Privacy policy | GCL Global Holdings

DATA PRIVACY NOTICE

(with Children Data Privacy Policy)

A. INTRODUCTION

1. This Data Privacy Notice ("Notice") sets out the basis which GCL Global Holdings Ltd, Company Registration No. 403942 and its affiliates and their respective officers & employees ("we", "us", or "our") may collect, use, disclose or otherwise process personal data of data subjects in accordance with applicable personal data protection laws ("Data Privacy Laws"). This Notice applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.

2. When a data subject accesses our websites, uses our services and/or submits personal data to us, the data subject is agreeing to our data privacy policies and consenting to our collection, processing, use, storage, disclosure and destruction of the data subject personal data, as described herein.

3. If the data subject does not agree with the terms and conditions under this Notice, the data subject must not access our websites, use our services and/or submit personal data to us.

B. PERSONAL DATA

Depending on the nature of interaction with us, we may collect the following types of personal data from data subjects for the purpose(s) on the following legal bases:

C. COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

1. We collect and use personal data of data subjects when:

(a) it is provided to us voluntarily by the data subject directly or via a third party who has been duly authorised by the data subject to disclose such personal data to us ("authorised representative") after (i) the data subject (or the authorised representative) have been notified of the purposes for which the data is collected, and (ii) the data subject (or the authorised representative) have provided written consent to us for the collection and usage of such personal data for those purposes, or

(b) collection and use of personal data without consent is permitted or required by Data Privacy Laws or other laws.

2. We will seek consent from data subjects before collecting any additional personal data and before using the personal data for a purpose which has not been notified to the data subject (except where permitted or authorised by law).

3. We collect, use and disclose personal data to the extent reasonably and legitimately required for our work and business purposes and/or as authorised by the data subject (or the authorised representative).

4. We do not knowingly solicit, collect or maintain personal data from children, minors and legally incapacitated persons without parental or legal guardian consent. Should we be informed that a child, minor or legally incapacitated person has provided us with any personal data, we will take reasonable steps to delete such personal data within the time period as required under law.

5. We may transfer or disclose personal data of data subjects:

(a) where such transfer or disclosure is required for performing obligations in the course of or in connection with our provision of the goods and services requested by the data subject;

(b) to third party service providers, agents and other organisations we have engaged to perform any of the functions with reference to the above-mentioned purposes;

(d) due to our business merger(s), acquisition(s) or reorganization(s); and/or

(e) for any of the purposes based on any of the legal bases as provided above.

6. The purposes listed above may continue to apply even in situations where the data subject's relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter but only to the extent permitted under applicable laws (including, where applicable, a period to enable us to enforce our rights under any contract with the data subject).

7. At websites that we operate and/or control, we may collect payment information, such as credit card numbers, to process payment of purchases made by data subjects and to provide refunds. Such information may be collected directly by us or indirectly through the following third parties (please refer to Section J (Third Party Websites) for more information):

D. WITHDRAWAL OF CONSENT

1. The consent provided by the data subject or the authorised representative for the collection, use and disclosure of personal data will remain valid until such time it is being withdrawn in writing. The data subject may withdraw consent and request us to stop collecting, using and/or disclosing the personal data of the data subject for any or all of the purposes listed above by submitting a request to us at the contact details provided below.

2. Upon receipt of the written request to withdraw consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with the data subject) for such request to be processed and for us to notify the data subject of the consequences of us acceding to the same, including any legal consequences which may affect the rights of the data subject and liabilities to us. In general, we shall seek to process the data subject request within the time period as required under Data Privacy Laws.

3. Whilst we respect the data subject's decision to withdraw consent, the provision of our goods or services to the data subject and/or the data subject's access to our websites may be affected or impacted by the withdrawal of consent, depending on the nature and scope of the request. The withdrawal of consent will not affect the lawfulness of any processing we have conducted prior to the withdrawal of consent. The withdrawal of consent will also not affect our right to continue to collect, use and disclose personal data where such collection, use and disclosure without consent is permitted or required under applicable laws.

E. ACCESS TO AND CORRECTION OF PERSONAL DATA

1. If a data subject wishes to make requests for (a) access to a copy of the personal data which we hold about the data subject or information about the ways in which we use or disclose the personal data of the data subject, or {b) correction or update of any of the personal data of the data subject which we have in our records, the data subject may submit the request to us at the contact details provided below. To the extent permitted under Data Privacy Laws and within the legal limits, if applicable, a reasonable fee may be charged for an access request. If so, we will inform the data subject of the fee before processing the request.

2. We will respond to the request as soon as reasonably possible. In general, our response will be within the time period as required under Data Privacy Laws. If we need an extension of time to attend to the data subject request(s), or if we are unable to accede to the request(s) of the data subject, we will inform the data subject accordingly (except where we are not required to do so under Data Privacy Laws).

F. OTHER PERSONAL DATA REQUESTS

1. A data subject may, by reaching us at the contact details provided below, make request(s) for:

(a) (Erasure or deletion) personal data which we hold about the data subject to be removed, deleted or erased;

(b) (Portability) personal data of the data subject that we have collected to be transferred to another organization or directly to the data subject;

(c)(Restrict processing) restrictions to apply as to how we collect, use, disclose or process personal data of the data subject;

(d) (Opt-out of email marketing) us to stop communicating with the data subject for marketing purposes;

(e) (Profiling and automated decision-making) us to stop processing the personal data for automated processing or profiling; and/or

(f) (Opt-out of sale of personal data to third parties) personal data not to be sold to third parties as contemplated by the California Consumer Privacy Act of 2018.

2. We will respond to the above requests within the time period as required under Data Privacy Laws. We may refuse any such requests if any laws and/or regulations allow or require us to do so. We will inform the date subject of the reasons for our refusal if required under Data Privacy Laws. In order for us to process such request(s), we may retain some basic information about the data subject, and we may keep a record of the request and our response.

H. ACCURACY OF PERSONAL DATA

We generally rely on personal data provided by the data subject (or the authorized representative). In order to ensure that the personal data of the data subject is current, complete and accurate, data subjects may update us if there are changes to the personal data by informing us at the contact details provided below.

I. RETENTION OF PERSONAL DATA

1. We may retain the personal data of data subjects for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

2. We will cease to retain the personal data of data subjects, or remove the means by which the data can be associated with the data subjects, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, and is no longer necessary for legal or business purposes.

J. THIRD PARTY WEBSITES

Our websites may contain links to other third-party websites. Data subjects' access and use of such third-party websites and services are subject to other terms, conditions and privacy policies which we have no control over. To the maximum extent permissible under law, we do not accept any responsibility or liability for such terms, conditions and policies or the processing of personal data by such third parties. We strongly encourage you to read and understand such terms, conditions and policies before you accept them.

K. CROSS BORDER TRANSFERS OF PERSONAL DATA

1. We may operate within and/or outside the data subject country of residence and/or office. The personal data of data subjects may thus be transferred, accessed and stored globally as necessary for the uses stated above in accordance with the terms of this Notice, and in compliance with Data Privacy Laws.

2. Personal data may be transferred to or processed at locations outside of the European Economic Area (EEA), some of which have not been determined by the European Commission to have an adequate level of data protection.

3. For cross-border transfers, we will take measures, such as the standard contractual clauses adopted by the European Commission, or other adequate transfer mechanism.

L. JURISDICTION-SPECIFIC DATA PRIVACY NOTICE

1. We may supplement this Notice with Addendums that address additional provisions which are applicable to certain jurisdictions. Such Addendums will apply to data subjects residing in or working at such jurisdictions.

2. In the event of any discrepancy or inconsistency between the English version of this Notice and a version of this Notice under a different language, if available, the English version shall prevail.

M. CONTACT INFORMATION

Data subjects can send us feedback, complaints or enquiries via post at:

GCL Global Holdings Ltd

29 Tai Seng Ave #01-01, Singapore, 534119

Or reach us via our online Contact Form at https://www.gclglobalholdings.com/contact

N. EFFECT OF NOTICE AND CHANGES TO NOTICE

This Notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of personal data by us.

We may revise this Notice from time to time without any prior notice. The data subject may determine if any such revision has taken place by referring to the date on which this Notice was last updated. The data subject's continued use of our services shall constitute acknowledgement and acceptance of such changes.

***

CHILDREN DATA PRIVACY POLICY

A. INTRODUCTION

1. This Children Data Privacy Policy ("Policy") is in addition to and supplements our Data Privacy Notice. This Policy applies to certain websites, services, games, software, social media sites, apps and e-commerce stores ("services") operated and/or managed by us which are either targeted at children or available for use by children. This Policy outlines how we may collect, use, disclose or otherwise process personal data of children. WHEN A CHILD ACCESSES AND/OR USES OUR SERVICES OR SUBMITS PERSONAL DATA TO US, BOTH THE CHILD AND HIS/HER PARENT OR LEGAL GUARDIAN ARE AGREEING TO OUR DATA PRIVACY POLICIES AND CONSENTING TO OUR COLLECTION, PROCESSING, USE AND STORAGE OF THE CHILD'S PERSONAL DATA, AS DESCRIBED UNDER THIS POLICY. IF THE PARENT OR LEGAL GUARDIAN OF A CHILD AND/OR THE CHILD DO NOT AGREE WITH THIS POLICY, THE CHILD MUST NOT ACCESS AND/OR USE OUR SERVICES AND/OR SUBMIT PERSONAL DATA TO US.

2. Some of our services require users to register and sign-up for an account. We do not knowingly allow children to register or sign up for an account without parental or legal guardian consent. Should we be informed that a child has provided us with any personal data to register or sign up for an account without parental or legal guardian consent, we will take reasonable steps to deactivate such user accounts within the time period as required under law.

3. Some of our services have age limits or published age recommendations. We do not knowingly allow children below such age limits or recommendations to use such services without parental or legal guardian consent. Should we be informed that a child below such age limits or recommendations has access and/or is using our services without parental or legal guardian consent, we will take reasonable steps to deactivate

such access and use of the services within the time period as required under law.

B. PERSONAL DATA

Depending on the nature of interaction with us, we may collect the following types of personal data from children for the purpose(s) on the following legal bases:

C. WITHDRAWAL OF CONSENT

Parents and legal guardians may, on behalf of their child or ward, withdraw consent at any time and may request us to stop collecting, using and/or disclosing the personal data of the child by submitting a request to us at the contact details provided on our Data Privacy Notice.

D. ACCESS TO AND CORRECTION OF PERSONAL DATA

Parents and legal guardians may, on behalf of their child or ward, make requests for (a) access to a copy of the personal data which we hold about the child or information about the ways in which we use or disclose the personal data of the child, or (b) correction or update of any of the personal data of the child which we have in our records, by submitting the request to us at the contact details provided on our Data Privacy Notice.

E. OTHER PERSONAL DATA REQUESTS

Parents and legal guardians may, on behalf of their child or ward, by reaching us at the contact details provided on our Data Privacy Notice, make request(s) for:

(a) (Erasure or deletion) personal data which we hold about the child to be removed, deleted or erased;

(b) (Portability) personal data of the child that we have collected to be transferred to

another organization or directly to the child;

(d) (Opt-out of email marketing) us to stop communicating with the child for

marketing purposes;

(e) (Profiling and automated decision-making) us to stop processing the personal data for automated processing or profiling; and/or

(f) (Opt-out of sale of personal data to third parties) personal data not to be sold to

third parties as contemplated by the California Consumer Privacy Act of 2018.

F. PROTECTION OF PERSONAL DATA OF YOUR CHILD OR WARD

1. Any username, avatar name, online alias, nickname or character name to be created for a child's participation in the services should not be directly identifiable to the child.

2. We recommend parents and legal guardians take steps to ensure that the username, password, and other personal data of their child or ward are kept safe and such personal data are not disclosed by their child or ward through our services.

3. We encourage parents and legal guardians to set up appropriate parental controls and monitoring on devices and/or our services to ensure the privacy and safety of their child or ward.

G. RETENTION OF PERSONAL DATA

How we may retain or cease to retain the personal data of children shall be as further detailed under our Data Privacy Notice.

H. THIRD PARTY WEBSITES

Our websites may contain links to other third-party websites. A child's access and use of such third-party websites and services are subject to other terms, conditions and privacy policies which we have no control over. To the maximum extent permissible under law, we do not accept any responsibility or liability for such terms, conditions and policies or the processing of personal data by such third parties. We strongly encourage parents and legal guardians to read and understand such terms, conditions and policies before accepting them on behalf of the child.

I. CROSS BORDER TRANSFERS OF PERSONAL DATA

How we may transfer, process and/or store personal data of children shall be as further detailed under our Data Privacy Notice.

J. JURISDICTION-SPECIFIC DATA PRIVACY NOTICE

We may supplement our Data Privacy Notice with Addendums that address additional provisions which are applicable to certain jurisdictions. Please refer to such Addendums that will apply to children residing in such jurisdictions.

K. CONTACT INFORMATION

Although we do not and cannot prevent children from reaching us directly, we encourage parents and legal guardians to contact us on behalf of their child or ward. Our contact information can be found on our Data Privacy Notice.

L. EFFECT AND CHANGES TO POLICY

We expect parents and legal guardians to read, understand and subsequently explain this Policy to their child or ward before permitting them access to and/or use of our services.

This Policy applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of children's personal data by us.

We may revise this Policy from time to time without any prior notice. Parents, legal guardians and children may determine if any such revision has taken place by referring to the date on which this Policy was last updated. A child's continued use of our services shall constitute acknowledgement and acceptance of such changes by both the child and the parent or legal guardian of the child.

Last updated 1 February 2025