Supplemental Brazil Privacy Statement

Last updated: October 13, 2025

We, Dream Games Teknoloji A.Ş. (as of November 1, 2025, we will become Dream Games Dijital Teknolojiler A.Ş.), address this Supplemental Brazil Privacy Statement to individuals located in Brazil only. This document supplements our Dream Games Privacy Policy (“Core Privacy Policy”) and describes how we process your personal data when you use or interact with our website, online advertisements and mobile games (collectively, our “Services”). If there are any inconsistencies between our Core Privacy Policy and this Supplemental Brazil Privacy Statement, this Statement prevails.

If you are located in Brazil, Brazilian General Data Protection Law (Law No. 13,709/18 or “LGPD”) applies to our processing of your personal data.

1. Who is the data controller?

The data controller is:

Dream Games Teknoloji A.Ş. (as of November 1, 2025, we will become Dream Games Dijital Teknolojiler A.Ş.)

Esentepe Mah. Büyükdere Cad. Maya Akar Center (B Blok) No: 102/106 Şişli / İstanbul / Türkiye

2. Who is and how can you contact our Person in Charge?

Dream Games’ Person in Charge for purposes of LGPD is our Data Protection Officer, whom you may contact at privacy@dreamgames.com.

3. What types of personal data do we collect and how do we collect it?

Please see Section 2 of our Core Privacy Policy. We also use cookies and other tracking technologies on our website and in our games as described in our Cookie Policy.

4. For what purposes do we process personal data? What lawful bases of processing do we rely on?

The table further below outlines the purposes for which we process personal data and the lawful bases of processing that correspond with each processing purpose. The lawful bases of processing include the following:

The processing is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract per Article 7(V) of LGPD ("Contract Performance Legal Basis");
The processing is necessary for us to comply with an applicable legal obligation per Article 7(II) of LGPD ("Legal Obligations Legal Basis");
The processing is necessary for us to realize a legitimate interest based on an assessment of that interest and your privacy and other fundamental interests per Article 7(IX) of LGPD ("Legitimate Interest Legal Basis"); more information on the balancing test is available upon request; or
The processing is performed according to your consent per Article 7(I) of LGPD ("Consent Legal Basis"). In these cases, you can withdraw your consent at any time with future effect by using the consent settings on our website or mobile games, or by emailing us at privacy@dreamgames.com with a description of what data processing activities of ours you would like to withdraw your consent from.

Purposes of Use or Disclosure	Legal Basis and Legitimate Interest
To enable us to personalise your in-game profile, provide our games (including the social elements of our games, such as team play and competitions), to ensure that your purchases are activated in the games, to provide you with player support if you need it; To provide access to certain areas, functionalities and features of our Services, including social features and multiplayer competitions; To enable us to optimize our games for you and for the device that you are using, as well as to deliver customized in-game events, offers and promotions; To verify your identity and entitlement to products or Services when you contact us or access our Services; To help maintain the safety, security and integrity of our property and Services, technology assets and business; To personalize our Services, understand our users and their preferences to enhance user experience and enjoyment using our Services and improve our users' experience; To respond to your comments and inquiries and provide customer support services; and To ensure internal quality control.	Contract Performance Legal Basis if there is a contract between you and us, or you and we are preparing to enter into a contract. Otherwise, Legitimate Interest Legal Basis – namely to optimize and personalize our Services, and to customize your experience, to maintain security of the Services and to ensure internal quality control.
To manage our organization and its day-to-day operations; To request your participation in our surveys about our organization, organizations we partner with, and the Services; To develop new games and other Services; To enable players to communicate with each other in games or on our social media accounts; and To measure interest in our Services; and To conduct internal research and analytics.	Legitimate Interest Legal Basis—namely, to operate and optimize our business; improve our Services; administer communities of users; develop new Services; manage our relationships with users; and ensure the security and integrity of our platforms and systems.
To communicate with you regarding Services-related information, including confirmations, technical notices, updates, security alerts and support and administrative messages; and To provide support through our customer service channels when requested.	If we are contractually required to provide such communications or support, Contract Performance Legal Basis. If applicable laws require us to provide such communications or support, Legal Obligations Legal Basis. Otherwise, Legitimate Interest Legal Basis—namely, to manage our relationship with you.
To enable us to comply with laws that apply to us, to prevent fraud, to ensure compliance with our Terms of Service or, where necessary, to defend, exercise or establish our legal rights, including our rights under our Terms of Service; To comply with contractual and legal obligations and requirements; and To activate, verify and give effect to parental control settings.	If we are contractually required to process your personal data for these purposes, Contract Performance Legal Basis. If applicable laws require us to process your personal data for these purposes, Legal Obligations Legal Basis. Otherwise, Legitimate Interest Legal Basis—namely, to enable us to comply with laws, prevent fraud, enforce contracts and defend, exercise or establish our legal rights.
To evaluate and enter into a reorganization, restructuring, merger, acquisition, or whole or partial sale or transfer of our business or assets ("Business Transaction").	Legitimate Interest Legal Basis—namely, to engage in a transaction that our management team considers to be advantageous to our business interests. But we will seek your consent if we wish to use your personal data for any new purpose incompatible with those set forth in our Privacy Statements, and if you provide such consent, the Consent Legal Basis applies.
To use essential cookies and tracking technologies.	Contract Performance Legal Basis if there is a contract between you and us, or you and we are preparing to enter into a contract. Otherwise, Legitimate Interest Legal Basis—namely, to provide you with a Service you have requested.
To use or disclose personal data for targeted advertising purposes; and To use tracking technologies other than essential technologies. For more information about our use of cookies, please see our Cookie Policy.	We obtain consent before using tracking technologies other than essential technologies on your device and rely on the Consent Legal Basis to collect and process your personal data through cookies to serve targeted advertising at you and measure the performance of our targeted ads. If you provide your consent, we disclose the following categories of personal data to our advertising technology providers (some of whose names and privacy statements are listed here: Identifier For Advertisers (IDFA) or Google Advertising ID IP address What Services of ours they have used Date and time of when they used our Services Inferred interests We rely on Contract Performance Legal Basis (if we concluded a contract with you) and on Legitimate Interest Legal Basis for the further processing of personal data collected through the use of essential cookies, such as the provision of a functioning website or game.

5. What legitimate interests are pursued where the processing is based on the Legitimate Interest Legal Basis?

Please see the table further above.

6. What categories of recipients receive personal data from us?

We may disclose personal data to the following types of third parties and in the below-mentioned circumstances.

Other Users in Your Online Community: If you participate in any of our online communities or send a virtual gift of virtual items to other users on our Services, we may disclose your public profile information to other online community members, including your screen name, profile picture or avatar, your in-game scores and achievements, the gifted items, and any other information you choose to provide or make public.
Contests, Sweepstakes, and Survey Providers: We may disclose personal data to third parties who assist us in delivering our contests, sweepstakes, or survey offerings and processing the responses.
Service Providers. We may disclose your personal data to our service providers. The types of service providers (data processors) to whom we entrust personal data include companies that (i) provide us with IT and related services; (ii) assist us with customer service activities; (iii) provide analytics and search engine services that assist us in the improvement and optimization of our Services; and (iv) provide any supporting activities in connection with our Services. We have executed appropriate contracts with the service providers that prohibit them from using or sharing personal data except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.
Disclosures to Protect Our Rights, Your Rights or the Rights of Others (e.g., as Required by Law and Similar Disclosures): We may access, preserve, and disclose your personal data to third parties, such as legal advisors and law enforcement authorities, if we believe doing so is required or appropriate: (i) to comply with law enforcement or national security requests and legal processes, such as a court order or subpoena; (ii) to respond to your requests; (iii) to protect your, our or others' rights, property or safety; (iv) to enforce our policies or contracts; (v) to collect amounts owed to us; (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; (vii) in connection with the establishment, exercise, or defense of legal claims; or (viii) if we, in good faith, believe that disclosure is otherwise necessary or advisable.
Ad Networks and Advertising Partners: We work with the third-party ad networks and advertising technology providers listed here (“Adtech Providers”) to deliver advertising and personalized content on websites and services that we do not operate, and across other devices. If you provide your consent, these parties may collect information directly from you for these purposes, as described in our Cookie Policy.
With Your Consent: We may disclose personal data about an individual to certain other third parties or publicly with their consent or direction. For example, with an individual's consent or direction, we may post their testimonial on our websites or other Services.
Sale of Assets and Change of Control: We may disclose personal data to potential acquirers of our business assets and their representatives for the purposes of evaluating and entering into Business Transactions.

7. Where is your personal data processed and on what basis do we transfer personal data across borders?

We may disclose personal data to our processors and AdTech Providers in locations including Turkïye, the United States, Israel, the European Union and the United Kingdom, for the purposes indicated in this Privacy Statement. We take measures to ensure that our processors and AdTech Providers in Türkiye, the United States, Israel, the European Union and the United Kingdom provide an adequate level of data protection by entering into appropriate data transfer agreements based on Standard Contractual Clauses or other mechanisms approved by the Brazilian Data Protection Authority (ANPD) and performing data transfer arrangements as appropriate. Data transfer agreements are accessible upon request by contacting us at the details shown further above.

8. How long do we process personal data?

The length of time for which we retain personal data depends on the purposes for which we collect and use it and how long we need to retain it to comply with applicable laws (including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements), to establish, exercise or defend our legal rights, or to make the data available to judges and courts or the competent public authorities. Once personal data is no longer necessary for the purposes for which it was collected, to meet legal requirements, in connection with legal rights, or for courts or authorities, we delete it.

9. What data protection rights do you have?

In Brazil, you have the following rights, subject to the conditions under LGPD:

the right to (i) confirm the existence of the processing activity and access your personal data we process;
the right to correct incomplete, inaccurate or outdated personal data relating to you;
the right to anonymization, blockage or elimination of unnecessary, excessive data or data processed in noncompliance with the LGPD;
the right to portability of your personal data to another service or product provider;
the right to have your personal data deleted when processed under your consent when you revoke your consent;
the right to receive information on public and private entities with which we shared your personal data;
the right to receive information on the possibility of not giving us your consent to process your personal data and the consequences of refusing to do so;
the right to revoke your consent;
the right to object to the processing of your personal data carried out on the basis of one of the hypotheses of waiver of consent and such processing infringes applicable privacy laws; and
the right to request a review of any decision that has a substantial or material impact on that individual that we make and which is based solely on "automated processing" (i.e. without any human involvement) (please note that there are some limits and exceptions to this right).
You also have the right to lodge a complaint with the Brazilian Data Protection Authority (“ANPD”). Contact details ANPD: https://www.gov.br/anpd/pt-br.

To submit a request to exercise your privacy rights, you can contact us by any method described in the Contact Us section below. In your request, please describe what rights you are exercising and how you would like us to assist. We may need to request specific information from you to help us verify your identity and that you have the right to request what your are requesting. These are security measures to ensure that we do not disclose personal data to any person who has no right to receive it, or otherwise process the data in unauthorized ways. We may also contact you to ask for further information about your request to clarify the scope of your request and speed up our response. We will respond to requests to exercise privacy rights according to applicable laws.

10. Are you required to provide us with your personal data?

You are not legally required to provide personal data to us but we cannot provide our Services without receiving some personal data from you.

11. How can you contact us?

If you have any questions about our privacy practices, personal data processing activities, or would like to exercise your rights under privacy laws, you may contact our Person in Charge/ Data Protection Officer at privacy@dreamgames.com.

12. Will we change this Supplemental Brazil Privacy Statement?

From time to time, we may revise this Supplemental Brazil Privacy Statement. When we do so, the changes will be posted and the revised document will be available online and the “last updated” date above revised.