Privacy Policy

PowerZ is a video game aiming at developing curiosity and fostering education of any child between 6 to 12-year-old with traditional video game mechanisms. We are strongly committed to protecting the privacy of our users and providing a safe online environment for children, educators, and parents to collaborate and advance learning. This Privacy Policy outlines what information we collect and why we collect it, how this information is used and shared, and what your options are regarding your personal information (accessing, updating and deleting your information). This Privacy Policy applies to all products and services provided by PowerZ SAS. (hereinafter called "PowerZ", "we", "us", or "our").

Last Modified Date: December 16, 2021

Overview

Personally Identifiable Information (PII) is any information you provide to us that personally identifies you, like your name or email address, or other information which could be reasonably linked to such identifying information by us. We will only collect, use, and share your personal information in accordance with this Privacy Policy.

What is PowerZ and who uses it?

PowerZ is a video game aiming at developing curiosity and fostering education of any children between 6 to 12-year-old with traditional video game mechanisms. We have embedded a powerful in game artificial intelligence to provide children with a totally dedicated pedagogical path and adaptive learning experience based on their capacities and constantly enhance their experience. By playing PowerZ, children can discover and learn different subjects ranging from mathematics, physics, geography, languages to astronomy, philosophy, or archeology as well as develop their creativity. We are deeply convinced that every children should be granted an equal right to Education, so we have decided to provide a free educational and open world game with the possibility to support the project through a “Pay-as-you-like” model. Parents can also track their children’s progression by accessing real-time reports on their children’s in game activities (e.g. identify specific topics or improvement area) and also customize the learning path by catering subjects in the game.

What information does PowerZ collect and why?

PowerZ collects information in a number of different ways in order to provide a completely personalized education experience for each child, and to provide real-time reporting and assessment features to parents. We do not ask for or require children to provide personal information beyond that which is reasonably necessary to use PowerZ. Information collected from children is never used or disclosed for third-party advertising or any kind of behaviorally targeted advertising, and it is never sold or rented to anyone, including marketers or advertisers.

If a child / parent is registering to play PowerZ

PowerZ collects the minimum amount of information from children to allow for a personalized educational experience and to facilitate progress monitoring for parents. The children's username and password are used to allow them to securely log in to PowerZ's game via PowerZ's website and applications. The children's fictional avatar name is used to display their avatar online to other players and is named after the children’s first name. The children's parent's email address is used to inform parents that their child has registered for an account on PowerZ. As children play, PowerZ collects information on the game features they interact with, pedagogical contents they interact with, questions they answer and level progression (hereinafter referred to as "Performance Data"). PowerZ uses children's Performance Data to customize their educational experience, including finding an optimal path to maximize children's pedagogical experience. Performance Data from one or more children may also be aggregated and used by PowerZ to improve PowerZ' educational algorithms. In addition to the information entered by the child, PowerZ automatically collects some information from any use of our Service as set forth in the "Automatically Collected Information" section. If a parent is registering to play PowerZ When parents sign up for an account on PowerZ, PowerZ asks for:

  • Full name
  • Email address Password
  • Birth date (on IOS and Google play only)

A parent's name, email address and password are used for identification purposes and to allow the parent to securely log in to PowerZ' parent dashboard. Email addresses are also used to communicate important information about the parent's account via email. Parents who sign up for a paid membership to PowerZ are asked for their credit card number, address, postal/zip code, country, card expiration date, and Card Verification Code (CVC), in addition to all the information required for a free parent account (listed in the paragraph above). This information is used by PowerZ to apply the appropriate charges to the parent's credit card, and to ensure that the membership is applied to the correct parent account. PowerZ does NOT directly store any credit card information - all credit card information and transactions are stored by our payment provider, Stripe (Please click here for more information about how Stripe secures customer information), Apple (Please refer to Apple website for more information about how Apple secures customer information) and Google (Please to Google Play Store website for more information about how Apple secures customer information). In addition, PowerZ automatically collects some information from any use of our Service as set forth in the "Automatically Collected Information" section. 3. How does PowerZ protect and secure my information? Protecting your information is extremely important to us. In addition to annual staff training to ensure the security and confidentiality of child's records, we take several precautions to ensure that user information is secure: Password protection - Secure passwords are the first line of defense for your parent/child account. In order to prevent unauthorized access to your account, we recommend choosing a password that is memorable but hard to guess, and keeping your password confidential at all times. Additional information on password safety is available on the Government of Canada's website, the US Department of Homeland Security's website, and at ConnectSafely.org. SSL encryption - PowerZ protects any information transferred through our website by encrypting it with the Secure Socket Layer (SSL) protocol by default. This makes it more difficult for malicious third parties to intercept your information. (à vérifier si on le fait aussi ?) Salted hashing - Passwords and other sensitive information are never stored in plain text, and are instead protected via salted hashes. 3

Independent service-level APIs - Childrens' PII is only available through a select few APIs. This minimizes the impact of a potential breach of any individual API. (à vérifier si on le fait aussi ?) Database protection - PowerZ databases are inaccessible to all IP addresses except for a pre-specified list of whitelisted IP addresses. All databases are also password protected. Periodic data review - Our team periodically reviews our data collection, storage, and processing policies and practices against leading industry standards to ensure that we are compliant. While we do our best to keep your data secure, PowerZ cannot guarantee the security of your data. Several factors including, but not limited to, hardware/software failure, outages, human error, attacks, or unauthorized use may compromise the security of our users' information. In the case of a data security breach, we will do our best to alert any affected users electronically via our website, the email account you have provided, and/or another medium that we deem appropriate, depending on the magnitude and severity of the breach. A security breach notification will be written in plain language and will be titled "Notice of Data Breach." The breach notification will include the following information: What happened What information was involved What we are doing about the breach What you can do Contact information 4. What children information is visible to others within PowerZ' virtual world? Since PowerZ is an online multiplayer game, children are able to interact with other players within our virtual world. However, we do take several precautions to ensure that any Personally Identifiable Information (PII) is only visible to an authorized parent within their password-protected PowerZ's account, and is not available to the public or other players within PowerZ's virtual world. Information that is visible to other players within PowerZ's virtual world includes: 4

Avatar names - This avatar name is displayed to others in the PowerZ's world, to protect the children's real identity. It is named after the children’s selected first name when creating their accounts. However, we strongly advise children against using their real full name or other personal information Avatar profiles - A children's avatar's appearance, clothing, items, and key game statistics (e.g. achievement, construction, house, etc) are available for other players to view in the game. This does not include any of the child's personal information. 5. Does PowerZ share data with third parties? As a website trusted by educators, parents, and children worldwide, PowerZ is committed to never selling or leasing your or your chidren personal information with third parties. Prior to engaging into a relationship with a third-party service provider, PowerZ will first review their privacy policies and ensure that these are compliant with those regulations that PowerZ is adhering to and that they are aware that PowerZ is directed to children. Third-party service providers will have their privacy policies reviewed by PowerZ on an annual basis to ensure that any changes made do not affect compliance with all applicable legislations. We value your privacy, and hence restrict sharing your data with third parties, with the exception of the following circumstances: Service providers - PowerZ uses various vendors, partners, and service providers to help us deliver our services to our users. For example, we use a mail service called Mailjet to deliver emails to our users on our behalf, as it would take a lot of resources for us to develop our own email delivery platform. As a result, some of your information, including Personally Identifiable Information, may be shared with our service providers in order for them to perform their tasks. Wherever possible, we ensure that we only share the minimal amount of information for the respective service provider to perform their service. We carefully vet all of our service providers and ensure that they protect and secure your information in a way that is consistent with this Privacy Policy. Analytics services - PowerZ doesn't uses third-party analytics services to protect and secure your information in a way that is consistent with this Privacy Policy. Non-personally identifiable information - PowerZ may share aggregated, non- personally identifiable information with the public for marketing or other purposes. For 5

example, we may share data on the percentage of children on PowerZ who use the game every week our marketing materials. None of this information will contain any Personally Identifiable Information about individual users. Legal requirements - PowerZ may share our users' information if we are legally obligated to do so to comply with the law. In these cases, we will disclose only the information that is deemed a legal necessity by the applicable law, so as to protect the rights and safety of our users. Change of control - In the case that PowerZ is acquired or merges with a third party, your data will still be protected as per the terms outlined in this Privacy Policy. In the case that PowerZ goes out of business or files for bankruptcy, we will protect your personal information, and will not sell it to any third party. Consent - PowerZ reserves the right to share your or your children's information with your explicit consent, given verbally, on paper, or electronically. 6. Parental Choices We understand that as a parent or legal guardian of a child, controlling your child's information and access to online resources can be difficult. If a child signs up for a PowerZ account independently, we require the child to enter a parent's email address so that an email can be sent to their parent seeking the parent's consent for the child to engage with our services. While we do our best to protect your child's information and provide them with an awesome educational experience, legal parents or guardians do have the right to request that their child's account be deleted by contacting us (or doing it from the parent's app). In order to do so, we may require verification of the parent or guardian's identity, and verification that they are the legal parent and/or guardian of that child. For example, we automatically track your approximate location to provide you with the most relevant pedagogical contents. 7. Automatically Collected Information In addition to information that you provide, PowerZ (and our Service Providers or Analytics Services) may also collect certain information automatically while you are engaging with our Service in order to track trends, help us to improve our service, and provide a more customized experience to our users. 6

This automatically collected information includes but is not limited to: device information, location information, session information, browser information, and cookies and similar technologies. Generally we collect this information through a variety of technologies, including cookies, web beacons, pixel tags, file information and similar technologies. Cookies and related technology allow us to provide you with a better user experience. For example, we may use the data collected through cookies to: (a) remember information so that a user will not have to re-enter it during subsequent visits; (b) provide custom, personalized content and information as relevant to our provision of the services to you; (c) to identify you across multiple devices; (d) to provide and monitor the effectiveness of our product and services; (e) monitor aggregate metrics such as total number of visitors, traffic, and usage on our website and our products and services; (f) diagnose or fix technology or technical problems; (g) otherwise plan for and enhance our products and services. To assist with this, we may collect information about your device and its software, such as your IP address, browser type, Internet service provider, platform type, device type, operating system, date and time stamp, a unique identifier that allows us to uniquely identify your browser, mobile device or your account, and other similar information. We may also collect information about the way you use our website, products and services, for example, the site from which you came and the site to which you are going when you leave our website, the pages you visit, the links you click, how frequently you access the product, whether you open emails sent by PowerZ or click links contained within those emails, whether you access the product from multiple devices or our mobile application, mobile carrier, device type, model and manufacturer, mobile device operating system, brand and model. We may be able to determine your approximate location by analyzing other information, a device’s location by analyzing other information, like an IP address to associate a user with their curriculum. We may also collect analytics data, or use third-party analytics tools, to help us measure traffic and usage trends for the website, product and services. Although we do the best we can to honour the privacy preferences of our users, we are not able to respond to Do Not Track signals from your browser at this time. 8. How can I view, modify, or delete my information? As a parent, you can view and/or modify your information through your password protected PowerZ account. Your PowerZ account also allows you to view and/or modify 7

information for your child(ren). As a parent, you have the ability to contact us at any time to review Personally Identifiable Information and categories of data being held in education records. While we would be sad to see you go, you are able to request to delete your account at any time by writing to us. You are also able to request to delete your child's account as long as you have a parent account that is linked to that child. In this event, we will delete your and/or your child's personal information from our systems, and will remove access from the account within 10 business days of your request. Please send your written request to: dpo@PowerZ.tech 9. How will PowerZ notify me of changes to this Privacy Policy? We are committed to keeping your data private and secure, and as technology, privacy laws, and best practices evolve over time, we will do our best to keep this Privacy Policy up-to-date. For minor changes which do not reduce your rights under this Privacy Policy, we will notify our users via our website and/or directly by email (using the email address provided). For more major changes, we will notify our users directly by email (using the email address provided). We encourage all users to review this Privacy Policy from time to time and write to us with any questions or concerns. If you do not agree with any updates, you have the option of terminating your account and discontinuing your use of our services. However, by continuing to use our services after a change to this Privacy Policy, you are agreeing to accept the changes and the terms of the updated Privacy Policy in their entirety. 10. How can I contact PowerZ with privacy questions? If you have any questions or concerns about our Privacy Policy, please contact our support team at: dpo@PowerZ.tech 11. California resident privacy rights Subject to certain limitations, the California Consumer Privacy Act (“CCPA”) provides California residents with specific rights regarding their personal information. For the purposes of this section, personal information has the meaning set out in the CCPA and does not include information that is publicly available, that is de-identified or aggregated 8

as such. This section describes the rights applicable to California residents and explains how to exercise those rights. Under the CCPA, California residents have the following rights : Right to request or access personal information. You have the right to request certain information about our collection and use of your personal data over the past 12 months. If you make such a request we will provide you with: the categories of personal information that we have collected about you; the categories of sources from which that personal information was collected; the business or commercial purpose for collecting your personal information; the categories of third parties with whom we have shared your personal information, if any, and, if applicable, the categories of personal information shared with each category of third party; and the specific pieces of personal information that we have collected about you. Right to delete. You are entitled to request that we delete the personal information that we have collected from you, subject to certain exceptions. If you request that we delete personal information we will take commercially reasonable steps to comply with that request in accordance with applicable laws. Right to opt out. You have the right to opt out of any sales of personal information that may be occurring or may occur in the future. We will not sell your personal information and have not done so since PowerZ creation. Right to not be discriminated against. You have the right to be free from discrimination for exercising these rights. We will not discriminate against you for exercising your rights under the CCPA. We will not deny you access to our services, charge you different prices or rates, or provide you with a lower level of services if you exercise your rights under the CCPA. Please note, that if the exercise of these rights limits our ability to process personal information, we may no longer be able to provide you with our products and services. To exercise your rights set out above, you must send us a request that (a) provides sufficient information for us to verify that you are the person about whom we have collected personal information and (b) describes your request in enough detail to allow us to understand, assess and respond to it (a “Valid Request”). If we receive a request that does not meet these criteria we may not respond to it. For a Valid Request, we will work to respond to the request within 45 days of receipt.