Effective Date: May 4, 2026

We, EDU Games Studio, a brand of Birikim Teşvik Danışmanlık Sanayi Ticaret Limited, address this Supplemental UK Privacy Notice to individuals located in the United Kingdom only. This document supplements our Privacy Notice ("Core Privacy Notice") and describes how we process your personal data when you use or interact with our website, online advertisements and mobile games (collectively, our "Services"). If there are any inconsistencies between our Core Privacy Notice and this Supplemental UK Privacy Notice, this Notice prevails.

If you are located in the UK, the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 apply to our processing of your personal data.

1. Who Is the Data Controller?

The data controller responsible for your personal data is:

EDU Games Studio
A brand of Birikim Teşvik Danışmanlık Sanayi Ticaret Limited
Kultur Mh. 1392 Sk. Konak/Izmir/Turkiye
Email: contact@edugamesstudio.com

2. What Types of Personal Data Do We Collect and How Do We Collect It?

Please see Section 1 of our Core Privacy Notice. We also use cookies and other tracking technologies on our Services as described in our Cookie Policy.

In summary, we may collect:

Personal Data Collected Directly from You:

• Contact information (country or region, name, email address or username)
• Profile and gameplay information (screen name, in-game progress, scores, achievements, payments)
• Survey information (feedback and ratings)
• Parental information (parent's email address and PIN if parental controls are activated)

Information We Collect Automatically:

• Analytics data (user ID, how you use and interact with our games, IP address, browser type, operating system, crash logs and diagnostics)
• Ad interaction data (how you interact with ads, click data, ad content details)
• Device data (device identifiers, IDFV on iOS, App Set ID on Android, IDFA, GAID)
• Approximate location data (based on IP address)
• Commercial information (products and services purchased)

Information from Third Parties:

• Online marketplaces (Apple App Store, Google Play — device and payment information)
• AdTech Providers (analytics, ad interaction and device data)

3. For What Purposes Do We Process Personal Data and What Lawful Bases Do We Rely On?

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

Where we rely on the Legitimate Interest lawful basis, we have conducted a balancing test to ensure our interests are not overridden by your data protection rights. More information on this balancing test is available upon request.

4. Who Do We Share Your Personal Data With?

We may disclose personal data to the following types of third parties:

• Other Users in Your Online Community: If you participate in any of our online communities, we may disclose your public profile information to other online community members, including your screen name, profile picture or avatar, your in-game scores and achievements, and any other information you choose to make public.
• Service Providers: We may disclose your personal data to our service providers (data processors), including companies that provide IT and related services, customer service, analytics and search engine services, and any supporting activities in connection with our Services. We have executed appropriate contracts that prohibit them from using or sharing personal data except as necessary to perform services on our behalf or comply with legal requirements.
• AdTech Providers: We work with third-party ad networks and advertising technology providers to deliver advertising within our Services and on websites and services we do not operate. If you provide your consent, these parties may collect information directly from your browser or device through cookies or other technologies. For a list of our AdTech Providers, please visit our Adtech Providers page.
• Legal and Regulatory Disclosures: We may access, preserve, and disclose your personal data to third parties such as legal advisors and law enforcement authorities if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal processes; (ii) respond to your requests; (iii) protect your, our or others' rights, property or safety; (iv) enforce our policies or contracts; (v) prevent physical harm or financial loss; or (vi) in connection with the establishment, exercise, or defence of legal claims.
• Business Transactions: We may disclose personal data to potential acquirers of our business assets and their representatives for the purposes of evaluating and entering into business transactions.
• With Your Consent: We may disclose personal data to certain other third parties or publicly with your consent or at your direction.

5. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside the UK, including Türkiye and the United States.

When transferring personal data outside the UK, we ensure appropriate safeguards are in place, including:

• UK Adequacy Decisions: Transfers to countries that the UK Secretary of State has determined provide an adequate level of data protection.
• International Data Transfer Agreements (IDTAs): Where no adequacy decision exists, we use IDTAs or the UK Addendum to the EU Standard Contractual Clauses approved by the Information Commissioner's Office (ICO).
• Supplementary Measures: Where required, we implement additional safeguards such as encryption, pseudonymisation, and access controls to ensure an adequate level of protection.

Data transfer agreements are accessible upon request by contacting us at the details shown below.

6. How Long Do We Process Personal Data?

The length of time for which we retain personal data depends on the purposes for which we collect and use it and how long we need to retain it to comply with applicable laws (including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements), to establish, exercise or defend our legal rights, or to make the data available to judges and courts or the competent public authorities.

If we retain the personal data solely to satisfy legal requirements, we will keep your personal data blocked — meaning we will implement measures to prevent the data's processing, except for making it available to public administrations, judges, and courts if necessary. Once personal data is no longer necessary for any of these purposes, we delete it.

7. Your Rights Under UK GDPR

As a UK resident, you have the following rights regarding your personal data, subject to the conditions under the UK GDPR and the Data Protection Act 2018:

• Right of Access: You have the right to obtain from us confirmation as to whether your personal data is being processed, and where that is the case, to request access to details about how we process your personal data and copies of the personal data.
• Right to Rectification: You have the right to obtain from us the rectification of inaccurate personal data concerning you.
• Right to Erasure ("Right to be Forgotten"): You have the right to ask us to erase your personal data to the extent it is not required for legally required purposes or necessary for security and integrity purposes.
• Right to Restriction of Processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.
• Right to Data Portability: You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
• Right to Object: You have the right to object, on grounds relating to your particular situation, to the processing of your personal data by us. This includes the right to object to our processing of your personal data for direct marketing and the right to object to our processing where we are pursuing our legitimate interests or those of a third party. If you object, we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.
• Right to Withdraw Consent: Where we rely on your consent for processing, you have the right to withdraw your consent at any time. This will not affect the lawfulness of our use of your personal data before your withdrawal. You can withdraw consent by going to Settings > Terms & Privacy in our games, or by emailing us.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UK's supervisory authority (see below).

8. How to Exercise Your Rights

To submit a request to exercise your privacy rights, you can contact us by any method described in the Contact Us section below. In your request, please describe what rights you are exercising and how you would like us to assist.

We may need to request specific information from you to help us verify your identity. These are security measures to ensure that we do not disclose personal data to any person who has no right to receive it, or otherwise process the data in unauthorized ways. We may also contact you to ask for further information about your request to clarify the scope of your request and speed up our response.

We will respond to your request within one (1) month. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request.

9. Targeted Advertising

We rely on AdTech Providers to serve targeted online ads at users of other companies' websites, games and online services. From time to time, we also offer ad-supported versions of our Services.

In the UK, we request your consent to engage in targeted advertising activities when you first launch our games. If you consent, you may subsequently withdraw your consent at any time by going to Settings > Terms & Privacy.

If you opt out of targeted advertising, you may still see ads, but that advertising will not be targeted using your personal data, and we will stop sharing your personal data with AdTech Providers for targeted advertising purposes.

You can also choose to prevent your device's ad identifier from being used for interest-based advertising, or reset your device's ad identifier by changing your device settings. Settings vary from device to device, but you will usually find the ad identifier settings under "privacy" or "ads" in your device's settings.

For a list of our AdTech Providers and their privacy policies, please visit our Adtech Providers page.

10. Children's Privacy

Our Services are not marketed to or intended for children. For these purposes, we use the term "children" to refer to someone who is: (a) under 12 years old or, if older, (b) between 12 and 18 years old but under the age at which they can give valid consent to processing of their personal data under applicable data privacy laws.

Children are not permitted to use our Services, and we do not knowingly collect any personal data from children. If we learn that we have inadvertently obtained personal data about a child, we will take measures to promptly remove that personal data from our systems. If a child under the age of 12 provides us with personal data, the child's parent or guardian may contact us immediately to request removal.

For children aged 12 to 17, parental or guardian consent and supervision is required to use our Services in accordance with our Terms of Service.

Parents can manage chat, in-app payments, and other select features through the parental control settings in the "Settings" menu. Once activated, these controls can only be modified with a pre-set password.

11. Security

We maintain physical, technical, electronic and procedural measures intended to protect personal data from unauthorized processing, including firewalls, data encryption technologies, internal data security protocols and data protection agreements with organizations that receive your personal data from us. However, no server, computer or communications network or system, or data transmission over the internet can be guaranteed to be 100% secure.

12. Supervisory Authority

If you are not satisfied with how we handle your personal data or your data protection rights, you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk
Telephone: 0303 123 1113
Contact: https://ico.org.uk/global/contact-us/

13. Changes to This Notice

We may update this Supplemental UK Privacy Notice from time to time. When we do so, the changes will be posted and the revised document will be available online and the "Effective Date" above revised. When we make material changes, we will take appropriate steps to inform you, consistent with the significance of the changes we make. We encourage you to review this notice periodically.

14. Contact Us

If you have any questions about this UK Privacy Notice, our privacy practices, or personal data processing activities, or would like to exercise your rights under UK privacy laws, please contact us at:

EDU Games Studio
Birikim Teşvik Danışmanlık Sanayi Ticaret Limited
Kultur Mh. 1392 Sk. Konak/Izmir/Turkiye
Email: contact@edugamesstudio.com