Global Privacy Statement

All features on the Joyz Website can be accessed without requiring Website Visitors to register. We do not collect or process any personal contact information such as your name, email address, or phone number unless you actively reach out to us.

However, Joyz does collect certain electronic data, which we may process in several ways. Below, you will find general information about how we handle your data. For more specific details about how your data is processed in different contexts, please see the topics listed further below.

Generally, we may use your data for the following purposes:

• For maintenance, administration and network and security purposes;
• For internal control and business operations;
• For analyzing and improving our products;
• For handling any requests, complaints and disputes;
• For determining, exercising and defending our rights; and
• For complying with legal obligations (incl. fraud prevention) and requests of authorized governmental institutions.

Generally, we may handle your data due to legal requirements. This means we will process your data to the extent necessary to fulfill legal obligations, such as adhering to mandatory retention periods.

At times, we may process your data based on the legal principle of "legitimate interest." This means that we carefully weigh the benefits of processing your data against your privacy rights, ensuring that the benefits outweigh any potential impact on your privacy. The specific legitimate interests are detailed under each topic below. If you require further information, please feel free to contact us using the details provided below.

The Joyz Website is not intended for individuals under 16 years of age. Additionally, we do not target individuals who are under a legal relationship, such as those under guardianship or those managed or supervised by another person. In rare circumstances where our services may apply to such individuals, Joyz will consider their vulnerable status and implement additional safeguards.

We collect your data through the following methods:

• Provided by you. We may receive certain data directly from you, such as details included in your messages to us or information you provide in our application form.
• Obtained internally. It is possible that we obtain your data via other Joyz systems.
• Obtained from third parties. WWe may also obtain data about you from other individuals or external parties in specific scenarios, such as:
• Website Visitors: we may receive information about you from privately held third parties, such as for the advertisements that are shown on the Joyz Website. Further information on this is included in our Cookie Statement.
• Applicants: we may obtain information from a referral included by you in your application.
• Automatically obtained. We also automatically collect certain data, such as when you visit the Joyz Website, through cookies and similar technologies. This data includes information on how you interact with the Joyz Website, like the number of visits, page views, time spent on pages, browser type, and referrer information that shows the websites you visited before and after visiting the Joyz Website. Further information on this is included in our Cookie Statement.
• Derived. Some data is indirectly inferred from the information we already have, such as your language preferences.

Generally, you are not required to provide any personal information to us. However, not providing certain data may affect the functionality of the Joyz Website. If specific personal information is legally required, necessary for a contract, or essential for an agreement with us, we will provide further details and inform you of any potential consequences of not supplying this information.

We only share your data with third parties if:

• This is essential for delivering our service or involving the third party. For example, subcontractors generally only access the data needed for their specific part of the service.
• Individuals within the third party who access your data are required to maintain its confidentiality, and this obligation is often reinforced through contractual agreements.
• The third party is obliged to comply with the applicable regulations for the protection of personal data, for instance because we have concluded an agreement with this party or because our Terms of Use apply. This includes that the party is obliged to ensure appropriate technical and organizational security measures.

We may share your data on a need-to-know basis with the parties listed below. 'Need-to-know' means a party will only access your data as necessary for their professional services.

• Authorized individuals employed by Joyz who are involved in the relevant processing activities, such as members of the support team you may interact with.
• Authorized individuals employed by service providers or sub-contractors engaged by Joyz, who are involved in the relevant processing activities.
• Authorized individuals employed by private sector partners with whom we may share certain data, such as game developers and advertising partners. Traffic information may be shared with these parties in an aggregate and anonymous form. Additionally, advertisers on the Joyz Website may receive data collected by cookies for targeted advertising. For more details on cookie usage, please refer to our Cookie Statement.
• Authorized government institutions, such as courts, police, and law enforcement agencies. We may disclose information about our Website Visitors when legally required, in response to requests from governmental institutions conducting investigations, or to ensure compliance with policies and laws. We may also release information to protect the rights, property, or safety of Joyz, our business partners, customers, or others.
• Aggregate Information. We may disclose non-identifying, aggregated user statistics to third parties for purposes such as showcasing our services to potential partners. Examples include the number of users who visited the Joyz Website during a specific period or played a particular game.

Protecting your privacy and data is a top priority for us. Joyz has implemented robust technical and organizational measures to safeguard personal data and ensure its confidentiality, integrity, and availability. All Joyz employees and engaged personnel are required to uphold the confidentiality of personal data.

oyz maintains internal documentation outlining our technical and organizational security measures. We also have a data breach procedure detailing how to handle (potential) breaches. In compliance with applicable laws, we will notify the relevant supervisory authority and affected individuals if a data breach occurs.

Parties involved with the processing of your data may be located in a different country than you are. No matter where you are located, we are securing your personal data as much as reasonably possible.

If your data is transferred from the EU to a party located outside the EU, we call this an 'EU transfer' (see this link for an overview of the EU countries). If your data is transferred from the UK to a party located outside the UK, we call this a 'UK transfer'. EU transfers and UK transfers are legitimized in the manner described below. You may contact us for information on the legitimization of other data transfers.

EU transfers. An EU transfer EUcan in the first place be legitimized based on an adequacy decision of the European Commission, in which it is decided that the (part within the) third country in question ensures an adequate level of data protection. See this link for a summary of the applicable adequacy decisions.

UK transfers. A UK transfer can in the first place be legitimized based on an adequacy regulation of the UK government. See this link for an overview of the applicable adequacy regulations.

If an EU transfer and/or UK transfer takes place for which there is no adequacy decision or adequacy regulation in place, we agree on the applicability of the relevant version of the Standard Contractual Clauses with the relevant party. This is a standard contract to safeguard the protection of your data, which is approved by the European Commission in which the parties fill out the appendices. See this link for the various versions of the Standard Contractual Clauses for the EU. Where appropriate, additional safeguards should be taken. Where the UK GDPR is applicable, a UK Addendum will be added to the Standard Contractual Clauses mentioned above, as required by UK law and regulations (see this link).

In specific situations we can also rely on the derogations as specified in applicable law to legitimize the EU transfer and/or UK data transfer. This could mean that we may transfer your data: (i) with your explicit consent, (ii) if this is necessary for the performance of a contract that has been concluded with you or has been concluded in your interest, or (iii) if this is necessary for the establishment, exercise or defense of legal claims. Lastly, in exceptional cases we may also transfer your data if the data transfer is necessary for our compelling legitimate interests and is not overridden by your interests or rights and freedoms.

You can contact us if you want additional information via our contact details as stated at the bottom of this Privacy Statement.

Google Analytics Blockage Blockage Please note that we do not use Google Analytics on any of our websites. However, it is possible that one of the game developers we work with tries to use Google Analytics for tracking in-game activities. We actively try to find these implementations and overwrite them for users from the EU. To opt out of being tracked by Google Analytics across all websites, please visit: http://tools.google.com/dlpage/gaoptout.

In general, we do not keep your data for longer than what is necessary in relation to the purposes for which we process the data. There could however be exceptions applicable to the general retention terms.

Exception: shorter retention period. If you exercise certain privacy rights, it is possible that Joyz will remove your data earlier than the general applicable retention period or – oppositely – retain it for a longer period of time. For more information about this, please refer to the header "What are your privacy rights (incl. right to object)?"

Exception: longer retention period. In certain situations, we process your data for a longer period of time than what is necessary for the purpose of the processing. This is for instance the case when we have to process your data for a longer period of time:

• Retention obligation. To comply with a minimum retention period or other legal obligation to which we are subject based on the applicable law;
• Procedure. Your personal data is necessary in relation to a legal procedure;
• Freedom of expression. When further processing of your personal data is necessary in order to exercise the right to freedom of expression and information.

You have various privacy rights. Which privacy rights you have, depends on the applicable law. To what extent you can exercise these rights may depend on the circumstances of the processing, such as the manner in which Joyz processes the personal data and the legal ground for the processing. Below, we included a summary of the privacy rights you may have. The applicable law may allow or require us to refuse your request, because these rights are not absolute or may not be applicable in your region.

For more information about your privacy rights in other jurisdictions, such as the Member States of the EU or the UK, go to this webpage or this webpage of the European Commission or this webpage of the UK Information Commissioner’s Office. In case you are visiting the Joyz Website from another jurisdiction, please refer to 12. Local Law Addenda to see which privacy rights you might have.

Joyz is in principle responsible for the processing of your data in the context of the Joyz Website, but other parties may also be involved and responsible themselves, as specified below.

9.1 Developers.
The developers of the games on the Joyz Website are in principle required to remove all outgoing links and branding/advertisements (e.g. splash-screens, social links and app-store links) from their game(s). If developers do gather personal data for their own purposes, Joyz is not responsible for this processing: only the developer decides what (personal) data is processed and for what purpose. However, because Joyz feels it is important that your data is also safe when you play a game, we took two measures. In the first place, we included contractual safeguards with the developers. They are only allowed to include cookies and similar technologies in their game if no consent for this is required under the applicable law. Concerning analytic cookies, such cookies are only allowed if the use is in line with applicable law and insofar privacy-impact is non-existent or minimal. In the second place, we have prepared this list of the cookies used by our game developers, categorized per game, to inform you on behalf of the developers.* For further information on developers cookies, please refer to our Cookie Statement. Furthermore, if you notice any possible undue processing by a developer of your data, please inform us so that we can investigate.

9.2 Advertisement partners.
Joyz uses the services of several advertising parties. These parties provide us with advertisements for the Joyz Website and are responsible for their part of the processing of your data in this context. To nevertheless safeguard your privacy in this respect as much as possible, Joyz has, amongst other things, ensured that suitable contractual measures are in place. Further information regarding the use of cookies, also in the context of advertising partners, can be found in our Cookie Statement.

9.3 Externally hosted games, third party games and other websites.
This Privacy Statement does not apply to usage of your data by other parties that are themselves responsible for such usage of your data, such as providers of third-party games available on the Joyz Website. The relevant provider of such third-party game is responsible for ensuring that any processing of your data by them in the context of a game complies with the applicable law. In principle, Joyz does not permit third party content providers to collect personal data about Website Visitors. However, if any personal data will be collected by a third-party content provider, Joyz will require that the processing of such data by them complies with the applicable law.

* Please note that this list may not be complete, since randomized cookies that are placed with less than 100 Website Visitors are not included in the list. Furthermore, the cookies used by developers may change over time. Therefore, we automatically update this list daily.