PERSONAL DATA PROTECTION POLICY

OF REPOS PRODUCTION AND SOMBREROS PRODUCTION (B2C)

We attach great importance to the protection of personal data that we process in the course of our activities.

This privacy policy details how we process your personal data.

This privacy policy defines our approach to the processing of your personal data that we collect from you or that third parties lawfully communicate to us, and the purposes of such processing. It also describes your rights with regard to our processing of your personal data.

We may collect personal data from you in the course of our activities, including when you use our website https://shop.rprod.com and our applications 7 Wonders, 7 Wonders Duel, 7 Wonders Companion, Time's Up! Party, Time's Up! Familiy, Doctor Panic (the "Site" or the "Sites"), when you participate in game tests or contests, when you contact us or request information. We may also receive data about you from social networks when you use our accounts.

1. Who is responsible for processing your personal data?

2. Minimum age

3. What personal data do we collect about you?

4. How do we use your personal data?

5. With whom do we share your personal data?

6. How long do we keep your personal data?

7. Security of your personal data

8. What are your rights?

9. Contact and complaints

10. Update of this Policy

1. Who is responsible for processing your personal data?

The private limited liability company Repos Production, whose registered office is located at Rue des Comédiens 22, 1000 Brussels, and registered with the Crossroads Bank for Enterprises under number 0863.606.935 (hereinafter "Repos Production") and the private limited liability company Sombreros Production whose registered office is located at Rue des Comédiens, 22, 1000 Brussels and registered with the Crossroads Bank for Enterprises under number 0535.709.224 (hereinafter "Sombreros Production"), represented by Mr Thomas PROVOOST, are joint controllers for processing your personal data.

2. Minimum age

Preserving the safety and privacy of children is very important to us. We do not voluntarily collect or use personal data from persons under the age of 13 without the consent of both the child and the holder of parental responsibility. You also confirm that you are at least 13 years old when you provide your personal data in connection with the use of our products or services. If you are not at least 13 years old, you must ask your parents or legal guardian for permission to provide us with your personal data. To do so, please contact us at the coordinates indicated in section 9 below.

3. What personal data do we collect?

We collect the information you provide us about yourself, including:

§ Your identification data such as your first and last name, address(s), company, telephone number (landline or mobile), email address, username, password and birthdate,

§ Your personal characteristics such as title of civility, language,

§ Your connection data (IP addresses, cookies) when you use our Sites; for more information, we invite you to consult our Cookie Policy,

§ Your personal behaviours, habits and activities (including your personal gaming habits and activities: connection, cards played, scores, number of games played, etc.) when you use our Sites,

§ Your additional data provided when you register, place an online order and make requests on this occasion, such as the items chosen, delivery and billing address,

§ Data related to incidents that may occur while using the Sites and/or the communication channels we offer,

§ Any other information relating to the provision of our services, and to respond to your requests.

The personal data to which we have access via social networks when you use our accounts are:

§ Your identification data such as your first and last name, ID, profile photo, birthdate,

§ Your connection data (IP addresses, cookies),

§ Your personal characteristics such as language and city,

§ Your personal data designated as public on these networks as well as the data contained in the private messages you send us via these networks.

4. How do we use your personal data?

We process your personal data for the following purposes. Whenever we process your personal data, we do so on the basis of a legal "ground" (or legal basis) for processing, which we have identified in the table below.

Purposes

Legal basis

1.

To respond to your requests for certain products and services and to perform the contracts to which you are a party.

This processing is necessary for the performance of the contract entered into between you and Repos Production and/or Sombreros Production or for the execution of pre-contractual measures taken at your request.

2.

To manage your personal account on shop.rpod.com and our applications

This processing is necessary for the performance of the contract entered into between you and Sombreros Production and/or Repos Production.

3.

To administer contests or other promotional events, and inform winners.

This processing is necessary for the performance of the contract entered into between you and Repos Production and/or Sombreros Production and/or one of their partners.

4.

For game tests

This processing is based on your prior consent at the time of registration. You have the right to withdraw your consent at any time.

5.

To answer your requests and complaints.

This processing is based on your prior consent.

6.

To provide you with commercial information about our products and services.

This processing is based on our legitimate interest in keeping our customers informed of our products and services, as it helps us to ensure the sustainability and development of our activities.

However, where the law requires that Repos Production and/or Sombreros Production obtain your consent before sending you such information, Repos Production and/or Sombreros Production will rely on your prior consent to proceed with the processing.

7.

To comply with any applicable law, court order, legal process, or the requirements of a regulatory body.

This processing is necessary to comply with our legal obligations.

8.

To optimise navigation on the Sites

We consider that it is in our legitimate interest to optimise our Sites.

9.

To improve our products and services

We consider it in our legitimate interest to improve our products and services.

10.

To enforce our legal rights and obligations and for any legal proceedings involving you, initiated by or against you.

We consider that it is in our legitimate interest to protect our organisation against any breach of a legal obligation owed to it and to defend ourselves in the event of a dispute.

11.

To protect the rights of third parties.

We consider that we have a legitimate interest in ensuring that our activities do not violate the rights of third parties.

12.

In anticipation of and/or in connection with a commercial transaction such as a merger, acquisition, restructuring or sale.

We consider that it is in our legitimate interest to be able to make decisions about the future of our company in an informed manner, in order to preserve and develop our business activities.

13.

To ensure the security of your data

We consider that it is in our legitimate interest to ensure the security of your data.

14.

To perform statistics such as marketing

This processing is based on your prior consent.

5. With whom do we share your personal data?

We may therefore share your personal data, according to our needs, with the following categories of recipients:

§ Third party service providers (maintenance, storage, payment, logistics, marketing services, etc.), to which Repos Production and Sombreros Production use for the purposes described in section 4 above,

Our main processors are:

- For the application development and support of applications 7 Wonders, 7 Wonders Duel, Time's Up Party, Time's Up Family: the French simplified joint stock company (‘SAS’) OUTER ZONE ENTERTAINMENT whose registered office is located at 31190 Miremont (France), chemin de Mazade, 64, 812 235 448 R.C.S. Toulouse,

- For the hosting of information systems: the French simplified joint stock company CTS COMPUTERS AND TELECOMMUNICATIONS SYSTEMS – MAGIC ONLINE, whose registered office is located at 93100 Montreuil (France), avenue du Président Wilson, 130, 378 499 073 R.C.S. Bobigny,

- For internal storage and instant messaging: the Irish company MICROSOFT IRELAND OPERATIONS LIMITED, whose registered office is located in Dublin 2 (Ireland), Sir Rogerson's Quay, 70, commercial register number 256796,

- For promotional communications: the French simplified joint stock company (‘SAS’) MAILJET, whose registered office is located at 75012 Paris (France), rue de l’Aubrac, 13/13 bis 498019298 R.C.S. Paris,

- For the productivity, collaboration and organisational tools of our teams: the American company ASANA Inc. whose head office is located in San Francisco, CA 94103 (United States), Bryan Street, 1550, Suite 200,

- For the management of the internal agenda: the American company SCHEDAPPLE LLC whose registered office is located at A307 Cheyenne Wyoming (United States), Capitol Avenue, 1603, Suite 310, company number 2015-000684737,

- For e-mail messaging: the Swedish company ONE.COM GROUP AB, whose registered office is located at 215 32 Malmö (Sweden), Hyllie Stationstorg, 2, organisation number 559205-2400,

As well as:

- Our professional advisors such as lawyers, accountants and auditors,

- Shareholders,

- Government or regulatory authorities,

- Professional insurers or any other relevant types of insurers,

- Supervisory authorities / tax authorities / company registers, and

- Banks.

Please note that this list is not exhaustive and that there may be other cases where we share your data with third parties, when this is in the legitimate interest of Repos Production and Sombreros Production, permitted by applicable law, or when it is necessary to comply with a legal obligation to which we are subject or necessary for the performance of the contract concluded between you and Repos Production and/or Sombreros Production.

In this context, your personal data may be transferred outside the European Economic Area (EEA) to countries that do not offer a level of protection for your personal data equivalent to that enjoyed by you within the EEA, such as the United States, etc. In the absence of a decision on the adequacy of the European Commission, the transfer of your personal data will be governed by standard contractual clauses adopted by the European Commission or the Privacy Shield.

6. How long do we keep your personal data?

We keep your personal data as long as necessary for the purposes for which they were collected. As a general rule, we keep your personal data for as long as is strictly necessary to manage the business relationship with you. However, we keep your personal data used for commercial prospecting purposes for an additional period of three years from the end of the commercial relationship.

In addition, we may retain some of your personal data for a longer period of time, in particular when we are required to do so by law or when such data is necessary to prove a right or contract. In this case, your personal data will be archived and stored for the duration imposed by the applicable regulations, or for the duration of the applicable statute of limitations.

When your personal data are no longer required, we will ensure that they are either deleted or made anonymous.

7. Security of your personal data

We are committed to ensuring the security of your personal data and have put in place information systems security policies and appropriate technical rules and measures to protect them against unauthorised access, modification, use and disclosure or unlawful destruction or accidental loss of such data.

All our partners, employees, consultants and data processors who have access to personal data and are involved in their processing are required to respect their confidentiality.

8. What are your rights?

You have a number of rights over your personal data. Each of these rights is further detailed below:

· Withdrawal of consent. You may withdraw your consent to any processing of your personal data based on your consent at any time. The withdrawal of your consent shall not affect the lawfulness of the processing operation based on your consent prior to such withdrawal.

· Access. You may ask us to confirm whether we process your personal data and, if so, inform you of the characteristics of the processing of your personal data, allow you access to it and obtain a copy.

· Correction. You may ask us to correct or complete your personal data if it is incorrect or incomplete.

· Erasure. You may ask us to erase your personal data in the following cases: when they are no longer necessary for the purposes for which they were collected; you have withdrawn your consent; following the exercise of your right of opposition; your personal data have been unlawfully processed; or to comply with a legal obligation. We are not obliged to comply with your request to delete your personal data, in particular if their processing is necessary to comply with a legal obligation or to establish, exercise or defend legal rights.

· Limitation. You may ask us to limit the processing of your personal data (i.e. to keep them without using them) when: their accuracy is contested; their processing is unlawful but you do not want them to be deleted; they are still necessary for the establishment, exercise or defence of legal rights; we check the existence of compelling reasons in the context of the exercise of your right of opposition. We may continue to use your personal data following a request for restriction: with your consent; for the establishment, exercise or defence of legal claims; or to protect the rights of any other natural or legal person.

· Portability. You may ask us to provide you with your personal data in a structured, commonly used and machine-readable format, or you may request that they be transmitted directly to another controller, but only if the processing is based on your consent or on the performance of a contract concluded with you, and if the processing is automated.

· Opposition to phone solicitation. If you provide us with your telephone number but do not wish to be the subject of commercial prospecting by telephone, you can register for free on the list of opposition to telephone solicitation "Do not call me again! " by following the link https://www.dncm.be/en/.

· Opposition to the processing of personal data based on legitimate interest. You may object to any processing of your personal data that is based on our "legitimate interest" (see section 4). If you exercise this right, we must stop processing, unless we can demonstrate the existence of legitimate and compelling reasons that prevail over your fundamental rights and freedoms, or for the establishment, exercise or defence of legal rights.

· Opposition to the processing of personal data for marketing purposes. You may at any time object to the processing of your personal data for the purpose of prospecting.

You can exercise your rights with regard to both Repos Production and Sombreros Production towards Repos Production, which assumes the obligation to act on them for both entities by completing this form and sending it to the following e-mail address: gdpr@rprod.com

You also have the right to file a complaint with the Data Protection Authority (DPA). A form is available on the DPA website: https://www.autoriteprotectiondonnees.be. The complaint must then be sent either by email: contact@apd-gba.be, or by post to the DPA address: Rue de la Presse 35 in 1000 Brussels.

9. Contact and complaints

For more information about your rights or for any complaint or question concerning the protection of your personal data, please contact Repos Production:

· by mail to the following address: Repos Production - Rue des Comédiens, 22 - 1000 Brussels
· by e-mail to the following address: gdpr@rprod.com

10.Update of this Policy

We may amend this Privacy Policy from time to time, for example to take into account legal changes, technological advances and good business practices. We will inform you in case of any material changes.