PURSUANT TO REGULATION (EU) 2016/679 — GDPR
AND ITALIAN LEGISLATIVE DECREE 196/2003 — PRIVACY CODE

This page is a translation provided for convenience. In case of discrepancy, the Italian version prevails.

01WHO PROCESSES THE DATA AND HOW TO CONTACT US

The data controller is Ganko S.r.l., with registered office at Via Pirandello 58/60, 76121 Barletta (BT), Italy, VAT No. 08925490727.

For questions about data protection you can write to [email protected]. For general support, and to request account deletion when you cannot access the app, you can write to [email protected].

02WHO THIS NOTICE APPLIES TO AND WHAT DATA WE PROCESS

This notice concerns only the Wordeex mobile app. It does not cover processing carried out through the wordeex.com website. It applies to guest users and to users who link Apple, Google or Facebook, as well as to the Community features, purchases, notifications, advertising and support.

To make Wordeex work we may process UID, username and technical account identifiers; any email address, identifiers and tokens provided by sign-in providers; device and usage data, IP address, operating system, language, country, network, configuration, push token, online or advertising identifiers, logs, crash data and diagnostics.

We may also process progress, scores, inventory, coins, hints, preferences, statistics, leaderboards, achievements and gameplay activity; puzzles you create or share, usernames, visibility settings and reports; non-financial purchase data; data sent to support; privacy choices and information on the acceptance of the Terms of Service, such as version, date, time and relevant technical identifiers.

Data may be provided directly by you, generated while you use the app, or received from sign-in providers, stores, technical providers and other users when they report Community content.

03WHY WE USE THE DATA AND ON WHAT BASIS

We use the data needed to create and manage your account, provide the game and the Community, save your progress, manage purchases and respond to support requests. The legal basis is the performance of the relationship with the user.

When you ask to sign in with Apple, Google or Facebook, we process the data needed solely to perform the function you requested.

To protect accounts and the service, prevent abuse and fraud, moderate content, handle disputes and establish, exercise or defend the rights of Ganko or third parties, we rely on Ganko's legitimate interest and, where required, on applicable law.

In some cases the law requires Ganko to retain or disclose certain data, for example for tax or accounting obligations or in response to lawful requests from authorities. In these cases the processing is carried out because it is required by law.

Notifications necessary for the service are based on the performance of the relationship with the user. Promotional notifications are sent only on the basis of consent or another applicable basis, after concretely verifying their lawfulness.

Analytics, personalised advertising, tracking and attribution are based on consent where required by law. Strictly necessary diagnostics, security and stability may rely on legitimate interest, within the limits allowed by law.

Acceptance of the Terms of Service is separate from the optional choices concerning analytics, advertising, tracking, attribution and promotional notifications. Where consent is required, you can refuse or withdraw it as easily as you gave it. Refusal or withdrawal does not affect the app features that do not depend on that processing.

04SIGN-IN WITH APPLE, GOOGLE OR FACEBOOK

You can choose to link Apple, Google or Facebook to make signing in easier and reduce the risk of losing your profile when you change device.

When you link a provider, we process the provider identifier, any email address and the tokens needed for sign-in and for managing the link. Linking is optional. Linking, recovery and unlinking operations follow the Terms of Service; when you unlink a provider, Ganko deletes or revokes the associated tokens, except as necessary for legal obligations or security.

05COMMUNITY AND PUZZLES

Your username is associated with the puzzles you create. Public puzzles are visible in the Community; private ones are accessible to the creator and to anyone who has the link. Before publishing or sharing a puzzle, check the visibility you have chosen.

You can change the visibility of a puzzle or delete it using the features available in the app. Deleting your account deletes the associated Community puzzles, except as necessary to handle reports, security, disputes or legal obligations.

06SECURITY, MODERATION AND AUTOMATED DECISIONS

Ganko uses technical and organisational measures appropriate to the risk to protect data. These measures include encryption in transit and, where supported by providers, at rest. Access is limited to the people and providers who need it for their respective functions. The measures are reviewed and updated periodically. No system can guarantee absolute security.

Wordeex uses an internal script that analyses the title and solution words of a puzzle, assigns risk categories and may automatically block its creation or publication. Content may also be assessed after reports from other users and may be removed if found non-compliant.

If a puzzle is blocked or removed, you can ask for a human review by writing to [email protected]. The block concerns the publication of the content and, on its own, does not produce legal or similarly significant effects on the person. Serious or repeated violations may nevertheless contribute to a ban under the Terms of Service.

07ANALYTICS, ADVERTISING, NOTIFICATIONS AND TECHNICAL TOOLS

Wordeex may show interstitial ads, rewarded videos and other formats. Ads are not personalised by default. The Ad-free purchase removes mandatory ads on the platform on which it was purchased, but not rewarded videos that you voluntarily choose to watch.

For analytics, advertising, attribution, configuration, notifications and diagnostics we may use Google AdMob, Google Analytics for Firebase, Firebase Crashlytics, Remote Config, Firebase Cloud Messaging, Meta and Tenjin. Depending on the service and the applicable settings, these tools may process technical data, online or advertising identifiers, usage events, ad interactions, crash data and device information.

Google Analytics for Firebase may derive an approximate location from the IP address, such as country, region or city. Wordeex does not request the precise location of the device. Firebase Crashlytics helps identify problems and improve stability and security; Remote Config provides app configurations; Tenjin is used for marketing tracking related to the application.

Firebase Cloud Messaging is used to send push notifications. The processing includes at least the push token, the recipient device and the information needed to select and deliver the message. You can disable notifications in your device settings. It must be possible to refuse or turn off promotional notifications as easily as they were turned on.

On iOS, App Tracking Transparency is a separate control. If you deny authorisation, the IDFA is not available. You can also manage the permissions available in your device settings and your privacy choices in the app. Processing subject to consent starts only after a valid choice, where the law requires it.

08WHO WE SHARE DATA WITH

To provide Wordeex we may share the necessary data with technical providers and platforms that support backend, authentication, database, analytics, diagnostics, configuration, notifications, advertising, attribution and purchases.

These providers include Google and Firebase, Meta, Tenjin, Apple, Hetzner and AWS. Google and Firebase support, among other things, infrastructure, authentication, database, analytics, diagnostics, configuration and notifications. Meta may support Facebook Login, advertising and measurement. Tenjin supports marketing tracking. Apple supports Sign in with Apple, the App Store, Game Center and notifications. Hetzner supports infrastructure and email.

Providers receive only the data necessary to perform their respective service. Depending on the specific service, they may act on behalf of Ganko or independently determine some aspects of the processing; Ganko verifies and documents the applicable role.

Ganko may also disclose data to advisers, public authorities or other parties when necessary for legal assistance, security, legal obligations, lawful requests from authorities, or to establish, exercise or defend a right.

09TRANSFERS OUTSIDE THE EEA

Some providers may process data in countries other than the one where the user is located, including outside the European Economic Area. Where applicable, Ganko uses the instruments provided by the GDPR, such as adequacy decisions or appropriate safeguards for transfers.

The measures used depend on the provider, the service and the specific transfer. Ganko verifies and updates the information on transfers when necessary. You can ask for further information by writing to [email protected].

10HOW LONG WE KEEP DATA

We keep data for as long as necessary to achieve the purposes described in this notice, for the duration of the account, or for the periods required by law. We apply criteria proportionate to the nature of the data, the purpose of the processing and the need for security or for defending rights.

Account and gameplay data are kept for the duration of the account and during the 30-day revocable period provided for deletion. Provider identifiers and tokens remain until unlinking or account deletion, except for the time needed for security, disputes or legal obligations.

Community puzzles remain until they are deleted or the account is deleted, except for the time needed to handle reports, security, disputes or legal obligations. Purchase data may be kept longer when necessary for tax or accounting obligations, fraud prevention or the defence of rights.

Support requests are kept until they are resolved and, if necessary, for the period relating to disputes or legal obligations. Reports, bans and security data are kept for the time necessary and proportionate to prevent abuse, enforce the Terms of Service and protect rights.

Analytics, diagnostics, advertising and marketing tracking follow the periods configured in the services used and are limited to their respective purposes. Privacy choices and acceptance of the Terms are kept to document decisions and to manage obligations or disputes. Backup copies remain until the end of their cycle.

Ganko does not apply automatic deletion of inactive accounts.

11ACCOUNT DELETION

You can request deletion from the app or, if you cannot sign in or have been banned, write to [email protected]. The request starts the 30-day revocable period provided for in the Terms of Service.

If you do not revoke the request within that period, Ganko deletes the account and associated data from its active systems, except for what must be kept for legal reasons, security, fraud prevention, handling of disputes or defence of rights.

Ganko revokes the tokens of linked providers. Achievements and benefits managed by Apple or Google, including Ad-free, may remain with the store according to the platform's rules. Providers acting independently keep data in accordance with their own notices. For banned users, Ganko may retain the minimum necessary for security, fraud prevention, enforcement of the Terms of Service, defence of rights or legal obligations.

12MINORS

Wordeex is intended for users aged 14 or over. If applicable law or store conditions require a higher minimum age, that threshold applies.

In Italy, for information society services, a minor who has turned 14 can give privacy consent independently where the processing is based on consent. Below that age, in the cases provided for by law, consent must be given or authorised by the person exercising parental responsibility.

Ganko may adopt proportionate age or parental-authorisation checks when required by law, by the service or by store conditions. Store ratings do not replace these requirements. For minor users Ganko applies particular caution to personalised advertising, attribution and tracking, and to the publication of the username or the sharing of puzzles in the Community.

For reports concerning a minor you can write to [email protected].

13YOUR RIGHTS

Where applicable law so provides, you can ask Ganko for:

• access to your personal data and to information on its processing;
• rectification of inaccurate data or completion of incomplete data;
• erasure of data, where the conditions are met;
• restriction of processing in the cases provided for by law;
• objection to processing based on legitimate interest and, where provided for, to marketing;
• portability of the data you provided, in the cases provided for;
• withdrawal of consent at any time, without affecting the lawfulness of the previous processing;
• meaningful information about the logic involved and the right to contest an automated decision, as well as human review where applicable.

Wordeex allows you to change your username. Where provided for by law, Ganko provides an export of the personal data associated with the account. To exercise your rights write to [email protected]. Requests are handled within the time limits set by law; before replying Ganko may verify your identity using the UID, linked email, provider check, transaction data or other proportionate information.

You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the competent authority of the country where you live or work, where provided for by applicable law.

14CHANGES TO THIS NOTICE

Ganko may amend this notice to reflect changes to the app, to providers or to the law. Material changes are communicated in the app.

If a new purpose requires consent, Ganko requests a separate choice before starting the relevant processing.

15LEGAL REFERENCES

Regulation (EU) 2016/679 (GDPR), Arts. 5–8, 12–13, 15–22, 24–28, 32, 35 and 44–46; Italian Legislative Decree No. 196 of 30 June 2003, Arts. 2-quinquies, 122 and 130; Italian Data Protection Authority, Decision of 15 January 2020, No. 7; Italian Data Protection Authority, Decision of 7 July 2022, No. 242.