Global Privacy Statement

All features on the Poki Website are available without the need for registration by Website Visitors. No contact details such as your name, email address and phone number are requested from or processed about Website Visitors, unless they actively contact us. Furthermore, our game developers are in principle required to remove all outgoing links and branding/advertisements (e.g. splash-screens, social links and app-store links) from their games.

Nonetheless, Poki does collect certain electronic data. We can process this data in various ways. Please find directly below some general information about our processing of your data and further below, you find an overview of various topics on which you can click for more detailed information about the processing of your data in a specific context.

In general, we may always process your data for the following purposes:

• For maintenance, administration and network and security purposes;
• For internal control and business operations;
• For analyzing and improving our products;
• For handling any requests, complaints and disputes;
• For determining, exercising and defending our rights; and
• For complying with legal obligations (incl. fraud prevention) and requests of authorized governmental institutions.

In general, we may process your data based on a legal obligation. This means that we will process your data for as far as we are legally obliged to do so, for instance to comply with statutory minimum retention periods.

Sometimes we indicate that we process your data based on the legal ground "legitimate interest". This means that a balance of interests is performed between the interests that are served by the processing on the one hand and your privacy interests on the other hand, and that the interests in favor of the processing prevail. The related legitimate interests are included below per topic. If you want more information about this, you can contact us directly via our contact details stated below.

The Poki Website is not meant for persons younger than 16 years. We also do not focus on persons who are placed under a legal relationship, such as guardianship or persons who are supervised or administered by someone else. If, in exceptional cases, we could focus on such persons, Poki will take into account the vulnerable position of these persons and take extra precautions, such as is the case for our Poki Kids Website.

We obtain your data in various ways:

• Provided by you. Some data about you, we receive straight from you. Examples include information in your messages to us and information you enter in our application form.
• Obtained internally. It is possible that we obtain your data via other Poki systems. An example for game developers is the data which is included into our CRM system.
• Obtained from third parties. We could also obtain data about you from other persons or external parties. Specifically, we make use of this possibility in two scenarios:
• Website Visitors: we may receive information about you from privately held third parties, such as for the advertisements that are shown on the Poki Website. Further information on this is included in our Cookie Statement.
• Applicants: we may obtain information from a referral included by you in your application.
• Automatically obtained. Some data we obtain automatically, for example by using cookies and similar techniques. When your computer or mobile device contacts our web servers (e.g. when you visit the Poki Website), our web servers automatically collect usage information. Such usage information includes information about how our Website Visitors use and navigate the Poki Website. It can include the number and frequency of Website Visitors to each web page and the length of their stays, browser type, and referrer data that identifies the web page visited prior and subsequent to visiting the Poki Website. Further information on this is included in our Cookie Statement.
• Derived. Certain data we do not receive directly, but can be derived from the information already in our possession. For example, information about your language preferences.

In principle you are under no obligation to provide any information about yourself to us. However, refusal to supply certain information could have a negative influence on, for example, the functionality of the Poki Website. If the provision of certain personal data is a legal or contractual obligation or an essential requirement for concluding an agreement with us, we will separately provide additional information about this for as far as this is not clear in advance. In such case we will also inform you about the possible consequences if this information is not provided.

We only share your data with third parties if:

• This is necessary for the provision of a service or the involvement of the third party. Sub-contractors, for example, will in principle only get access to the data that they require for their part of the service provision.
• The persons within the third party that have access to the data are under an obligation to treat your data confidentially. Where necessary this is also contractually agreed on.
• The third party is obliged to comply with the applicable regulations for the protection of personal data, for instance because we have concluded an agreement with this party or because our Terms of Use apply. This includes that the party is obliged to ensure appropriate technical and organizational security measures.

We could share your data on a need-to-know basis with the parties mentioned below. In this context, "need-to-know" means that a party only gets access to your data if and insofar as this is required for the professional services provided by this party.

• Authorized persons, employed by Poki, who are involved with the processing activity concerned. Such as, the members of the support team you are in contact with.
• Authorized persons, employed by service providers / sub-contractors engaged by Poki, who are involved with the processing activity concerned. Such as, the service provider for the Poki web shop.
• Authorized persons, employed by parties in the private sector with whom we may share certain data, such as our game developers and advertising partners. Traffic information may be shared with game developers and advertisers on an aggregate and anonymous basis. In addition, advertisers on the Poki Website may receive information gathered by cookies for targeted advertising purposes. Further information regarding the use of cookies can be found in our Cookie Statement.
• Authorized government institutions. Such as, courts, police, and law enforcement agencies. We may release information about our Website Visitors, when legally required to do so, at the request of governmental institutions conducting an investigation or to verify or enforce compliance with the policies governing the Poki Website and applicable law. We may also disclose such user information whenever we believe disclosure is necessary to protect the rights, property or safety of Poki, or any of our respective business partners, customers or others.
• Aggregate Information. We may also disclose non-identifying, aggregated user statistics to third parties for a variety of purposes, including describing our services to prospective partners and other third parties. Examples of such non-personal information include the number of users who visited this Poki Website during a specific time period or played a specific game.

Protecting your privacy and data is very important to us. Therefore, Poki has implemented appropriate technical and organizational measures to protect and secure personal data, in order to prevent violations of the confidentiality, integrity and availability of the data. All Poki employees and other persons engaged by Poki for the processing of data are obliged to respect the confidentiality of personal data.

Poki has internal documentation in which it is described how we safeguard an appropriate level of technical and organizational security. In addition, a data breach procedure is applicable within Poki, in which it is explained how (potential) data breaches need to be handled. We will, for example, inform the competent supervisory authority and involved data subjects when this is required by the applicable law.

Parties involved with the processing of your data may be located in a different country than you are. No matter where you are located, we are securing your personal data as much as reasonably possible.

If your data is transferred from the EU to a party located outside the EU, we call this an 'EU transfer' (see this link for an overview of the EU countries). If your data is transferred from the UK to a party located outside the UK, we call this a 'UK transfer'. EU transfers and UK transfers are legitimized in the manner described below. You may contact us for information on the legitimization of other data transfers.

EU transfers. An EU transfer EUcan in the first place be legitimized based on an adequacy decision of the European Commission, in which it is decided that the (part within the) third country in question ensures an adequate level of data protection. See this link for a summary of the applicable adequacy decisions.

UK transfers. A UK transfer can in the first place be legitimized based on an adequacy regulation of the UK government. See this link for an overview of the applicable adequacy regulations.

If an EU transfer and/or UK transfer takes place for which there is no adequacy decision or adequacy regulation in place, we agree on the applicability of the relevant version of the Standard Contractual Clauses with the relevant party. This is a standard contract to safeguard the protection of your data, which is approved by the European Commission in which the parties fill out the appendices. See this link for the various versions of the Standard Contractual Clauses for the EU. Where appropriate, additional safeguards should be taken. Where the UK GDPR is applicable, a UK Addendum will be added to the Standard Contractual Clauses mentioned above, as required by UK law and regulations (see this link).

In specific situations we can also rely on the derogations as specified in applicable law to legitimize the EU transfer and/or UK data transfer. This could mean that we may transfer your data: (i) with your explicit consent, (ii) if this is necessary for the performance of a contract that has been concluded with you or has been concluded in your interest, or (iii) if this is necessary for the establishment, exercise or defense of legal claims. Lastly, in exceptional cases we may also transfer your data if the data transfer is necessary for our compelling legitimate interests and is not overridden by your interests or rights and freedoms.

You can contact us if you want additional information via our contact details as stated at the bottom of this Privacy Statement.

Google Analytics Blockage Blockage Please note that we do not use Google Analytics on any of our websites. However, it is possible that one of the game developers we work with tries to use Google Analytics for tracking in-game activities. We actively try to find these implementations and overwrite them for users from the EU. To opt out of being tracked by Google Analytics across all websites, please visit: http://tools.google.com/dlpage/gaoptout.

In general, we do not keep your data for longer than what is necessary in relation to the purposes for which we process the data. There could however be exceptions applicable to the general retention terms.

Exception: shorter retention period. If you exercise certain privacy rights, it is possible that Poki will remove your data earlier than the general applicable retention period or – oppositely – retain it for a longer period of time. For more information about this, please refer to the header "What are your privacy rights (incl. right to object)?"

Exception: longer retention period. In certain situations, we process your data for a longer period of time than what is necessary for the purpose of the processing. This is for instance the case when we have to process your data for a longer period of time:

• Retention obligation. To comply with a minimum retention period or other legal obligation to which we are subject based on the applicable law;
• Procedure. Your personal data is necessary in relation to a legal procedure;
• Freedom of expression. When further processing of your personal data is necessary in order to exercise the right to freedom of expression and information.

You have various privacy rights. Which privacy rights you have, depends on the applicable law. To what extent you can exercise these rights may depend on the circumstances of the processing, such as the manner in which Poki processes the personal data and the legal ground for the processing. Below, we included a summary of the privacy rights you may have. The applicable law may allow or require us to refuse your request, because these rights are not absolute or may not be applicable in your region.

For more information about your privacy rights in other jurisdictions, such as the Member States of the EU or the UK, go to this webpage or this webpage of the European Commission or this webpage of the UK Information Commissioner’s Office. In case you are visiting the Poki Website from another jurisdiction, please refer to 12. Local Law Addenda to see which privacy rights you might have.

Poki is in principle responsible for the processing of your data in the context of the Poki Website, but other parties may also be involved and responsible themselves, as specified below.

9.1 Developers.
The developers of the games on the Poki Website are in principle required to remove all outgoing links and branding/advertisements (e.g. splash-screens, social links and app-store links) from their game(s). If developers do gather personal data for their own purposes, Poki is not responsible for this processing: only the developer decides what (personal) data is processed and for what purpose. However, because Poki feels it is important that your data is also safe when you play a game, we took two measures. In the first place, we included contractual safeguards with the developers. They are only allowed to include cookies and similar technologies in their game if no consent for this is required under the applicable law. Concerning analytic cookies, such cookies are only allowed if the use is in line with applicable law and insofar privacy-impact is non-existent or minimal. In the second place, we have prepared this list of the cookies used by our game developers, categorized per game, to inform you on behalf of the developers.* For further information on developers cookies, please refer to our Cookie Statement. Furthermore, if you notice any possible undue processing by a developer of your data, please inform us so that we can investigate.

9.2 Advertisement partners.
Poki uses the services of several advertising parties. These parties provide us with advertisements for the Poki Website and are responsible for their part of the processing of your data in this context. To nevertheless safeguard your privacy in this respect as much as possible, Poki has, amongst other things, ensured that suitable contractual measures are in place. Further information regarding the use of cookies, also in the context of advertising partners, can be found in our Cookie Statement.

9.3 Externally hosted games, third party games and other websites.
This Privacy Statement does not apply to usage of your data by other parties that are themselves responsible for such usage of your data, such as providers of third-party games available on the Poki Website. The relevant provider of such third-party game is responsible for ensuring that any processing of your data by them in the context of a game complies with the applicable law. In principle, Poki does not permit third party content providers to collect personal data about Website Visitors. However, if any personal data will be collected by a third-party content provider, Poki will require that the processing of such data by them complies with the applicable law.

* Please note that this list may not be complete, since randomized cookies that are placed with less than 100 Website Visitors are not included in the list. Furthermore, the cookies used by developers may change over time. Therefore, we automatically update this list daily.