GUNGHO ONLINE ENTERTAINMENT, INC.
SUPPLEMENTAL U.S. PRIVACY NOTICE

This Supplemental U.S. Privacy Notice (this “Supplemental Policy”) describes the practices of GungHo Online Entertainment, Inc. and its affiliates, including GungHo Online Entertainment America, Inc. (“we,” “us,” or “our”) regarding the collection, use, and disclosure of personal information and provides instructions for submitting data subject requests. This Supplemental Policy applies only to information collected about consumers residing in California, Colorado, Connecticut, Virginia, Utah, or Texas (“consumer(s),” “Consumer(s),” “you,” “your”) and supplements the information contained in Add LINK: U.S. Privacy Policy.

It provides information required under the California Consumer Privacy Act of 2018 and as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), the Colorado Privacy Act of 2021 (the “CPA”), the Virginia Consumer Data Protection Act of 2021 (the “VCDPA”), the Utah Consumer Privacy Act of 2022 (the “UCPA”), the Connecticut Data Privacy Act of 2022 (“CDPA”), the Texas Data Privacy and Security Act (the “TDPSA”), and any and all regulations arising therefrom (collectively, “Applicable Laws”). Some portions of this Supplemental Policy apply only to consumers of particular states, and we have indicated where those portions are state-specific.

If you are unable to review or access this Supplemental Policy due to a disability, you may contact us at support_eu@gungho.jp to access this Supplemental Policy in an alternative format.

1. Definitions Specific to this Policy.

“Consumer” means a natural person who resides in California, Colorado, Connecticut, Virginia, Texas and Utah, and to whom we offer information, goods, or services.

*For purposes of this Supplemental Policy and subject to laws and regulations in each applicable state, the term “Consumer” may also include natural persons who reside in any of the above-described states and engage with us as part of business-to-business transactions, including, without limitation, transactions involving our customers (existing or potential), business partners, agencies and suppliers. In addition, the term “Consumer” may also include under certain circumstances job applicants, students, visitors to our website and claimants.

• “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information includes “personal data” as that term is defined in the Applicable Laws, including, without limitation, any information, including pseudonymous data and sensitive data, that is linked or reasonably linkable to an identified or identifiable individual. Personal Information also includes “Sensitive Personal Information,” as defined below.
• “Sensitive Personal Information” means Personal Information that reveals a Consumer’s: 1) Social security, driver’s license, state identification card, or passport number; 2) Account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to the individual’s account; 3) Precise geolocation; 4) Racial or ethnic origin; 5) Religious beliefs; 6) Union membership; 7) Contents of email or text messages, unless we are the intended recipient; 8) Genetic data; 9) Biometric information used to uniquely identify the Consumer, 10) Health, mental or health diagnosis, sex life, or sexual orientation, (11) citizenship or immigration status and (12) Personal Information collected from a known child. Sensitive Personal Information includes “sensitive data” as that term is defined in the Applicable Laws.
• “Sell,” “Sale,” or “Sold” means selling, renting, releasing, disclosing, transferring or other communications of an individual’s Personal Information to a Third Party for money or other valuable consideration.
• “Share,” “Shared,” or “Sharing” means disclosing, transferring and other communications of an individual’s Personal Information to a Third Party for behavioral advertising purposes, whether or not for money or other valuable consideration.
• “Third Party” means a person or organization which is not a Consumer, Vendor, or an entity owned or controlled by us and as defined by the Applicable Laws.
• “Vendor” means a “service provider,” “contractor,” or “processor” which collects, stores, or otherwise handles data for us, as those terms are defined in the Applicable Laws.

These definitions apply, whether terms are capitalized or not. Other terms used in this Supplemental Policy may be defined under the Applicable Laws, and they shall have the meanings described in those statutes. If there are variations between such definitions in different laws, you will be covered by the definition that applies in your state.

2. The Personal Information We Collect and Sell, Share or Otherwise Disclose.

The chart below shows the categories of Personal Information we may collect; examples of Personal Information in each category; types of sources from which each category of Personal Information is collected; the business purposes for which each category of Personal Information is collected; and the types of Vendors or Third parties with whom that category of Personal Information is shared. As this chart shows, we may share or sell certain Personal Information to Third Parties or disclose certain Personal Information to Vendors for business purposes. Our collection of Personal Information will be limited to what is adequate, relevant, and reasonably necessary to achieve the purposes of collection described below.

3. Sensitive Personal Information We Collect and Disclose.

4. Retention of Data.

We intend to retain each category of Personal Information described above only for as long as necessary to fulfill the purpose for which it was collected, or a related and compatible purpose consistent with the average consumer’s expectation, and to comply with applicable laws and regulations. We consider the following criteria when determining how long to retain Personal Information: why we collected the Personal Information; the nature of the Personal Information; the sensitivity of the Personal Information; our legal obligations related to the Personal Information, and risks associated with retaining the Personal Information.

5. Your Rights to Your Personal Information.

Consumers have certain rights with respect to the collection and use of their personal information. Those rights vary by state. As required by the Applicable Laws, we provide detailed information below regarding the data subject rights available to consumers. Consumers can find more detail by referencing the Applicable Laws.

You have the right to submit requests related to the Personal Information we have collected about you. You may make such a request twice in a 12-month span. Please note, there are circumstances when we may not be able to comply with your request. For example, we may not be able to verify your request or we may find that providing a full response conflicts with other legal obligations or regulatory requirements. We will notify you if this is the case.

6. Right to Receive Information on Privacy Practices.

You have the right to receive the following information at or before the point of collection:

• The categories of Personal Information to be collected;
• The purposes for which the categories of Personal Information are collected or used;
• Whether or not that Personal Information is sold or shared with Third Parties or disclosed to Vendors;
• If the business collects Sensitive Personal Information, the categories of Sensitive Personal Information to be collected, the purposes for which it is collected or used, and whether that information is sold or shared; and
• The length of time the business intends to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period.

We have provided such information in this Supplemental Policy, and you may request further information about our privacy practices by using the contact information provided below.

7. Right to Know and Right to Access.

You have the right to request a portable copy of certain information we have collected about you. You have the right to request:

• Specific pieces and categories of Personal Information we collected about you;
• The categories of sources from which Personal Information was collected;
• The purposes for which Personal Information was collected, shared, sold, or processed;
• The categories of Personal Information we shared, sold or disclosed; and
• The categories of Vendors or Third Parties with whom we shared, sold or disclosed Personal Information.

If you would like to make a request to know or to access a portable copy of your Personal Information, you can use the email address or phone number listed below.

8. Right to Delete.

You have the right to request that we delete certain Personal Information that we have collected. If you would like to make a request to delete your Personal Information, you can use the email address below.

9. Right to Correct.

You have a right to request that we correct any inaccurate Personal Information we may retain about you. If you would like to make a request to correct your Personal Information, you can email us support_eu@gungho.jp

10. Right to Opt-Out of the Sale and Sharing of Your Personal Information.

You have the right to opt-out of the sale and sharing of your Personal Information with Third Parties, and the right to opt out of the processing of Personal Information for targeted advertising purposes (or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer), as defined in the Applicable Laws.

We sell or share Personal Information, or process Personal Information for targeted advertising purposes. In the past 12 months, we have sold or shared the categories of consumer personal information as listed in this Supplemental Policy. As a consumer, you have the right to opt-out of the sale and/or sharing of your Personal Information and of the processing of Personal Information for the purpose of targeted advertising. To submit an opt-out request, please use the email address or phone number listed below. We do not knowingly sell or share Personal Information of consumers under 16 years of age.

If you opt-out of the sale of your Personal Information, we will wait at least 12 months before asking you if we may sell or share your Personal Information. You have the right to opt-in to the sale of your Personal Information after you have opted out. If you would like to opt-in to the sale or sharing of your Personal Information, please email us at support_eu@gungho.jp. Opting-in is a two-step process in which you will first clearly request to opt-in, and then separately confirm that choice.

11. Right to Consent to or Limit the Use of Your Sensitive Personal Information.

You have the right to consent to the use of your Sensitive Personal information under Applicable Laws. Separately, you have the right to instruct us to limit the use and disclosure of your Sensitive Personal Information to only that which is necessary to perform the services or provide the goods reasonably expected by an average consumer or for specific business purposes defined by law. However, we do not use Sensitive Personal Information for purposes beyond those authorized by Applicable Laws, or beyond your consent. By accepting this Supplemental Policy pursuant to a statement by electronic or other means permitted under the Applicable Laws, you acknowledge and agree that you will be signifying your freely given, specific, informed, and unambiguous agreement to process your Personal Information (including Sensitive Personal Information) pursuant to this Supplemental Policy.

12. Right to Non-discrimination.

You have a right to exercise the above rights and we will not discriminate against you for exercising these rights. Moreover, we will not process Personal Information in violation of applicable state and federal antidiscrimination laws. Please note that a legitimate denial of a request to access, delete, or opt-out is not discriminatory, nor is charging a fee for excessive or repetitive requests.

13. Instructions to Exercise your Rights.

If you would like to exercise any of the rights described herein or make any of the data requests listed above, please contact us using one of following two methods: (a) at support_eu@gungho.jp. If you use the telephone number, you will be guided through a process that will allow you to submit a verifiable request, and the level of verification will depend on the request being submitted. If you use the email address, we may email you to request additional information from you to verify your request. You may designate an authorized agent to exercise your rights under the CCPA on your behalf. Such individual must have power of attorney, or be an authorized agent registered with the relevant Secretary of State. We will provide information in response to your request at least twice annually and free of charge, unless the request is manifestly unfounded, excessive, or repetitive.

14. Right to Appeal.

If you submit a request to exercise your data subject rights under this Supplemental Policy and it is denied, or if we fail to act on your request within the required period of time, you have the right to appeal that decision or failure to act, as applicable. If you choose to appeal, your request will move from HR to our Legal Department for review. If you would like to submit an appeal, please email support_eu@gungho.jp. Please state that your request is an “Appeal,” and describe the date and nature of your original request. Pursuant to the TDPSA, if we deny your appeal, you may submit a complaint with the Texas Office of the Attorney General at: Consumer Complaint Form | Office of the Attorney General (salesforce-sites.com).

15. Verification Process/Response to Requests.

When you submit a request to exercise your data subject rights, we may ask you to provide information that will enable us to verify your identity. If you designate an authorized agent to exercise your rights on your behalf, we may require that you or the authorized agent do the following:

• Verify your identity with us directly.
• Provide proof of your signed written permission for the authorized agent to submit a request on your behalf.

We may deny a request from an agent purportedly acting on your behalf if we request, and the agent does not submit, proof that he, she, or it has been authorized by you to act on your behalf.

We will authenticate and respond to your rights request within the applicable time periods set forth in the Applicable Laws, including, without limitation, within 45 days as required under the TDPSA (subject to an additional 45 day extension when reasonably necessary).

16. Personal Information of Minors.

We do not knowingly collect, store, process, Sell or Share information from minors under the age of eighteen (18) years except as required by applicable laws.

If we become aware or you or your parent/legal guardian identify to us or one our Third Party partners, that you are a minor under the minimum age of consent guidelines set by applicable laws, we will:

• (a) Promptly obtain verifiable consent from your parent or legal guardian for the use your Personal Information, when required by applicable laws; and
• (b) offer controls and choices to parents and legal guardians. For example, if your parent or legal guardian wishes to revoke their previously provided consent, we will provide them with an opportunity to review information collected from you or have that information deleted by contacting us via the process described in Section 13 (Instructions to Exercise Your Rights). If we become aware that you have provided us with Personal Information without verifiable consent as required by applicable law, we will delete any Personal Information we have collected, unless we have a legal obligation to keep it, and terminate your account and/or revert you to the age-appropriate experience, as applicable. If we make material changes to how we collect, store, use, Sell, Share or otherwise process Personal Information of minors under the minimum age of consent guidelines set by applicable laws, we will update this Policy accordingly and if applicable, notify such minor’s parents or legal guardians as required by applicable law.

17. Additional California Privacy Rights: Shine the Light Request.

California Civil Code Section § 1798.83 permits users of our website who are California residents to request certain information regarding our disclosure of Personal Information to other parties for their direct marketing purposes. To make such a request, please send an email to support_eu@gungho.jp with the subject “Shine the Light Request.”

18. Changes to Our Supplemental Policy.

We reserve the right to amend this Supplemental Policy at our discretion and at any time. When we make changes to this Supplemental Policy, we will post our updated notice online with a new “Revised on” date at the top of the page. We encourage you to review this Supplemental Policy regularly to ensure you are aware of any updates.

19. Contact Details.

If you have any questions about this Supplemental Policy, please contact us at: GungHo Support.

GungHo Online Entertainment, Inc.
Pacific Century Place Marunouchi, 1-11-1 Marunouchi, Chiyoda-ku, Tokyo, 100-6221 Japan