PRIVACY POLICY – 2GAME PRO LTDA

1. Introduction

This Privacy Policy ("Policy") describes how 2GAME PRO LTDA ("2Game Brasil", "we", "our") collects, uses, stores, shares, and protects the personal data of users who access or use:

• the website www.2game.com.br and related subdomains;
• our online store and associated apps;
• any services, features, content, tools, or resources offered by us (collectively, "Services").

2Game Digital Limited acts as the corporate controller and infrastructure provider for the group, but is not the seller of the products and services offered to Brazilian consumers and does not assume direct consumer liability. All sales, billing, customer support, and obligations related to the Services provided in Brazil are the exclusive responsibility of 2Game Pro Ltda, under this Policy and our Terms and Conditions.

In case of conflict between this Policy and the Terms and Conditions, the more specific rule regarding personal data protection will prevail, in accordance with the General Data Protection Law – LGPD (Law No. 13.709/2018).

By accessing or using the Services, you declare that you have read, understood, and agree to this Policy.

2. Legal Bases for Data Processing (LGPD)

We process personal data in compliance with the LGPD, based on one or more of the following legal bases:

• Contract execution (art. 7º, V): to process orders, deliver products (digital and physical), provide customer service, and offer technical support.
• Compliance with legal or regulatory obligation (art. 7º, II): for issuing invoices, fulfilling tax, accounting, and regulatory obligations, and responding to requests from authorities.
• Legitimate interest (art. 7º, IX): to ensure platform security, prevent fraud, improve Services, conduct statistical analyses, personalize content and offers, always respecting your fundamental rights and freedoms.
• Consent (art. 7º, I): for sending marketing communications, newsletters, and using non-strictly necessary cookies, when required by law.
• Credit protection (art. 7º, X): for fraud and default analysis and prevention, in conjunction with payment and anti-fraud partners.

When processing is based on consent, you may revoke it at any time upon request, without affecting the legality of the processing carried out up to that point.

3. Categories of Personal Data We Collect

4. How We Use Your Personal Data

5. Cookies and Other Tracking Technologies

We use cookies and similar technologies to:

• Enable basic site functionality (login, cart, checkout);
• Remember your language, region, and platform preferences;
• Understand site performance and improve your experience;
• Offer personalized advertising and content, when authorized.

You can manage cookies:

• through the consent banner on our site;
• in your browser settings, where you can block or delete cookies.

Blocking certain types of cookies may affect the functioning of parts of the site or some Services.

6. Sharing of Personal Data

7. International Data Transfers

Personal data may be transferred and processed in countries other than Brazil, including:

• Canada and other countries where Shopify or its subcontractors operate;
• United States and European Union countries, due to cloud, CDN, anti-fraud, logs, and analytics services;
• Hong Kong, due to activities of 2Game Digital Limited.

When we conduct international transfers, we adopt measures provided for in the LGPD, including:

• appropriate contractual clauses;
• security assessments;
• compliance with international data protection standards.

8. Data Retention and Deletion

We will retain your personal data:

• for as long as necessary to fulfill the purposes described in this Policy; and/or
• for the period required by law, regulation, or competent authority; and/or
• until they are no longer necessary for defense in legal, administrative, or arbitration proceedings.

Examples of typical periods (which may vary according to applicable law):

• order and billing data: at least 5 (five) years after the transaction is completed, or a longer period as required by tax legislation;
• accounting and tax records: specific legal periods;
• access logs (application logs): minimum of 6 (six) months, which can be extended as needed for security;
• marketing data: until consent is revoked or the right to object is exercised, unless retention is required by legal obligation.

After the expiration of these periods, the data will be deleted or anonymized, unless the law permits or requires its retention.

9. Your Rights as a Data Subject (LGPD)

Under the LGPD, you have, among others, the following rights:

• Confirmation of the existence of personal data processing;
• Access to the personal data we hold about you;
• Correction of incomplete, inaccurate, or outdated personal data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• Data portability to another service or product provider, where applicable;
• Deletion of personal data processed based on consent, except in cases of legal retention;
• Information about data sharing with public and private entities;
• Information about the possibility of not providing consent and the consequences of refusal;
• Revocation of consent when processing is based on this hypothesis;
• Review of automated decisions that affect your interests.

We may request additional information or documents to verify your identity and ensure security in handling your request.

10. Automated Decisions and Profiling

Some processes may involve automated processing, such as:

• transaction risk analysis (anti-fraud);
• automatic approval or blocking systems in case of high risk;
• product recommendations based on browsing and purchase history.

You can request details about the logic used and, where applicable, request human review of exclusively automated decisions that affect your interests, in accordance with the LGPD.

11. Information Security

We adopt technical and administrative measures to protect your personal data against unauthorized access, destruction, loss, alteration, communication, or improper dissemination, including but not limited to:

• communication encryption (HTTPS/TLS);
• profile-based access controls;
• logging of access and relevant activities;
• server and application monitoring;
• internal privacy and security policies;
• use of providers that follow internationally recognized security standards.

Apesar dos esforços, nenhum sistema é totalmente seguro. Caso tenhamos conhecimento de incidente de segurança que possa acarretar risco relevante ou dano aos titulares de dados, adotaremos as medidas cabíveis, inclusive comunicação aos afetados e às autoridades competentes, conforme a LGPD.

12. Children, Adolescents, and Age Rating

The Services are primarily intended for users who are at or above the age of majority in their country of residence. Certain games, content, or products may have age ratings (e.g., national ratings, ESRB, PEGI).

When required by law or by publishers:

• we may request age verification;
• it is recommended that minors use the Services under the supervision of parents or guardians;
• certain content may be restricted to users who meet minimum age requirements.

Parents or guardians who suspect that minors' data has been processed contrary to this Policy can contact us at suporte@2game.com.br to request clarification and, if applicable, the adoption of appropriate measures.

13. Relationship with Other Documents

This Policy:

• is part of the 2Game Brasil Terms and Conditions;
• should be interpreted in harmony with other applicable policies (e.g., Refund Policy, Shipping and Returns Policy).

In case of discrepancies between documents, the one more specific in terms of personal data protection will prevail, respecting applicable legislation.

14. Changes to this Privacy Policy

We may change this Policy at any time to reflect:

• legislative or regulatory changes;
• changes in the Services, our corporate structure, or internal processes;
• technological advancements or security adjustments.

Whenever there is a significant change, we may:

• publish the new version on our website, with the update date; and/or
• send communication via email or notification within the user's account, when appropriate.

Continued use of the Services after the new version comes into effect will be interpreted as agreement with the updated Policy.

15. Data Protection Officer (DPO)

For matters related to this Policy or the LGPD, you can contact our Data Protection Officer (DPO) through the following channel:

16. Applicable Law and Jurisdiction

This Policy will be governed and interpreted in accordance with the laws of the Federative Republic of Brazil.

The forum of the Barueri – SP district is elected, except in cases where consumer protection legislation ensures a different forum in favor of the consumer, in which case the more protective rule will prevail.