Supplemental EEA+ Privacy Statement

English

Last updated: October 13, 2025

We, Dream Games Teknoloji A.Ş. (as of November 1, 2025, we will become Dream Games Dijital Teknolojiler A.Ş.), address this Supplemental EEA+ Privacy Statement to individuals located in the European Economic Area (EEA), United Kingdom (UK) and Switzerland only (collectively, “EEA+”). This document supplements our Dream Games Privacy Policy (“Core Privacy Policy”) and describes how we process your personal data when you use or interact with our website, online advertisements and mobile games (collectively, our “Services”). If there are any inconsistencies between our Core Privacy Policy and this Supplemental EEA+ Privacy Statement, this Statement prevails.

If you are located in the EEA, the EU General Data Protection Regulation applies to our processing of your personal data, as well as local data protection laws, as the case may be. If you are located in the UK, the UK General Data Protection Regulation applies to our processing of your personal data. References to the "GDPR" are references to the General Data Protection Regulation as it applies in the country where you are located. If you are located in Switzerland, the Swiss Federal Data Protection Act (the "FDPA") applies to our processing of your personal data, and references to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA.

1. Who is the data controller and who are its EEA and UK representatives?

The data controller is:

Dream Games Teknoloji A.Ş. (as of November 1, 2025, we will become Dream Games Dijital Teknolojiler A.Ş.)

Esentepe Mah. Büyükdere Cad. Maya Akar Center (B Blok) No: 102/106 Şişli / İstanbul / Türkiye

Our representative in the EEA for data protection matters is:

Andrékó Ferenczi Kinstellar Ügyvédi Iroda

Address: 1054 Budapest, Széchenyi rkp. 3.

E-mail Address: art27.representation.hungary@kinstellar.com

Our representative in the UK for data protection matters is:

Dream Games Publishing Limited

Address: 13th Floor One Angel Court, London, England, EC2R 7HJ

E-mail Address:

2. How can you contact our data protection officer?

You may contact our Data Protection Officer at privacy@dreamgames.com.

3. What types of personal data do we collect and how do we collect it?

Please see Section 2 of our Core Privacy Policy. We also use cookies and other tracking technologies on our website and in our games as described in our Cookie Policy.

4. For what purposes do we process personal data? What lawful bases of processing do we rely on?

The table further below outlines the purposes for which we process personal data and the lawful bases of processing that correspond with each processing purpose. The lawful bases of processing include the following:

  • The processing is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract per Article 6(1)(b) GDPR ("Contract Performance Legal Basis");
  • The processing is necessary for us to comply with an applicable legal obligation per Article 6(1)(c) GDPR ("Legal Obligations Legal Basis");
  • The processing is necessary for us to realize a legitimate interest based on an assessment of that interest and your privacy and other fundamental interests per Article 6(1)(f) GDPR ("Legitimate Interest Legal Basis"); more information on the balancing test is available upon request; or
  • The processing is performed according to your consent per Article 6(1)(a) GDPR ("Consent Legal Basis"). In these cases, you can withdraw your consent at any time with future effect by using the consent settings on our website or mobile games, or by emailing us at privacy@dreamgames.com with a description of what data processing activities of ours you would like to withdraw your consent from.
Purposes of Use or Disclosure Legal Basis and Legitimate Interest
  • To enable us to personalise your in-game profile, provide our games (including the social elements of our games, such as team play and competitions), to ensure that your purchases are activated in the games, to provide you with player support if you need it;
  • To provide access to certain areas, functionalities and features of our Services, including social features and multiplayer competitions;
  • To enable us to optimize our games for you and for the device that you are using, as well as to deliver customized in-game events, offers and promotions;
  • To verify your identity and entitlement to products or Services when you contact us or access our Services;
  • To help maintain the safety, security and integrity of our property and Services, technology assets and business;
  • To personalize our Services, understand our users and their preferences to enhance user experience and enjoyment using our Services and improve our users' experience;
  • To respond to your comments and inquiries and provide customer support services; and
  • To ensure internal quality control.
  • Contract Performance Legal Basis if there is a contract between you and us, or you and we are preparing to enter into a contract.
  • Otherwise, Legitimate Interest Legal Basis – namely to optimize and personalize our Services, and to customize your experience, to maintain security of the Services and to ensure internal quality control.
  • To manage our organization and its day-to-day operations;
  • To request your participation in our surveys about our organization, organizations we partner with, and the Services;
  • To develop new games and other Services;
  • To enable players to communicate with each other in games or on our social media accounts;
  • To measure interest in our Services; and
  • To conduct internal research and analytics.
  • Legitimate Interest Legal Basis—namely, to operate and optimize our business; improve our Services; administer communities of users; develop new Services; manage our relationships with users; and ensure the security and integrity of our platforms and systems.
  • To communicate with you regarding Services-related information, including confirmations, technical notices, updates, security alerts and support and administrative messages; and
  • To provide support through our customer service channels when requested.
  • If we are contractually required to provide such communications or support, Contract Performance Legal Basis.
  • If applicable laws require us to provide such communications or support, Legal Obligations Legal Basis.
  • Otherwise, Legitimate Interest Legal Basis—namely, to manage our relationship with you.
  • To enable us to comply with laws that apply to us, to prevent fraud, to ensure compliance with our Terms of Service or, where necessary, to defend, exercise or establish our legal rights, including our rights under our Terms of Service;
  • To comply with contractual and legal obligations and requirements; and
  • To activate, verify and give effect to parental control settings.
  • If we are contractually required to process your personal data for these purposes, Contract Performance Legal Basis.
  • If applicable laws require us to process your personal data for these purposes, Legal Obligations Legal Basis.
  • Otherwise, Legitimate Interest Legal Basis—namely, to enable us to comply with laws, prevent fraud, enforce contracts and defend, exercise or establish our legal rights.
  • To evaluate and enter into a reorganization, restructuring, merger, acquisition, or whole or partial sale or transfer of our business or assets ("Business Transaction").
  • Legitimate Interest Legal Basis—namely, to engage in a transaction that our management team considers to be advantageous to our business interests. But we will seek your consent if we wish to use your personal data for any new purpose incompatible with those set forth in our Privacy Statements, and if you provide such consent, the Consent Legal Basis applies.
  • To use essential cookies and tracking technologies.

EEA:

  • The legal basis for the storage of and access to information on your end user device for us to be able to provide the digital service expressly requested by you is Article 5(3) of the ePrivacy Directive, as transposed into local law (e.g., in Germany, Sec. 25 (2) No. 2 German Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz)).
  • The further processing of personal data collected through the use of essential cookies is contract performance (Art. 6 (1) lit. b GDPR) (if we concluded a contract with you) or legitimate interests of us or third parties (Art. 6 (1) lit. f GDPR), such as the provision of a functioning website. More information on the balancing test is available upon request.

UK:

  • It is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract per Article 6(1)(b) of the UK General Data Protection Regulation; or
  • It is necessary for us to realize a legitimate interest based on an assessment of that interest and your privacy and other fundamental interests per Article 6(1)(f) UK GDPR.
  • To use or disclose personal data for targeted advertising purposes; and
  • To use cookies and tracking technologies other than essential technologies.
  • Where required, we obtain consent before using tracking technologies other than essential technologies necessary for the provision of the Services and rely on the Consent Legal Basis to collect and process your personal data through cookies to serve targeted advertising at you and measure the performance of our targeted ads. If you provide your consent, we disclose the following categories of personal data to our advertising technology providers (some of whose names and privacy statements are listed here:
    • Identifier For Advertisers (IDFA) or Google Advertising ID
    • IP address
    • What Services of ours you have used
    • Date and time of when you used our Services
    • Inferred interests
  • We rely on Contract Performance Legal Basis (if we concluded a contract with you) and on Legitimate Interest Legal Basis for the further processing of personal data collected through the use of essential cookies, such as the provision of a functioning website or game.

Please see the table further above.

6. What categories of recipients receive personal data from us?

We may disclose personal data to the following types of third parties and in the below-mentioned circumstances.

  • Other Users in Your Online Community: If you participate in any of our online communities or send a virtual gift of virtual items to other users on our Services, we may disclose your public profile information to other online community members, including your screen name, profile picture or avatar, your in-game scores and achievements, the gifted items, and any other information you choose to provide or make public.
  • Contests, Sweepstakes, and Survey Providers: We may disclose personal data to third parties who assist us in delivering our contests, sweepstakes, or survey offerings and processing the responses.
  • Service Providers. We may disclose your personal data to our service providers. The types of service providers (data processors) to whom we entrust personal data include companies that (i) provide us with IT and related services; (ii) assist us with customer service activities; (iii) provide analytics and search engine services that assist us in the improvement and optimization of our Services; (iv) provide any supporting activities in connection with our Services; and (v) assist us in delivering our contests, sweepstakes or survey offerings and processing the responses. We have executed appropriate contracts with the service providers that prohibit them from using or sharing personal data except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.
  • Disclosures to Protect Our Rights, Your Rights or the Rights of Others (e.g., as Required by Law and Similar Disclosures): We may access, preserve, and disclose your personal data to third parties, such as legal advisors and law enforcement authorities, if we believe doing so is required or appropriate: (i) to comply with law enforcement or national security requests and legal processes, such as a court order or subpoena; (ii) to respond to your requests; (iii) to protect your, our or others' rights, property or safety; (iv) to enforce our policies or contracts; (v) to collect amounts owed to us; (vi) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; (vii) in connection with the establishment, exercise, or defense of legal claims; or (viii) if we, in good faith, believe that disclosure is otherwise necessary or advisable.
  • Ad Networks and Advertising Partners: We work with the third-party ad networks and advertising technology providers listed here (“Adtech Providers”) to deliver advertising and personalized content on websites and services that we do not operate, and across other devices. If you provide your consent, these parties may collect information directly from you for these purposes, as described in our Cookie Policy.
  • With Your Consent: We may disclose personal data about an individual to certain other third parties or publicly with their consent or direction. For example, with an individual's consent or direction, we may post their testimonial on our websites or other Services.
  • Sale of Assets and Change of Control: We may disclose personal data to potential acquirers of our business assets and their representatives for the purposes of evaluating and entering into Business Transactions.

7. Where is your personal data processed and on what basis do we transfer personal data across borders?

We may disclose personal data to our processors and AdTech Providers in locations including Turkïye, the United States, Israel, the European Union and the United Kingdom. We take measures to ensure that our processors and AdTech Providers in Türkiye and the United States provide an adequate level of data protection by entering into appropriate data transfer agreements based on Standard Contractual Clauses including local law amendments (where necessary) and performing data transfer arrangements as appropriate. Data transfer agreements are accessible upon request by contacting us at the details shown further above. The UK Government and the Swiss Federal Council recognize the EEA as providing an adequate level of protection for personal data, and the EU Commission recognizes the UK GDPR and the FDPA as providing an adequate level of protection for personal data. The UK Government, the Swiss Federal Council and EU Commission recognize Israel as providing an adequate level of protection for personal data. Other players and recipients of your data may be located worldwide. We take steps to ensure that these transfers are in line with applicable data protection laws. You may contact us at the details shown further above for more details about our data transfers and data protection arrangements.

8. How long do we process personal data?

The length of time for which we retain personal data depends on the purposes for which we collect and use it and how long we need to retain it to comply with applicable laws (including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements), to establish, exercise or defend our legal rights, or to make the data available to judges and courts or the competent public authorities. If we retain the personal data solely to satisfy legal requirements, we will keep your personal data blocked. This means that we will implement measures to prevent the data's processing, except for making it available to public administrations, judges, and courts if necessary to satisfy legal requirements or address potential liabilities arising from its processing. Once personal data is no longer necessary for the purposes for which it was collected, to meet legal requirements, in connection with legal rights, or for courts or authorities, we delete it.

9. What data protection rights do you have?

In the EEA, Switzerland and the UK you have the following rights, subject to the conditions under the GDPR and/or local data protection law:

  • To object, on grounds relating to your particular situation, to the processing of your personal data by us. This includes the right to object to our processing of your personal data for direct marketing (also known as mass marketing under Swiss law) and the right to object to our processing of our personal data where we are performing a task in the public interest or pursuing our legitimate interests or those of a third party. If we process your personal data based on our legitimate interests or those of a third party, or in the public interest, you can object to this processing, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons. Where we use your personal data for direct marketing for our own products and services, you can always object and opt out of future marketing messages using the unsubscribe link in such communications.
  • To obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to details about how we process your personal data and copies of the personal data.
  • To obtain from us the rectification of inaccurate personal data concerning you.
  • To ask us to erase your personal data to the extent it is not required for legally required purposes or necessary for security and integrity purposes.
  • To request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.
  • To receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
  • To withdraw your consent at any time. This will not affect the lawfulness of our use of your personal data before your withdrawal.
  • To lodge a complaint with a supervisory authority.
  • In some jurisdictions such as France and Portugal, you also have the right to provide us with guidelines as to the processing of your personal data after your death.

You may view a list of supervisory authorities in the EEA, UK and Switzerland and their respective contact information here:

To submit a request to exercise your privacy rights, you can contact us by any method described in the Contact Us section below. In your request, please describe what rights you are exercising and how you would like us to assist. We may need to request specific information from you to help us verify your identity and that you have the right to request what you are requesting. These are security measures to ensure that we do not disclose personal data to any person who has no right to receive it, or otherwise process the data in unauthorized ways. We may also contact you to ask for further information about your request to clarify the scope of your request and speed up our response. We will respond to requests to exercise privacy rights according to applicable laws.

10. Are you required to provide us with your personal data?

You are not legally required to provide personal data to us but we cannot provide our Services without receiving some personal data from you.

11. How can you contact us?

If you have any questions about our privacy practices, personal data processing activities, or would like to exercise your rights under privacy laws, you may contact our Data Protection Officer at privacy@dreamgames.com.

12. Will we change this Supplemental EEA+ Privacy Statement?

From time to time, we may revise this Supplemental EEA+ Privacy Statement. When we do so, the changes will be posted and the revised document will be available online and the “last updated” date above revised.