Dear User,

XLAYS Network Co., Ltd. (hereinafter referred to as "the Company") values personal data security and privacy protection. To safeguard your rights, we have formulated this Personal Data and Privacy Policy (hereinafter referred to as "this Policy"). In accordance with the provisions of the Personal Data Protection Act (hereinafter referred to as "the PDPA"), we inform you of the following matters before collecting your data:

(1) Non-governmental organization name.

(2) Purpose of collection.

(3) Types of personal data.

(4) Period, region, recipients, and methods of personal data utilization.

(5) Rights and methods of exercise for the party as stipulated in Article 3 of the PDPA.

(6) Impact on the party when they refuse to provide personal data if free to make the decision.

Before registering for and logging into the games and services provided by the Company, please review and agree to our User Agreement and this Policy on our website. Please note that once you register for and log into the Company's services, you are deemed to have reviewed, understood, and agreed to this Policy under the provisions of the User Agreement (also referred to as the "Terms of Use"). The Company reserves the right to modify, change, or supplement this Policy at any time. The aforementioned modified, changed, or supplemented contents take immediate effect upon publication by the Company. Please visit our website regularly and pay attention to related notifications or announcements. If the revised version involves substantial changes, the Company will publish update messages on its website 30 days in advance and officially implement the revised policy at the end of the 30-day period. If you continue to use the services provided by the Company, you will be deemed to have read, understood, and accepted all modifications.

We hereby remind you that if you are under the age of 20, your legal guardian must agree to this Policy and the User Agreement on your behalf. If you are under the age of 7, your parent(s), guardian(s), caregiver(s), or legal representative(s) must review and agree to this Policy and the User Agreement, and register and log in on your behalf. Once again, if you complete the registration and log-in process, you will be deemed to fully understand, be aware of, and agree to this Policy and the User Agreement. Please proceed with caution.

Article 1 Scope of Application

The collection, processing, and use of your personal information will be subject to this Policy when you use the services provided by the Company. However, this Policy does not apply to websites or pages operated by partners accessed through the Company's website or services. For partner-provided services, the privacy policies of each partner's website shall apply, and the Company assumes no joint liability.

Article 2 Categories of Collected Data

The Company may collect the following categories of personal data (refer to the Legal Department's Specific Purposes and Categories of Personal Data under the Personal Data Protection Act for details):

1. Personal identifiers (C001): Name, title, address, work address, previous address, home phone number, mobile phone number, instant messaging accounts, online platform accounts, communication and residence addresses, photos, fingerprints, email addresses, electronic signatures, credential numbers, voucher numbers, records of online identity authentication or query services, and any other data that can be used to identify the individual.

2. Financial identifiers (C002): Account numbers and names for financial institution accounts, credit card or debit card numbers, insurance policy numbers, and other personal numbers or accounts.

3. Identifiers in government data (C003): Unified ID number, unified certificate number, tax registration number, insurance certificate number, disability certificate number, retirement certificate number, license number, passport number, etc.

4. Personal descriptors (C011): Age, gender, date of birth, place of birth, nationality, voice, etc.

5. Retrievers of written documents (C131): Indexes or codes of written files not processed by automated machines.

6. Unclassified Data (C132): Unclassifiable letters, files, reports, emails, etc.

Article 3 Types of Collected Data

In order to provide you with services, the Company will collect and use the following types of data (limited to the data actually obtained):

1. Data for gaming: To facilitate your login and gaming experience, the Company will collect specific data provided by you, including name, nickname, ID number, phone number, email address, residence area, language settings, and other necessary related data.

2. Data for game operations: To maintain game operations and service quality, the Company may collect data about your computer hardware, software, and mobile devices; network environment; IP address, product model, operating system, network service provider, browser type, login time, usage time, website addresses/records, and other tracking data; and game content, purchase records, prize records, relationships with other players, etc.

3. Data for online transactions: For the purpose of completing payments, stored-value services, and other consumer services, the Company will collect order-related data and credit card information that you provide based on the online transaction method you choose when using online transaction services. The Company will only use your credit card information for the purpose of processing your purchase or usage of fee-based services provided by the Company; it will not retain your credit card information because your credit card payments will be processed by appropriate payment institutions.

4. Contact information for customer service and support: If you contact the Company through contact forms or other means provided by the Company, the Company may obtain and retain any information you choose to provide, including contact information such as your name, email address, and phone number, as well as information about your devices and operating systems. The Company will use this information to provide support and improve customer support services.

5. Contact information for promotions and customer surveys: If you participate in Company-provided activities or surveys, the Company may collect any information you choose to provide, including but not limited to name, postal address, phone number, email address, gender, and birthdate.

6. Cookies: Cookies can record your preferences and usage habits and automatically adjust the displayed contents to improve your user experience when you return to the website. The Company may use cookies to collect data on website management information, activity records, website usage dynamics, etc. If you do not wish to accept cookies, you can change your cookie settings through your browser or set a high privacy level. Please note that disabling cookies may result in some website functions not performing properly.

7. Data from browsing web pages: To improve the quality of the Company's services, when you browse or query on the Company's website or affiliated websites, the Company's server will automatically record related information such as your IP address, time of use, and browsing records in time of use. The data are only used for statistical traffic analysis and network service optimization. The analysis will only be performed on an aggregated basis unassociated with specific individuals.

8. Information you voluntarily provide based on Company services.

9. Information about you voluntarily provided by other users based on Company services.

10. Others: In addition to providing personal data directly to the Company, you may also voluntarily disclose your personal data to the Company's partnering manufacturers, which may then be provided to the Company with your consent or for the purpose of fulfilling contractual obligations. If you access a third-party service while using Company services, the Company may collect data related to your use of that third-party service. The data will only be used and processed within the scope of your consent or contractual obligations, and will not be used for other purposes.

Article 4 Specific Purposes

1. The Company will use your information for the following purposes (refer to the Legal Department's Specific Purposes and Categories of Personal Data under the Personal Data Protection Act for details):

(1) 040: Marketing (including joint marketing activities with partner companies).

(2) 063: Collection, processing, and utilization of personal data by non-governmental entities according to obligations as defined by law.

(3) 069: Contracts, legal relations similar to contracts, or other legal relations.

(4) 090: Consumer and customer management and services.

(5) 091: Consumer protection.

(6) 098: Business and technical information.

(7) 129: Accounting and related services.

(8) 135: Information and communication services.

(9) 136: Information, communication, and database management.

(10) 137: Information and communication safety and management.

(11) 148: Online shopping and other e-commerce services.

(12) 150: Auxiliary and logistical support management.

(13) 157: Surveys, statistics, and research analysis.

(14) 173: Oversight and management of target enterprise by other governmental agencies.

(15) 181: Other business activities in line with business registration items or organizational bylaws.

(16) 182: Other consulting and advisory services.

2. For providing the services offered by the Company: The Company may use collected information to provide, maintain, and enhance the applications, related websites, etc., developed, operated, or managed by the Company, and to prevent illegal activities or behaviors violating the User Agreement. If you choose to use online transaction services, the Company will collect the relevant order information and credit card details you provide according to the online transaction option you have selected to ensure the completion of payment, top-up, delivery, or other consumer services.

3. For resolving user queries or consumer disputes: The Company may use the data you provide to address your inquiries about issues occurring in the usage of related applications, webs, or other services. In case of disputes between you and the Company, your personal data may be used to verify or communicate relevant circumstances.

4. Providing, maintaining, and improving Company services and developing new services:

(1) The Company may use collected information to operate, maintain, enhance, provide, create, and develop platforms and other related services, automatically update applications in user systems, and remember user information to avoid repeated information entry during current or subsequent visits to Company services.

(2) The Company may use collected information to assist in developing new services.

5. Communication with users: The Company may use collected information (such as user name, phone number, email address, etc.) for direct communication and interaction. This includes but is not limited to: sending notifications about upcoming changes or improvements to network services or messages relating to contents you have posted on or downloaded from network services. Additionally, if you contact the Company, your requests will be recorded to help address any potential issues you may face.

6. Providing personalized services, including notifications on contents, promotions, recommendations, marketing, and activities, and business information on various business cooperation opportunities, etc: The Company may use collected information and provide it to affiliated companies, partners, or collaborators to offer customized network services and enhance your experience with these services. This may include recommendations and promotions for contents related to the Company, affiliated companies, partners, or collaborators, and other relevant contents that the Company, affiliated companies, partners, or collaborators hope you may discover (including but not limited to advertisements, marketing information, activity notifications, and business information on various business cooperation opportunities, etc). The Company may also send promotional materials or notifications related to network services on a regular basis.

7. Statistics and analysis:

(1) When you use the gaming services, the Company will automatically collect information about your device usage to analyze your gaming habits and consumption behaviors. The analysis will serve as a basis for improving services, designing member activities, optimizing gaming contents, conducting marketing activities, and developing new products and services. In addition, the Company will conduct occasional statistical analysis on overall member behavior based on the data obtained during your game account application and server browsing records, but this analysis will not target individual behavior.

(2) To improve service quality, the Company may use, share, or disclose collected information within the Company or with affiliated companies, partners, or collaborators for market analysis, statistics, or surveys for sales, rewards, or to provide a broader and more comprehensive range of services.

8. Compliance with applicable laws and statutory obligations.

9. The Company will not actively collect or process sensitive personal data (such as medical records, medical history, genetic information, sexual experience, health examinations, and criminal records). If processing sensitive personal data is necessary for legitimate reasons, the Company will comply with relevant laws (such as the proviso clause in Article 6 of the Personal Data Protection Act). When providing sensitive personal data to the Company, please ensure that you have the legal right to disclose such information.

10. The Company may engage in the acquisition or sale of companies, subsidiaries, products, or assets for transformation or growth. Because customer data are typically considered part of the transferred business assets in such transactions, your personal data may also be transferred in the event that the Company undergoes a transfer of assets due to a business transaction (such as a merger, acquisition, or sale of all or part of its products or assets); this transfer will be limited to the personal data relevant to the change in management rights.

Article 5 Duration, Region, Recipients, and Methods of Use

1. Duration:

(1) User data will be used during the operational period of the Company's services until use cessation as requested or service termination.

(2) Based on relevant laws and regulations, data may be retained for the necessary period for operations defined by law or the duration stipulated by individual contracts (whichever is longer).

2. Recipients:

(1) The Company, its affiliated companies, partners, collaborators, and their personnel (including shareholders, directors, consultants, senior officers, employees, and other individuals, as well as other professional, financial, legal, or accounting advisors).

(2) Governmental and non-governmental entities as required or authorized by law.

(3) Other entities as agreed upon.

(4) Social media or software service providers used by the Company (such as Facebook, LINE, Instagram, YouTube, Discord, Google, etc.).

3. Regions:

The service areas or locations of the Company, its affiliated companies, partners, collaborators, and social media or software service providers used by the Company, as well as all relevant Company websites and their subsidiary websites.

4. Methods: The collection, processing, international transmission, and utilization of personal data using automated or non-automated machines or carriers in compliance with personal data protection laws.

Article 6 Rights and Procedures for Exercising Rights

1. Pursuant to Article 3 of the PDPA, you have the following rights regarding your personal data retained by the Company:

(1) You can inquire with the Company about, request access to, or request copies of your personal data, and the Company may charge necessary costs in accordance with the law.

(2) You can request the Company to supplement or correct your personal data. However, as per Article 19 of the Personal Data Protection Act Enforcement Rules, you should provide appropriate explanations including reasons and facts.

(3) You can request the Company to delete your personal data or cease collecting, processing, or utilizing them.

(4) Pursuant to Article 11, Paragraph 2 of the PDPA, in the case of a dispute over the correctness of personal data, you can request the Company to cease processing or utilizing your personal data. However, based on the proviso clause of the same paragraph, this limitation does not apply if the data are required by the Company to perform its operations or if you have provided written consent specifying the dispute.

(5) Pursuant to Article 11, Paragraph 3 of the PDPA, when the specific purpose for personal data collection no longer exists or the deadline has expired, you can request the Company to delete, cease processing, or cease utilizing your personal data. However, based on the proviso clause of the same paragraph, this limitation does not apply if the data are required by the Company to perform its operations or if you have provided written consent.

6) If the Company violates the PDPA when collecting, processing, or utilizing your personal data, you can request the Company to cease data collection in accordance with Article 11, Paragraph 4 of the PDPA.

2. The aforementioned rights may be restricted if you do not meet the Company's application procedures or if the law provides otherwise.

3. To exercise the rights in the first paragraph of this article, you must complete the following procedures:

(1) Fill out the application documents.

(2) The parties involved should provide valid identity documents to the Company for verification.

(3) The Company may charge necessary costs in accordance with your request.

(4) If you entrust a third party to apply on your behalf, they must provide a power of attorney and identity documents for both the principal and the trustee.

Article 7 Impacts of Refusing to Provide Personal Data When Free to Choose

If you are unable to provide complete and accurate personal data, it may affect the Company's ability to provide services, communicate with you, complete transactions, verify identities, process purchases/transactions/customer complaints, or perform other business activities. You are advised to provide complete and updated personal data. If failure to provide complete and accurate personal data causes damage to you or third parties, you shall be obliged to bear full legal responsibility; if such failure causes loss to the Company, you shall also be liable for compensating the Company for damages.

Article 8 Maintenance of Personal Data

1. The Company shall endeavor to safeguard your personal data using appropriate and reasonable technologies and measures and conduct security maintenance according to relevant laws and regulations to prevent data theft, alteration, destruction, loss, or leakage.

2. The Company is obligated under this Policy to protect members' privacy and shall not modify or delete any personal data or files without your personal consent.

3. Except when provided otherwise in this Policy or other applicable privacy policy revisions or in the following situations, the Company will not lend, sell, or share your personal data with any other entity:

(1) Through lawful means.

(2) To protect the rights of the Company's website and its affiliated units.

(3) To cooperate with lawful investigations by judicial authorities.

(4) To cooperate with investigations or usage required by relevant authorities based on their duties.

(5) Disclosures as believed in good faith to be required by law or for the purpose of management when maintaining and improving website services.

(6) To prevent risks to your life, body, freedom, or property.

(7) To protect the personal safety of other users or third parties in emergencies.

4. The Company cannot guarantee 100% security during the transmission or storage of your information within the system. To protect the security of your account and personal data, please refrain from providing personal account numbers or passwords to third parties or allowing third parties to apply for accounts or passwords using your personal data. If your account or password is at risk of leakage, please change your password immediately or inform the Company to suspend the account (the Company may require verification of your personal data). The Internet is not a secure environment for information transmission, so please avoid providing sensitive personal data to others or disclosing it publicly on the website.

Article 9 Policy Modification

The Company reserves the right to amend the Privacy Policy. The revised provisions will be announced on the website. To protect your rights, please review the website and related notices or announcements regularly. If you continue to use the services provided by Company after modifications or changes to this Privacy Policy, it means you have reviewed, understood, and agreed to accept the modified or changed content of the Privacy Policy.

If you do not agree with this Privacy Policy, please stop using the Company's website and related services immediately.

Article 10 Opinions and Suggestions

If you have any opinions or questions regarding the Company's privacy policies or matters related to personal data, feel free to inquire by email: cs@xlays.com.tw.