Privacy Policy

Effective Date: 8 August 2026
Last Updated: 8 August 2026
Version: 1.0

1. Introduction

This Privacy Policy explains how Syraverse Limited ("Syraverse", "we", "us" or "our") collects, uses, stores, shares and protects personal information when you access or use the Syraverse Platform, website, Marketplace, applications, APIs and related services (collectively, the "Services").

We are committed to protecting your privacy and handling personal information in accordance with applicable data protection laws, including:

• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018;
• where applicable, the EU General Data Protection Regulation (EU GDPR); and
• other applicable privacy and data protection legislation.

This Privacy Policy applies to all users of the Services, including individual participants, parents or guardians, brands, agencies, game studios, enterprise customers, developers and other organisations using the Platform.

By using the Services, you acknowledge that your personal information may be processed as described in this Privacy Policy.

Where your use of a particular Service is governed by additional privacy information or notices, those notices will supplement this Privacy Policy.

2. Who We Are

Syraverse Limited ("Syraverse", "we", "us" or "our") is the provider of the Syraverse Platform and is the data controller responsible for the personal information processed through the Services, except where this Privacy Policy or a separate agreement states otherwise.

| | | |---|---| | Company Name | Syraverse Limited | | Company Number | 15017789 | | General Enquiries | hello@syraverse.com | | Privacy Enquiries | hello@syraverse.com | | Registered Office | 32 De Montfort Street, Leicester, Leicestershire, LE1 7GD, United Kingdom |

2.1 Data Controller

For the purposes of applicable data protection legislation, Syraverse Limited is generally the data controller of the personal information collected through the Services.

In certain circumstances, Organisations using the Services (such as brands, agencies, game studios or enterprise customers) may also act as independent data controllers or processors in relation to personal information collected through their Campaigns or integrations.

Where this applies, the relevant Organisation's own privacy policy may also govern how your personal information is processed.

2.2 Data Protection Officer

Syraverse has not appointed a Data Protection Officer (DPO) because it is not currently required to do so under applicable data protection legislation.

Privacy matters are managed by our internal privacy team.

If Syraverse appoints a DPO in the future, this Privacy Policy will be updated with the relevant contact details.

2.3 Regulatory Authority

If you are located in the United Kingdom and believe that we have not handled your personal information appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

If you are located in another jurisdiction, you may also have the right to contact your local data protection authority.

We encourage you to contact us first so that we have the opportunity to resolve your concerns before you approach a supervisory authority.

3. Scope of this Privacy Policy

This Privacy Policy applies to the personal information processed by Syraverse when you access or use the Services.

The Services include, without limitation:

• the Syraverse website;
• the Syraverse Platform;
• the Syraverse Marketplace;
• user accounts;
• participation Campaigns;
• digital rewards and collectibles;
• mobile applications;
• APIs and developer tools;
• software development kits (SDKs);
• integrations with third-party platforms;
• customer support services; and
• any other products or services that reference this Privacy Policy.

This Privacy Policy applies whether you access the Services as:

• an individual participant;
• a parent or legal guardian;
• a brand representative;
• an agency representative;
• a game studio or developer;
• an enterprise customer;
• a partner;
• a supplier; or
• another authorised user of the Platform.

3.1 Third-Party Services

This Privacy Policy applies only to personal information processed by Syraverse.

The Services may contain links to, integrate with or enable access to third-party websites, applications, games, payment providers, retailers, event organisers, social media platforms and other services.

Those third parties operate independently and have their own privacy policies and practices.

Syraverse is not responsible for the privacy practices or content of third-party services. We encourage you to review their privacy policies before providing them with your personal information.

3.2 Organisation Campaigns

Some Campaigns are created or operated by Organisations using the Syraverse Platform.

Depending on how a Campaign is structured, the relevant Organisation may act as a separate data controller or processor in relation to personal information collected through that Campaign.

Where this applies, the Organisation's own privacy policy may also govern the processing of your personal information.

3.3 Regional Differences

Certain features, products or services may only be available in specific countries or regions.

The way personal information is processed may vary where required to comply with applicable local laws or regulatory requirements.

Where additional privacy notices are required for particular jurisdictions or Services, they will supplement this Privacy Policy.

4. Personal Information We Collect

The personal information we collect depends on how you interact with the Services, the features you use and the choices you make.

We may collect the following categories of personal information.

4.1 Identity Information

This may include:

• your name;
• username or display name;
• date of birth or age verification information;
• profile photograph or avatar;
• organisation name;
• job title;
• account identifiers;
• verification information where required.

4.2 Contact Information

This may include:

• email address;
• telephone number;
• postal address;
• billing address;
• shipping address;
• country or region.

4.3 Account Information

This may include:

• account credentials;
• encrypted passwords;
• authentication information;
• account preferences;
• profile settings;
• language preferences;
• accessibility preferences;
• account status;
• subscription information.

4.4 Participation & Campaign Information

As a participation platform, Syraverse may collect information relating to your participation in Campaigns and activities, including:

• Campaign registrations;
• completed missions;
• achievements;
• participation history;
• reward eligibility;
• progress;
• leaderboard activity;
• attendance verification;
• event participation;
• QR code interactions;
• purchase verification where applicable;
• participation timestamps.

4.5 Marketplace & Transaction Information

Where you use the Marketplace or purchase products or services, we may collect:

• order information;
• transaction history;
• redeemed rewards;
• digital collectibles;
• loyalty information;
• payment status;
• invoice information.

Syraverse does not store full payment card details. Payment information is processed by authorised payment providers.

4.6 Device & Technical Information

We may automatically collect technical information including:

• IP address;
• browser type;
• operating system;
• device identifiers;
• device model;
• app version;
• referring website;
• crash reports;
• diagnostics;
• network information;
• cookies and similar technologies.

4.7 Location Information

Depending on your device settings and your choices, we may collect:

• country;
• region;
• approximate location;
• event location verification;
• location required to participate in specific Campaigns.

Where precise location information is required, we will request your permission where required by law.

4.8 Communications

We may collect information relating to communications with Syraverse, including:

• customer support enquiries;
• feedback;
• surveys;
• chat messages;
• emails;
• telephone communications where applicable.

4.9 Marketing Preferences

We may collect information about:

• your communication preferences;
• marketing consent choices;
• newsletter subscriptions;
• campaign interests;
• promotional preferences.

You may change your marketing preferences at any time.

4.10 User Content

Where you choose to submit content to the Services, we may collect:

• photographs;
• videos;
• documents;
• comments;
• reviews;
• uploaded files;
• social content;
• campaign submissions;
• profile information.

You remain responsible for any User Content you choose to share.

4.11 AI & Platform Usage Information

Where AI-powered or automated platform features are available, we may process information relating to:

• prompts submitted to AI features;
• AI-generated outputs;
• feature usage;
• interaction history;
• platform activity;
• recommendations;
• engagement analytics.

4.12 Information from Third Parties

We may receive personal information from third parties, including:

• Organisations operating Campaigns;
• identity verification providers;
• payment providers;
• authentication providers;
• social login providers;
• analytics providers;
• fraud prevention providers;
• game platforms;
• retail partners;
• event partners;
• publicly available sources where permitted by law.

Special Category Data

Syraverse does not intentionally collect special category personal information (such as information relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health information or information concerning a person's sex life or sexual orientation) unless:

• you voluntarily provide it;
• it is necessary for a specific Service;
• we have a lawful basis to process it; and
• appropriate safeguards are in place.

Where required by law, we will obtain your explicit consent before processing special category personal information.

5. How We Collect Your Personal Information

We collect personal information from a variety of sources depending on how you use the Services.

5.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

• create an Account;
• complete your profile;
• participate in Campaigns;
• redeem Rewards;
• purchase products or services;
• contact customer support;
• submit feedback;
• enter competitions or promotions;
• upload User Content;
• communicate with us;
• register for events;
• subscribe to newsletters or marketing communications.

You are responsible for ensuring that the information you provide is accurate and up to date.

5.2 Information Collected Automatically

When you access or use the Services, certain information is collected automatically through your browser, device or application.

This may include:

• device information;
• browser information;
• operating system;
• IP address;
• pages viewed;
• features used;
• participation activity;
• session information;
• crash reports;
• diagnostic information;
• cookies and similar technologies;
• performance metrics;
• security logs.

Some of this information is necessary for the operation, security and improvement of the Services.

5.3 Information from Organisations

Where you participate in Campaigns or use Services provided by an Organisation, we may receive information from:

• brands;
• agencies;
• game studios;
• enterprise customers;
• retailers;
• event organisers;
• loyalty programme operators;
• other authorised Organisations using the Platform.

This may include participation information, reward eligibility, verification information and other data necessary to operate the relevant Campaign or Service.

5.4 Information from Third-Party Providers

We may receive personal information from trusted third-party providers, including:

• identity verification providers;
• payment providers;
• authentication providers;
• fraud prevention providers;
• analytics providers;
• cloud service providers;
• communication providers;
• customer support platforms;
• marketing platforms;
• game platforms and integrations.

We only receive the information necessary to provide the relevant Services.

5.5 Social Sign-In and Connected Accounts

If you choose to sign in using a third-party account (such as Google, Apple or another supported authentication provider), we may receive certain profile information in accordance with your privacy settings and the permissions you grant.

The information we receive depends on the provider and your account settings.

5.6 APIs and Platform Integrations

Where Organisations integrate with the Syraverse Platform using APIs, SDKs or other approved integrations, we may receive information necessary to:

• authenticate users;
• verify participation;
• process Campaigns;
• deliver Rewards;
• operate Marketplace features;
• improve platform functionality;
• maintain security.

Such integrations operate in accordance with applicable agreements between Syraverse and the relevant Organisation.

5.7 Cookies and Similar Technologies

We collect certain information through cookies, pixels, software development kits (SDKs), local storage and similar technologies.

These technologies help us:

• operate the Services;
• remember your preferences;
• analyse platform usage;
• improve performance;
• detect fraud and abuse;
• personalise your experience;
• measure the effectiveness of marketing and Campaigns.

Further information is available in our Cookie Policy.

5.8 Publicly Available Information

Where permitted by applicable law, we may obtain information from publicly available sources for purposes including:

• fraud prevention;
• identity verification;
• business verification;
• regulatory compliance;
• protecting the security and integrity of the Platform.

We only collect such information where there is a lawful basis to do so.

5.9 Information from Parents or Guardians

Where a child is permitted to use the Services in accordance with our Terms of Service, we may collect personal information from a parent or legal guardian where necessary to:

• verify parental consent;
• manage the child's Account;
• administer participation in age-appropriate Campaigns;
• respond to support requests;
• comply with applicable child privacy laws.

We take additional care when processing personal information relating to children and apply appropriate safeguards in accordance with applicable legislation.

6. How We Use Your Personal Information

Syraverse uses personal information only where necessary to provide, operate, improve and protect the Services, fulfil our contractual and legal obligations, support our users and Organisations, and develop new products and features.

We will only process personal information where we have a lawful basis for doing so.

We may use your personal information for the following purposes.

6.1 Providing the Services

We use personal information to:

• create and manage your Account;
• authenticate users;
• provide access to the Platform;
• deliver Marketplace functionality;
• administer Campaigns;
• verify participation;
• issue and redeem Rewards;
• process transactions;
• provide customer support;
• personalise your experience;
• manage subscriptions and memberships.

6.2 Operating Participation Campaigns

As a participation platform, Syraverse processes personal information to:

• register Campaign participants;
• verify eligibility;
• track participation;
• validate completed missions and activities;
• administer competitions and promotions;
• distribute digital and physical Rewards;
• maintain participation history;
• prevent duplicate or fraudulent participation;
• generate participation insights for authorised Organisations.

6.3 Operating the Marketplace

Where you use the Marketplace, we may process personal information to:

• process purchases and redemptions;
• manage digital collectibles and Rewards;
• fulfil orders;
• arrange delivery where applicable;
• manage billing and invoicing;
• process refunds where appropriate;
• prevent fraudulent transactions.

6.4 Improving the Services

We continually improve the Platform using information about how it is used.

This may include:

• analysing feature usage;
• improving usability;
• developing new products;
• testing new functionality;
• measuring platform performance;
• identifying technical issues;
• improving accessibility;
• enhancing customer experience.

Where possible, we use aggregated or anonymised information for these purposes.

6.5 Security and Fraud Prevention

We process personal information to protect users, Organisations and the Platform by:

• detecting fraud;
• preventing abuse;
• investigating suspicious activity;
• protecting Accounts;
• enforcing our Terms and policies;
• monitoring platform security;
• responding to security incidents;
• maintaining audit logs.

6.6 Communications

We may use personal information to:

• respond to enquiries;
• provide customer support;
• send service notifications;
• confirm transactions;
• provide account updates;
• notify you about Campaign activity;
• respond to legal requests;
• communicate operational changes.

These communications are generally necessary to provide the Services and are not marketing communications.

6.7 Marketing

Where permitted by applicable law, we may use personal information to:

• send newsletters;
• promote new Services;
• inform you about new Campaigns;
• invite you to events;
• provide product updates;
• share relevant offers.

You may unsubscribe from marketing communications at any time using the unsubscribe link in our emails or by updating your communication preferences.

6.8 Personalisation

We may personalise your experience by:

• recommending Campaigns;
• recommending Rewards;
• suggesting Marketplace content;
• remembering your preferences;
• presenting relevant content;
• improving search results;
• tailoring user experiences.

Where required by law, personalisation will only occur with your consent.

6.9 Artificial Intelligence and Automation

Where AI-powered or automated features are available, we may process personal information to:

• assist with Campaign creation;
• improve search and discovery;
• generate recommendations;
• automate moderation;
• detect fraud;
• improve customer support;
• enhance platform efficiency;
• develop future AI-assisted Services.

Where appropriate, AI processing will be subject to human oversight and applicable legal safeguards.

6.10 Legal and Regulatory Compliance

We may process personal information where necessary to:

• comply with applicable laws;
• respond to lawful requests from regulators or public authorities;
• exercise or defend legal claims;
• maintain financial and accounting records;
• meet tax obligations;
• comply with anti-fraud and security requirements;
• enforce our legal rights.

6.11 Business Operations

We may use personal information to support the operation of our business, including:

• internal administration;
• financial reporting;
• auditing;
• risk management;
• corporate governance;
• business planning;
• mergers, acquisitions or business restructuring, where appropriate safeguards are applied.

Where personal information is transferred as part of a business transaction, we will ensure that it remains protected in accordance with this Privacy Policy and applicable law.

7. Legal Bases for Processing Personal Information

Syraverse only processes personal information where we have a lawful basis to do so under applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU General Data Protection Regulation (EU GDPR).

Depending on the circumstances, we rely on one or more of the following lawful bases.

7.1 Performance of a Contract

We process personal information where it is necessary to perform a contract with you or to take steps at your request before entering a contract.

This includes processing necessary to:

• create and manage your Account;
• provide access to the Platform;
• administer Campaigns;
• verify participation;
• deliver Rewards;
• operate the Marketplace;
• process purchases and subscriptions;
• provide customer support;
• authenticate users;
• fulfil our contractual obligations.

Without this processing, we may be unable to provide some or all of the Services.

7.2 Legitimate Interests

We process personal information where it is necessary for our legitimate interests or the legitimate interests of our users, Organisations or business partners, provided those interests are not overridden by your rights and freedoms.

These legitimate interests may include:

• operating and improving the Services;
• maintaining platform security;
• detecting and preventing fraud;
• protecting users and Organisations;
• improving customer experience;
• analysing platform performance;
• developing new products and features;
• responding to enquiries;
• managing our business operations;
• protecting our legal rights.

Where we rely on legitimate interests, we carefully consider the impact on your privacy and implement appropriate safeguards.

7.3 Consent

In certain circumstances, we rely on your consent before processing personal information.

This may include:

• sending marketing communications where consent is required;
• using non-essential cookies or similar technologies;
• processing precise location information;
• processing special category personal information where required by law;
• other processing activities where consent is the appropriate legal basis.

You may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

7.4 Legal Obligation

We process personal information where necessary to comply with legal or regulatory obligations.

This may include:

• responding to lawful requests from regulators or public authorities;
• complying with tax and accounting obligations;
• maintaining legally required records;
• preventing fraud and financial crime;
• complying with court orders or other legal processes;
• meeting applicable regulatory requirements.

7.5 Vital Interests

In exceptional circumstances, we may process personal information where necessary to protect the vital interests of an individual or another person.

We expect this lawful basis to apply only in rare situations.

7.6 Public Task

Syraverse does not generally process personal information on the basis that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

If this changes in relation to a specific Service, we will update this Privacy Policy or provide additional privacy information.

7.7 Multiple Lawful Bases

In some circumstances, more than one lawful basis may apply to the same processing activity.

For example, processing personal information to operate a Campaign may be necessary both to perform a contract with you and to pursue our legitimate interests in operating and improving the Platform.

Where multiple lawful bases apply, Syraverse will rely on the basis that is most appropriate for the relevant processing activity.

8. Artificial Intelligence & Automated Decision-Making

Syraverse may use artificial intelligence ("AI"), machine learning and other automated technologies to enhance the Services, improve user experiences and support the operation of the Platform.

We design and operate these technologies responsibly and in accordance with applicable data protection laws.

8.1 How We Use AI

AI-powered or automated technologies may be used to:

• assist users in creating Campaigns;
• recommend Campaigns, Rewards or Marketplace content;
• improve search and discovery;
• personalise certain aspects of the Services;
• analyse platform usage;
• detect fraudulent or suspicious activity;
• assist with customer support;
• improve moderation processes;
• generate analytics and insights;
• enhance the performance and reliability of the Platform.

Where possible, we use aggregated or anonymised information when developing and improving AI-powered features.

8.2 Automated Processing

Some platform functions may involve automated processing of personal information.

Examples include:

• fraud detection;
• spam prevention;
• account security monitoring;
• verification of Campaign participation;
• Reward eligibility checks;
• content moderation;
• system performance optimisation.

These automated processes help us operate the Services safely, securely and efficiently.

8.3 Human Oversight

Where automated systems identify activity that may require action, appropriate human review may be carried out before significant decisions are made, particularly where required by applicable law.

Our aim is to ensure that automated technologies support decision-making rather than replace appropriate human judgement.

8.4 Automated Decision-Making

Syraverse does not generally make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

If we introduce Services that involve solely automated decision-making with significant effects, we will:

• inform affected individuals;
• explain the nature of the processing where required by law;
• provide information about the safeguards that apply;
• provide an opportunity to request human review where legally required.

8.5 AI Improvement

We may use information relating to interactions with AI-powered features to improve the quality, accuracy, security and performance of those features.

Where personal information is used for this purpose, it will be processed in accordance with this Privacy Policy and applicable data protection legislation.

8.6 Your Responsibilities

If you use AI-assisted features, you remain responsible for reviewing any content, recommendations or outputs before relying on them.

AI-generated outputs may contain inaccuracies, omissions or information that is not appropriate for your particular circumstances.

AI-generated content should not be treated as legal, financial, medical or other professional advice.

8.7 Future AI Features

As the Syraverse Platform evolves, we may introduce additional AI-powered capabilities.

Where those features involve materially different processing of personal information, we will update this Privacy Policy or provide additional privacy information before those features are introduced where required by applicable law.

9. Sharing Your Personal Information

Syraverse does not sell your personal information.

We only share personal information where necessary to operate the Services, fulfil our contractual and legal obligations, protect the Platform, or where you have requested or authorised us to do so.

Depending on how you use the Services, we may share personal information with the following categories of recipients.

9.1 Organisations Operating Campaigns

Where you participate in a Campaign operated by a brand, agency, game studio, retailer, event organiser or other Organisation, we may share personal information that is necessary to:

• verify your eligibility;
• confirm participation;
• administer Campaigns;
• deliver Rewards;
• validate completed activities;
• provide Campaign reporting;
• investigate fraud or abuse.

The information shared will be limited to what is reasonably necessary for the relevant Campaign.

The Organisation's own privacy policy may also apply to its processing of your personal information.

9.2 Service Providers

We work with trusted third-party service providers that help us operate the Services.

These providers may include:

• cloud hosting providers;
• payment providers;
• customer support providers;
• identity verification providers;
• authentication providers;
• email and communication providers;
• analytics providers;
• fraud prevention providers;
• infrastructure providers;
• software providers;
• security providers.

These providers are only permitted to process personal information on our behalf and in accordance with our instructions, applicable law and appropriate contractual safeguards.

9.3 Business Partners

Where necessary to provide specific Services, we may share limited personal information with approved business partners, including:

• retail partners;
• fulfilment providers;
• logistics providers;
• event partners;
• loyalty programme partners;
• digital reward providers;
• technology integration partners.

Information shared will be limited to what is reasonably necessary to provide the relevant Service.

9.4 Payment Providers

Payments made through the Services are processed by authorised third-party payment providers.

Syraverse does not store full payment card information.

Payment providers process your payment information in accordance with their own privacy policies and applicable legal requirements.

9.5 Legal and Regulatory Authorities

We may disclose personal information where we reasonably believe disclosure is necessary to:

• comply with applicable laws;
• respond to lawful requests from courts, regulators or public authorities;
• protect the rights, property or safety of Syraverse, our users or others;
• investigate fraud or unlawful activity;
• enforce our Terms or other legal rights.

9.6 Professional Advisers

Where reasonably necessary, we may share personal information with professional advisers acting under duties of confidentiality, including:

• legal advisers;
• accountants;
• auditors;
• insurers;
• financial advisers;
• compliance advisers.

9.7 Corporate Transactions

If Syraverse is involved in:

• a merger;
• an acquisition;
• an investment transaction;
• a business restructuring;
• the sale of all or part of its business or assets; or
• another corporate transaction,

personal information may be disclosed to prospective purchasers, investors, advisers or other relevant parties as part of that process.

Appropriate confidentiality obligations and legal safeguards will apply.

9.8 Public Information

Certain information may be visible to other users where you choose to make it available.

For example:

• your display name;
• profile image;
• achievements;
• participation history;
• leaderboard position;
• public comments;
• publicly shared Campaign content.

You control many of these visibility settings through your Account where those options are available.

9.9 With Your Consent

Where appropriate, Syraverse may share personal information with other organisations where you have requested, authorised or expressly consented to that sharing.

You may withdraw your consent at any time, although this will not affect processing that took place before consent was withdrawn.

9.10 We Do Not Sell Personal Information

Syraverse does not sell personal information to third parties.

Where we provide reporting or analytics to Organisations operating Campaigns, this is done as part of providing the Services and not as the sale of personal information.

Where possible and appropriate, reports are provided using aggregated, anonymised or pseudonymised information.

9.11 Safeguards

Whenever Syraverse shares personal information, we take reasonable steps to ensure that:

• the recipient has a legitimate need to receive the information;
• appropriate contractual protections are in place where required;
• the information shared is limited to what is necessary;
• applicable privacy and data protection laws are complied with;
• appropriate technical and organisational security measures are maintained.

10. International Transfers of Personal Information

Syraverse operates internationally and may transfer, store or process personal information in countries outside the United Kingdom or the European Economic Area (EEA).

Where personal information is transferred internationally, we take appropriate steps to ensure that it continues to receive an adequate level of protection in accordance with applicable data protection laws.

10.1 When International Transfers Occur

International transfers may occur where:

• our service providers operate internationally;
• cloud infrastructure is located in multiple countries;
• Organisations operating Campaigns are located in different jurisdictions;
• support services are provided across multiple regions;
• authorised partners process information on our behalf;
• business operations require international collaboration.

10.2 Safeguards

Where required by applicable law, Syraverse will only transfer personal information internationally where appropriate safeguards are in place.

These safeguards may include:

• adequacy regulations or adequacy decisions recognised by the UK Government or the European Commission;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the European Commission's Standard Contractual Clauses (SCCs);
• the European Commission's Standard Contractual Clauses (SCCs);
• approved codes of conduct or certification mechanisms where available;
• other transfer mechanisms permitted under applicable law.

10.3 Service Providers

Some of our trusted service providers may process personal information outside your country of residence.

Before engaging such providers, Syraverse undertakes appropriate due diligence and requires contractual commitments designed to protect personal information and comply with applicable data protection legislation.

10.4 Security Measures

Where personal information is transferred internationally, we implement appropriate technical and organisational measures to protect it.

Depending on the nature of the transfer, these measures may include:

• encryption in transit and at rest;
• access controls;
• authentication requirements;
• contractual confidentiality obligations;
• monitoring and auditing;
• security incident response procedures;
• data minimisation principles.

10.5 Your Rights

You may contact us if you would like further information about the safeguards we use when transferring personal information internationally.

Where required by law, we will provide information about the relevant transfer mechanism, subject to protecting confidential commercial information and the security of our systems.

10.6 Changes to International Transfers

As Syraverse grows, we may engage additional international service providers or expand our operations into new regions.

Where such changes materially affect how your personal information is transferred internationally, we will update this Privacy Policy and, where required by law, provide additional notice.

11. Data Retention

Syraverse retains personal information only for as long as necessary to fulfil the purposes for which it was collected, including providing the Services, complying with legal obligations, resolving disputes, enforcing our agreements and protecting the security and integrity of the Platform.

When personal information is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with applicable law and our internal data retention procedures.

11.1 How We Determine Retention Periods

The length of time we retain personal information depends on a number of factors, including:

• the type of personal information;
• the purpose for which it was collected;
• the Services you use;
• whether you continue to maintain an Account;
• legal and regulatory requirements;
• contractual obligations;
• security and fraud prevention needs;
• the need to establish, exercise or defend legal claims.

11.2 Account Information

We generally retain Account information for as long as your Account remains active.

If you close your Account, we will begin the process of deleting or anonymising your personal information unless we are required or permitted to retain it for longer.

Certain information may continue to be retained where necessary to:

• comply with legal obligations;
• resolve disputes;
• prevent fraud;
• maintain security;
• enforce our agreements;
• protect the rights of Syraverse, our users or third parties.

11.3 Campaign and Participation Information

Information relating to Campaign participation, Reward redemptions, Marketplace activity and participation history may be retained for an appropriate period where necessary to:

• administer Campaigns;
• validate Rewards;
• investigate fraud;
• resolve disputes;
• provide reporting to authorised Organisations;
• comply with legal or regulatory obligations.

Where possible, historical reporting will use aggregated, anonymised or pseudonymised information.

11.4 Financial Records

Where Syraverse processes payments or financial transactions, relevant records may be retained for the periods required under applicable accounting, taxation and financial legislation.

11.5 Security Information

Security logs, audit records and fraud prevention information may be retained where reasonably necessary to:

• protect the Platform;
• investigate security incidents;
• detect fraudulent activity;
• comply with legal obligations;
• maintain the integrity of our systems.

11.6 Backup Copies

Personal information may continue to exist in secure backup systems for a limited period after deletion from active systems.

Backup copies are protected using appropriate security measures and are retained only for disaster recovery, business continuity and system restoration purposes before being securely overwritten or deleted in accordance with our backup retention procedures.

11.7 Anonymised Information

Where personal information has been irreversibly anonymised so that it can no longer identify an individual, Syraverse may retain and use that information for purposes including:

• platform analytics;
• service improvement;
• research and development;
• statistical reporting;
• business planning.

Anonymised information is no longer considered personal information under applicable data protection laws.

11.8 Retention Schedule

Syraverse maintains internal data retention schedules that define appropriate retention periods for different categories of information.

Retention periods are reviewed periodically to ensure they remain appropriate, proportionate and compliant with applicable legal and regulatory requirements.

A summary of our retention approach may be made available upon request or included in an annex to this Privacy Policy where appropriate.

12. Your Privacy Rights

Depending on where you are located and the applicable data protection laws, you may have certain rights in relation to your personal information.

Syraverse is committed to respecting those rights and will respond to requests in accordance with applicable legal requirements.

You may exercise your rights by contacting us using the details provided in this Privacy Policy.

12.1 Right of Access

You have the right to request confirmation of whether Syraverse processes your personal information.

Where we do, you may request access to:

• the personal information we hold about you;
• the purposes for which it is processed;
• the categories of information involved;
• the recipients or categories of recipients;
• the expected retention period where available;
• information about your privacy rights; and
• details of any international transfers where applicable.

You may also request a copy of your personal information, subject to applicable legal requirements.

12.2 Right to Rectification

You have the right to request that inaccurate or incomplete personal information be corrected.

Where possible, you may update certain information directly through your Account settings.

12.3 Right to Erasure

You may request that we delete your personal information where:

• the information is no longer necessary;
• you withdraw consent where consent is the legal basis;
• you successfully object to processing;
• the information has been processed unlawfully; or
• deletion is otherwise required by applicable law.

This right is not absolute and may not apply where we are required or permitted to retain information for legal, regulatory, security or legitimate business purposes.

12.4 Right to Restrict Processing

You may request that we restrict the processing of your personal information in certain circumstances, including where:

• you contest its accuracy;
• processing is unlawful but you oppose deletion;
• we no longer require the information but you need it for legal claims; or
• you have objected to processing and we are considering your request.

12.5 Right to Data Portability

Where processing is based on your consent or a contract and carried out by automated means, you may request a copy of your personal information in a structured, commonly used and machine-readable format.

Where technically feasible, you may also request that the information be transferred directly to another organisation.

12.6 Right to Object

You have the right to object to certain types of processing, including processing based on our legitimate interests.

Where you object, we will consider your request and cease processing unless we have compelling legitimate grounds to continue or another lawful basis applies.

You also have the right to object at any time to the processing of your personal information for direct marketing purposes.

12.7 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

12.8 Rights Relating to Automated Decision-Making

Where applicable law provides such rights, you may request:

• information about automated decision-making;
• human review of certain automated decisions;
• the opportunity to express your point of view; and
• the ability to challenge certain decisions made solely through automated processing.

As described in this Privacy Policy, Syraverse does not generally make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

12.9 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us using the contact details provided in this Privacy Policy.

To protect your privacy and security, we may request information to verify your identity before responding to your request.

We will respond within the timeframes required by applicable law.

In certain circumstances, we may refuse or partially refuse a request where permitted by law. If this happens, we will explain the reasons for our decision unless we are legally prevented from doing so.

12.10 Complaints

If you are unhappy with how Syraverse has handled your personal information, we encourage you to contact us first so that we have the opportunity to resolve your concerns.

If you remain dissatisfied, you may lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom or with another competent supervisory authority in the jurisdiction where you live or work, where applicable.

Exercising your privacy rights will not affect your ability to access the Services except where the exercise of a particular right makes it impossible for us to continue providing a specific Service.

13. Children's Privacy

Syraverse is committed to protecting the privacy and safety of children who use the Services.

Certain Services and Campaigns may be designed for or accessible to younger users, subject to our Terms of Service, applicable laws and any age restrictions established by the relevant Campaign or Organisation.

Where required by applicable law, we will seek appropriate consent from a parent or legal guardian before collecting or processing a child's personal information.

13.1 Age-Appropriate Services

Not all Services or Campaigns are intended for children.

Certain features, products or Campaigns may:

• have minimum age requirements;
• require parental or guardian consent;
• be restricted to adults;
• require additional verification before participation.

Organisations operating Campaigns are responsible for ensuring that their Campaigns comply with applicable laws relating to children where those Campaigns are directed at or intended for children.

13.2 Information We Collect

Where permitted by applicable law, we may collect personal information relating to children where necessary to:

• create and manage Accounts;
• verify parental or guardian consent where required;
• administer participation in Campaigns;
• deliver Rewards;
• provide customer support;
• maintain platform security;
• comply with legal obligations.

We collect only the personal information reasonably necessary for these purposes.

13.3 Parents and Guardians

Parents and legal guardians may, where applicable and subject to appropriate verification:

• provide or withdraw consent;
• review personal information relating to their child;
• request correction of inaccurate information;
• request deletion of personal information where permitted by law;
• contact Syraverse regarding their child's use of the Services.

Requests may be subject to identity verification and other reasonable security measures.

13.4 Children's Safety

Syraverse takes additional steps to help protect children using the Services.

These measures may include:

• age-appropriate privacy settings;
• data minimisation;
• appropriate security controls;
• parental consent mechanisms where required;
• restrictions on certain features or communications;
• additional monitoring of child-focused Services where appropriate.

13.5 Campaigns Operated by Organisations

Some Campaigns available through the Platform are operated by brands, agencies, game studios or other Organisations.

Where an Organisation operates a Campaign directed at children, that Organisation is responsible for ensuring its Campaign complies with applicable child privacy, consumer protection and advertising laws.

Syraverse may require Organisations to demonstrate compliance with applicable legal requirements before permitting such Campaigns to be made available through the Platform.

13.6 Educational and Youth Activities

Where the Services are used in connection with educational, youth or community programmes, Syraverse expects participating Organisations to obtain any permissions, consents or approvals required under applicable law before providing personal information to the Platform.

13.7 Reporting Concerns

If you believe that a child has provided personal information to Syraverse in circumstances that do not comply with this Privacy Policy or applicable law, please contact us immediately.

We will investigate the matter and take appropriate action, which may include restricting access, removing information or requesting additional verification where appropriate.

14. Security of Your Personal Information

Syraverse is committed to protecting the confidentiality, integrity and availability of personal information.

We maintain appropriate technical and organisational measures designed to safeguard personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful forms of processing.

While we take reasonable steps to protect personal information, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure.

14.1 Security Measures

Depending on the nature of the Services, Syraverse may implement security measures including:

• encryption of personal information in transit using industry-standard protocols;
• encryption of sensitive information at rest where appropriate;
• strong authentication mechanisms;
• role-based access controls;
• multi-factor authentication for administrative access where appropriate;
• secure password management;
• network security controls;
• logging and monitoring;
• vulnerability management;
• secure software development practices;
• regular security reviews and testing;
• malware protection;
• backup and disaster recovery procedures.

Security measures are reviewed periodically and updated as appropriate.

14.2 Access Controls

Access to personal information is restricted to authorised personnel, contractors and service providers who require access in order to perform their duties.

Those individuals are subject to appropriate confidentiality obligations and receive training relevant to the protection of personal information where appropriate.

14.3 Security Monitoring

Syraverse monitors the security of the Platform to help detect:

• unauthorised access;
• suspicious activity;
• fraud;
• misuse of the Services;
• attempted attacks;
• technical vulnerabilities;
• other security threats.

Where appropriate, security events may be investigated to protect users, Organisations and the Platform.

14.4 Your Responsibilities

You also play an important role in protecting your personal information.

You are responsible for:

• keeping your Account credentials confidential;
• using a strong and unique password;
• enabling additional security features where available;
• keeping your devices and software up to date;
• notifying Syraverse promptly if you believe your Account has been compromised.

14.5 Security Incidents

If Syraverse becomes aware of a personal data breach, we will investigate the incident promptly and take appropriate steps to contain, assess and remediate the issue.

Where required by applicable law, we will:

• notify the relevant supervisory authority;
• notify affected individuals where required;
• cooperate with regulatory authorities;
• take reasonable steps to reduce the impact of the incident.

14.6 Third-Party Service Providers

Where Syraverse engages third-party service providers to process personal information on our behalf, we seek to ensure they maintain appropriate technical and organisational security measures consistent with applicable legal and contractual requirements.

14.7 Continuous Improvement

Security threats continue to evolve.

Syraverse regularly reviews and improves its security practices, technologies and procedures to help maintain an appropriate level of protection for personal information and the Services.

We may introduce additional safeguards, certifications or security controls as our Platform and business continue to grow.

15. Cookies & Similar Technologies

Syraverse uses cookies and similar technologies to provide, secure and improve the Services.

These technologies help us remember your preferences, maintain the security of the Platform, understand how the Services are used and, where permitted, personalise your experience.

Depending on your location and applicable law, we will request your consent before placing non-essential cookies or similar technologies on your device.

15.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website or use certain online services.

Similar technologies may include:

• pixels;
• web beacons;
• local storage;
• software development kits (SDKs);
• device identifiers; and
• other technologies that perform similar functions.

15.2 Types of Cookies We Use

Depending on the Services you use, Syraverse may use the following categories of cookies and similar technologies.

Strictly Necessary Cookies

These cookies are essential for the operation and security of the Services.

They help us to:

• authenticate users;
• maintain secure sessions;
• remember privacy preferences;
• protect against fraud;
• ensure the Platform functions correctly.

These cookies cannot generally be disabled through our cookie preference tools because they are necessary to provide the Services.

Functional Cookies

Functional cookies help us remember your preferences and improve your experience.

These may include remembering:

• language preferences;
• accessibility settings;
• user interface preferences;
• regional settings;
• account preferences.

Analytics Cookies

Analytics cookies help us understand how users interact with the Services.

This information allows us to:

• improve usability;
• measure performance;
• identify technical issues;
• understand feature usage;
• improve customer experience.

Where required by law, analytics cookies are used only with your consent.

Marketing Cookies

Where permitted, marketing cookies may be used to:

• measure the effectiveness of marketing campaigns;
• deliver more relevant advertising;
• understand how users discover our Services;
• prevent repeated advertising;
• improve promotional activities.

Marketing cookies will only be used where required consent has been obtained.

15.3 Managing Cookies

You can manage your cookie preferences through:

• our cookie preference centre where available;
• your browser settings;
• your device settings;
• any consent management tools made available through the Services.

Please note that disabling certain cookies may affect the functionality or availability of some features of the Services.

15.4 Third-Party Cookies

Some cookies or similar technologies may be provided by trusted third-party service providers acting on our behalf.

These providers may assist with:

• website functionality;
• analytics;
• customer support;
• security;
• content delivery;
• marketing measurement.

Where required by law, these technologies will only be used with your consent.

15.5 Cookie Policy

Further information about the cookies and similar technologies used by Syraverse, including details of specific cookie categories, retention periods and how to manage your preferences, is available in our separate Cookie Policy.

Our Cookie Policy forms part of this Privacy Policy where applicable.

16. Changes to this Privacy Policy

Syraverse may update this Privacy Policy from time to time to reflect changes to:

• our Services;
• our technology;
• applicable laws or regulations;
• industry standards;
• security practices;
• business operations; or
• the way we collect, use or protect personal information.

We encourage you to review this Privacy Policy periodically to stay informed about how we process and protect your personal information.

16.1 Notification of Changes

Where appropriate, we may notify users of changes to this Privacy Policy by:

• publishing an updated version on our website;
• updating the "Last Updated" date shown at the beginning of this Privacy Policy;
• displaying notices within the Services;
• sending email notifications;
• notifying Organisations through their administrative accounts; or
• using other reasonable communication methods.

The method of notification will depend on the nature and significance of the changes.

16.2 Material Changes

Where we make material changes that significantly affect how we process personal information, we will take reasonable steps to bring those changes to the attention of affected users before the changes take effect where required by applicable law.

Where required, we will seek your consent before processing personal information in a materially different manner than previously disclosed.

16.3 Continued Use of the Services

Your continued use of the Services following the effective date of an updated Privacy Policy indicates that you acknowledge the revised Privacy Policy.

Where applicable law requires your explicit consent for certain changes, we will obtain that consent before relying on the updated processing activities.

16.4 Previous Versions

Previous versions of this Privacy Policy may be retained for legal, regulatory, audit or record-keeping purposes.

Where appropriate, earlier versions may be made available upon reasonable request, unless doing so would be impracticable or prohibited by law.

17. Contact Information

If you have any questions about this Privacy Policy, your personal information or how Syraverse processes personal information, please contact us using the details below.

We are committed to responding to privacy enquiries promptly and in accordance with applicable data protection laws.

17.1 Data Controller

Syraverse Limited

• Company Number: 15017789
• Email: hello@syraverse.com
• Registered Office: 32 De Montfort Street, Leicester, Leicestershire, LE1 7GD, United Kingdom

17.2 Privacy Enquiries

For questions relating to this Privacy Policy or our handling of personal information, please contact:

Email: hello@syraverse.com

Where appropriate, please include sufficient information to help us identify your request. We may ask you to verify your identity before disclosing or modifying personal information.

17.3 Exercising Your Privacy Rights

If you wish to exercise any of your privacy rights described in this Privacy Policy, including requests to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing;
• request data portability; or
• withdraw consent where applicable,

please contact us at:

Email: hello@syraverse.com

We will respond within the timeframes required by applicable law.

17.4 Security and Data Protection Concerns

If you believe your Account has been compromised, become aware of a potential security issue or have concerns regarding the protection of your personal information, please contact us as soon as possible at:

Email: hello@syraverse.com

Prompt reporting helps us investigate and respond appropriately.

17.5 Complaints

If you are dissatisfied with how Syraverse has handled your personal information, we encourage you to contact us first so that we have the opportunity to resolve your concerns.

If you remain dissatisfied, you may have the right to lodge a complaint with the supervisory authority responsible for data protection in your jurisdiction.

For individuals in the United Kingdom, the relevant supervisory authority is the Information Commissioner's Office (ICO).

Further information about making a complaint to the ICO is available at: https://ico.org.uk/

If you are located in another country or territory, you may also have the right to contact your local data protection authority.

17.6 Effective Date

• Effective Date: August 2026
• Last Updated: August 2026
• Version: 1.0