Privacy Notice
Last updated: 14th December 2022

This Privacy Notice explains who we are, how we collect, process, and share personal data about you, and how you can exercise your privacy rights. This Privacy Notice applies to personal data we collect and process through our games, mobile applications, and other products (“Games”) and websites such as  www.sommoro.com (“Websites”) (together “Services”).

From time to time, we may change this Privacy Notice due to changes in our business operations, technologies, industry practices or regulatory requirements. If we make any material changes to this Privacy Notice, we will notify you separately as required under the applicable law.

How to contact us?

If you have any questions about data protection, the processing of your personal data or you wish to exercise your rights as a data subject, we kindly ask you to contact us through the support feature within our Games and Websites. Alternatively, you may contact us at:

SOMMORO Games Ltd

Attn: Data Protection Officer

Kaitalantie 135

33850 Pirkkala

Finland

support(a)SOMMORO.com

What data do we collect?

The categories of personal data we collect depend on the Services you use. Please note that providing personal data to us is not mandatory, but we are unable to provide our Services, or some parts of them without processing of your personal data.

The sources of the personal data we process can be divided into three categories:

Data you provide us:

• Contact information such as your name and email address.
• Messages, chat logs and other content you submit when you use our Services, contact our customer support or interact with other players inside the Services.
• Payment details and financial information in connection with the purchases you make through the Services and the related refunds.
• Marketing & communication preferences.
• Other data you may provide to us in connection with different surveys, promotions, competitions and other events.

Data we collect automatically when you interact with our Services:

• Account identifiers automatically created such as PlayerID.
• Customer relationship details, such as contract start and end date and the Services ordered.
• Your IP address, mobile device identifiers and other electronic network activity information.
• Data about your device, such as device model, type and used language.
• Gameplay data such as your level and different game events.
• Coarse location (e.g. country, state, or city) inferred from your IP address.
• Data collected via cookies and similar technologies such as cookieID’s and activities within our Services.

Data obtained from 3rd parties:

• 3rd party account details if you decide to login using 3rd party tools or services such as
• Facebook, Google or Apple.
• Payment verification details when you make a purchase through our payment service providers.
• Data you make available on different social media channels such as your posts and account name.
• Demographic data and segments that we use to target our advertising.
• Data related to surveys and questionnaires organized by our partners.

Why do we collect your personal data?

To perform the contract between you and us

• Providing the Service. The primary purpose of processing your personal data is to provide you with the Services. For example, when you play Games, we process your game events and PlayerID to enable the gameplay.
• Payments and refunding. When you make a purchase or ask for a refund, we need to process your payment details
• Service related communication. We are constantly improving our Services and we use your contact details to communicate with you regarding the Services and their updates.

Our legitimate interests

• Analyzing, reporting and Service development. When you use our Services (e.g. play Games, visit our Websites or make a purchase), we collect personal data to analyze and learn how the Services are used. We use this information to maintain and improve the quality of the Services, to develop new games and services and to gather certain insights for our internal reporting.
• Customer support. When you send us a message or contact our customer support, we will process your contact details to respond to your inquiries.
• Social media management. When you tag us on social media or post a message on our channels, we collect certain information to monitor and analyze our social media presence.
• Marketing. We collect and process personal data for creating audiences to show personalized advertisements via other communication channels (for example on other websites or mobile apps). We also collect information from these advertising campaigns to measure and improve the effectiveness of our advertising.
• Information security. We are collecting logs and other information from the use of our Services to analyze and detect frauds or misbehavior to keep our Services safe for everyone.
• Content moderation. We monitor the content, such as chats and player names, to clean up and block acts of disruptive behavior on our Services.

With your consent

• Cookies. With your consent, we use certain cookies to collect information about your use of the Websites to analyze how our Websites are used and to display targeted advertising on different communication channels.
• Player surveys. From time to time, we may contact you about surveys when we want to gather feedback on our Services or to learn more about our players.

Do we share your personal data?

Instead of doing everything on our own, we rely on certain service providers and other partners to provide data processing services for us for the purposes described in this Privacy Notice.

Please note that certain recipients such as payment service providers, social media / advertising partners and 3rd party account providers, such as Facebook, Google, Apple and Supercell may process your personal data as data controllers under their own privacy policies. Privacy policies for Facebook here, Google here, and Apple here.

Depending on the Services you use, we might share your personal data with the following categories of recipients:

• Group companies.
• 3rd party account providers. We have integrated 3rd party accounts, such as Google Account, Facebook login, Sign in with Apple, to our Services. To enable easy login options, these account providers will receive your personal data and process it under their own privacy policies.
• Advertising partners. When we request our advertising partners to show our advertising campaigns, we may disclose a limited amount of your personal data (such as information about the segmenting) to enable our partners to deliver an ad that is relevant to you. To monitor the effectiveness of our advertising campaigns and to prevent ad frauds, we also disclose information about your device and installs to our advertising partners.
• Analytics providers. We use tools provided by 3rd parties to collect and gather personal data for analytics and reporting purposes.
• Payment service providers. We use payment processors to process your payment transactions on our behalf. They have access to your credit card data.
• Partners working for us, such as IT-service providers and consultants who process your personal data on our behalf and in accordance with our instructions.
• Social media partners who provide advertising services, social media interaction tools or other functionalities to our Services.
• Server and datacenter providers who provide data center and IT-infrastructure related services for us.
• Potential or actual buyers (and their agents and advisers) in connection with any proposed or actual purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Privacy Notice.
• Other organizations and public authorities such as competent law enforcement or regulatory bodies, government agencies, courts or other third parties where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

Do we transfer your personal data outside the EU?

Our Services are global by nature and therefore your personal data is transferred to countries outside the European Union and the European Economic Area in certain situations. These countries may have data protection laws that are different to the laws of your country.

Specifically, our servers are located around the world, and our group companies and third party service providers and partners operate around the world. This means that when we collect your personal data, it can be processed in any of these countries.

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. These safeguards may include having standard contractual clauses approved by the EU Commission or implementing other safeguards required by law.

How long do we keep your personal data?

We retain personal data we collect from you where we have an ongoing legitimate business need or a legal obligation to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

When your personal data is no longer necessary to fulfill the purposes defined in this Privacy Notice, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

Cookies and similar technology

We use cookies and similar tracking technology such as software development kits (collectively, “Cookies”) on our Services.

A "Cookie" is a piece of information that is stored on a user's computer, tablet or phone when they visit a website. Cookies can help in identifying a user's device when they use a mobile application or visit a website and remember helpful details of the use and the choices made by the user to improve the user experience.

Cookies cannot be used alone to identify an individual, but they may be linked directly or indirectly to an identifiable individual when combined with other information. In these cases, cookies may be treated as personal data. If we identify a user based on cookies, we make sure that all cookie information is processed as personal data in accordance with applicable data protection laws.

The cookies we use include

• Essential cookies: These cookies are essential to provide the Websites and to enable the use of some of its features.
• Functionality cookies: These cookies allow us to remember choices you make when using the Websites.
• Tracking and performance cookies: These cookies are used to track information about traffic to the Websites and how users use the Websites. We may also use these cookies to serve interest-based advertising.
• You may also prohibit the use of cookies by changing your browser or device settings. Depending on your browser or device, you may also limit the use of cookies or remove specific cookies from your browser or device settings. However, cookies are an important part of how a web service works, so limiting the use of cookies may affect the functionality of our Websites.

Your rights as a data subject

The law guarantees you certain rights regarding the personal data we hold and process. Please note however, that these rights are not absolute. For example, we are not able to delete your personal data if we have a legal obligation to retain it. To exercise your rights, we kindly ask you to contact us by either using the support feature in our Services or to contact us in the address mentioned above.

• You have the right to request access to personal data we hold about you. In addition, you have the right to request a copy of such data.
• You have the right to request rectification, restriction of erasure of your personal data. However, certain information is strictly necessary to fulfill the purposes defined in this Privacy Notice and may also be required by law. Thus, it may not be possible to remove such personal data.
• You have the right to object to the processing operations that are based on legitimate interest. You always have the right to object to processing for marketing purposes and decline from receiving future direct marketing.
• When processing of your personal data is based on your consent, you have the right to withdraw such consent at any time. The withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.
• You have the right to receive the personal data you provided in a structured, commonly used machine-readable format and transmit such data to another data controller. Please note that this right applies only to the personal data you have provided, is processed by automated means and where the processing is based on your consent or a contract.
• If you believe there is a problem with the way we are handling your personal data, you have a right to file a complaint to your national data protection authority in the EU/EEA, for instance the Finnish Data Protection Ombudsman (www.tietosuoja.fi). You may also file a complaint to the data protection authority in any other EU member state where you live, work, or where you think the alleged violation has occurred.

FOR CALIFORNIA RESIDENTS

Last updated: 14th December 2022

This section applies only to residents of California and is meant to provide additional information about how we handle personal information about California residents as required under California privacy laws including the California Consumer Privacy Act (“CCPA”).

Categories of personal information

The categories of personal information we have collected in the preceding 12 months, and the sources of such information are described in the section “What data do we collect?” above.

Purposes for collecting your personal information

Depending on the Services you have used, we use your personal information for the following business purposes:

• Auditing related to an interaction with you and concurrent transactions including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging to identify and repair errors that impair existing intended functionality in our Services.
• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction.
• Performing Services including, but not limited to, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
• Internal research for technological development and demonstration.
• Activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Disclosures to third parties

We do not “sell” your personal information to third parties. As described in the “Do we share your personal data?”, depending on the Services you have used, we share your personal information with a variety of recipients, such as our service providers, to achieve our business purposes.

In the preceding 12 months, we have disclosed the following categories of personal data as part of our Services:

Your rights

The CCPA grants you certain rights and you can submit your requests by either using the support feature in our Services or to contact us in the address mentioned in section “How to contact us?” above.

Please note that when you submit a request, we may take certain steps to validate your request by asking you some questions (e.g. about game experience, such as your current level or your playerID) and matching the information provided by you with the information we have in our records.

• Right to know. You have the right to request that we disclose certain details to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you (i) the categories of personal information we have collected about you; (ii) The categories of sources from which we have collected personal information about you; (iii) Our business or commercial purposes for collecting that personal information; (iv) The categories of third parties with whom we share that personal information; (v) The categories of personal information that we have disclosed about you for a business purpose; and (vi) a copy of the specific personal information we have collected about you.
• Right to deletion. You have the right to request that we delete personal information we have about you. Upon receiving your verifiable request, we will delete your personal information and direct our service providers to do so, unless we have a lawful right to retain your information under the CCPA. For example, we may deny your request if retaining your personal information is necessary for detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activities or to comply with a legal obligation.
• Right to non-discrimination. We will not discriminate against you for exercising any of your rights granted in the CCPA. Unless permitted by the CCPA, we will not deny your use of our Services or provide you with a different level or quality of Services

Changes to this notice

We reserve the right to amend this Privacy Notice at our discretion and at any time. We may update this Privacy Notice due to changes in our operations or in the processing of personal information. The date this Privacy Notice was last updated is identified at the top of this page. You are responsible for periodically visiting the Websites and this Privacy Notice to check for any changes.