SKY MAVIS PRIVACY POLICY
Last Updated: August 2, 2024
Sky Mavis Pte. Ltd. (“Sky Mavis,” “we,” “us,” or “our”) is a software development company thatbuilds virtual worlds and the infrastructure that makes them possible.
This Privacy Policy (“Privacy Policy”) is designed to inform you about how we collect, use,
process, and share your Personal Data (as defined below) in connection with use of any of our
products, services, or applications (collectively the “Services”); and visit or use of our website(“Site”) to the extent related to the Services. By using our Services, you agree to the collection
and use of your Personal Data in accordance with this Privacy Policy. Unless otherwise defined inthis Privacy Policy, any terms used in this Privacy Policy will have the same meanings as set forthin our Terms of Use.
Please note that our Services and Site are not intended for minors below 18 years of age, and we
do not knowingly collect data relating to minors.
1. SKY MAVIS’ ROLE WITH YOUR DATA
1.1.
Data Controller. Sky Mavis Pte. Ltd., a company incorporated in Singapore, is thecontroller of your Personal Data, and we are responsible for handling your Personal Data
related to the use of our Services.
1.2.
Data Protection Offer. We have appointed a Data Protection Officer (“DPO”) who
shall be responsible for overseeing questions relating to this Privacy Policy. If you have any
questions or concerns related to this Privacy Policy or our privacy practices, or want toexercise your legal rights, please contact our DPO at: DPO@skymavis.com.
1.3.
Changes to your Personal Data. We may update our Privacy Policy periodically.
This version was last updated on the date written above. It is your responsibility to review
and ensure that you have read and understand any new versions of the Privacy Policy that
we may update from time to time. We will also additionally inform you on material changesof this Privacy Policy. It is important that the Personal Data we hold about you is accurate andup-to-date, so please keep us informed if your Personal Data changes during your relationshipwith us.
1.4.
Third-Party Links. Our Site, app, and any applicable browser or browser extension
required to access the Services may include links to third-party websites, plug-ins, andapplications (“Third-Party Sites”). If you click on those links or enable those connections, you
may allow third parties to collect or share data about you. We do not control these ThirdParty Sites and therefore are not responsible for their privacy statements or policies. When
you leave our Site, you should read the privacy policy or statement of every Third-Party Siteyou visit or use.

1

2. PERSONAL DATA WE COLLECT
2.1.
General. The categories of Personal Data we collect depend on how you interact
with us, our Services, and the requirements of applicable laws. We collect information thatyou provide to us, information we automatically obtain when you use our Services, andinformation from other sources such as third-party services and organizations, as described
below.
2.2.
Definition of Personal Data. Personal Data, or personal information, means any
information that relates to an identified or identifiable living individual (collectively, all“Personal Data” as described in this section). This is a broad definition which includes the
specific pieces of personal data which we describe in further detail below. However, Personal
Data does not include data which cannot be used to identify an individual person, such as acompany registration number.
A Data Subject (“Data Subject”) is an individual who can be identified, directly or indirectly,
by Personal Data. This is usually by reference to an identifier, such as a name, identification
number, location data, an online identifier, or one or more other factors specific to thephysical, physiological, genetic, mental, economic, cultural, or social identity of that natural
person. Different pieces of information, if collected together, may also lead to theidentification of a particular person, and therefore also is Personal Data. However, Personal
Data does not include data where the identity has been removed (anonymous data). For more
information about Personal Data, please refer to the European Commission’s definition here.
2.3.
Kinds of Personal Data We May Collect. Below are different kinds of Personal Data
about you that we may collect, use, store, and transfer:
Personal Data Category

Examples of this Category of Personal Data

Identity Data

●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●

Contact Data
Financial Data

Transactional Data

Name
Display name or user handle
Profile picture
Background picture
Short biography
Social media account(s) information (e.g. Discord or Twitter account)
Blockchain address
Email address
Phone number
Payment card details
Bank account information
Digital asset accounts
Digital wallet addresses
Amounts associated with accounts or digital wallet addresses
External account details
Details about the source of your funds
Information relating to economic and trade sanctions lists
Details about payments to or from you

2●
Investment Data
Technical Data

Profile Data

Usage Data

Marketing andCommunications Data
Other special categories of
Personal Data

Other details of any transactions you enter into when using theServices or Site
● Information about royalties and fees
● Information about sales price and sales information● Internet connectivity data
● Internet protocol (IP) address● Login data
● Browser type and version● Device type, category, and model● Time zone setting and location data
● Browser plug-in types and versions● Operating system and platform● Diagnostics data such as crash logs and any other data we collect forthe purposes of measuring technical diagnostics● Other information or technology stored on the devices you allow us
access to when you visit the Site or use the Services● Your username and password● Your identification number as our user
● Requests by you related to products, features, or services● Your interests, preferences, and feedback● Other information generated by you when you communicate with us,
for example when you address a request to our customer support● Information about how you use the Site, the Services, and otherofferings made available by us, including interaction type and time, andevent time, name, and source● Your preferences in receiving marketing from us or third parties● Your communication preferences● Your survey responses
There are certain types of sensitive Personal Data that are subject toadditional protection under applicable laws. These are called “special
categories” of Personal Data. Currently the Services do not include
processing of special categories of Personal Data (such as personal data
revealing racial or ethnic origin, political opinions, religious, or philosophicalbeliefs).

2.4.
Refusal to Provide Personal Data. If you refuse to provide Personal Data where weneed to collect Personal Data by law, or under the terms of an agreement we have with you,we may not be able to perform the agreement we have or are trying to enter into with you(e.g. to provide you the Services). In this case, we may cancel a product or Service you havewith us, but we will notify you if this is the case at that time.
3. HOW WE COLLECT YOUR DATA
3.1.
General. The forementioned categories of Personal Data we collect depend on
how you interact with us, our Services, and applicable law requirements. We collect data andinformation that you provide to us, information we obtain through automated technologies
or interactions when you use our Services, and information from third parties or othersources, as described below.

3

3.2.
Methods of Collecting Data. Sky Mavis uses different methods to collectinformation from and about you, including through:(a) Information you directly provide to us – you may give us your Identity Data, Contact
Data, Financial Data, Investment Data, Profile Data, and Marketing andCommunications Data when you directly interact with us, including by filling out
forms, by email, or any other method or form. This includes Personal Data you provide
when you:(i) Visit our Site;(ii) Use or apply to use our Services;(iii) Create an Account;(iv) Request marketing materials to be sent to you, for example, by subscribing toour newsletters;(v) Enter a giveaway, sweepstake, or contest, including through social media
channels;(vi) Provide us with Submissions or otherwise contact us.
(b) Information collected from automated technologies or interactions – as you interact
with and/or use our Site, we may automatically collect Technical Data about yourequipment, browsing patters, actions, and habits. We collect this Personal Data byusing server logs, cookies, and similar technologies. We may also collect Transactional
Data, Investment data, and Usage Data through your use of our Site. Finally, we may
also receive Technical Data and Marketing and Communications Data about you if you
visit other websites using our cookies. On our main Site, you will be informed about
how we use cookies through the Cookies Policy.
(c) Information collected from third parties or other sources – we also obtain information
about you from third parties or other sources. These sources may include publicblockchains or other publicly available information on the Internet (e.g. websites,
articles, social media; etc.)
4. HOW WE USE YOUR DATA
4.1.
General. We will only use your Personal Data according to applicable laws. Thus,
we must ensure that there is a legal basis for using your Personal Data. Common examples ofwhen we will use your Personal Data include:(a) Contract performance – we may process your Personal Data when it is necessary for
us to perform a contract to which you are a party, or to take steps at your request
prior to entering into a contract (e.g. this is the basis for the provision of our Services);(b) Legitimate interests – we may process your Personal Data for our interests, or thoseof a third party, when we ensure we use this basis does not override or is otherwise
in conflict with your interests and individual rights;

4

(c) When you have given consent – we may process your Personal Data where you havefreely given your consent, which is based on your informed and clear indication by astatement or clear affirmative action that indicates your agreement to the processingof your Personal Data; there may be certain circumstances where this consent needs
to be explicit, and we will properly request for your consent in those circumstances.
4.2.
Purposes for Processing Your Personal Data. In the table below, we describe thevarious ways we plan to use your Personal Data and the legal bases we rely on to do so. Where
applicable, we have also identified our legitimate interests. We may process your Personal
Data for more than one legal basis, depending on the specific purpose for which we are using
your data. Please contact us if you need more details about the specific legal basis that weare relying on to process your Personal Data.
Purpose for Processing Your
Personal Data

Categories of Personal
Data

Legal Basis for Processing

Registration of you as a new customer

●
●
●
●
●
●
●
●
●

●

Contract performance●Contract performance●

Legitimate interests●●

Contract performance
Consent, if required●●

Legitimate interests:
understanding our customers
and improving our Services
Consent, if required●

Contract performance

Processing and delivery of our Services
to you, including the management,
processing, and execution of any
instructions or orders you make

Prevention of abuse of our Services
and promotions

●
●
●
●
●
●
●

Management of our relationship withyou, which may include keeping you
informed about our business andproduct development

●
●
●
●
●
●

Maintenance and updates of ourrecords and to study how ourcustomers use our Services

●
●
●
●
●
●

Management, processing, collection,and transfer of payments and fees●●

Identity Data
Contact Data
Identity Data
Contact Data
Financial Data
Transactional Data
Investment Data
Technical Data
Marketing andCommunications Data
Identity Data
Contact Data
Financial Data
Transactional Data
Investment Data
Technical Data
Marketing andCommunications Data
Identity Data
Contact Data
Profile Data
Transactional Data
Investment Data
Marketing andCommunications Data
Identity Data
Contact Data
Profile Data
Transactional Data
Investment Data
Marketing andCommunications Data
Identity Data
Contact Data

5

Compliance to applicable laws andregulations, including responding toand resolving complaints

Facilitation of your participation in
giveaways, sweepstakes, and othercompetitions●●

Financial Data
Investment Data

●

●
●
●
●
●
●
●
●
●
●
●

Identity Data
Contact Data
Financial Data
Technical Data
Transactional Data
Investment Data
Identity Data
Contact Data
Profile Data
Usage Data
Marketing andCommunications Data
Identity Data
Contact Data
Profile Data
Usage Data
Marketing andCommunications Data
Identity Data
Contact Data
Financial Data
Technical Data
Transactional Data
Investment Data

●

●

●
●
●

Identity Data
Contact Data
Profile Data
Usage Data
Marketing andCommunications Data
Technical Data
Usage Data
Technical Data

●
●
●
●
●
●

Identity Data
Contact Data
Technical Data
Investment Data
Usage Data
Profile Data

Gathering market data for studying
customers’ behavior, including theirpreference, interest, and how they use
our Services, determining ourmarketing campaigns, and growing ourbusiness
Administration and protection of ourbusiness, our Site, and social media
channels, including troubleshooting,data analysis, testing, system
maintenance, support, reporting, bans,and data hosting

●
●
●
●
●

Delivery of relevant website content
and advertisements to you, andanalyzing or understanding theadvertisement’s effectiveness

●
●
●
●
●

Use of data analytics to improve our
website, Services, marketing, customer
relationships, and overall experience

Giving you suggestions or
recommendations about Services or
products that you may be interested in

●
●
●
●
●
●

●

Legitimate interests: ensurethat our customers’transactions are properly
executed
Compliance with legal
obligations
Legitimate interests: ensure
we effectively resolve
complaints●●

Contract performance
Consent, if required●

Legitimate interests:
understanding our customers
and improving our Services●

Legitimate interests: carry on
business, providing
administration and IT
services, network security,and in a business context,
reorganization or group
restructuring exercise (ifapplicable)
Legitimate interests:
understanding how ourcustomers use our Services,developing and growing ourbusiness, and developing ourmarket strategy
Consent, if required
Legitimate interests: defining
customer types for our
Services, ensuring our
website is relevant andupdated, develop and formbusiness and/or marketingstrategy
Consent, if required
Legitimate interests:
developing our Services andproducts, and growing ourbusiness
Consent, if required

●
●

●
●

●

6

●
Use of social media or advertising
platform services, some of which may
use your Personal Data for their own
purposes, such as marketing●●

Marketing andCommunications Data
Technical Data
Usage Data●

Consent

4.3.
Change of Purpose. We will only use your Personal Data for the purposes we havecollected it for unless we reasonably consider that we will need it for another reason whichis also compatible with the original purpose and in accordance with applicable laws. If weneed to use your Personal Data for an unrelated purpose, we will notify you of this intent andexplain the legal basis for allowing us to do so.
4.4.
Marketing. If you have requested information from us and consented to receive
marketing communications, you will receive marketing communications from us. We will use
your Contact Data and Marketing and Communications Data for our respective activities.
4.4.
Third-Party Marketing. Regarding third-party marketing, we will get your consent
prior to sharing your Personal Data with any third party for marketing purposes.
4.5.
Opting Out. You may opt out, or ask us to stop sending you marketing messages,
at any time by directly emailing us at: DPO@skymavis.com. Please note that opting out ofreceiving marketing messages will not apply to services messages directly related to the useof our Services (e.g. maintenance or updates, changes in terms of use; etc.).
4.6.
Cookies. You may set your browser to allow or refuse all or some browser cookies,
or to alert you when websites set or access cookies. If you refuse or disable cookies, someparts of the Services or Site may become inaccessible or not properly function. Please review
the Cookies Policy for more information about the types of cookies we may use.
5. HOW WE TRANSFER YOUR DATA
5.1.
Transferring Within our Group Companies. We may share your Personal Data
within our group companies. This may involve transferring your Personal Data outside theEuropean Economic Area (EEA) or the UK.
5.2.
Transferring to Third Parties. Many of our external third parties are based outside
the EEA or UK regions. Thus, their processing of your Personal Data will involve a transfer ofdata outside the EEA or the UK.
5.3.
How We Transfer Your Personal Data. Whenever we transfer your Personal Dataout of the EEA and the UK, we ensure a similar degree of protection that is afforded to it by
ensuring at least one of the following safeguards is implemented:

7

(a) The country where we transfer your Personal Data to has been deemed to provide anadequate level of protection for personal data by the European Commission (for more
information, please refer here);(b) There are Standard Contractual Clauses in place. Standard Contractual Clauses are a
specific contract approved by the European Commission that provides safeguards tothe processing of personal data. Please note that there may be future changes to theStandard Contractual Clauses for transfers from the UK. When these are
implemented, we will comply with the guidance provided by the respective UKsupervisory authority.
6. HOW WE DISCLOSE YOUR DATA
6.1.
General. We may share your Personal Data with various third parties, including
our third-party service providers, agents, subcontractors, and other associated organizations,
our group companies, and affiliates to provide Services to you on our behalf and complete
other related tasks. When using third-party service providers, they are required to respect
the security of your Personal Data and must treat it in accordance with the law.
6.2.
Disclosure of Personal Data. We may disclose your Personal Data to the following
third parties:(a) Companies and other organizations that assist in providing any of the Services you
have requested, including verifying your transactions;(b) Anyone to whom we may lawfully transfer our rights and duties under the relevantterms and conditions governing the use of any Services; and(c) Law enforcement and regulatory authorities, whether they are inside or outside of
the EEA, under applicable law.
7. DATA SECURITY
7.1.
General. We have implemented appropriate security measures to prevent your
Personal Data from being accidentally lost, used, damaged, altered, disclosed, or accessed in
an unauthorized or unlawful way or manner. We also limit access to your Personal Data to
those employees, agents, contractors, and other third parties who have a legitimate businessreason. They will only process your Personal Data in accordance with our instructions, andthey are subject to a duty of confidentiality.
7.2.
Risk of Data Breaches. You understand and accept that there is an inherent risk inany data being shared over the Internet against your wishes, and that there is no security
system that is impenetrable. Thus, we cannot guarantee the security or our systems or thoseof our vendors. If there is any information under our custody and control that is compromised
as a result of a breach of our security, we will take steps to investigate and remediate thesituation, and in accordance with applicable laws and regulations, may notify the individuals
whose Personal Data may have been compromised.
8

7.3.
Your Responsibilities. You are solely responsible for the security of your digitalwallet and any Personal Data relating to or arising thereof. We encourage you to takemeasures to ensure that it remains secure. If at any time you discover an issue related to yourwallet, please contact your wallet service provider.
8. DATA RETENTION
8.1.
General. We consider a variety of factors in determining the appropriate retention
period for your Personal Data. This includes the amount, nature, and sensitivity of the
Personal Data; the potential risk of harm from unauthorized use or disclosure of your
Personal Data; the purposes for which we may process your Personal Data and whether we
can achieve those purposes through other means; and any applicable legal, regulatory, tax,
accounting, or other requirements.
8.2.
Removal or Deletion of Personal Data. If your Personal Data is no longer necessary
for the purpose(s) for which it may be lawfully processed, we will remove any details that will
identify you, or we will securely destroy the relevant records.
8.3.
Retention of Data. In order to adhere to applicable laws, we may need to maintainrecords for a significant period of time after you cease being our customer. We may also be
subject to certain anti-money laundering laws that may require us to retain the following fora period of time after our business relationship with you has ended:(a) A copy of the records we used in order to comply with any required or applicable
customer due diligence obligations;(b) Supporting evidence and records of transactions with you, and your relationship withus.
We may also keep your Personal Data for a longer period if we cannot delete it for legal,
regulatory, or technical reasons.
8.4.
Marketing Communications Obligations. If you have opted out of receiving
marketing communications from us, we will retain your details on an opt-out list so that weknow you do not want to receive these communications.
9. YOUR LEGAL RIGHTS
9.1.
General. There are legal rights that are available to you regarding your Personal
Data that we process. We have outlined these below. You may request to exercise theserights, subject to any limitations provided for under applicable data protection laws.
9.2.
Access. You may ask us to confirm whether we are processing your Personal Data,and if so, what information we process and to provide you with a copy of that information.
99.3.
Rectification. You may request for us to rectify your Personal Data by providing uswith the information you think is inaccurate or incomplete, and then providing us with the
new and updated information. We may need to verify the accuracy of the new data you
provide to us.
9.4.
Deletion. You may ask us to delete your Personal Data. However, we may not beable to comply with your deletion request for specific legal reasons.
9.5.
Processing Restrictions. You may request for us to restrict the processing of your
Personal Data by asking us to suspend the processing of your Personal Data for the following
reasons:(a) if you want us to establish the data accuracy;(b) where our use of your Personal Data is unlawful but you do not want it erased;(c) where you need us to hold the Personal Data even if we no longer require it as youneed it to establish, exercise, or defend legal claims; or(d) if you have objected to our use of your Personal Data, but we need to verify whether
we have overriding legitimate grounds to use it.
9.6.
Objection. You may object to the processing of your Personal Data, where we arerelying on a legitimate interest (or those of a third party) and there are certain circumstances
which make you want to object about the particular processing as you feel it impacts yourfundamental rights and freedoms. In certain situations, we may demonstrate that we also
have compelling legitimate grounds to process your Personal Data which override your rights
and freedoms. As stated above, you also have the right to object where we are processing
your Personal Data for direct marketing purposes.
9.7.
Transfers. You may request us to transfer your Personal Data to you or to a third
party, and we will provide to you or the third party you have chosen (where technicallyfeasible) your Personal Data in a structured, commonly used, machine-readable format. This
right only applies to automated information that you initially provided consent for us to use
or where we used the information to perform an agreement with you.
9.8.
Automated Decision-Making and Profiling. You may require us to reconsider
decisions if they are solely made by automated means (without human involvement). Please
note that we will do our best to notify you if decisions are made solely on an automated basis
so that you may have the opportunity to exercise this right.
9.9.
Complaints. You may complain to our DPO or any relevant authority about any
perceived violation and seek compensation for damages in the applicable courts.
9.10.
Withdrawal of Consent. You can withdraw your consent at any time where we arerelying on consent to process your Personal Data. However, this will not affect the legality of10any processing carried out prior to your withdrawal of consent. If you withdraw your consent,
we may not be able to provide certain Services or products to you.
9.11.
Potential Fees. Usually, you will not have to pay a fee to access your Personal Dataor to exercise any of the rights mentioned in this Privacy Policy. However, we may charge areasonable fee if your request is clearly unfounded or excessive. In this situation, we may also
refuse to comply with your request.
9.12.
Statutory Period for Replying to Legitimate Requests. The statutory period under
the GDPR for us to reply to a legitimate request is one (1) month. This period may be extendedby two (2) additional months where necessary and considering the complexity and numberof requests. Please note that we may request that you provide some details necessary toverify your identity when you request to exercise a legal right regarding your Personal Data.
10. MISCELLANEOUS
10.1.
Privacy When Using Digital Assets and Blockchains. Your use of Digital Assets may
be recorded on a public blockchain. Public blockchain are distributed ledgers that are
intended to immutably record transactions across wide networks of computer systems. Many
blockchains are open to forensic analysis, which can lead to re-identification of the individuals
who make transactions as well as the revelation of Personal Data, especially when blockchain
data is combined with other data.
Because blockchains are decentralized or are third-party networks that are not controlled or
operated by us, we are not able to erase, modify, or alter Personal Data on such networks.
10.2.
Minors and Children. Our Services and the Site are not intended for persons under
the age of 18, and we do not knowingly collect data relating to minors. If we learn that wehave inadvertently processed Personal Data from a minor or child, we will take legallypermissible measures to remove that data from our records. We may also require the minor
user to close their account and will not allow the use of our Services or Site. If you are a parent
or guardian of a minor and you become aware that a minor has provided Personal Data to us,
please contact us.

11