for use of Services.
• To provide our Services.
• For personalization to customize our Services to meet your specific needs, such as identifying your requests for regionality to improve your experience with the Services, and enabling you to interact with Third Party Platforms (defined below).
• For product improvement developing new products and/or new Service features.
• To communicate, including for administrative purposes, security support, maintenance purposes, providing services/information you requested and responding to your comments/questions.
• Subject to any consent requirements, to send marketing materials, alerts about the latest developments and features or other promotional materials and to develop new promotional materials that can be useful or relevant to you. You will always be provided with an opportunity to opt out of receiving marketing communications.
• Where required by law, we will obtain your prior explicit consent before sending you any marketing materials. This means you will be given a clear choice to agree or refuse to receive marketing communications, and we will only send you such materials if you have provided your consent. If you choose to opt in, you can always change your preferences and withdraw your consent at any time without impacting the lawfulness of processing based on your consent before its withdrawal.
• For customer and third-party relationship management and tracking. Where we use automated decision-making or profiling, we will inform you and provide you with the right to object to such processing if it impacts your legal rights or has a significant impact.
• For aggregation or de-identifying of Personal Information which is a format that does not allow you to be personally identified. We use the resulting information for statistical analysis regarding the use of the Services, such as to better understand our customer base or for other purposes.
• For administrative and legal purposes, such as for compliance purposes. This includes enforcing our Terms of Use or enforcing or defending other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency, and to comply with our legal obligations and internal policies as permitted by law, such as preventing the Services to be accessed by individuals in sanctioned territories, or by sanctioned individuals.
• For safety, security and integrity purposes, including investigating in good faith alleged violations of our Terms of Use, such as unauthorized access and use. In order to protect the Services, and ensure your continued access to the Services, your Personal Information is collected to prevent (although there are no guarantees) malicious actors from attacking and disrupting the Services.

4. Who We Share Personal Information With

We may disclose Personal Information about you under the following circumstances:

• Group Entities. We may disclose Personal Information about you to our affiliates and subsidiaries, if any, for the purpose of providing the Services and conducting business.
• Service Providers. We work with third parties for the purpose of providing the Services such as hosting, maintenance, network management, cybersecurity and/or support. These third parties may have access to and/or process your Personal Information as part of providing those services to us. For example:
  • When you use a credit card to pay for our Services, information such as your name, billing address, phone number, email address and credit card information will be submitted to service providers for verification and to manage any recurring payments.
  • We use cloud service providers who we rely on for data storage, disaster recovery and to perform our obligations to you.
  • We use service providers for certain business communication tools.
  • We use service providers who manage the networks for the operation of the Services and to improve latency for our Users.
  • We use service providers to help us prevent malicious actors from threatening the Services and to comply with legal obligations, such as preventing individuals from sanctioned territories, or sanctioned individuals, from accessing the Services.
• Native Integrations. We do not share data from integrated apps with any other services or clients except as necessary to provide the Services.
• Legal. Personal information about you may be disclosed to law enforcement agencies, regulatory bodies, public authorities or pursuant to the exercise of legal proceedings if we are legally required to do so, or if we believe, in good faith, that such disclosure is necessary to comply with a legal obligation or request, to enforce our terms and conditions, to prevent or resolve security or technical issues or to protect the rights, property or safety of Xsolla ZK (or an affiliate), our Users, a third party or the public.
• Strategic Business Partners. Where you have provided your explicit consent (as required by applicable laws such as the GDPR in the European Union or the CCPA/CPRA in the United States), we may share your Personal Information with our strategic business partners. These partners may use your information for marketing and advertising purposes, including sending you promotional materials about products or services that may be of interest to you. We may also share your information for other commercial purposes, such as to develop joint services or products. When we share your Personal Information with third parties for such purposes, we ensure that they comply with applicable data protection laws and maintain the confidentiality and security of your data. These third parties are only permitted to use your Personal Information in accordance with our instructions and for the specific purposes outlined in this Policy. Additionally, we will provide you with clear and easily accessible options to opt out of such data sharing for marketing purposes at any time.
• Third Party Platforms (as defined below). Your Personal Information may be disclosed to Third Party Platforms where you have requested to interact with a third-party service or platform. Please see Third Party Links and Websites (Section 10) for more information.

5. Service Providers

From time to time, we engage Service Providers for the purposes described above in Section 4. These Services Providers include the unaffiliated entities listed here.

6. Your Rights

You have the following rights associated with the processing of your Personal Information:

• Right to Access or Right to Know. You have the right to obtain access to the Personal Information we hold about you and to request certain information about our processing. Specifically, you have the right to receive an explanation of (i) why we process your Personal Information, (ii) the categories of Personal Information we have about you, (iii) who we share your Personal Information with, (iv) how long we store your Personal Information and (v) who we received your Personal Information from if it was not collected from you directly. We will also inform you about your privacy rights.
• Right to Rectification or Correction. You have the right to correct, update or complete any Personal Information we hold about you that is inaccurate or incomplete. Please note that we may also rectify or remove incomplete or inaccurate information on our own at any time and at our discretion.
• Right to Erasure or Deletion. You may request to have your Personal Information anonymized, erased or deleted, as appropriate. In this case, if there is no overriding legitimate interest or requirement to continue processing your Personal Information or as otherwise required by law, we will erase your data.
• Right to Object to Processing. You have the right to object to our processing of your Personal Information where we are relying on a legitimate interest unique to us or if we are processing your Personal Information for direct marketing purposes or for commercial purposes.
• Right Not to Be Subject to Automated Decision-Making, Including Profiling: You have the right to request that you are not subject to decisions based solely on automated processing, including profiling, if such decisions have legal impacts on you or significantly impact you. This right applies when decisions are made without any human involvement, such as automated evaluations of personal characteristics to analyze or predict aspects like your personal preferences or interests. If we decide to engage in any automated decision-making or profiling as part of our Services, we will notify you of: (i) the existence of such automated processes; (ii) the logic behind the decision-making, and (iii) the significance and expected consequences for you of such processing. You may also request human intervention in the decision-making process, express your viewpoint and contest the decision if it significantly impacts your rights or interests. Please note, this right does not apply in certain cases where automated decision-making is: (i) necessary for entering into or performing a contract between you and us, (ii) authorized by law (e.g., for fraud prevention) or (iii) based on your explicit consent.
• Right to Restrict Processing. You have a right in certain circumstances to stop us processing your Personal Information other than for storage purposes.
• Right to Portability. You have the right to receive, in a structured, commonly used and machine-readable format, Personal Information that we hold about you, if we process it based on our contract with you or with your consent or to request that we transfer such Personal Information to a third party. Additionally, if technically feasible, you may request that we transfer this information directly to another data controller. Please note that this right only applies to Personal Information that you have provided to us and does not cover data that has been derived from such Personal Information, or data we process based on other legal grounds.
• Right to Withdraw Consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal Information at any time and free of charge. We will apply your preferences going forward. This will not affect the lawfulness of the processing before you withdraw your consent.
• Right to Lodge a Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work or where you believe an incident took place.
• Right Against Discrimination. In accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we will not discriminate against you for exercising any of your privacy rights. This means that if you choose to exercise your rights, such as requesting access to, deletion of or opting out of the sale or sharing of your Personal Information, we will not:
  • Deny you Services;
  • Charge you different prices or rates for Services, including through the use of discounts or other benefits or imposing penalties;
  • Provide you with a different level or quality of Services; or
  • Suggest that you may receive a different price or rate for Services or a different level or quality of Services.
• Right to Opt Out of Targeted Advertising, Sale or Sharing. You can ask us to stop using your Personal Information for targeted advertising, any sale or sharing when required by law.

You may exercise these rights by contacting us as set forth in the “Contact Us” section.

Prior to any response to the exercise of such rights, we may require you to verify your identity. In addition, we may have valid legal reasons to reject your request and will inform you if that is the case. Note that applicable laws contain certain exceptions and limitations to each of these rights. Subject to certain restrictions, you can ask an agent to exercise your rights for you. If you have an agent exercising your rights, that person must provide to us your written authorization allowing them to make such a request on your behalf. We reserve the right to deny the agent’s request if we are not reasonably able to confirm proper authorization and/or verify your identity as the requestor.

To appeal any refusal by us to act on a data subject right's request contact us by email at: privacy-requests@x.la .

7. Retention of Information

We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Global Privacy Notice, to make the Services available to you or as instructed by you, unless a longer retention period is required or permitted by law. We may also keep your data for as long as it is needed in relation to a legal claim, complaint, litigation or regulatory proceeding.

8. Security and Storage

We implement a variety of security measures that are designed to reasonably protect the safety of your Personal Information from loss, misuse and/or unauthorized access, disclosure, alteration and/or destruction when you enter or submit your Personal Information on the Services. However, no Internet or email transmission is ever fully secure or error free.

If you believe your privacy has been breached through use of the Services, please contact us immediately.

When you use the Services, Personal Information about you will be stored in the United States.

9. Data Analytics & Advertising

We will seek your explicit consent before utilizing any cookies or tracking technologies for data analytics or advertising purposes if you are accessing our Services from a country where the opt-in approach is supported, such as the European Union, Canada, Australia, or South Korea. You have the option to withdraw your consent at any time by adjusting your preferences through our cookie management tool. For Users in the United States, Japan, or India, and others where the opt-out approach is applicable, we may employ an opt-out approach where cookies are enabled at the onset of your interaction with our Services. Nonetheless, you will receive clear information about these technologies, and you can opt out or modify your preferences at any time.

Data Analytics. We may use first-party analytics to provide the Services, including analyzing the performance of the Services for product improvement or for marketing purposes (as described above). We may also use third-party web analytics services on the Services (subject to your consent), such as those of Google Analytics. These third-party services use the sort of technology described in the “Information Collected Automatically” section above to help us analyze how Users use the Services (such as our Sites), including by noting a third-party website from which you arrive. The information collected by the technology will be disclosed to or collected directly by these third parties, who use the information to evaluate your use of the Services. We also use Google Analytics for certain purposes related to advertising, as described above. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-Out Browser Add-on.

Advertising. Third-party services, which may include Google Analytics, Google Tag Manager, Hubspot, LivePerson, Segment or LinkedIn, may use cookies and web beacons to collect information about your activities on the Services (such as our Sites) to provide you advertising based upon your interests. This means these third-party services may show our ads on sites across the Internet based upon your previous visits to the Services. Together with these third-party services, we may use these cookies and web beacons to report how your ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to your visits to the Services.

The uses of tracking technologies by third-parties, technology partners or other third-party assets (such as social media links) on their sites are not covered by this Global Privacy Notice. We do not have access or control over these technologies.

If you would like to learn more or opt out of receiving online display advertising tailored to your interests, please visit the Networking Advertising Initiative at: www.networkadvertising.org/managing/opt_out.asp or the Digital Advertising Alliance at: http://aboutads.info/choices.

10. Third Party Links and Websites

The Services enable you to interact with certain third-party services, decentralized applications and third-party platforms (collectively, "Third Party Platforms"). However, this Global Privacy Notice does not address, and we are not responsible for, the privacy practices of any third parties, including but not limited to those that operate websites to which the Services link. The inclusion of a link on the Services does not imply that we (or our affiliates) endorse the practices of the linked website. Your use of such Third Party Platforms and those Third Party Platforms’ use of your Personal Information is subject to their respective terms of use and privacy notice (if any) and is not subject to this Global Privacy Notice.

Where you have sought to interact with a Third Party Platform through the Services and to share Personal Information as required for such interaction, we will seek, where permitted and where possible and practical, to limit the Personal Information shared through the use of proxies.

11. Co-Branded Websites

If our Services link to other websites that include our branding, this Global Privacy Notice does not apply to those other websites. Visitors to those websites are advised to carefully read the notices on those individual websites.

12. Eligibility

Our Services are not intended for minors and we do not offer our Services to children. Accordingly, we do not knowingly collect data from you if you are not the age of majority. If you are under the age of majority in your jurisdiction of residence, you may use the Services only with the consent of or under the supervision of your parent or legal guardian. Consistent with the requirements of the Children’s Online Privacy Protection Act (COPPA), if we learn that we have received any information directly from a child under age 13 without first receiving his or her parent’s or legal guardian’s verified consent, we will use that information only to respond directly to that child, or his or her parent or legal guardian, to inform the child that he or she cannot use the Services (including the Sites) and subsequently we will delete that information.

NOTICE TO PARENTS AND GUARDIANS: By granting your minor permission to access or use the Services, you agree with this Global Privacy Policy (and all other relevant Policies, such as Terms of Use, Cookie Policy and EULA) on behalf of your minor. You are responsible for exercising supervision over your minor’s online activities. If you do not agree to these terms and conditions, do not let your minor access or use the Services. We recognize the importance of parental supervision in minor's online activities. We encourage parents to contact us if they have any questions or concerns.

13. Change of Ownership

In the event of a change in ownership or a merger with, acquisition by or transfer or sale of all or a portion of our assets to another entity, we reserve the right to transfer all your Personal Information to that entity. We will use reasonable efforts to notify you of a transfer to an unaffiliated third party (by a posting on our homepage, or by email to your email address that you provided to us, as determined at our discretion).

14. Changes to Our Global Privacy Notice

We reserve the right to amend this Global Privacy Notice from time to time to reflect changes in the law, our data collection, use or sharing practices or advances in technology. We will make the revised Global Privacy Notice accessible throughout the Services (including our Sites). It is our recommendation that you review this Global Privacy Notice periodically. The “Date of Last Revision” included at the beginning of this Notice will indicate when it was last updated.

By continuing to access or use the Services (including our Sites), you are confirming you have read, understand and consent to the latest version of this Global Privacy Notice.

15. Complaints

If you wish to lodge a complaint regarding how we process or use your Personal Information, please contact us as described in the “Contact Us” section below. We will endeavor to respond to your complaint as soon as possible. You may also lodge a claim with the applicable supervisory authority.

16. Contact Us

If you have any questions or comments about this Global Privacy Notice or our privacy practices, or if you would like to exercise your rights with respect to your Personal Information, please contact us by emailing us at: privacy-requests@x.la.

Alternatively, you can write to us at: (via postage pre-paid, first class mail) Attention: Global Privacy Notice, Xsolla ZK, Inc., 15260 Ventura Blvd, #2230, Sherman Oaks, California, USA 91403.