Play Toz Corp. complies with the privacy-related requirements that information and communication service providers must adhere to under relevant laws, including the Personal Information Protection Act.

A privacy policy is provided by Play Toz Corp. (hereinafter referred to as the "Company") to give information about the life cycle of personal information, such as which personal information the company collects, how the information is used, with whom it may be shared when necessary, and how and when personal information is disposed of after its purpose has been achieved.

We also inform users about their rights regarding their personal information, how to exercise these rights, and who to contact and seek assistance from in case of a personal information breach for the prevention of any potential harm.

The privacy policy serves the purpose of not only defining the life cycle of user's personal information but also regulating the rights and responsibilities of the Company and the users in the services provided by the Company and related services (hereinafter referred to as the "Services"), ensuring the user's right to self-determination over their personal information.

1. Information Collection and Collection Methods Items of Personal Information Collected

The items of personal information collected by the Company are as follows. In this Privacy Policy, “Personal Information" refers to all information about an identified or identifiable individual. When using the service, the Company processes the user's personal information collected as follows:

• MetaMask, WEMIX Wallet ID, wallet address, encrypted wallet key, and technical information (e.g., browser, OS, device type, IP address) for logging into the service
• Automatically collected data (Google Analytics cookies) Detailed information can be found in the Cookies Policy.
• Information for handling user inquiries and complaints (in-game ID or nickname and information related to user issues)



The Company collects the above information either directly provided by service users or through third-party organizations. If this information is not provided, the Company may not be able to provide all requested services, and the variance in services may be related to user information.

The Company does not collect sensitive information or information related to a user's criminal convictions and crimes (e.g., race or ethnic information, political opinions, religious or philosophical beliefs, labor union membership, genetic information, biometric information, health information, or sexual life and sexual orientation).

Collection Method
The Company obtains the user's unique wallet address from wallet service providers (MetaMask, WEMIX Wallet). Wallet service providers obtain user consent for the provision of this information in accordance with relevant laws at the time the user engages with the service, and then provide it to the Company.

2. Use of Collected Information

The Company uses the collected user information for the following purposes:

• To provide services: The Company employs user information to create accounts, maintain user accounts, provide suitable services, personalize services, and offer forum and community features.
• To enhance services: The Company utilizes user information for the maintenance, improvement, and management of services, including troubleshooting, data analysis, and testing.
• To comply with relevant legal regulations: Using information to fulfill legal obligations (e.g., record-keeping obligations), resolve disputes, execute contractual agreements, and establish, exercise, or defend legal claims is included.
• To ensure the safety of services and users: This includes detecting users who use the program unlawfully. Additionally, user information is used to prevent and respond to fraud, misuse, security risks, technical issues, and to secure the safety of services and users.



The Company utilizes user's personal information based on the following legal grounds:

• To fulfill contracts between the Company and users.
• To comply with legal obligations.
• For interests and fundamental rights of the users not to override the legitimate interests of the Company (or a third party) when required. Additionally, user's personal information is used based on the following legal grounds:
• To protect the interests of users (or other individuals).
• When the user has given consent.
• In situations where legal claims need to be advocated or pursued.



If information is to be used for purposes other than those explicitly stated in this Privacy Policy, the Company will seek the user's consent.

3. Disclosure of Collected Information

The Company utilizes user's personal information within the scope of the collection and usage purposes, and it does not exceed or provide beyond this scope without the prior consent of the user. However, personal information may be used or disclosed in the following cases:

• When the user has given prior consent
  • The Company informs the user about who the collecting/providing partners are, what information is necessary, and how long it will be retained before collecting or providing personal information, and seeks the user's consent. If the user does not consent, the information is not collected or provided.
• When required by law
  • The Company may provide information when there are specific provisions in the law or when law enforcement agencies request it according to the procedures and methods prescribed by law for investigative purposes.



The Company, for professional customer support and service provision, operates the handling of personal information through outsourcing to external companies as follows. When entering into outsourcing contracts, the Company clearly stipulates instructions for compliance with personal information protection, prohibition of personal information leakage, and responsibility in the event of an incident to ensure the safety of personal information protection.

• Third-Party Service Provider: PLAY D&C Co., Ltd.
  Countries of Operation: Republic of Korea
  Contact : biz@playdnc.com
  Outsourced tasks: Service operation and maintenance, customer consultation, and support
  Retention and Usage Period: Until user withdrawal or at the user's request

4. User Rights

As the subject of information, users or their legal representatives have the following rights regarding the collection, use, and sharing of personal information by the Company:

• Access to personal information
• Correction or deletion of personal information
• Temporary suspension of personal information processing
• Request for withdrawal of previously given consent



To exercise these rights, users may avail themselves of the “Edit Profile” menu on the website or contact the Company (or the Personal Information Manager, representative) in writing, by phone, or via email, and we shall promptly take the necessary actions. However, the Company may refuse such requests only in cases where valid legal or equivalent reasons as specified by the law exist.

5. Security

The Company takes the following measures to ensure that user’s personal information is not lost, stolen, leaked, altered, or damaged in the processing:

• The Company securely protects user's personal information using security systems in accordance with relevant laws and internal policies.
• The Company takes measures to prevent damage caused by computer viruses using antivirus programs. These programs are regularly updated, and in case of sudden virus outbreaks, the Company applies the updates immediately to prevent breaches of personal information.
• The Company securely stores and manages user's personal information and adopts security systems for safe transmission of personal information over networks.
• The Company employs systems to block external intrusion to prevent the leakage of user's personal information due to hacking or other incidents, and continuously monitors external intrusions.
• The Company establishes systematic guidelines for creating, changing, and granting access to passwords for the database systems storing personal information and systems processing personal information to ensure compliance by the responsible staff.
• The Company strictly limits employees who handle personal information to those who are responsible for personal information management tasks and those whose job necessitates the handling of personal information, and ensures compliance through regular education and training for responsible staff to protect personal information.

6. Minors

Services are not provided to individuals under the age of 19. The Company does not intentionally collect or sell information from minors without parental consent, as defined by the applicable regulations, or as allowed by the applicable regulations.

7. Guidance for California Residents

If you are a resident of California, there may be additional rights and considerations. The Company takes preventive measures to protect members' personal information to comply with the California Online Privacy Protection Act (CCPA). Users have the right to request confirmation of a data breach if their personal information has been compromised. Additionally, all website users can modify their information at any time by accessing their personal accounts. The Company does not track website visitors, and it does not use "Do Not Track" signals. The Company does not collect and provide personally identifiable information to third parties through advertising services without user consent.

• Right to Know
  • You have the right to request the disclosure of categories and specific portions of personal information collected, used, or disclosed about you by us over the past 12 months. For California residents, our response to requests for the "Right to Know" will include personal information collected and retained about consumers over the past 12 months, as of January 1, 2022, or for a shorter period if required by an exemption or requested by the consumer. Please note that we are not obligated to provide you with a personal information copy more than twice in a 12-month period.
• Right to Opt-Out
  • We only use and share your personal information as permitted by this Privacy Policy. We do not consider these uses and disclosures as sales under the CCPA. We have not sold personal information in the past 12 months, and we have no plans to do so in the future.
• Do Not Track
  • The CCPA requires us to disclose how we respond to web browser "Do Not Track" signals. Since there are no industry or legal standards for recognizing or respecting Do Not Track signals, we do not respond to them at this time.
• Exercising Your Rights
  • If you want to exercise your California privacy rights or have questions about our practices, please email us at privacy@playtoz.com.

8. Data Protection Policy for EU/UK GDPR Legitimate Processing of Personal Data under GDPR

The Company processes the user's personal data lawfully in the following cases:

• When the user has given consent for the processing of their personal data.
• When processing is necessary for the performance of a contract to which the user is a party or for taking steps at the user's request before entering into a contract. This includes:
  • Membership management, identity verification, etc
  • Fulfillment of service requests and the execution of contracts, including payment and billing.

• When processing is necessary to comply with legal obligations imposed on the company. This includes:
  • Compliance with relevant laws, regulations, legal procedures, and government requests.

• When processing is necessary to protect the vital interests of the user or other natural persons. This includes:
  • Detection, prevention, and response to fraud, abuse, security risks, technical issues, and more.

• When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the company.

• When processing is necessary for the legitimate interests pursued by the company or a third party (However, in cases where the interests or fundamental rights and freedoms of users, especially when users are children, override such interests, the processing will not be carried out).

"User Rights” under GDPR in Accordance with GDPR Application
As the subject of information, users or their legal representatives have the following rights regarding the collection, use, and sharing of personal information by the Company:

• Access to personal information
  • Users or legal representatives can access information and request confirmation regarding the collection, use, and sharing of data records in accordance with applicable laws.

• Right to rectify personal information
  • Users or their legal representatives have the right to request the correction of inaccurate or incomplete information.

• Right to erase personal information
  • Users or their legal representatives have the right to request the deletion of information based on the achievement of its purpose, withdrawal of consent, and other legal grounds.

• Right to restrict the processing of personal information
  • Users or their legal representatives have the right to request the restriction of information processing when there are disputes about its accuracy, the lawfulness of processing, or the need to retain the data.

• Right to data portability
  • Users or their legal representatives have the right to request the provision or transfer of information.

• Right to object
  • Users or their legal representatives can request the cessation of information processing for direct marketing, legitimate interests, public duties, and authority exercises, as well as information processing for research and statistical purposes.

• Right to object to automated individual decision-making, including profiling
  • Users or their legal representatives can request the cessation of automated information processing, including profiling, that may have legal effects or significant impacts on them.

Data Transfer Abroad
As the Company operates globally, user data may be provided to companies or third parties located in other countries for the purposes specified in this Privacy Policy. The Company takes reasonable measures to protect personal data at the location where it is transmitted, held, or processed. Additionally, when using or disclosing personal data obtained from the European Union or Switzerland, the company complies with the US-EU Privacy Shield and Swiss-US Privacy Shield agreements, utilizes standard contractual clauses approved by European Union executive bodies, or employs other means within European Union regulations to ensure adequate safeguards, or obtains user consent as necessary.

9. Contact Information

If you have any questions regarding this policy or wish to update your information held by the company, please contact us using the following information:

• Company Name: Play Toz Corp.
  Address: 16F Bundang Square Bldg, 42 Hwangsaeul-ro 360 beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
  Phone: +82-2-1800-6855
  Email: help@playtoz.com



The Company has appointed a Data Protection Officer (DPO) to protect user's personal information and address complaints related to personal information.

• DPO contact information
  VeraSafe
  Anastasia Pavlou (Privacy Counsel)
  100 M Street S.E., Suite 600
  Washington, D.C. 20003 USA
  +1 (617) 398-7067
  experts@verasafe.com
  

The company has appointed a representative within the EU to protect user's personal information and address complaints related to personal information.

• EU Representative contact information Representative: VeraSafe Netherlands B.V.
  Address: Keizersgracht 391 A 1016 EJ Amsterdam The Netherlands
  contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/
  telephone : +420 228 881 031.
  


• UK Representative contact information Representative: VeraSafe United Kingdom Ltd.
  Address: 37 Albert Embankment London SE1 7TL United Kingdom
  contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/
  telephone : +44 (20) 45322003.