Effective date: 14 November 2025

In its capacity as Data Controller, MILLION VICTORIES has implemented this Personal Data Protection Policy (hereinafter “the Policy”) and undertakes to process such Data in accordance with the applicable rules, in particular in accordance with the principles of transparency, purpose limitation and legitimacy, accuracy, proportionality and minimisation, security and confidentiality, accountability and protection by design and by default.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you play our mobile game “Million Lords”

We invite you to read it carefully.

 

ARTICLE 1 – DEFINITION

“Data” or “Personal Data” – Refers to any information that identifies you directly or indirectly (in particular by cross-referencing or cross-checking information), such as your email address or your pseudo.

“Data Subject” or “You” – Refers to you and to any person whose Data are processed by MILLION VICTORIES.

“MILLION VICTORIES”, “Data Controller”, “We” or “Us” – Refers to MILLION VICTORIES SAS, a French company, with a share capital of 166 881,18 euros, registered with the Lyon Trade and Companies Register under the number 830 912 051, whose head office is located at 34, rue Verlet Hanus – 69003 Lyon, France (hereinafter “Million Victories” or “We” or “Us”).

“MILLION LORDS” or “the Game” – Refers to the mobile game called “Million Lords”, available on iOS and Android.

 

ARTICLE 2 – ACCEPTANCE OF THE POLICY

By playing MILLION LORDS, you acknowledge that you have read and accepted this Privacy Policy without limitation or reserve. If you do not agree, please refrain from using the Game. This Privacy Policy forms a legal agreement between you and Million Victories.

 

ARTICLE 3 – DATA WE COLLECT

We collect:

• Data You provide us: email address, pseudo, clan messages, support messages and data you choose to give us (for instance to identify a lost account);
• Data we collect automatically from our partners, such as Facebook, Android Google Play, Xsolla and Apple App Store identifiers;
• Data You create in the Game about your Game progress, your gameplay and your interactions with other players;
• Data collected automatically by our partners that we can consult such as IDFA identifier, mobile device name, mobile device OS, location data, payment information (i.e. bank account)

MILLION VICTORIES also creates a specific ID to identify You in our database.

We only use your Data in the cases provided for by current regulations, and, in particular:

• For the performance of a contract we have entered into with you ;
• To comply with a legal o regulatory obligation, and/or
• After obtaining you free, specific and informed consent to the processing of your Data, and/or
• If we have a legitimate interest in using your Data.

 

ARTICLE 4 – PURPOSE OF COLLECTING YOUR DATA

We collect your Data to:

• Allow you to play the Game ;
• Improve the player experience;
• Keep the Game safe and fair;
• Show advertisement in the Game
• Operate our web shop and the in Game shop;
• Analyse, profile and segment collected Data;
• Implement our VIP Program;
• Operate our after-sales service and manage relations with players.

 

ARTICLE 5 – WHO CAN ACCESS YOUR DATA

Internal Access: Our employees who are authorised to process Data may have access to some of your Data. Access to your Data is based on individual and limited access authorisations. Staff who can access Personal Data are subject to a confidentiality obligation (through a nominal and personal confidentiality agreement).

Subcontractors: During our activities, we use Subcontractors, i.e. persons who process all or part of your data on behalf of MILLION VICTORIES. We take particular care in selecting Subcontractors who process Personal Data on our behalf. We are committed to ensuring that Subcontractors provide the same guarantees of confidentiality and security and that the processing they carry out is in accordance with the regulations in force, particularly the GDPR.

Our Subcontractors provide services on our behalf, in particular:

• Downloading the Game (AppStore, PlayStore);
• In-app purchases (AppStore, PlayStore, Xsolla);
• The management of our creator code program (Nexus);
• The hosting of the Game and of your Data (Google Drive, MongoDB);

The access that our subcontractors have to your data is governed by contracts that they have signed, which outline their responsibilities for safeguarding, securing, and keeping confidential your Data. We ensure that our Subcontractors process Data in accordance with this Policy.

Social networks and other third-party services: The use of social networks and/or third-party services to interact with the Game (for example, if you decide to sign in with your Google account or to link your Facebook account to the Game) may result in the exchange of Data between MILLION VICTORIES and these third parties.

We therefore invite you to consult the personal data management policies of these third parties to find out how they collect and process your Data.

Other Players: Other players will see some of your Data while playing the Game, including your pseudo, the clan you are a member of, some Game’s results and any messages you post (either in the global chat or in the clan chat). All other Data (especially email addresses) will only be accessible to MILLION VICTORIES and its partners, under the conditions described in this article.

Authorities: Where we have a legal obligation to do so or in order to protect the rights, property and safety of MILLION VICTORIES, we may also disclose your information in the following circumstances: (i) to investigate, detect, prevent or take action regarding illegal activities or other wrongdoing, suspected fraud or security issues; (ii) to establish or exercise our rights to defend ourselves against legal claims; (iii) to protect our rights, property or personal safety and that of our users or the general public; (iv) if we or any of our affiliates undergo a change of control, including through a merger, acquisition or purchase of all or substantially all of our assets.

 

ARTICLE 6 – WHERE IS YOUR DATA STORED

Data is stored, processed and stored in France and in other jurisdictions within the European Union, if necessary for the proper provision of our services and/or if required by law.

If you reside in the European Union, your Data may only be transferred to locations outside the European Union if we are convinced that a comparable or better level of protection is in place to protect your Personal Data in the location concerned.

A transfer of personal data to a third country outside the European Union or to an international organisation may take place when the CNIL has determined, by means of a decision, that the third country, a territory or one or more specific sectors in that third country, ensures an adequate level of protection of personal data.

Such a transfer does not require specific authorisation.

In the absence of a decision by the CNIL concerning the adequate level of protection of the third country outside the European Union, MILLION VICTORIES may not transfer such data to such a country unless appropriate safeguards have been put in place contractually and on condition that the Data Subjects nevertheless have enforceable rights and effective legal remedies within the country or countries concerned.

 

ARTICLE 7 – PROTECTION OF YOUR DATA

Your Data are processed and are stored by MILLION VICTORIES for a period no longer than necessary for the purposes for which they are collected and processed, beyond the period strictly necessary for the management of our relationship.

We continuously develop and implement administrative, technical, and physical security measures to protect your data from unauthorised access, loss, misuse, or alteration. MILLION VICTORIES relies on a combination of several levels of security. Measures may be human, physical or logical in order to contribute to the security of its information systems.

Human security: MILLION VICTORIES undertakes to preserve the confidentiality of Personal Data regarding its staff, collaborators and any person likely to have access to it.

MILLION VICTORIES staff authorised to access Personal Data undertake to respect confidentiality and may be subject to a legal or contractual obligation of confidentiality. Similarly, authorised staff have received the necessary training in the protection of Personal Data.

MILLION VICTORIES has also appointed a data protection officer and complies with the principle of privacy by design. In addition, we regularly offer our employees IT security training sessions to limit any risk of data breaches.

Logical security: The logical security measures implemented by MILLION VICTORIES include:
Configuring computers, servers and mobile phone with recommended security protocols;
Protecting servers and computers with regularly updated antivirus software;
Encrypting hard drives on employees’ laptops

Physical security: The physical security measures implemented by MILLION VICTORIES include:
Regularly updated password-protected FTP server;
Perimeter security components such as firewalls and proxies filter access to MILLION VICTORIES resources

In the event of a breach of Personal Data, MILLION VICTORIES undertakes to promptly notify the CNIL (French Data Protection Authority) in accordance with the conditions set out in the GDPR.

If the breach poses a high risk to the Data Subjects and the Personal Data has not been sufficiently protected, MILLION VICTORIES will notify the Data subjects and provide them with the necessary information and recommendations.

 

ARTICLE 8 – DATA RETENTION PERIOD

We keep your information for the time necessary for the purposes for which it is processed.

The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it. We may also retain and use this information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

 

ARTICLE 9 – YOUR RIGHTS

In accordance with the GDPR, you have several rights regarding your Data. These rights include:

• The right to be informed: You have the right to be informed about the Data we’re collecting, the purpose for which we collect your Data, the length of time your Data is stored and whether we share your Data with third Party.

  This privacy policy contributes directly to the exercise of this right.

  If you have any questions about how your Data is processed, you can contact us by email at the address indicated in Article 11.3 of this privacy policy.

 

• The right of access: You have the right to access information about the existence of any processing and its methods.

 

• The right of rectification: If you find that some of your Data is inaccurate or incomplete, you have the right to ask us to rectify it.

 

• The right to erasure: In certain specific cases, you may ask us to delete all or part of your Data.

  This right applies if you consider that the processing was unlawful, for processing based on your consent (such as, for example, the fact that the advertisements visible in the game are personalized) or if you consider that your Data is no longer necessary for the processing for which it was collected.

• The right to restrict processing: Under certain conditions, you may obtain from MILLION VICTORIES the restriction of the Processing of your Data:
  • When the accuracy of the Personal Data concerning you is contested, for a period enabling the Data Controller to verify the accuracy of the Data;
  • When the processing is unlawful and you oppose the erasure of your Data and request, instead, the restriction of processing;
  • When the Data is no longer necessary for the purposes for which it was collected, but you need it for exercising legal claims;

    When you object to Processing carried out by MILLION VICTORIES and based on its legitimate interest, MILLION VICTORIES may continue the Processing for the duration of the verification process to determine whether the legitimate grounds pursued by MILLION VICTORIES in the context of the Processing override your own.

 

• The right to data portability: You have the right to ask us to send the Data we have about in a structured, commonly used and machine-readable format (e.g. in a “.xlsx” format file).

 

• The right to object: You have the right to object at any time, on grounds relating to your situation, to the processing of your Data. The right to object is limited, in particular by our legitimate interest in processing Personal Data and other legal requirements, such as compelling reasons.

 

• Rights in relation to automated decision, including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

  A decision is deemed to be based solely on automated processing when a decision producing legal effects concerning you or significantly affecting you is taken solely by technological means, without human intervention.

  Where applicable, you may request MILLION VICTORIES to have a person intervene in the decision-making process.

If you want to exercise any of these rights, please send us an email specifying the subject of your request to the address mentioned in Article 11.3 of this privacy policy.

Please note that, in certain cases, we may refuse to comply with your request (for example, we have the right to oppose the erasure of your data if we are legally required to retain it) or ask you to prove your identity beforehand.

You also have the right to introduce a complaint to the French Data Protection Authority (CNIL), either electronically at www.cnil.fr or by post to the following address:

CNIL – Complaints Department
3 Place de Fontenoy
TSA 80715 – 75334 PARIS CEDEX 07

 

ARTICLE 10 – DATA TRANSFER

In connection with the provision of the Game, we do not plan to transfer information to affiliated entities or other third parties outside your country or jurisdiction to other countries or jurisdictions around the world. However, in the event that we do transfer information in this manner, by using the Game, you consent to the transfer of your information outside the European Union.

If you are located in the European Union, your Personal Data may only be transferred to locations outside the European Union if we are satisfied that an adequate or comparable level of protection is in place to protect Personal Data.

We will take reasonable steps to ensure that we have appropriate contractual agreements with our third parties to ensure that adequate safeguards are in place so that the risks of unlawful use, alteration, deletion, loss or theft of your Data are minimised, and that these third parties act always in accordance with applicable laws. These measures may include seeking adequacy decisions, compliance with the European Commission’s standard or specific contractual clauses, binding corporate rules (BCRs) or approved certification mechanisms and codes of conduct.

 

ARTICLE 11 – MISCELLANEOUS

Deletion of your account: You may decide to delete your Game’s account at any time. We shall then delete your Data. To do so, please write to us at the email address listed below in the “Contact us” section.

If we decide to delete your account, particularly if you fail to comply with the Game’s terms of use, we will delete your Data.

Policy updates: We may update this Privacy Policy from time to time without notice. If you continue playing the Game, you are deemed to have accepted the updated version of the Privacy Policy.

Contact us: If you have any questions about this Policy and/or if you want to make a request regarding your Data, you may contact us by email: requestpersonaldata @ millionvictories.com