Last updated: September 24, 2021

The DELiGHTWORKS Inc. (the “Company”) global privacy policy (this “Privacy Policy”) provides for the methods of processing personal information of customers (“customers”, “you”) who use the Company’s online fighting game service (the “Service”) in “MELTY BLOOD: TYPE LUMINA” (the “Game”) who access the official website of the Game (the “Website”) located at https://meltyblood.typelumina.com, or who contact the customer support for the Game (the “Customer Support”). The Company is located at 3-6-28 Aobadai, Meguro-ku, Tokyo.

In addition to this Privacy Policy, which applies to all of our customers, the Company has prepared exhibits that may also apply to you depending on the area in which you reside or are located. In such case, please refer to the applicable exhibits. If this Privacy Policy conflicts with the country-specific exhibits, such exhibits will prevail.

1. Categories of personal information subject to processing

The Company collects and processes the following personal information about its customers. Some of it may be collected automatically.

• ID and Password for Game accounts and online accounts (SEN Accounts, Nintendo Accounts and NetworkService Accounts, Microsoft Accounts, or Steam Accounts) of customers who use the Service
• Cookies and other terminal identifiers and attribute information of customers who access the Website (such as, age, gender, interests categories, affinity categories, in-market segments. For more information about interests categories, affinity categories, in-market segments, visit About Demographics and Interests - Analytics Help (google.com))
• IP addresses, provider information, terminal information and web browser information of customers who access the Website
• Names, email addresses, the play time and date of accessing the Game, ID and Password for online accounts (SEN Accounts, Nintendo Accounts, Microsoft Accounts or Steam Accounts), and system requirements of customers who contacted Customer Support
• Other personal information collected by the Company in connection with the Services, the Website, and the Customer Support (if required by applicable laws and regulations, the Company shall obtain such personal information after separately notifying the customers.)

2. Purpose

The Company may process personal information of customers for the following purposes:

• to provide the Service, and to handle faults in the Game and diagnose its problems;
• to analyze the attributes of customers who accessed the Website and improve our customers’ experience when they access the Website;
• to analyze the use of the Website, to maintain, handle faults in and operate and improve the Website, and to diagnose server problems;
• to respond to inquiries made by customers to Customer Support;
• if required, to respond to disputes and litigation and to comply with our legal obligations;
• to conduct other business operations necessary to provide the Service and services incidental thereto;
• to develop new services;
• to send updates, promotions, and marketing materials that may be of interest to you;
• with your consent, or as otherwise disclosed at the time information is collected;
• for our recordkeeping purposes;
• to maintain security of the Service and the Website including preventing fraud and cyber-attacks; and
• for other purposes permitted under applicable laws and regulations.

3. Legal basis, etc. for processing

The Company processes your personal information in accordance with applicable personal information protection regulations. Please refer to the country-specific exhibits regarding the Company’s legal basis for processing.

If the provision of personal information is a statutory or contractual requirement, or a requirement necessary to enter into a contract, the Company will separately notify you. If you do not provide your personal information, the Company may not provide to you the Service or Customer Support services.

For example, the provision of your ID and Password for Game accounts and online accounts (SEN Accounts, Nintendo Accounts and NetworkService Accounts, Microsoft Accounts, or Steam Accounts) is a requirement necessary for you to use the Service.

Furthermore, your IP addresses, provider information, terminal information and web browser information is a requirement necessary for you to access the Website.

4. Retention period for personal information

The Company retains your personal information as long as it is necessary in order to fulfill the purposes of processing personal information as set out above. Specifically, the retention period for each personal information is as follows.

• ID and Password for Game accounts and online accounts (SEN Accounts, Nintendo Accounts and NetworkService Accounts, Microsoft Accounts, or Steam Accounts) of customers who use the Service:
  as long as these platforms provide the Service
• Cookies and other terminal identifiers and attribute information of customers who access the Website:
  within14 months
• IP addresses, provider information, terminal information and web browser information of customers who access the Website:
  6 months
• Names, email addresses, the play time and date of the Game, and ID and Password for online accounts of customers who contacted Customer Support:
  26 months

5. Sources of personal information

The Company obtains all of your personal information from you directly, save for (i)ID and Password for Game accounts and online accounts (SEN Accounts, Nintendo Accounts and NetworkService Accounts, Microsoft Accounts, or Steam Accounts) of customers who use the Service which the Company obtains from platforms providing the Service such as Sony Interactive Entertainment LLC, Nintendo Co., Ltd., Microsoft Corporation and Valve Corporation, and (ii) attribute information of customers who access the Website which the Company obtains from The Website Traffic Analysis Service Provider such as Google LLC.

6. Sharing and disclosure of personal information

The Company shares with and discloses customers personal information to the following third parties in order to fulfil the purpose of processing personal information as set out above.

○ Sharing with Processors (service providers)

• Platforms providing the Service such as Sony Interactive Entertainment LLC, Nintendo Co., Ltd., Microsoft Corporation and Valve Corporation;
• The Game Developer such as Unknown Corporation, TAMSOFT CORPORATION, and GameLoop Inc.;
• The Website Production and Maintenance Service Provider such as RYU'S OFFICE Inc. and Amazon Web Services, Inc.;
• The Customer Support Service Provider such as E-Guardian Inc.;
• The Website Traffic Analysis Service Provider such as Google LLC; and
• Other contractors of the Company

○ Legal compliance, etc.

In some instances, the Company may be required to disclose your personal information to public and governmental authorities within or outside your country of residence in accordance with law and/or requests from such authorities. The Company will also disclose your personal information if the disclosure is necessary or appropriate, due to the purposes of law enforcement or handling other issues of public importance. The Company will also disclose your personal information if the disclosure is reasonably necessary to protect the Company’s rights, to pursue available remedies, to enforce the Company’s terms of use, to investigate fraud, or to protect the Company’s operations or customers.

○ Other

In addition, we may also share personal information of customers with other parties, including the following.

• As part of a corporate sale, merger, or acquisition, or other transfer of all or part of our assets, including as part of a bankruptcy proceeding;
• Cases in which there is a need to protect a human life, body or fortune, and when it is difficult to obtain a principal's consent;
• With your consent;
• Other cases permitted under applicable laws and regulations.

We may share information that has been de-identified or aggregated without limitation.

7. Overseas transfer of personal information

As a result of the above sharing and disclosure, your personal information may be transferred to the following countries.

• United States of America

In such cases, the Company will take proper protection measures required by the personal information protection regulation of each country. For the protection measures of each country, please refer to the country-specific exhibits.

8. Safety management measures

For safety management of customers’ personal information, the Company takes the following safety management measures:

• Formulation of basic policies: to secure proper processing of personal information, the Company will form basic security policies e.g. “compliance with related laws, regulations, guidelines, and the like”, “questions and complaints processing center”, etc.
• Preparation of procedures related to processing of personal information: in each of the steps of acquiring, using, storing, providing, deleting, disposing etc, the Company will form processing procedures for personal information regarding processing methods, responsible persons, persons in charge and their duties etc;
• Organizational safety management measures: the Company will, as well as identifying persons responsible for the processing of customers personal information, clarify which employees will process personal information and the scope of personal information that such employee will process, and prepare a reporting and communication system if a breach of such access rights is found or a breach of any personal information is found (in accordance with applicable personal information protection regulations).
• Human safety management measures: The Company will conduct regular training for employees for important matters regarding processing of personal information.
• Physical safety management measures: In the areas that personal information will be processed, the Company will, as well as managing employees’ access of rooms and limiting devices that would be brought into the room, take measures to prevent access to personal information by persons without authority. The Company will, take measures to prevent robbery, loss or unauthorised access etc. devices, electronic media, documents and anything else containing personal information.
• Technical safety management measures: The Company will limit the number of persons in charge and the scope of personal information databases accessible by persons. The Company will install systems to protect information systems that process personal information from unauthorized access and unauthorized software from outside.
• Grasping the external environment: The Company will take safety management measures after grasping systems regarding protection of personal information in the United States where personal data are stored.

9. Cookies and similar technologies

When a customer accesses the Website and such customer enables cookies, etc. (including tracking technologies such as flash cookies and web beacons, and other technologies; “Cookies, etc.”), the Company may automatically acquire information about the PC, mobile phone, tablet, or other information regarding the communication devices used by the customer etc. If the Company acquires such information, the Company will handle the information as personal information. If you do not wish to use cookies or other tracking technologies, you may disable them by changing your web browser settings.

10. Regarding acquisition of information accompanied by service tools provided by third parties

○ digital advertising and analytics

We may work with third parties that collect data about your use of the Website over time for non-advertising purposes. For example, the system may use Google Analytics for analytics and marketing purposes.
In Google Analytics, user information will be collected by using Cookies, etc. For more information about how Google Analytics collects and uses data when you use our Site, visit http://www.google.com/policies/privacy/partners, and to opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout.

Google Analytics advertising function that the Company uses is as follows:

• Reports on user attributes and interest categories of Google Analytics

The Company and third party vendors including Google Analytics combine first party cookies (or other first party IDs) and third party cookies such as Google advertising cookies (or other third party IDs) to analyze customers attributes and interests.

○ Third-Party Links and Tools

The Website and Service may provide links to third-party websites or apps. We do not control the privacy practices of those websites or apps, and they are not covered by this Privacy Policy. You should review the privacy policies of other websites or apps that you use to learn about their data practices.

The Website also includes integrated social media tools or “plug-ins,” such as social networking tools offered by third parties. If you use these tools to share personal information or you otherwise interact with these features on the Site, those companies may collect information about you and may use and share such information in accordance with your account settings, including by sharing such information with the general public.
Your interactions with third-party companies and your use of their features are governed by the privacy policies of the companies that provide those features. We encourage you to carefully read the privacy policies of any accounts you create and use.

11. Rights of customers

The Company will respect the rights you hold regarding personal information protection regulations applicable to you. Customers may require disclosure of personal information, correction, addition, and elimination of content, suspension and erasure of usage, and suspension of provision to third parties in accordance with Japanese laws regarding protection of personal information. In addition, in personal information protection regulations of each country that will be applied, rights may be granted to customers. For rights granted in each country, please refer to the country-specific exhibits. If you wish to exercise your rights, please make an inquiry using the contact in Article 13 (Contact details) of the Global Privacy Policy.

12. Personal information of children

Regarding personal information of children, the Company will take necessary measures in accordance with applicable laws and regulations. Please refer to the country-specific exhibits for more information.

13. Contact details

For questions and inquiries regarding the Global Privacy Policy, please contact the consultation center stated below:

• For Japanese support　support_ja@typelumina.com
• For English support　support_en@typelumina.com
• For Traditional Chinese support　support_zh-tw@typelumina.com
• For Simplified Chinese support　support_zh-ch@typelumina.com
• For Korean language support　support_ko@typelumina.com

14. Changes to the Global Privacy Policy

The Company may, in making changes to the Global Privacy Policy (including country-specific exhibits), change or add all or part of the Global Privacy Policy by publishing on the Website, sending e-mail to customers, or giving notice by any other method that the Company deems appropriate (subject to applicable laws and regulations, if any). In such case, the amended Global Privacy Policy will be applied from the earlier of the date on which you use the Service, access the Website, or make inquiries to the Customer Support for the first time after receiving such notice or the date stated in such notice. If there are any necessary procedures in personal information protection regulations that will be applied, such procedures will be taken.

Exhibit: EEA (European Economic Area) and UK

Effective date: September 24, 2021

This Exhibit applies to customers located or residing in the EEA (European Economic Area) and the UK. The controller for the purposes of the obligations set out in the Global Privacy Policy and this Exhibit is the DELiGHTWORKS Inc.

1. Legal basis for processing

The legal basis for the Company’s processing of personal information (in this Exhibit “personal information” means the same as “personal data” as defined within the GDPR and the UK GDPR (collectively, the “GDPR”)) under the GDPR is as follows. There may be cases where we obtain some kind of consent from you in connection with your personal information, but unless item (3) below applies, even in such a case, the legal basis for processing will be, “processing is necessary for the performance of a contract” or “processing is necessary for the pursuit of legitimate interests.”

(1) Processing is necessary for the performance of a contract (GDPR Article 6(1)(b))

We process your personal information on the basis that processing is necessary for the performance of a contract (GDPR Article 6(1)(b)) for the following purpose:
• to respond to inquiries made by customers to Customer Support

(2) Processing is necessary for the pursuit of legitimate interests (GDPR Article 6(1)(f))

We process your personal information on the basis that processing is necessary for the pursuit of legitimate interests (GDPR Article 6(1)(f)) for the purposes specified in Section 2 (Purposes) of the Global Privacy Policy other than the purposes specified in items (1) and (3) (for details of the balancing test for legitimate interests, please contact us using the contact details specified in Section 13 (Contact details) of the Global Privacy Policy.

(3) We obtain your consent in advance (GDPR Article 6(1)(a))

We will obtain your consent before using cookies and other terminal identifiers, except for cookies and other terminal identifiers that are strictly essential in order to provide services to you. We process cookies and other terminal identifiers of you who access the Website on the basis of your consent (GDPR Article 6(1)(a)) for the following purpose:
• to analyze the attributes of customers who accessed the Website and improve our customers’ experience when they access the Website.

Where required by law, we will obtain your consent before engaging in direct marketing. You have the right to withdraw your consent at any time by the means separately specified at the time we obtain your consent. However, your withdrawal of consent does not affect the lawfulness of processing conducted based on your consent before its withdrawal.

2. Overseas transfer of personal information

When we transfer personal information to a country outside the EEA (European Economic Area) and the UK, we do so on the basis of an adequacy decision for countries where an adequacy decision has been made (GDPR Article 45), and for other countries, we implement appropriate safeguards by executing standard data protection clauses adopted by the European Commission (and where applicable the UK Information Commissioner) (GDPR Article 46(2)(c) and Article 46(5)) with the recipient. If you wish to receive copies of documents regarding these safeguards, please contact us using the contact details specified in Section 13 (Contact details) of the Global Privacy Policy.

3. Your rights

You have the following rights.

• Obtaining information regarding data processing: You have the right to obtain from us all necessary information regarding our processing of data concerning you (GDPR Article 13 and Article 14).
• Access to personal information: You have the right to obtain confirmation from us as to whether or not personal information concerning you are being processed, and, where that is the case, to access personal information and certain information (GDPR Article 15).
• Rectification and erasure of personal information: You have the right to have us rectify inaccurate personal information concerning you without undue delay and have incomplete personal information completed by us (GDPR, Article 16). You also have the right to have us erase personal information concerning you without undue delay when certain conditions are met (GDPR Article 17).
• Restricting processing of personal information: You have the right to restrict our processing of personal information concerning you when certain conditions are met (GDPR Article 18).
• Objection to processing of personal information: You have the right to object to our processing of personal information concerning you when certain conditions are met (GDPR Article 21).
• Personal information portability: You have the right to receive personal information concerning you in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from us, when certain conditions are met (GDPR Article 20).
• Freedom from automated decision-making: You have the right to not be subject to automated (no human involvement) decision-making, which produces legal effects or significant effects on you, when certain conditions are met (GDPR Article 22).
• You may lodge a complaint regarding our processing of your personal information with the data protection supervisory authority of the member state where you live or work or where the alleged infringement took place (GDPR Article 77) or, if you live in the United Kingdom, with the Information Commissioner of the United Kingdom.

Exhibit: California/Nevada

Effective date: September 24, 2021

California Privacy Rights
This section applies to customers residing in California and applies only to “personal information” that is subject to the CCPA. It includes disclosures required under the California Consumer Privacy Act (“CCPA”).

If you are vision impaired, you can access this section using a screen reader. If you are otherwise disabled, you can access this section by contacting the Company for additional accessibility information using the contact details specified in Section 6 below.

1. Categories of California Personal Information collected by the Company

We collect information that is subject to the CCPA (“California Personal Information”). We have collected California Personal Information in the following categories within the past 12 months:

• Personal and online identifiers (such as first and last name, address, phone number, unique online identifiers, IP addresses, email addresses, account names, etc.)
• Characteristics of protected classifications under California or federal law (age, gender, etc.)
• Internet or other electronic network activity information (such as browsing history, search history, interactions with a website, email, application, or advertisement)
• Inferences drawn from the above information about your predicted characteristics and preferences
• Other information about you that is linked to the personal information above

We do not sell personal information.

2. Categories of sources of California Personal Information

In the past 12 months we have obtained the California Personal Information specified in Section 1 above from the following categories of sources: information sources specified in Section 5 (Sources of personal information) of the Global Privacy Policy..

3. Why We Collect, Use, and Share California Personal Information

Our purposes for collecting, using, use, and sharing California Personal Information are as set forth in Section 2 (Purpose) of the Global Privacy Policy..

• Our business purposes as identified in the CCPA include:

• Auditing related to our interactions with you;
• Legal compliance;
• Detecting and protecting against security incidents, fraud, and illegal activity;
• Debugging;
• Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics;
• Internal research for technological improvement;
• Internal operations;
• Activities to maintain and improve our services; and
• Other one-time uses.

4. Recipients of California Personal Information

In the past 12 months we have disclosed your California Personal Information to the following categories of service providers for business purposes.

We have not sold your California Personal Information to any third party within the past 12 months, irrespective of whether you are under 16 years of age or not.

5. Your rights concerning California Personal Information

You have certain rights in connection with your California Personal Information. You can exercise these rights free of charge, unless otherwise provided by applicable law. We will endeavor to respond to your request promptly after verification pursuant to the provisions of applicable laws.

• The right to know the categories of California Personal Information that we have collected concerning you, the categories of information sources from which we collect that California Personal Information, our business or commercial purpose for collecting or selling California Personal Information, the categories of third parties with whom we share California Personal Information, and specific pieces of California Personal Information that we have collected concerning you.
• The right to request deletion of the California Personal Information concerning you that we have collected from you.
• The right to opt-out of our sale of your California Personal Information.
• The right not to be discriminated against by us on the grounds of your exercise of privacy rights granted under the CCPA.
• As a California resident, under California’s Shine the Light law (California Civil Code § 1798.83) you may request that we provide a list of the categories of personal information that we have disclosed to third parties for direct marketing purposes in the most recent calendar year, and the names and addresses of those third parties. You also may request that we do not share your personal information with third parties for marketing purposes.

You can make a request to exercise the above rights by contacting us using the contact details specified in Section 6 below.

Verification procedures and necessary information: We may request that you provide additional information to verify your identity or to correctly understand, evaluate and respond to your request, but you are not required to create an account with us in order to submit or achieve any request. We ask you to provide specific personal information for our records and reference. We will require you to provide, at a minimum name and email address.

Agent: You may nominate an agent who is authorized to make requests on your behalf. You may do so by giving your agent written permission to act on your behalf. Even if you choose to use an agent, to the extent permitted by law, there may be cases where we request a new verification when responding to a request.

Minors’ Right to Opt In. We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

6. Contact details for detailed information

If you have any questions or concerns regarding our privacy policies and practices or your options and rights under California law, please contact us using the contact details specified in Section 13 (Contact details) of the Global Privacy Policy.

Email us at: support_en@typelumina.com

Or contact us at: 3-6-28, Aobadai, Meguro-ku, Tokyo, 153-0042, Japan

Nevada Privacy Rights
Although we do not currently conduct sales of personal information, Nevada residents may submit a request directing us to not sell personal information we maintain about them if our practices change in the future.

Exhibit: Hong Kong

Effective date: September 24, 2021

This Exhibit is in addition to the Privacy Policy and applies to customers located or residing in Hong Kong under the Personal Data (Privacy) Ordinance, Cap. 486 of the laws of Hong Kong (the “PDPO”).

1. Direct marketing

We will not send you any direct marketing, or provide your personal information (in this Exhibit “personal information” means the same as “personal data” as defined within the PDPO) to a third party for use by that third party in direct marketing, without obtaining your consent. You have the right to withdraw your consent at any time by the means separately specified at the time we obtain your consent. However, your withdrawal of consent is only valid into the future, and does not affect the lawfulness of processing conducted based on your consent before its withdrawal.

2. Legal basis, etc. for processing

Your personal information is collected, held, processed, and used in accordance with the PDPO.

3. Retention period for personal information

We will take all practicable steps to ensure that your personal information is not kept longer than is necessary for the fulfilment of the purpose for which the personal information is or is to be used as notified to you in the Privacy Policy and above. Where the retention period for any personal information is not specifically set out in the Privacy Policy, this general principle applies.

4. Sources of personal information

As described in the Privacy Policy, we may receive your personal information through third party sources if you have previously submitted such personal information to them. We are not responsible for the collection, retention, processing, use, disclosure, transfer, security, and/or access of your personal information by or from such third-party sources, and we recommend you examine the privacy policy of any third parties to understand their procedures for collecting, holding, processing, using, and disclosing personal information.

5. Sharing and disclosure of personal information

As stated in the Privacy Policy, we may disclose your personal information in order to fulfill the Purposes to certain third parties. “Other contractors of the Company” and other third parties include:

• our affiliates and/or other service providers that provide development and maintenance, administrative, data processing, research and marketing, distribution, IT and telecommunications, digital storage, professional, or other similar services to us. This includes, without limitation, cloud hosting service providers, which provides us with digital storage services on its servers;

6. Overseas transfer of personal information

As set out in the Privacy Policy, your personal information may, from time to time be transferred to and/or stored by us in physical locations and/or servers located within or outside Hong Kong and/or shared with our affiliates and/or other third parties (as set out above) within or outside Hong Kong. Where the specific countries or locations for any overseas transfer of personal information is not specifically set out in the Privacy Policy, we will take proper protection measures required by the personal information protection regulation of each country as set out in the Privacy Policy.

7. Safety management measures

In addition to those specific safety management measures as set out in the Privacy Policy, we will take all practicable steps to ensure that your personal information held by use are protected against unauthorised or accidental access, processing, erasure, loss or use, and we shall procure by contract or use our reasonable endeavours to ensure that our affiliates and/or any other third parties to whom we disclose your personal information do the same. Where the specific safety management measures are not specifically set out in the Privacy Policy, this general principle applies.

8. Rights of customers

You have the right to:

• ascertain whether we hold any of your personal information;
• request access to your personal information held by us (and be given reasons if such a request is refused, and object to such a refusal);
• require us to correct any personal information which is inaccurate (and be given reasons if such a request is refused, and object to such a refusal);
• ascertain our policies and practices (from time to time) in relation to personal information generally, and the types of personal information held by us; and
• withdraw consent from receiving direct marketing from us at any time.

If you would like to make a request in relation to the above (or make any general enquiries), please send us your request or enquiry in writing as set out in the Privacy Policy as supplemented by this Exhibit in paragraph 9 below.

In accordance with the PDPO, we have the right to charge you a reasonable fee for the processing of any personal information access request.

9. Contact details

For any enquiries in relation to the Privacy Policy or this Exhibit, our contact details are as follows:

Game Business Department General Manager
support_en@typelumina.com

10. Changes to the Privacy Policy and this Exhibit

We reserve the right to modify the Privacy Policy and this Exhibit at any time, so please review each document frequently. Where there are significant changes, we will notify you (as set out in the Privacy Policy) and, where required by law, obtain your acceptance of the changes, consents, and/or opt in (as necessary or applicable). If you do not accept the changes and/or provide your consent, then we may not be able to perform the Purposes and/or provide the Services to you.