PRIVACY POLICY

Last Updated: September 22, 2026

1. INTRODUCTION

1.1 This Privacy Policy (“Policy”) explains how CrispTeenie, represented by Mahtab Ahmed, established in Pakistan (“we”, “us”, or “our”), collects, uses, discloses, and otherwise processes personal data of users in connection with the mobile game Will of Shadows (the “Game”) and related services (collectively, the “Services”).

1.2 We are committed to protecting your privacy in accordance with applicable data protection laws, including:

• the EU General Data Protection Regulation (GDPR), where applicable to users in the European Economic Area (EEA);

• applicable laws of Pakistan relating to privacy and electronic data, including the right to privacy under Article 14 of the Constitution of the Islamic Republic of Pakistan and the Electronic Transactions Ordinance, 2002, as amended;

• other applicable privacy laws and regulations.

1.3 “User”, “you”, or “your” means an individual who accesses or uses the Services.

1.4 This Policy explains:

• what personal data we collect and when;

• the purposes and legal bases for processing;

• use of cookies and third-party SDKs;

• how we share, transfer, and disclose your data;

• your rights and how to exercise them;

• data retention periods;

• children’s data;

• international data transfers;

• changes to this Policy, dispute resolution, and contact information.

2. DATA CONTROLLER

2.1 The data controller responsible for your personal data is:

CrispTeenie

Representative: Mahtab Ahmed

Country: Pakistan

Email: konradbirnbaumgreen@gmail.com

2.2 For any questions about this Policy or your personal data, please contact us at the email above.

3. WHEN WE COLLECT PERSONAL DATA

3.1 We may collect personal data when:

(a) you download, install, or use the Game;

(b) you create an account or log in, including as a guest;

(c) you make in-game purchases or transactions;

(d) you contact customer support;

(e) you participate in surveys, events, or promotions;

(f) you interact with advertisements or third-party services integrated into the Game;

(g) you use cookies or similar technologies within the Services.

4. WHAT PERSONAL DATA WE COLLECT

4.1 We may collect the following categories of personal data:

(a) Account and profile data: username, nickname, email address, password (stored in hashed form), profile picture, and similar information you provide.

(b) Device and technical data: IP address, device identifier, advertising identifier, operating system, device model, app version, language, network type, and crash logs.

(c) Gameplay data: game progress, levels, scores, achievements, in-game actions, and preferences.

(d) Transaction data: purchase history, order IDs, and payment confirmation details. We do not store full payment card details; payments are processed by the relevant app store or payment provider.

(e) Support and communication data: messages, emails, and other correspondence with us.

(f) Usage and analytics data: how you use the Services, session duration, feature usage, and similar information.

(g) Marketing and communication preferences: your choices regarding receiving promotional communications.

4.2 We may also receive data from third parties, such as:

(a) platform providers (e.g., Google Play, Apple App Store);

(b) analytics and advertising partners;

(c) payment processors;

(d) social media platforms, if you choose to link your account.

5. LEGAL BASES FOR PROCESSING

5.1 Where the GDPR applies, we process your personal data on one or more of the following legal bases:

(a) Performance of a contract: to provide the Game and Services you request (Art. 6(1)(b) GDPR).

(b) Consent: where you have given us explicit consent, for example for certain marketing or advertising activities (Art. 6(1)(a) GDPR). You may withdraw consent at any time.

(c) Legitimate interests: to improve the Services, ensure security, prevent fraud, and conduct analytics, provided your rights and freedoms are not overridden (Art. 6(1)(f) GDPR).

(d) Legal obligation: to comply with applicable laws and regulations (Art. 6(1)(c) GDPR).

(e) Vital interests: to protect your vital interests or those of another person where necessary (Art. 6(1)(d) GDPR).

5.2 Where the GDPR does not apply, we process personal data based on your consent, the necessity to provide the Services, and our legitimate interests in operating and improving the Game, in accordance with applicable law.

6. COOKIES AND SIMILAR TECHNOLOGIES

6.1 We use cookies, web beacons, SDKs, and similar technologies to operate and improve the Services, analyze usage, and provide personalized advertising where permitted.

6.2 You can manage cookie preferences through your device or platform settings. Disabling certain cookies may affect the functionality of the Game.

6.3 Our Services may integrate third-party SDKs for analytics, advertising, crash reporting, and consent management. These providers may collect and process data in accordance with their own privacy policies. We encourage you to review their policies.

7. HOW WE USE YOUR PERSONAL DATA

7.1 We use your personal data for the following purposes:

(a) to create, manage, and secure your account;

(b) to provide, operate, maintain, and improve the Game and Services;

(c) to process purchases and maintain transaction records;

(d) to communicate with you about your account, updates, and support requests;

(e) to personalize your experience and provide relevant content;

(f) to conduct analytics, research, and development;

(g) to detect, prevent, and address fraud, cheating, abuse, and security incidents;

(h) to comply with legal obligations and enforce our terms;

(i) to send marketing communications where you have consented or where permitted by law. You can opt out at any time.

8. HOW WE SHARE, TRANSFER, AND DISCLOSE PERSONAL DATA

8.1 We do not sell your personal data. We may share your data with:

(a) Service providers: hosting, analytics, customer support, payment processing, advertising, and technical service providers.

(b) Platform providers: Google Play, Apple App Store, and other distribution platforms.

(c) Legal and regulatory authorities: when required by law, court order, or valid governmental request.

(d) Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets.

(e) Affiliates: where necessary for the operation of the Services, subject to this Policy.

8.2 All third parties processing data on our behalf are required to protect your data and use it only for the purposes for which it was disclosed.

9. INTERNATIONAL DATA TRANSFERS

9.1 Your personal data may be processed on servers located in Pakistan or in other jurisdictions where we or our service providers operate.

9.2 Where personal data is transferred outside the EEA, we implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms under Chapter V of the GDPR.

9.3 Where personal data is transferred from Pakistan to another jurisdiction, we take reasonable steps to ensure that the recipient protects your personal data in a manner consistent with applicable law.

9.4 You may request a copy of the applicable safeguards by contacting us at konradbirnbaumgreen@gmail.com.

10. DATA RETENTION

10.1 We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law.

10.2 Typical retention periods:

(a) Account data: while your account is active; after deletion, data is deleted or anonymized within 30 days, unless a longer period is required by law.

(b) Transaction records: up to 5 years, or as required by tax and accounting laws.

(c) Support records: up to 3 years from the closure of the request.

(d) Marketing consent records: until consent is withdrawn, plus 3 years.

(e) Technical logs and analytics data: up to 24 months in aggregated or anonymized form, unless a longer period is required by law.

11. DATA SECURITY

11.1 We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures may include encryption, access controls, secure storage, regular software updates, and security audits.

11.2 While we strive to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

12. YOUR RIGHTS

12.1 Under the GDPR (where applicable) and applicable Pakistani law, you may have the following rights:

(a) Right of access: to obtain confirmation of whether we process your personal data and receive a copy.

(b) Right to rectification: to correct inaccurate or incomplete data.

(c) Right to erasure: to request deletion of your personal data under certain circumstances.

(d) Right to restriction of processing: to limit how we use your data.

(e) Right to data portability: to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.

(f) Right to object: to object to processing based on legitimate interests or for direct marketing.

(g) Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

(h) Right to lodge a complaint: with a supervisory authority.

12.2 To exercise your rights, contact us at konradbirnbaumgreen@gmail.com. We will respond within the timeframes required by applicable law. Where the GDPR applies, we will respond within one month, extendable by two further months where necessary.

13. CHILDREN

13.1 The Services are not intended for children under the age of 13. We do not knowingly collect personal data from children under 13.

13.2 If you are under 16 in the European Economic Area (EEA), you may use the Services only with verifiable parental or legal guardian consent, where required by applicable law.

13.3 If we become aware that we have collected personal data from a child under the applicable age without proper consent, we will delete such data as soon as possible. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at konradbirnbaumgreen@gmail.com.

14. CHANGES TO THIS POLICY

14.1 We may update this Policy from time to time. Changes become effective when the revised version is posted or otherwise made available.

14.2 For material changes, we will provide notice as required by applicable law. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

15. GOVERNING LAW AND DISPUTE RESOLUTION

15.1 This Policy shall be governed by and construed in accordance with the laws of Pakistan, without prejudice to mandatory consumer protection or data protection rights you may have under your local law.

15.2 Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of Pakistan, unless mandatory applicable law provides otherwise.

15.3 Nothing in this Policy limits your right to lodge a complaint with a supervisory authority or to bring proceedings before the competent courts of your place of residence where provided by mandatory applicable law, including users in the European Union.

16. CONTACT INFORMATION

For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please contact:

CrispTeenie

Representative: Mahtab Ahmed

Country: Pakistan

Email: konradbirnbaumgreen@gmail.com

Effective Date: September 22, 2026

Last Updated: September 22, 2026