Privacy Notice for MARVEL SNAP
Last Updated: May 10


This privacy notice (the “Privacy Notice”) is designed to provide users (“you”) of Marvel Snap (the “Game”) with clear information relating to how Second Dinner Studios, Inc., (“Second Dinner” or “we”), as the developer of the Game, processes your personal data or personal information (“Personal Information”) for our own purposes. From a general perspective, Second Dinner is committed to protecting your privacy.


In this Privacy Notice, you will find the following information:

1. Who are we?
2. What Personal Information do we collect from you?
3. Why and how do we use your Personal Information?
4. Who do we share your Personal Information with?
5. How long do we retain your Personal Information?
6. European Specific Information
7. California Privacy Rights
8. Children
9. Modifications to the Privacy Notice
10. Who can you contact if you have queries or complaints?

Who are we?
Second Dinner is a Delaware (US) corporation, with its principal place of business at 2875 Michelle Drive, Suite 200, Irvine, CA 92606, USA.




What Personal Information do we collect from you?
We collect and generally process the Personal Information generated when you use the Game, namely character appearance (i.e., face, body, and equipment), attributes (i.e., level, experience points, and skills), item inventory, purchases and statistical data which are all linked to your account.The Game is distributed by our partner Nuverse (Hong Kong) Limited (“Nuverse”) and we collect Personal Information about you from Nuverse, namely: email address, account information, name, opt-in contact information, compliance-related information (e.g., age gate and self-reported geolocation and unique ID).Please note that Nuverse is also processing your Personal Information for its own purposes and has a separate and independent privacy notice that you are invited to read carefully at Nuverse privacy notice.




Why and how do we use your Personal Information?
We only use Personal Information for the purposes outlined below:

• Provide the Game: We process your Personal information in order to provide you with the Game, ensure the continuation of the services and communicate with you.
• Marketing communications: We process your Personal Information in order to send you marketing communications about our services and products, or those of our partners.
• Migrating your environment: We may process your Personal Information to migrate your environment, including your Personal Information, to another legal entity if we change distributing partners.
• Legal Reasons: We may process your Personal Information to comply with applicable law and the legal obligations to which we are subject (i.e., to detect abuse, fraud and illegal activity), respond to requests from, and other communications with, competent public, governmental, judicial or other regulatory authorities, respond to valid legal process, investigate or participate in civil discovery, litigation, or other adversarial legal proceedings, or protect your rights, property or security and ours, including by investigating potential violations of or enforcing our Terms of Service.

Who do we share your Personal Information with?
For the purposes referred to under this Privacy Notice, we share certain Personal Information with certain recipients. Such recipients will either act as another controller or as data processor acting on behalf and upon our instructions.The data processors with which we may share your Personal Information with our third party services providers (i.e., cloud service and data storage providers, analytics providers or ad networks).In addition, we may communicate your Personal Information to separate controllers, i.e.,:

• our partner distributing the Game (i.e., Nuverse to date);
• any person or authority when disclosure is required by law, regulations or a judicial decision;
• any person or authority if such disclosure is necessary to protect and defend your rights, property or security or ours;
• any other person subject to your prior consent.

We do not sell your Personal Information to third parties.




How long do we retain your Personal Information?
We shall retain your Personal Information for no longer than necessary for the purposes identified under this Privacy Notice.With respect to the services provided to you, we will keep your Personal Information during the period of our contractual relationship, extended by the applicable limitation period.With respect to the processing carried out in order to protect your rights, property and security and ours, Second Dinner will keep your Personal Information for the time of the relevant dispute or statute limitation period.As to the processing carried out in order to comply with a legal obligation, we will keep your Personal Information for the duration of such obligation.Upon expiry of the applicable data retention period, we undertake to erase or irrevocably anonymize the relevant Personal Information.




European Specific Information
Data Subject RightsWhen the General Data Protection Regulation (“GDPR”) applies, you have various rights in relation to the processing of your Personal Information depending on the relevant situation:

• Access to Personal Information processed concerning you;
• Correct inaccurate Personal Information;
• Delete any Personal Information concerning you;
• Restrict processing of your Personal Information;
• Receive your Personal Information provided to us in an interoperable format (data portability);
• Object to the processing on grounds relating to your particular situation.

In order to exercise any of your rights, or if you have any other questions about our use of your Personal Information, please send a request at the contact details specified at the end of this Privacy Notice. Please note that we may request you to provide us with additional information in order to confirm your identity.In any case, you also have the right to lodge a complaint with the competent data protection authority.


Legal Bases for Processing
When the GDPR applies, we rely on the following legal bases when we process your Personal Information:

• Contractual Necessity: We process Personal Information for the management of our relationship on the basis of the contract between Second Dinner and you in order to provide you with the Game, ensure the continuation of the services and communicate with you.
• Consent: We rely on your prior consent in order to send you marketing communications about our services and products, or those of our partners as specified in the relevant consent forms. In this regard, please note that you have the right to withdraw your consent at any time (without calling into question the processing previously carried out) by sending a request at the contact details specified at the end of this Privacy Notice.
• Legitimate Interest: We process Personal Information based on our legitimate interests which consist in: (i) sending you marketing communications regarding our products and services similar to the Game; (ii) migrating your environment, including your Personal Information, to another legal entity if we change of distributing partner; (iii) complying with non-EU laws, responding to requests from, and other communications with, competent public, governmental, judicial or other regulatory authorities and responding to valid legal process, investigate or participate in civil discovery, litigation, or other adversarial legal proceedings; and (iv) protecting your rights, property or security and ours, including by investigating potential violations of or enforcing our Terms of Service.
• Legal Obligations: We process Personal Information to comply with the legal obligations to which we are subject (i.e., to detect abuse, fraud and illegal activity).

Is any of your Personal Information transferred internationally?As we are located in the United States, your Personal Information needs to be transferred to the United States for the purposes referred to under this Privacy Notice.Considering that our partner Nuverse is located in Hong Kong, a country whose legislation has not been recognized by the European Commission as having an adequate level of protection, we ensure that the transfer is governed by the European Commission's standard contractual clauses. In this regard, please note that we will provide you with a copy of applicable safeguards upon request, at the contact details specified at the end of this Privacy Notice.


Children


California Privacy Rights


The California Consumer Privacy Act of 2018 (“CCPA”) provides California residents the right to request:

• Disclosure of our practices: The categories of Personal Information we collect, the categories of sources from which the Personal Information is collected, our purpose(s) for collecting the Personal Information, and the categories of third parties with whom we have shared Personal Information.
• Access to specific pieces of your Personal Information we have collected.
• Deletion of any of your Personal Information we have collected.
• To opt out of “sale”: request that your Personal Information not be sold to third parties. As noted above, we do not sell Personal Information to third parties, and therefore do not provide an option to opt out of the sale of your Personal Information.

As required by the CCPA, we will not discriminate against you for exercising any of these rights.


You may exercise your rights by sending a request to dpo@seconddinner.com. We will acknowledge receipt of your request within 10 business days, and provide a substantive response or notify you of the reason and extension period within 45 days. Under the CCPA, only you or an authorized agent may make a request related to your Personal Information. We must verify your identity to respond to certain requests. We may do so by requiring you to log into the Game, provide information that matches information we’ve already collected about you (e.g., purchases, game statistics), or give a declaration as to your identity under penalty of perjury.


California’s Shine the Light Law
California Civil Code Section 1798.83, also known as “Shine The Light” law, permits California residents to annually request, free of charge, information about the disclosure of their Personal Information (if any) to third parties for the third parties’ direct marketing purposes in the preceding calendar year. We do not share Personal Information with third parties for such purposes.
Do-Not-Track is an initiative that developed a signal that an Internet user may activate to inform websites that the user does not want to have their data tracked. The Game does not currently respond to such signals.


Children
The Game is not intended for children under the age of 13 (under the age of 16 if you are in the EU) and we do not knowingly collect or solicit Personal Information from children under 13 (under 16 if you are in the EU).
If you believe that we have Personal Information about or collected from a child under the relevant age, please contact us at the contact details specified at the end of this Privacy Notice and we will ensure that it is deleted.


Modifications to the Privacy Notice
We reserve the right to change this Privacy Notice at any time. In case there is a substantial change, we will notify you in this respect. If such change to the Privacy Notice requires your consent, you will have the choice to consent as to whether or not we may use your information in a different manner.


Who can you contact if you have queries or complaints?
If you have any questions, you may contact us by email at the following
address: dpo@seconddinner.com.


You can also contact our Data Protection Officer by sending an email to the following
address: dpo@seconddinner.com.