WINNER'S MARKETING, INC.
and its affiliate FUNAMBULIST GAMING, LLC
PRIVACY NOTICE

A. U.S. State Privacy Laws

Residents of certain U.S. states may have rights (now or in the future) under privacy laws in effect in their state, such as the California Consumer Privacy Act (CCPA), Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey Data Privacy Act, Oregon Consumer Privacy Act, Rhode Island Data Transparency and Privacy Protection Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, and any other U.S. privacy law and implementing regulations (collectively, State Privacy Laws). Some of these laws may not take effect until a future date.

While consumers may be covered by an applicable State Privacy Law, some State Privacy Laws may not apply to Funambulist due to the scope of our business, the types of Data involved, statutory exemptions, or limited interactions with consumer residents in certain states. We will adhere to the privacy rights below to the extent they apply to you and to Funambulist.

In general, the State Privacy Laws provide (now or in the future) consumer state residents with rights to:

• Confirm whether we process their Personal Data and access it (the Right to Know);
• Delete certain Personal Data;
• Correct inaccuracies in their Personal Data, taking into account the nature of the information and the Controller’s processing purpose (excluding Iowa and Utah);
• Obtain a copy of their Personal Data (the Right of Data Portability);
• Opt out of Personal Data processing for targeted advertising (excluding Iowa), sales, or profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah);
• Provide consent prior to, revoke consent for, or limit or opt out of the processing of sensitive Personal Data where required by applicable State Privacy Laws; and
• Certain rights to question profiling or automated decisions having legal or similarly significant effects (Minnesota only).

Funambulist may process sensitive Personal Data as described in this Notice, such as Social Security numbers, driver’s license numbers, financial account information, and chat contents where those contents include sensitive information. Funambulist does not make decisions based on algorithms, automated decision-making, or automated profiling that produce legal or similarly significant effects concerning you.

The exact scope of these rights varies by state, may change, and new privacy rights may become applicable as State Privacy Laws and implementing regulations are passed or amended. Funambulist works to maintain this Notice with accurate and relevant information about consumer rights and each State Privacy Law. Please check this section periodically for updates.

B. Privacy Rights for Business Contacts and Workforce Members

Most State Privacy Laws apply to U.S. consumers who are natural persons acting in their personal or household capacities. Some State Privacy Laws do not apply to Personal Data collected in business-to-business (B2B), workforce, or employment contexts, while the CCPA and certain other laws may provide rights or disclosures for those contexts. If you interact with Funambulist as a contractor, employee, worker, job applicant, business representative, customer contact, customer, vendor, or supplier, we will process privacy requests to the extent required by applicable State Privacy Laws and any exceptions that may apply.

To make inquiries or exercise rights based on your interactions with Funambulist in your personal capacity, or to submit a request in a B2B or workforce context where applicable law provides rights, you can contact us directly using one of the methods in the Contact Us section of this Notice.

C. Our Collection, Use, and Disclosure of Personal Data

As noted above, we collect certain Data that identifies, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer. Personal Data does not include the following:

• Publicly available information;
• De-identified or aggregated consumer information; and
• Information excluded from most State Privacy Laws’ scope, such as: personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), and the California Financial Information Privacy Act (FIPA); data collected in the B2B context (except for California consumers, as defined under the CCPA); and data collected in the employment context (except for California consumers, as defined under the CCPA).

Summary of our Data practices over the last twelve (12) months:

Note: Certain items such as sales-tax IDs and operator licenses are collected from Funambulist customers and business contacts in the B2B context and are not consumer Personal Data subject to State Privacy Laws (except as required by the CCPA).

D. Right to Know and Data Portability

If you are protected by an applicable State Privacy Law, you have the right to request access and disclosure of certain information about our collection and use of your Personal Data and to have a copy of that Data (collectively, the right to know). Once we receive a request and confirm the identity of the requestor and the Data subject (see Section 16.F below), we will disclose the following, per the request:

• The categories of Personal Data we collected about you;
• The categories of Personal Data we are processing or have processed;
• The categories of sources for the Personal Data we collected about you;
• Our business or commercial purpose for collecting, selling, sharing, or otherwise processing the Personal Data;
• A list of the categories of third parties with whom we have shared your Personal Data, if any, and the categories of Personal Data shared with each;
• A list of the categories of Personal Data we disclosed about you for a business purpose, if any, identifying the categories of recipients that obtained each category; and
• A copy (if requested) of the specific pieces of Personal Data collected and maintained, in a commonly used electronic format.

If you are protected by the Oregon Consumer Privacy Act or the Minnesota Consumer Data Privacy Act, you have additional rights to obtain a list of the specific third parties to which we have disclosed your Personal Data. Please indicate that you are an Oregon or Minnesota resident when you submit your request.

E. Right to Delete and Correct

If you are protected by an applicable State Privacy Law, you may have the right to request that we delete the Personal Data collected or maintained about you and to correct inaccuracies in that Data, subject to certain exceptions (collectively, the right to delete or correct). Once we receive a request and confirm identity (see Section 16.F below), we will review the request to determine whether an exception applies. We may deny a deletion request if retaining the information is necessary for us or our service providers to:

• Complete the transaction for which we collected the Data, provide a requested good or Service, take actions reasonably anticipated within our ongoing business relationship with the consumer, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with the consumer;
• Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for such activities;
• Debug the Services to identify and repair errors that impair intended functionality;
• Exercise free speech, ensure the right of a consumer to exercise their free-speech rights, or exercise another right provided for by law;
• Comply with applicable state law, including the California Electronic Communications Privacy Act (Cal. Penal Code Sec. 1546 et seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to applicable ethics and privacy laws, when deletion may render the research impossible or seriously impair it, if informed consent was previously provided;
• Comply with a legal obligation; or
• Other purposes as permitted under State Privacy Law.

Upon receipt of a verifiable request, we will delete or de-identify and/or correct Personal Data not subject to an exception, and will direct our service providers to take similar action.

F. Exercising Your Privacy Rights

To exercise the rights to know or delete described above, please submit a request using one of the methods in the Contact Us section of this Notice.

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your Personal Data. You may submit a request to know no more than twice within a twelve (12) month period. Your request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data, or an authorized representative; and
• Describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it.

Verifying Requests. We cannot respond to your request or provide you with Personal Data unless we verify your identity or authority and confirm the Data relates to you. For requests to know and delete, we will attempt to match your identity to Data in our records and may ask for additional information. The Data you provide will be used solely for identity-verification purposes.

Authorized Agents. You may designate an authorized agent to make a request on your behalf, but they must submit proof of authorization. We may deny requests if proof is inadequate. We will not process privacy requests from third-party services that have not passed our verification process; such services are susceptible to spoofing and phishing, and often request that we follow hyperlinks, which we will not engage due to security concerns. If an applicable State Privacy Law allows third-party agents for privacy requests, they must contact us directly using the information in the Contact Us section.

Responses to Requests. We endeavor to respond within 45 days. If more time is needed (up to 90 days), we will provide written notice of the reason for the extension. Responses will be delivered by mail or electronically, and if we cannot comply with a request, we will explain why. For data-portability requests, we will provide your Data in a readily usable electronic format. We may charge a fee if we find requests to be excessive, repetitive, or unfounded; if so, we will explain why and provide a cost estimate before completing the request.

G. Right to Opt Out of Automated Profiling Resulting in Legal or Similarly Significant Effects

Consumer residents of certain states have the right to opt out of the automated processing of their Personal Data for profiling in furtherance of decisions that produce legal or similarly significant effects, such as the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunities, criminal justice, employment opportunities, health-care services, or access to essential goods or services. Funambulist does not make decisions based on algorithms, automated decision-making, automated processing, or profiling that produce legal or similarly significant effects concerning you.

H. Do Not Sell or Share My Personal Data – Opt-Out Rights

Your State Privacy Law may provide the right to opt out of the sale or sharing of your Personal Data and the right to opt out of the use of Personal Data for targeted advertising or cross-context behavioral advertising.

We do not sell Personal Data for monetary or other valuable consideration. We use social media advertising, marketing pixels, cookies, analytics, and similar technologies for marketing, advertising, measurement, and analytics, and some State Privacy Laws may treat these practices as a sale, sharing, targeted advertising, or cross-context behavioral advertising. Our Site uses a consent-management platform to gate tracking and advertising technologies behind user consent and to recognize and honor opt-out preference signals, including GPC. You may also exercise applicable opt-out rights by contacting us using the methods in the Contact Us section.

We disclose some Personal Data to service providers, vendors, affiliates, subsidiaries, customers, and business partners to support our Services and operations, including to process payments, manage the Site, host and process Data, support marketing and advertising, provide analytics, ship or print materials, manage customer support, maintain business records, and comply with legal, tax, and regulatory obligations. See Section 16.C above.

We may collect information considered “sensitive” under State Privacy Laws, including Social Security numbers where applicable, driver’s license numbers, financial account information, bank account and routing information, account credentials, and chat contents where those contents include sensitive information. We do not use or disclose sensitive Personal Data for the purpose of inferring characteristics about you, and we do not sell sensitive Personal Data.

I. Right to Non-Discrimination and No Retaliation

The State Privacy Laws provide consumers the right not to be discriminated against for opting out or exercising privacy rights. Unless permitted by applicable State Privacy Laws, we will not deny goods or Services; charge different prices or rates (including through discounts or penalties); provide a different level or quality of goods or Services; or suggest that you may receive a different price, rate, level, or quality of goods or Services. We do not currently offer a financial-incentive program based on the collection, retention, sale, or sharing of Personal Data. If we later offer such a program, we will provide the required terms and obtain consent where required.