Bank of Innovation, Inc. (hereinafter “BOI,” “we,” “our,” or “us”) has established this Privacy Policy (hereinafter “Policy”) for the purpose of specifying how the personal information of users (hereinafter “User,” “Users,” “you”, “their”, or “your”) is handled in every service (hereinafter “Services”) that relates to BOI’s title MementoMori.
If you are a User residing in European Economic Area (“EEA”), then the Privacy Policy for EEA Residents shall apply.

If you are a User residing in the United States, then the Privacy Policy for United States Residents shall apply.

Article 1: The Types of Information BOI Collects and How BOI Collects It

The term “personal information” used in this Policy shall refer to the information regarding a living individual, including information that identifies an individual via the individual’s name, date of birth, and other identifying descriptions, etc., or the individual’s identification code, as stipulated in Article 2, Paragraph 1 of Japan’s governing law regarding the protection of personal information (hereinafter “Japan’s Act on the Protection of Personal Information”).
Furthermore, the term “individual identification codes” shall refer to the information stipulated in Article 2, Paragraph 2 of Japan’s Act on the Protection of Personal Information, which includes passport number, driver’s license number, and social security number.
BOI shall collect personal information appropriately and shall not collect any personal information by deception or other improper means.

Examples of the types of personal information that BOI collects in the Services are detailed below. BOI may not be able to provide the Services, in part or in full, to Users who cannot provide the following information.

Furthermore, all Users under the age of 18 must obtain consent from their legal guardian before providing BOI with personal information.

(1) Information that BOI automatically collects from you when you use the Services.

• • Language settings.
• • Email address.
• • Any other information, including username, that you provide via the method prescribed by BOI.

(2) Information provided by other services that have been allowed to link with the Services.

If you allow an outside service, like a social networking service, etc., to link with the Services as you use the Services, the following information may be provided to BOI.

• • User ID of said other services.
• • Any other information that you have acknowledged to release to said other services via your privacy settings.

(3) Information that BOI acquires while you use the Services.

BOI may obtain information regarding your access to the Services, or your method of use, which includes the following information.

• • Interactions with other Users, including chat messages sent or received by you.
• • Device information.
• • Log data.
• • Cookies and anonymous IDs

(4) If you provide consent via the method prescribed by BOI, we shall obtain the following information from the device you use for the Services.

• • Geographic location.

(5) Information you provide to BOI in relation to inquiries and other forms of communication.

If you send an inquiry to BOI, we may have you provide the following information for the purposes of investigating inquiries and replies, or the verification of your identity.

• • Phone number.
• • Email address.
• • Device information.
• • OS information.
• • User identification IDs.

(6) Information you provide to BOI in relation to promotional campaigns, etc.

We may have you provide the following information solely for the purposes of questionnaires, promotional campaigns, and any related lotteries, prize shipments, and purchase shipments.

• • Full name.
• • Shipping address.
• • Phone number.
• • Gender.
• • Date of birth.
• • Other information that we determine as necessary.

Apart from everything stipulated in (1) through (6) above, BOI shall not collect any of the sensitive personal information written below. However, this shall not apply should you provide any of the following information on your own volition, or when the acquisition of this information is legally permitted.

• • Race and ethnicity.
• • Ideology and beliefs.
• • Social status.
• • Medical history.
• • Criminal record.
• • Any records that indicate that you were a victim of a crime.
• • Any other information determined as sensitive personal information under Japan’s Act on the Protection of Personal Information.

NOTE:
The governing laws of this Policy are the laws of Japan, so the language and terminology written in the Japanese version of this Privacy Policy shall take precedence.

Article 2: Intended Use of Personal Information

BOI shall use the personal information acquired from you for the following purposes, goals, and objectives.

1. (1)For the provision, maintenance, protection, and improvement the Services, including the acceptance of registration for the Services, verification of identity, calculation of usage fees, etc.
2. (2)For providing guidance and correspondence to inquiries concerning the Services.
3. (3)For corresponding to any actions that violate BOI’s Terms of Service Agreement, and other policies, etc., related to the Services.
4. (4)For ensuring legal compliance.
5. (5)For conducting questionnaires, monitoring activities, etc., related to the Services.
6. (6)For creating statistical data, and other marketing purposes related to the use of the Services.
7. (7)For processing information in a way that does not identify any specific Users for the purpose of creating and providing information for advertising. The username that you have registered may be made public in marketing, advertising, or promotional videos. In the event that this were to happen, your User information shall be processed and used as written below.
   1. 1. Excluding individual identification codes, personal information shall be used once identifying descriptions, etc., contained in said personal information are partially deleted. This includes replacing or obscuring any deleted parts of identifying descriptions, etc., with other descriptions, etc., using unregulated methods that can restore or reconstruct said parts of identifying descriptions.
   2. 2. Individual identification codes shall be used after completely deleting said individual identification codes. This includes replacing or obscuring said individual identification codes with other descriptions, etc., using unregulated methods that can restore or reconstruct said personal identification codes.
8. (8)For sending information regarding BOI’s games and promotional campaigns.
9. (9)For any purpose of use closely associated with any of the purposes of use mentioned above.

When BOI acquires any personal information that is not mentioned above, we shall announce the purpose for collecting and intended use of said personal information in advance. However, we may not announce the purpose for collecting and intended use of said personal information in the following cases.

1. (1)Cases in which notifying a User or disclosing the intended use of personal information to the public would potentially endanger or cause harm to a User or a third party’s life, body, property, or other rights and interests.
2. (2)Cases in which notifying a User or disclosing the intended use of personal information to the public would potentially harm the rights or legal interests of BOI.
3. (3)Cases that require cooperation regarding the execution of administrative affairs stipulated by any national or local government institutions, or when notifying a User or disclosing the intended use of personal information to the public would interfere with the execution of the said administrative affairs.
4. (4)Cases in which it is acknowledged that the intended use of personal information is clear, judging from the circumstances in which said personal information is acquired.

Article 3: Provision of Information

When BOI uses information collection modules or advertising distribution tools, etc., we may provide the following User information to third parties. However, any information that specifically identifies individuals shall not be provided to any third parties.

1. (1)User identification IDs.
2. (2)Device information.
3. (3)Purchase information.
4. (4)Log data.
5. (5)Advertisement data.
6. (6)Performance data.

Article 4: Restrictions on the Provision of Information to Third-Party Affiliates

Except for the cases listed below, BOI shall not provide any third-party affiliates with any personal information organized in personal information databases, etc. (hereinafter “Personal Data”) (Personal information databases refer to a collective body of information which comprises of personal information stipulated in Article 2, Paragraph 4 of Japan’s Act on the Protection of Personal Information, systematically structured so that specific personal information can be searched for using a computer. This can also refer to a collective body of information which comprises of personal information organized in accordance to standardized rules and regulations, systematically structured so that specific personal information can be easily searched for, with tables of contents, indexes, and other items which possess the functionality to easily facilitate searches.)
When providing Personal Data to a third party, we shall keep a record in accordance with Japan’s Act on the Protection of Personal Information and the rules and regulations stipulated by Japan’s Personal Information Protection Commission regarding the dates which any applicable Personal Data was provided, the names or appellations of all concerned third parties, and other matters prescribed by the rules and regulations of Japan’s Personal Information Protection Commission.
Furthermore, when BOI is provided with Personal Data from a third party, we shall keep a record in accordance with Japan’s Act on the Protection of Personal Information, and rules and regulations stipulated by Japan’s Personal Information Protection Commission regarding the names or appellations of all concerned third parties, as well as any concerned third party’s addresses, and, should the third party be a corporate entity, the name of its representative, and the confirmation of the details of the circumstances under which all applicable Personal Data was acquired.

1. (1)Cases in which a User consents to provide their Personal Data in advance.
2. (2)Cases that are in accordance with laws and regulations.
3. (3)Cases in which providing Personal Data is necessary to protect an individual’s life, body or property, as well as cases in which obtaining a User's consent is difficult.
4. (4)Cases in which BOI entrusts the handling of Personal Data, in part or in full, within the necessary scope to achieve BOI’s intentions for use.
5. (5)Cases of business succession due to a merger or other means.
6. (6)Cases that require cooperation regarding the execution of administrative affairs stipulated by any national or local government institutions, or any individual or party commissioned by said institutions, as well as cases in which obtaining a User’s consent would interfere with the execution of said administrative affairs.

Article 5: Joint Use of Personal Information

BOI may share your personal information with other business entities which we are cooperating with to provide the Services. In such cases, BOI shall jointly use your personal information after informing you in advance regarding the content, as well as the items in the jointly used Personal Data; the scope in which the other business entity can use your personal information; the other business entities’ intended use for your personal information, as well as the names or appellations of parties responsible for managing your Personal Data. Additionally, BOI shall notify you in a way that is easily accessible and understandable before jointly using your personal information.

Article 6: Disclosing Personal Information

When you request that your Personal Data be disclosed to you based on the provisions stipulated in Japan’s Act on the Protection of Personal Information, after verifying that the demand is from you by confirming your name, date of birth, address, user identification ID, etc., BOI shall disclose all your Personal Data to you without delay. Furthermore, should your Personal Data not exist, we shall notify you appropriately. However, this shall not apply to cases in which we do not bear responsibility for disclosing personal information according to Japan’s Act on the Protection of Personal Information and other applicable laws and regulations.

If you request us to disclose your Personal Data to you as described above, please do not hesitate to contact us using the contact details written in Article 10 below. Please note that in order to disclose your personal information, we may charge a handling fee due to postage charges and other expenses. We shall notify you about the fee separately.

Article 7: Revisions to and Cessation of Use of Personal Information

If (1) you request BOI to revise your Personal Data based on the provisions stipulated in Japan’s Act on the Protection of Personal Information due to your Personal Data not being factual; or (2) request BOI to cease using your Personal Data based on the provisions stipulated in Japan’s Act on the Protection of Personal Information due to your Personal Data being handled beyond the intended scope of use as previously announced, or being acquired by deceit or other improper means; or (3) request BOI to cease providing your Personal Data to a third party based on the provisions stipulated in Japan’s Act on the Protection of Personal Information due to your Personal Data being provided to a third party without proper rationale; after verifying that the demand is from you by confirming your name, date of birth, address, user identification ID, etc., BOI shall conduct all necessary investigations without delay, and notify you regarding the result of the investigations, as well as how BOI will handle your request. Furthermore, if BOI decides to not revise your Personal Data, or cease using or providing your Personal Data based on proper rationale, BOI shall inform you appropriately.
If you request BOI to delete your personal information, and BOI determines it necessary to correspond to your request, BOI shall delete your personal information after verifying that the demand is from you by confirming your name, date of birth, address, user identification ID, etc.

If you request your Personal Data to be revised or ceased being used, please do not hesitate to contact us using the contact details written in Article 10 below.

Article 8: Management System

BOI shall conduct lawful and fair management of all personal information. Additionally, BOI shall exercise appropriate supervision over all company officers and employees to ensure that all personal information is securely protected.

All the personal information we utilize is stored in Japan to achieve every purpose, goal, and objective written in this Policy.

We shall retain all User information we acquire for as long as is reasonably necessary in the interest of every purpose, goal, and objective stipulated in this Policy.

If a User has consented to allow their information to be handled, then the User possesses the right to revoke their consent at any time, provided, however, that the revocation of consent does not obstruct the lawfulness of any processing that is based on the User’s initial provision of consent.

Article 9: Supervision over Trustees

If BOI entrusts the handling of personal information, in part or in full, to a trustee, we shall form a non-disclosure agreement (NDA) with the trustee and exercise the necessary and appropriate supervision over the trustee to ensure that all Users’ Personal Data is securely protected.

Article 10: Contact Us

If you have any questions, comments, concerns, or inquiries regarding the handling of your personal information, please do not hesitate to contact us by using any of the forms of contact written below.

Email us:
support@mememori-game.com

Write to us:
Attn: Personal Information Inquiries
Bank of Innovation, Inc.
Shinjuku Eastside Square 3F
6-27-30 Shinjuku, Shinjuku-ku, Tokyo 160-0022, Japan

Article 11: Changes, Amendments, and Revisions to this Privacy Policy

We shall appropriately review every situation of application regarding the handling of personal information, strive for continuous improvement, and thus may change this Policy as necessary. If we make any significant changes to this Policy, we shall notify Users of the changes in a way that is easy to understand. Additionally, if we make any changes that require the consent of the User, we shall obtain the User’s consent via the method that BOI will prescribe separately.

NOTE:
This English translation is provided for reference purposes only.
If part of the translated version of this Policy conflicts with the original Japanese version, the original Japanese version shall take precedence.

Last Updated: August 31th, 2022

Privacy Policy for EEA Residents

This Privacy Policy (the “Policy”) explains the way of treating the Personal Data which is provided or collected while using MementoMori service (the “Service”) operated by BANK OF INNOVATION (the “Company”).

The Company is the controller of the Personal Data provided or collected in the course of using the Service. The Company treats the Personal Data of the users as important, hence, through the Policy informs the users of the purpose and method of the Company’s using the Personal Data provided by them and the measures taken by the Company for protection of those Personal Data.

1. What data do we collect?

The Personal Data concerns any information concerning an identified or identifiable natural person that is processed by the Company. The Personal Data the users are requested to provide may be necessary to provide the users with the Service. Therefore, when a user rejects to provide such data, the user may not be able to use the Service.

(1) Data directly provided by the users when signing up the Service

The following Personal Data may be provided when signing up the Service.

• • Language in use, email address, Name, birth date, the User’s ID(which includes ID of the Service, IDFA and Advertising ID), national information, any other data the users directly fill in the form provided by the Company
• • For minors(under age of 16), additional data of legal representatives (name, birth date, email address, telephone number)

(2) Personal Data provided by other service providers who are allowed to connect with the Service

The following information may be provided by other service providers

• • The user’s ID of other service providers
• • Any other information which the user consented to provide to other affiliates

(3) Personal Data collected while using the Service

The following Personal Data may be collected when using the Service.

• • Device information: Equipment identifier, operation system, hardware version, equipment set-up, type and set-up of browser and use information of website or application
• • Log information: IP address, log data, use time, internet protocol address, cookies and web beacons
• • Service usage history: Email or text messages, game play contents, inquiry history, search word input by the users, contact information with other users including chat history, performance data

(4) Personal Data collected only with specific consent of the users

The following Personal Data may be collected only when the Company obtains specific consent from the users.

• • Location information: Information of device location including specific geographical location detected through GPS, Bluetooth or Wi-Fi (limited to the region permissible under the laws)

(5) Personal Data directly provided by the users when using online payment system

The following Personal Data may be provided when using online payment system in the Service

• • Purchase information: Purchase history, purchase ID, purchase date, purchase item, purchase amount, postal code

(6) Personal Data directly provided by the users through inquiry system of the Company

The following Personal Data may be provided by the users.

• • email address, the user’s ID, operation system, device identifier, hardware version, set-up status

(7) Personal Data directly provided by the users through events operation, marketing, and any other related matters

The following Personal Data may be provided by the users.

• • Name, address, telephone number, sex, birth date, other information which is required to operate the events, marketing, and any other related matters

The Company collects Personal Data of the users as above, but it does not collect sensitive Personal Data which includes but not limited to the below.

• • Race and ethnicity, ideology and beliefs, political views and criminal record, social status, medical history, the fact that suffered from a crime, and any other information which may infringe upon the basic human rights of the users.

2. The purpose the Company collects Personal Data and grounds for processing

The company may collect and process the users’ Personal Data solely for the purposes and grounds for processing below;

1. (1)To sign up for the Service, confirm identification, provide, maintain, protect, and improve existing services and develop new services; This is necessary for the performance of the contract between the Company and the user (the “Contract”)
2. (2)To make notice related to the Service and respond to inquiry from the users; This is necessary for the performance of the Contract and/or for a legitimate interest of the Company, namely to communicate with the users and provide customer service
3. (3)To detect and respond to unauthorized or fraudulent use of or abuse of the Service; This is　necessary for the performance of the Contract and/or for a legitimate interest of the Company, namely to prevent fraudulent use of or abuse of the Service
4. (4)To comply with applicable laws or legal obligation; This is necessary for compliance with a legal obligation under EU laws to which the Company is subject and/or for a legitimate interest of the Company with respect to laws of other jurisdictions
5. (5)To institute questionnaires and monitor the Service; This is necessary for the performance for a legitimate interest of the Company, namely to communicate with the users and secure the Service environment
6. (6)To make statistics on member’s service usage to provide services and place advertisements based on statistical characteristics; This is necessary for a legitimate interest of the Company, namely to offer the users other services or products in which the users may be interested or based on prior consent
7. (7)To use the personal information in non-identified form for marketing purpose (the user’s ID may be open to public through advertising images). In this case, Personal Data of the users will be processed as follows; This is necessary for a legitimate interest of the Company, namely to invite new users to the Service which make the users explore new experience with them or based on prior consent
   1. • The company may use non-identifiable Personal Data after deleting or changing some of it with a method which cannot restore the data.
   2. • The company may use identifiable Personal Data after deleting or changing all of it with a method which cannot restore the data.
8. (8)For other purposes which are incidental to the purposes stated above; This is necessary for the same grounds with the main purposes of the incidental purposes

When the company intends to collect other Personal Data which is not listed above, it will give a prior notice to the users about the purpose except the situations as below;

1. (1)When the Company reasonably believes that a prior notice of the purpose may cause damage to a third party’s life, safety, property and any other rights Company’s other contracts, or to protect other person’s rights, property or safety
2. (2)When the Company reasonable believes that a prior notice of the purpose may cause damage to the Company’s legitimate interests
3. (3)When the Company is requested to cooperate with national government, local public authorities, administrative office, other equivalent organizations or individuals in dealing with affairs prescribed in the laws and regulations and a prior notice of the purpose may cause disturbance with the affairs
4. (4)When the purpose is objectively clear from the circumstances

3. When does the Company disclose the Personal Data to a third party?

Except for the following cases, the Company will not disclose or provide Personal Data to a third party;

1. (1)When the Company obtained the prior consent of the users
2. (2)When the disclosure is required by the law
   1. • If required to be disclosed by the laws and regulations; or
   2. • If required to be disclosed by the investigative agencies for detecting crimes in accordance with the legitimate procedure and method as prescribed in the laws and regulations
3. (3)When the disclosure is required to protect a person’s life, safety, and property but it is difficult to obtain the user’s consent
4. (4)When the Company is requested to cooperate with national government, local public authorities, administrative office, other equivalent organizations or individuals in dealing with affairs prescribed in the laws and regulations and obtaining consent form the users may cause disturbance with the affairs
5. (5)When the Company transfers Personal Data to a third party in/outside Japan
   1. • When the Company needs to transfer the Personal Data to its subsidiaries, affiliates, partners and service providers, outside contractors of the Company to provide, maintain, improve the Service; or
   2. • When the Company sells or buys any business or assets to a third party; or
   3. • WWhen the company reasonably believes that it is necessary to disclose the Personal Data to comply with the Company’s other contracts

The users should be aware that the Personal Data collected by the Company may be transferred, processed, stored and used outside of EEA, which includes Japan. For the places where the Personal Data is transmitted, retained or processed, the Company takes reasonable measures for protecting those Personal Data. When the users give their consent to this Policy, they agree with the following terms;

• • Outside EEA, the level of the data protection law may be lower than EEA therefore data subjects may not be able to receive the same rights as those in EEA.
• • The users’ Personal Data may be disclosed to third parties located outside EEA.
• • In order to accomplish the purposes set forth above, the users’ Personal Data may be provided to not only the Company but also to third parties located outside EEA, where the users’ Personal Data may be processed by such third parties.
• • The Company provides Personal Data to a third party as below;

4. When the Company jointly use Personal Data with third parties

When the Company needs to share the Personal Data with third parties to provide the Service, the Company may use the Personal Data with the necessary third parties jointly.

5. What are the users’ data protection rights?

The Company would like to make sure the users are fully aware of all of your data protection rights. You will not have to pay a fee to exercise any of the rights. However, the Company may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, the Company could refuse to comply with your request in these circumstances. Every user is entitled to the following;

• • The right to withdraw – The users have the right to withdraw consent at any time. Provided, however, that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• • The right to access – The users have the right to view/change their Personal Data through the Service.
• • The right to rectification – The users have the right to request that the Company correct any data they believe is inaccurate and cannot change by themselves.
• • The right to erasure – The users have the right to request that the Company erase their Personal Data, under certain conditions.
• • The right to restrict processing – The users have the right to request that the Company restrict the processing of their Personal Data, under certain conditions.
• • The right to object to processing – The users have the right to object to the Company’s processing of their Personal Data, under certain conditions.
• • The right to data portability – The users have the right to request that the Company transfer the data that it has collected to another organization, or directly to you, under certain conditions.
• • The right to complain –The users have the right to complain with a supervisory authority in the EU Member State of your habitual residence, place of work or of an alleged infringement of the GDPR at all times.
• • If the user makes a request, the Company will take measures without delay; Provided that the Company may reject the request of them only to the extent that there exists either proper cause as prescribed in the laws or equivalent cause.
• • Any user who would like to exercise any of these rights, please contact us at the contract details below;

Email us at: dataprotectionofficer-team@boi.jp
Or write to us: Bank of Innovation, Inc,.
Shinjuku Eastside Square
6-27-30 Shinjuku, Shinjuku-ku, Tokyo 160-0022, Japan

6. How does the Company store Personal Data?

• • The Company securely stores Personal Data with all necessary and appropriate safety measures from any unauthorized access, release, use or modification. The Company strictly limit access to Personal Data to its employees, agents, contractors, and other third parties who have a need to have access. In addition, these persons are bound by a confidentiality obligation, either under their employment agreements or other contracts.
• • The Company will retain Personal Data for as long as reasonably required for the purposes for which the Company has collected such data. Exact periods are determined based on consideration of the purpose for which Personal Data is collected, the nature of the Personal Data, and legal or business requirements for retention of Personal Data.

7. Protection concerning personal information of Children

• • The Company will not intentionally collect Personal Data from a user under the age of 16 without prior consent from such user’s parents or legal guardian. In the event that anyone under the age of 16 wishes to use the Service, the Company asks them to make sure that the consent is given or authorized by their parents or legal guardian.
• • The Company may grant to parents or legal guardian of children a right to access to Personal Data of those children, correct, delete, or temporarily suspend treating the Personal Data of those children, and request for withdrawal of their consent provided before.

8. Cookies and similar technologies

1. (1)‘Cookies’ are text files placed on the user’s computer to collect standard internet log information and visitor behavior information. When the users visit and use the Service, the Company may collect information from the users automatically through cookies or similar technologies.
2. (2)The Company may collect and use cookies below or similar technologies in a range of ways to improve your experience on the Service;
   1. • Necessary cookies: These cookies are necessary for the Service to function properly, including cookies that are necessary to create an account. These cookies do not collect any information which may be used for marketing or memorizing the sites visited by the users.
   2. • Performance cookies: These cookies collects information how the users use the Service such as the information of pages which are visited by the users most. Where users have previously indicated a preference, that user’s preference will be stored in these cookies. Through these cookies the Company can improve the Service and optimize the experience of the users whenever they visit the Service so that the users can search the Service more comfortably.
   3. • Functionality cookies: These cookies are used for memorizing the set-ups such as layout, text size, basic set-up and languages so that the Company provides services and improves visit of the users. Any information collected by this cookie do not identify the users individually.
3. (3)The Service is set to accept cookies by default. The users can set the browser not to accept cookies, however, in a few cases, certain features of the Service as well as third parties’ services may not function as a result.

9. Privacy policies of other websites

The Service may contain links to other websites or services. The policy applies only to the Service, so if you click on a link to another website, we recommend you to carefully read their privacy policy.

10. Changes to the Policy

The Policy may be amended pursuant to changes in the applicable laws, regulations, and/or the Company’s policy, so please check the Policy from time to time for possible changes when using the Service. This Policy was updated and effective on 01 March 2023.

11. How to contact the Company

If you have any questions about the Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Email us at: dataprotectionofficer-team@boi.jp

Privacy Policy for United States Residents

Effective Date: August 2022

Please click here for a printable PDF version of this notice.

This Privacy Policy (the “Policy”) applies to personal information provided or collected while using the MementoMori online properties, including our website or mobile applications that link to it, and our social media pages or handles (together the “Services”) operated by BANK OF INNOVATION (the “Company”).

This Policy does not apply to third-party websites, mobile applications, or services that may link to the Services or be linked to from the Services. Please review the privacy policies on those websites and applications directly to understand their privacy practices.

We may change this Policy from time to time. If we do, we will notify you by posting the updated version.

1. What Data Do We Collect?

We collect information from you directly, from the devices you use to interact with us, and from third parties. We may combine information from the Services together and with other information we obtain from our business records. We may use and share information that we aggregate (compile to create statistics that cannot identify a particular individual) or de-identify (strip information of all unique identifiers such that it cannot be linked to a particular individual) at our discretion.

(1) Information you provide to us when using or signing up for Services

You may provide the following information to us directly when signing up for or using the Services:

• • Contact information, including name, and application username. For minors under the age of 16, the contact information and date of birth of your parent or legal guardian.
• • Account information, such as a User ID, postal address, date of birth, language preferences, and country of residence.
• • Information about your use of and interaction with our Services, such as your gameplay, online status, Service use history, and interactions with other users.
• • Payment information, including purchase history, purchase ID, and transaction information.
• • Information contained in your communications to us, including survey responses, emails, text messages, and any other information provided within online forms.
• • Information you make available to us via a social media platform.
• • Any information or data you provide by interacting in our social media online forums and chatrooms, within our gameplay chat and message boards, or by commenting on content posted on our Services. Please note that these comments are also visible to other users of our Services.
• • Any other information you submit to us.

(2) Information we collect automatically

We and partners working on our behalf may use log files, cookies, or other digital tracking technologies to collect the following information from the device you use to interact with our Services. We also create records when you make purchases or otherwise interact with the Services.

• • Device information, including IP address, operating system, hardware version, equipment set-up, device identifiers (which includes the IDFA and Advertising ID), and details about your web browser.
• • Analytics information, including details about your interaction with our website, app, and electronic newsletters, such as search history, chat history, and gameplay contents.
• • Log (Diagnostic) information, including web traffic logs, IP address, and use time.
• • Location information, including specific geographical location detected through GPS, Bluetooth or Wi-Fi.
• • Advertising information, including special advertising and other unique identifiers that enable us or third parties working on our behalf to target advertisements to you. Please be aware that our advertising partners may collect information about you when you visit third-party websites or use third-party apps. They may use that information to better target advertisements to you on our behalf.
• • Business record information, including records of your purchases of products and services.

The following is a list of our partners who collect the information described above. Please follow the links to find out more information about the partner’s privacy practices.

(3) Information We Collect From Other Sources

We may collect the following information about you from third-party sources.

• • Contact information, demographic information, and information about your interests and purchases, from consumer data providers, other gaming providers, and/or affiliates.
• • Information about your interests, activities, and employment history from social networks and other places where you choose to share information publicly.
• • Information about your interaction with advertisements on our Services, or ads that we place on third party websites, from online advertising companies.

2. How We Use Your Information

We may use any of the information we collect for the following purposes.

• • Service functionality:
  To provide you with our Services, including to sign up for the Services, process payments, confirm your identification, send service communications (including renewal reminders), and conduct general business operations, such as accounting, recordkeeping, and audits.
• • Service improvement:
  To improve and grow our Services, including to develop new Services and understand how our Services are being used, our customer base and purchasing trends, and the effectiveness of our marketing.
• • Personalization:
  To offer you recommendations and tailor the Services to your preferences.
• • Advertising and marketing:
  To send you marketing communications, personalize the advertisements you see on our Services and third-party online properties, and measure the effectiveness of our advertising. We may share your information with business partners, online advertising partners, and social media platforms for this purpose.
• • Security:
  To protect and secure our Services, assets, network, and business operations, and to detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal.
• • Legal compliance:
  To comply with legal process, such as warrants, subpoenas, court orders, and lawful regulatory or law enforcement requests and to comply with applicable legal requirements.

3. How We Share Your Information

We may share any of the information we collect with the following recipients.

• • Affiliates:
  We share information with other members of our group of companies.
• • Service providers:
  We may engage vendors to perform specific business functions on our behalf, and they may receive information about you from us or collect it directly. The business functions that these vendors provide may include:
  
  1. • Supporting Service functionality, such as vendors that support customer service and customer relationship management, application development, list cleansing, postal mailings, and communications (email, fax).
  2. • Auditing and accounting firms, such as firms that assist us in the creation of our financial records.
  3. • Professional services consultants, such as firms that perform analytics, assist with improving our business, provide legal services, or supply project-based resources and assistance.
  4. • Analytics and marketing services, including entities that analyze traffic on our online properties and assist with identifying and communicating with potential customers.
  5. • Security vendors, such as entities that assist with security incident verification and response, service notifications, and fraud prevention.
  6. • Information technology vendors, such as entities that assist with website design, hosting and maintenance, data and software storage, and network operation.
  7. • Marketing vendors, such as entities that support distribution of marketing emails.
• • Business partners:
  From time to time, we may share your contact information with other organizations for marketing purposes.
• • Online advertising partners:
  We partner with companies that assist us in advertising our Services, including partners that use cookies and online tracking technologies to collect information to personalize, retarget, and measure the effectiveness of advertising.
• • Social media platforms:
  If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Services (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity. To control this sharing of information, please review the privacy policy of the relevant social media platform.
• • Government entities/Law enforcement:
  We may share information when we believe in good faith that we are lawfully authorized or required to do so to respond to lawful subpoenas, warrants, court orders, or other regulatory or law enforcement requests, or where necessary to protect our property or rights or the safety of our employees, our customers, or other individuals.
• • Other businesses in the context of a commercial transaction:
  We may change our ownership or corporate organization while providing the Services. We may transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information as described in this policy.

4. Security

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

5. Other Important Information

(1) Data retention

The Company will retain personal information for as long as reasonably required for the purposes for which the Company has collected such data. Exact periods are determined based on consideration of the purpose for which Personal Data is collected, the nature of the Personal Data, and legal or business requirements for retention of Personal Data.

(2) Cross-border data transfer

We may collect, process, and store your information in the United States and other countries, such as Japan. The laws in the United States regarding information may be different from the laws of your country. Any such transfers will comply with safeguards as required by relevant law.

(3) Information about children

The Services are intended for users age 16 and older. We do not knowingly collect information from children. In the event that anyone under the age of 16 wishes to use the Service, the Company will require prior consent by their parent or legal guardian. Please contact us for more information.

6. Your Options and Rights Regarding Your Information

• Your Account:
  Please visit your account page within the app to update your account information.
• Ad Choices:
  You have options to limit the information that we and our partners collect for online advertising purposes.
  
  1. • You may disable cookies in your browser or mobile device using their settings menus. Your mobile device may give you the option to disable advertising functionality. Because we use cookies to support Service functionality, disabling cookies may also disable some elements of our online properties.
  2. • You may disable cookies in your browser or mobile device using their settings menus. Your mobile device may give you the option to disable advertising functionality. Because we use cookies to support Service functionality, disabling cookies may also disable some elements of our online properties.
  3. • You may contact us directly.
  If you exercise these options, please be aware that you may still see advertising, but it will not be personalized. Nor will exercising these options prevent other companies from displaying personalized ads to you. If you delete your cookies, you may also delete your opt-out preferences.
• Do Not Track:
  Your browser or device may include “Do Not Track” functionality. The information collection and disclosure practices and the choices that we provide to you will continue to operate as described in this privacy policy, whether a Do Not Track signal is received.
• Jurisdiction-specific rights:
  You may have certain rights with respect to your personal information depending on your location or residency. Please see “privacy disclosures for specific jurisdictions” below. Please contact us to exercise your rights.

7. Privacy Disclosures for Specific Jurisdictions

(1) European Economic Area, United Kingdom, and Switzerland

We process “personal data,” as that term is defined in the European Union’s General Data Protection Regulation (“GDPR”). If you are located within the European Economic Area, the United Kingdom, or Switzerland, please review the “Privacy Policy for EEA Residents.”

(2) California

Your California Privacy Rights; “Shine the Light” Law

California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their own direct marketing purposes in the preceding calendar year. Please contact us to obtain this information.

California Consumer Privacy Act

The California Consumer Privacy Act (“CCPA”) provides California residents with rights to receive certain disclosures regarding the collection, use, and disclosure of information about them, as well as rights to know/access, delete, and limit disclosure of personal information. You have the right to be free from discrimination based on your exercise of your CCPA rights. To the extent that we collect personal information that is subject to the CCPA, that information, our practices, and your rights are described below.

Notice at Collection Regarding the Categories of Personal Information Collected

You have the right to receive notice of the categories of personal information we collect and the purposes for which we use personal information. The following table summarizes the categories of personal information we collect, the categories of sources of that information, and whether we disclose or sell that information to service providers or third parties, respectively. The categories we use to describe personal information are those enumerated in the CCPA. We collect this personal information for the purposes described in Section 1 of this Policy.

Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf.

Entities to whom we “sell” information are third parties. Under the CCPA, a business “sells” personal information when it discloses personal information to a company for monetary or other benefit. A company may be considered a third party either because we disclose personal information to the company for something other than an enumerated business purpose under California law, or because its contract does not restrict it from using personal information for purposes unrelated to the service it provides to us.

Your rights under the CCPA

• • Opt-out of sale of personal information:
  You have the right to opt out of our sale of your personal information to third parties. To exercise this right, please visit our Do Not Sell My Personal Information link or contact us. Please be aware that your right to opt out does not apply to our disclosure of personal information to service providers.
• • Know and request access to and deletion of personal information:
  You have the right to request access to personal information collected about you and information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers with to whom we sell or disclose it. You also have the right to request in certain circumstances that we delete personal information that we have collected directly from you. Please contact us to exercise these rights.

Financial incentives
We may offer you the opportunity to participate in special promotions and programs from time to time, such as Instant Wins on Twitter and the program we offer may qualify as a financial incentive program (FIP) under California law. We use the Personal Information you provide to enter you into a lottery for a chance to win in-game currency and your participation is voluntary. The category of Personal Information we collect is social media information and gaming account information which we use to facilitate your participation in the program. If we run the program jointly with a business partner, we may disclose the information to that business partner.

You may opt in to Instant Wins using the means we present to you, such as an online registration page, at the time we make the offer. You may opt out of Instant Wins at any time by following the instructions in Section 8 below.

8. Contact Information, Submitting Requests, and Our Response Procedures

(1) Contact

Please contact us if you have questions or wish to take any action with respect to information to which this privacy policy applies.

1. • Email us at:dataprotectionofficer-team@boi.jp
   • Mail:Bank of Innovation, Inc.
     Shinjuku Eastside Square
     6-27-30 Shinjuku, Shinjuku-ku, Tokyo 160-0022, Japan

(2) Making a request to exercise your rights

• Submitting requests:
  You may request to exercise your rights by submitting the form by making a request using the contact information above.

If you are a California resident, you may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf. We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

• Verification:
  We must verify your identity before responding to your request. We verify your identity by asking you to provide personal identifiers that we can match against information we may have collected from you previously. We may need to follow up with you to request more information to verify identity. We will not use personal information we collect in connection with verifying or responding to your request for any purpose other than responding to your request.