We care about your privacy and we think it is important that you always know what information we obtain about you in the context of your use of the CrossfireX and what that information is used for. In the Privacy Policy below, we therefore aim to keep you fully informed as to the type, extent and purpose of the collection, storage, use and processing of personal data relating to the CrossfireX game and related services and game support applications and software (the "Game") and any website on which this Privacy Policy is posted (the "Websites").

Personal data is all information relating to an identified or an identifiable natural person. A person is identified when the identity of a specific person can be deduced from the information itself. A person is identifiable when we can make a connection to a specific person using additional information available to us.

This Privacy Policy applies to the Game and Websites only. You can also see this Privacy Policy at the Websites. We recommend that you read the privacy policy of every other service provider you make use of, in particular before you make your personal data available to them.

Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it.

IF YOU DO NOT AGREE WITH OUR POLICIES AND PRACTICES, DO NOT DOWNLOAD, REGISTER WITH, OR USE THE GAME OR VISIT THE WEBSITES.

By downloading the Game, visiting the Websites, you acknowledge the terms of this Privacy Policy and the use and disclosure of your personal data as set out in this policy.

If you are using Services in specific countries or regions (for example, when you use services in Republic of Korea), please refer to our Privacy Policy applied in each country (located at https://cfx.game.onstove.com/en/privacypolicy_kor.html).

We are Smilegate West, Inc./Smilegate Entertainment, Inc. (collectively, "we" or "us"), the co-publishers of CrossfireX.

We are the provider of the Game and Websites and the organization responsible for the personal data you provide as part of using the Game and the Websites within the meaning of applicable data protection and privacy laws.

If you have any questions about this Privacy Policy or our use of your personal data, if you need to report a problem, or if you would like to exercise one of your rights under this Privacy Policy you can contact us using the following contact details:

Title:	Data Protection Officer
Email:	info@smilegatewest.com

For the purposes of applicable EU data protection legislation, we also have a representative located within the European Union. The contact details of our EU representative are set out below:

Name:	v. KEUSSLER Consulting GbR
Address:	v. Keussler Consulting GbR, partnership, Schepp Allee 47, 64295 Darmstadt, Germany
Email:	privacy_EU@smilegate.com

We may collect the following types of information relating to you indirectly through Microsoft Corporation(‘Microsoft’), the operator of the Xbox gaming platform:

• By playing CrossfireX(‘CFX’) on Microsoft's Xbox Live Service, you agree that Microsoft may provide us with your Microsoft user account information. From Microsoft, we receive information including your account, items used, gameplay information, and IP address etc., to provide you with CrossfireX services. We do not receive your credit card number or other financial information. The categories of personal data that we receive from Microsoft include identifiers, commercial information, and internet or other electronic network activity information. For details of how Microsoft uses your data, please refer to the Microsoft Privacy Statement. (located at https://privacy.microsoft.com/en-ca/privacystatement; 'Microsoft Privacy Statement' > 'Product-specific details' > 'Entertainment and related services' > 'Xbox').

You may also optionally create a STOVE account and link your Microsoft account to utilize CFX website-based features. In this case, we may collect identifiers, commercial information, internet or other electronic network activity information, and geolocation data relating to you indirectly through Smilegate Stove, Inc., the operator of the STOVE platform, including:

• Identifier for linking accounts
• connection record (IP address, dates, link/unlink status, etc.)
• service use record (coupon, customer support service)
• country, email address (If you agree to receive Smilegate West newsletters)

We may use your email address to transmit direct marketing communications (related to games of Smilegate West, Inc., including but not limited to CFX) to you by email, but only in case you have consented in receiving Smilegate West newsletters on our website. If you agree to receive Smilegate West newsletters, you are entitled to withdraw your consent at any time. You may withdraw your consent to receive marketing email messages from us by following the unsubscribe instructions provided in our emails. Alternatively, you can make a request using the contact details above.

During your participation and progression in our Events, we may also collect certain personal data about you, such as name, email address, phone number, address for the prize delivery etc (identifiers).

Within the Game and Websites, you may be provided with the option to link through to other websites and services. These other domains, apps and websites are subject to their own privacy practices and we encourage you to read the privacy policies of each and every website and application with which you interact. You visit these other websites or applications at your own risk.

You should be aware that personal data that you voluntarily include and transmit online in a publicly accessible blog, chat room, social media platform or otherwise online or that you share in an open forum may be viewed and used by others without any restrictions. We are unable to control such uses of your data and by using such services, you assume the risk that the personal data you provide may be viewed and used by third parties for any number of purposes.

We collect, process and use your personal data for the following purposes:

To provide services and comply with the service contract

• for the purposes of providing the Game, the Websites and associated content/event and otherwise fulfilling our contract for services
• for the purposes of analysing and tracking game data
• settling fees, provide contents, purchase and fee payments, delivery of goods (prizes from events, etc.)
• protecting our business and interests, including investigating any potential violation of our terms and conditions
• to analyse the performance of our services, in order to ensure the proper operation of our services and to identify and remedy software errors and security risks as well as to improve our services according to our users' requirements

We will not keep your personal data for longer than is necessary for the purposes for which we collect it unless we believe that the law or other regulation requires us to preserve it (for example, because of a request by a tax authority or in connection with any anticipated litigation).

Besides those statutory obligations, we are entitled to store your personal data for specific cases. The end of the storing period depends on the purpose for which we still need your personal data. This means we are storing your personal data at least for the time of a contractual relationship with you as our customer. However, we are permitted to store information, including your personal data, for longer if necessary to bring or defend ourselves against legal claims in court. This retention period relates to the respective periods set forth by a given statute of limitation.

When it is no longer necessary the retain your data, we will delete the personal data that we hold about you from our systems.

You have various rights in relation to the data which we hold about you. To get in touch with us about any of your rights under applicable data protection laws, please use the contact details set out above or contact Customer Service (https://help.onstove.com/web/faq/serviceMain/page?game=2112090016). We will seek to deal with your request without undue delay, and in any event within any time limits provided for in applicable data protection law (subject to any extensions to which we are lawfully entitled). Please note that we may keep a record of your communications to help us resolve any issues which you raise.

In addition, for users located in the EU only, the European General Data Protection Regulation (the "GDPR") gives you the following rights in relation to your personal data:

Right to object

This right enables you to object to us processing your personal data where we do so for one of the following reasons:

• because it is in our legitimate interests to do so (for further information please see the section on our legal bases for processing below);
• to enable us to perform a task in the public interest or exercise official authority;
• to send you direct marketing materials; or
• for scientific, historical, research, or statistical purposes.

Right to withdraw consent

Where we have obtained your consent to process your personal data for certain activities (for example, for marketing), you may withdraw this consent at any time and we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition.

Data Subject Access Requests

You may ask us for a copy of the information we hold about you at any time, and request us to modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this unless permitted by law. If you request further copies of this information from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so.

Right to erasure

You have the right to request that we "erase" your personal data in certain circumstances. Normally, this right exists where:

• The data are no longer necessary;
• You have withdrawn your consent to us using your data, and there is no other valid reason for us to continue;
• The data has been processed unlawfully;
• It is necessary for the data to be erased in order for us to comply with our obligations under law; or
• You object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing.

We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will always tell you our reason for doing so. When complying with a valid request for the erasure of data we will take all reasonably practicable steps to delete the relevant data.

Right to restrict processing

You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.

Right to rectification

You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.

Right of data portability

If you wish, you have the right to transfer your personal data between service providers. In effect, this means that you are able to transfer the details we hold on you to another third party. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data. Alternatively, we may directly transfer the data for you.

Right to complain

You also have the right to complain to your applicable data protection authority. Contact details for data protection authorities in the EU are available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

For users located in California only, the California Consumer Privacy Act (CCPA) gives you the following rights in relation to your personal data:

Right to Know

You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. Once we receive your request and confirm your identity, we will disclose to you information regarding what personal data we collect, use, disclose, and sell pursuant to the CCPA.

Right to Delete

You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions under the CCPA. Once we receive your request and confirm your identity, we will review your request to see if an exception applies and delete personal data not subject to an exception and will direct our service providers to take similar action

When submitting your request to know or delete to us, you must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information. If you submit your request via email to info@smilegatewest.com, you must provide at least two of the following data points: email address used to originally register your Stove account, location that you registered your Stove account from (country), Stove membership number, creation date of the Stove account or other information that we may require if none of the foregoing applies. If you make a request to know or delete that requires verification with a reasonably high degree of certainty, we may ask you for one or more additional data points for verification. If you choose to have an authorized agent make a request on your behalf, the authorized agent must provide sufficient evidence that you appointed the agent for the purpose of making the request. We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. You must describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Right to Opt-out of Sale of Personal Data

We do not sell your personal data. If we sell your personal data, you have the right to opt-out of the sale under the CCPA.

You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. Once we receive your request and confirm your identity, we will disclose to you information regarding what personal data we collect, use, disclose, and sell pursuant to the CCPA.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

In general, your data is processed by us and we do not pass on any personal user data to third parties unless it is necessary to do so in order to offer you the Game and Websites services. Where we do share your personal data, we do so with the following categories of recipients:

Service Providers

In order to provide the Game and Websites services, we work with certain service providers (e.g. email service provider, platform providers, solution providers and marketing agencies) who may, in the course of providing the respective services, receive and process personal data on our instruction and on the basis of a commissioned data processing agreement.

Related entities

We may share your data with certain other entities within the Smilegate group to support the services.

Regulatory bodies

We may disclose your personal data:

• to data protection regulatory authorities;
• in response to an enquiry from a government agency; and
• to other regulatory authorities with jurisdiction over our activities.

Professional advisors and Auditors

We may disclose your personal data to professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.

Replacement providers

In the event that we sell or buy any business assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If all or substantially all of our assets are acquired by a third party, personal data held by us about our clients will be one of the transferred assets.

Indicator and tracking analysis tools

We share your personal data with certain entities which provide us with indicator and tracking analysis tools in the Game and Websites. In particular we share your personal data with:

• Google: We use Google Analytics. For details of how Google uses your data, please visit www.google.com/policies/privacy/partners/; and

Please see the "Cookies" section, below for further information on the cookies which are used as part of the indicator and tracking analysis tools in the websites.

At your option

In certain circumstances, you have the option of sharing information with others yourself as part of the Game and Websites (e.g. if you give out personal information in a public forum). However, we do not transfer such data to other third parties.

Otherwise, your data will only be passed on in special exceptional cases, where we are obligated or entitled to do so by statute or upon binding order from a public authority.

We will review this Privacy Policy periodically, and reserve the right to modify and update it at any time. You acknowledge that we may make changes to this Privacy Policy and it is your responsibility to check back to this page from time to time to review the Privacy Policy; provided, however, that if such changes are significant and it is required by applicable laws, we will endeavour to post notice or acquire your consent regarding such significant changes to this Privacy Policy. Changes to this Privacy Policy will come into effect immediately upon such changes being uploaded in the Game or to our Websites.

THE GAME IS NOT INTENDED FOR CHILDREN.

The Game is primarily intended for persons: (i) aged 17 or older, or (ii) reached the applicable age otherwise defined in your country of residence ("applicable age") or older than such applicable age.

We therefore do not knowingly collect any personal data from: (i) children under 17, or (ii) under applicable age. Any person who provides their personal data to us through the Game or Websites represents that he or she is of an applicable age. If we learn that personal data of persons under these age restrictions has been collected, then we will take the appropriate steps to delete this information.

If you are a parent or legal guardian and discover that your child under these age restrictions has obtained an account with us or otherwise has provided personal data to us, you may contact us using the contact details set out above and request that we delete your child's personal data and account.

California Civil Code section 1798.83 permits users who are California residents to request certain information identifying any third party to whom we may have disclosed, within the past year, personal data pertaining to such user and such user's family for that third party's direct marketing purposes, as well as a description of the personal data disclosed. To request such information, you may contact us using the contact details set out above. Any written inquiry must include "California Privacy Rights Request" in the first line of the description. Please note that we are only required to respond to one request per user each year.

If the California Consumer Privacy Act (CCPA) applies to your information, you can exercise your rights to receive information about our data practices, as well as to request access to and deletion of your information. See the 'Your rights' section above for more information.

In addition, California residents under the age of 18 who are registered users of any of online sites, services or applications where this Privacy Policy is posted may under California law request and obtain removal of content or information they have publicly posted. To make such a request, you may contact us using the contact details set out above. Your request should include a detailed description of the specific content or information to be removed. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

California law permits our users who are California residents to be informed as to how we respond to web browser "Do Not Track" settings. We do not respond to "Do Not Track" settings at this time, whether that signal is received on a computer or on a mobile device.

We use cookies (access data files) which save the user's personal information in order to provide a specialized service that is customized and personalized to our users, as well as for analytics and tracking purposes. Cookies are small pieces of data (text files) that are sent by the website server to the user's browser or app and saved on the user's computer and other devices. With respect to its operation, our cookies distinguish between the users' computer or mobile phones but do not differentiate the individual users.

You have a right to choose whether the cookies are installed or not. You may choose to refuse all cookies, confirm each time a cookie is saved, or permit all cookies by going to [Browser Setting], or by using the Settings or Options function on mobile devices. However, if you refuse all cookies, you cannot use our services that use cookies.

[Browser Setting]

Internet Explorer: Select "Tool" menu at the top of the browser > "Internet Options" > "Personal Data" Tab > Settings

Chrome: Select "Settings" menu at the top right side of the browser > "Privacy and security" > "Cookies and other site data"

Edge: Select "Settings" menu at the top right side of the browser > "Cookies and site permissions " > "Manage and delete cookies and site data"

Firefox: Select "Options" menu at the top right side of the browser > "Privacy and Security" > "Cookies and Site Data"

Google Analytics

The Websites use Google Analytics, a web analytics service provided by Google, Inc. ("Google").

Google Analytics uses "cookies", which are text files placed on your computer, to help us analyse how users use the Websites. These cookies do not collect any personally identifiable information and are only used for the statistical collection of data such as visits and page hits. Google Analytics' cookies store IP addresses but we cannot link those addresses to any individual or path through the Websites. Google uses the cookies to read information and evaluate visitors' use of the Websites in the form of statistical reports that we can access. The information generated by the cookie about your use of the Websites (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the Websites, compiling reports on website activity and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

For further information regarding the way in which Google Analytics uses cookies please see "How Google uses data when you use our partners' sites or apps", (located at www.google.com/policies/privacy/partners/). You can also stop being tracked by Google Analytics across all websites by going to Google's site at: http://tools.google.com/dlpage/gaoptout.

We have in place appropriate technical and organizational security measures to protect your personal data, including:

• In order to protect the unauthorized disclosure of users' personal data from hacking or any external break-ins, we currently use an equipment that blocks any external break-ins, which protects the data from any hacking, attacks, or unauthorized access, and we also use encryption, etc., so that personal data may be transferred safely.
• In preparation for any unexpected emergencies, we have a policy to back-up the system and data.
• We are taking protective measures to try and minimize damages caused by computer viruses by using vaccines that are regularly updated.
• Only the minimum number of people have right of access to the users' personal data.
• We regularly train our staff who handle personal data on new security technology and personal data protection obligations. Further, through an internal designated personal data protection unit, etc., we try and correct any errors immediately upon detection by checking the company's personal data processing procedure implementation and the relevant personnel's compliance with the personal data protection policies.

In general, your data will be stored in Canada and the Republic of Korea. However, it may be transferred to other jurisdictions. For example, your personal data may be transferred to the country where our service provider's servers are located.

In the event that we transfer your personal data to another country and where the country or territory in question does not maintain adequate data protection standards, we will take all reasonable steps to ensure that any such transfers is undertaken in accordance with applicable data protection and privacy laws and that your data is treated securely and in accordance with this Privacy Policy. However, please note that where personal data is stored in another country, it may be accessible to law enforcement agencies in accordance with domestic laws.

For users located in the EU only, the GDPR requires us to inform you of the different legal bases that we rely on to legitimize our processing of your personal data. We have described these below.

Where you give us your consent to process your personal data

We are allowed to use your personal data where you have specifically consented. In order for your consent to be valid:

• It has to be given freely, without us putting you under any type of pressure;
• You have to know what you are consenting to - so we'll make sure we give you enough information;
• You should only be asked to consent to one thing at a time - we therefore avoid "bundling" consents together so that you don't know exactly what you're agreeing to; and
• You need to take positive and affirmative action in giving us your consent - for example, we could provide a tick box for you to check so that this requirement is met in a clear and unambiguous fashion.

We currently seek your consent for marketing and advertisement purposes.

Before giving your consent you should make sure that you read any accompanying information provided by us so that you understand exactly what you are consenting to.

You have the right to withdraw your consent at any time, and details can be found in the "Right to withdraw consent" paragraph in the section on your rights above.

Where processing your information is within our legitimate interests

We are allowed to use your personal data where it is in our interests to do so, and those interests aren't outweighed by any potential prejudice to you.

We believe that our use of your personal data is within a number of our legitimate interests, including but not limited to:

• To handle customer complaints;
• To verify your identity;
• To ensure that our systems run smoothly;
• To protect against improper use or unauthorized use of the Game and Websites; and
• To market the Game.

We don't think that any of the activities set out above will prejudice you in any way. However, you do have the right to object to us processing your personal data on this basis. We have set out details regarding how you can go about doing this in the section on your rights above.

Where processing your personal data is necessary for us to carry out our obligations under our contract with you

We are allowed to use your personal data when it is necessary to do so for the performance of our contract with you. For example, we need to process certain personal data about you in order to be able to provide you with the Game and related services (including Websites) which you have requested from us and in order to govern the relationship between you and us.

Where processing is necessary for us to carry out our legal obligations

As well as our obligations to you under any contract, we also have other legal obligations that we need to comply with, and we are allowed to use your personal data when we need to comply with those other legal obligations.