Introduction

Effective date: 17 June 2026

This privacy notice describes how we will collect, use, share, transfer, and otherwise process personal data in connection with: (i) your use of FIFA Heroes (the "Game"); (ii) websites that we own or operate relating to FIFA Heroes and that link to this privacy notice (each a "Website"); (iii) when you sign up to our mailing list; (iv) if you participate in a promotion that we run in relation to FIFA Heroes; or (v) if you otherwise communicate or interact with us. Please read the following carefully to understand our practices regarding your personal data and how we handle it.

We keep our privacy notice under regular review. It was last updated at the effective date stated above. It may change and, if it does, those changes will be posted on this page. Material updates relating to the Game will be notified to you when you next start the Game or log into your account.

The Game and our Websites may, from time to time, contain links to and from the websites or applications of third parties. Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this privacy notice. You should review these privacy notices to understand how they use your personal data before you submit any personal data to these websites or use these services.

In some cases, for example in relation to promotions we run, we may provide supplemental privacy information, which should be read in addition to this privacy notice.

1. Who we are

Solace Games, SARL, a company with registered number B214651 and incorporated in Luxembourg with registered address at 15, Blvd Franklin D Roosevelt, Luxembourg, is the controller and is responsible for your personal data ("Solace", "we", "us" or "our" in this notice). If you have any questions about this privacy notice, please contact our data privacy manager at: privacy@solacegames.io.

2. The personal data we collect about you

We collect, use, share, and transfer different kinds of personal data about you depending on the nature of our relationship with you. What constitutes "personal data" (sometimes also referred to as "personal information") under applicable law may also differ depending on the jurisdiction in which you are based. For the purposes of this privacy notice, we use personal data to mean any information relating to an identified or identifiable natural person or household (including any information that identifies, relates to, describes, or can be associated with you).

To make it easier for you to use this privacy notice, we group the personal data we collect into the following categories:

• Profile Data: e.g., your username (which may be your email address), and password.
• Contact Information: e.g., your email address or telephone number.
• Transaction Data: e.g., history of your payments, purchases, and refunds.
• Device Data: the type of device you use and your unique device identifier.
• Usage Data: logs and detail of your use of the Game, being the dates and times on which you download, access and update the Game, any error or debugging information, the actions we and you take in relation to them, and any Game Analytics Data.
• Game Analytics Data: the information collected through technologies placed on your device (such as software development kits (SDKs)).
• Website Analytics Data: the information collected through analytics technology used on any of our Websites (such as cookies).
• Promotion-Specific Data: any information we may collect in relation to a specific promotion that we run.
• Preferences: if you provide us with your marketing and related preferences, e.g., consent to receive direct electronic marketing.
• Communications Data: any information included in any communications with us (e.g., support requests, emails or social media messages, or communications regarding your data subject rights).

We do not routinely collect any "special category" or "sensitive" personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) or information relating to criminal convictions. However, if you include such personal data in any communications with us, this will constitute your explicit consent for us to process such personal data in order to consider your communication and respond accordingly.

We may process certain limited data relating to criminal offences in monitoring the use of the Game or our Websites, or for security or other purposes, where we suspect you may have committed a crime, such as attempting to make a fraudulent purchase or claim or circumvent the security of the Game. In such circumstances we may provide that information to law enforcement and/or use it to establish, exercise or defend a legal claim. For more information on this processing, please contact us at: privacy@solacegames.io.

3. How is your personal data collected?

We collect your personal data in the following way:

Directly from you.

• Registration. We collect your Profile Data when you register your account with us.
• Communications Data. We collect Communications Data when you communicate with us.
• Mailing List. If you sign up to one of our mailing lists, we will collect your email address and communications preference.
• Promotion-Specific Data. If you participate in a promotion that we operate, we will collect personal data specific to that promotion.

From your use of the Game or our Websites.

• Information you generate when using the Game. Each time you access and use the Game we collect Device, Usage, and Game Analytics Data. If you access our Websites, we may collect Website Analytics Data.

From third parties and publicly available sources

• When you make a purchase. If you make a purchase in the game, we receive Transaction Data from the relevant application store provider.
• If you engage on social media. We may collect personal data if you engage with us on social media, including on Discord channels relating to FIFA Heroes. For example, we may collect the details of your account, and any comments you make.

4. Cookies and similar technologies

With your consent, where required by applicable law, we permit third parties to use online tracking technologies on the Game for analytics and advertising, including to help manage and display advertisements and to tailor advertisements to your interests. The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear on the Game or elsewhere (e.g., on websites or in other applications).

In particular, we use Google AdMob to display advertisements within the Game. We do not provide Google AdMob with information that directly identifies you (such as your email address or unique user ID) but Google AdMob may directly collect device identifiers, IP addresses, and information about your use of the Game and combine this with information it obtains from other sources in order to build up a profile of you and use this to provide you with advertisements that are more relevant to you.

With your consent, where required by applicable law, we may also use cookies and similar tracking technologies on our websites. For more information, see our Cookie Policy.

5. How we use your personal data

We will use your personal data for the purposes specified in this privacy notice. Depending on the jurisdiction in which you are based, certain uses of your personal data require an identified "lawful basis". Some of our most common lawful basis for which we use your personal data are specified below:

• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time. For more information on how to do so, please contact us (see Section 10 below).
• Performance of a contract. Where we need to process your personal data to perform a contract with you (i.e., the Terms of Use for the Game) or where you ask us to take steps before we enter into a contract with you (e.g., in relation to in-Game purchases). Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

The tables below detail the primary uses of your personal data in connection with the Game:

The tables below detail the primary uses of your personal data in connection with the Websites and mailing lists:

The tables below detail the primary uses of your personal data in connection with promotions that we may operate:

We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).

6. Disclosures of your personal data

We may share your personal data with the following third parties:

• Internal third parties. Other companies in the Solace Group to provide IT and system administration services.
• External third parties.
  • Your Game Store (or Appstore) provider and mobile network operator to allow you to install the Game.
  • Enver Studios, who has developed and administers the Game on our behalf.
  • We may share all personal data that we collect with FIFA, including via the FIFA Gaming Hub (FGH) or other FIFA integrations within the Game.
  • Service providers (acting as "processors") who provide the following services: IT and system administration services, hosting services for the Game and the Websites, payment processing, email and SMS delivery and administration, and data storage and analysis.
  • Our professional advisors acting as controllers including lawyers, auditors, insurers, and consultants who provide legal, accounting, insurance, and other services.
• Social media platforms and networks. Some parts of the Game may have features such as, plugins, widgets, and/or other tools made available by social media platforms and networks that may result in information being collected or disclosed between us and such parties. Their use of your information is not governed by this privacy notice.
• Counterparties to a transaction. We may share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets or third parties advising in connection with such activities (or re-organisation of our business). Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
• Relevant authorities. We may share your personal data with regulators, law enforcement, public authorities or other third parties acting as controllers where necessary to exercise our rights or comply with a legal obligation or where we otherwise deem it to be in our legitimate interests (in operating our business and preventing and detecting potentially unlawful acts), including where such disclosures are voluntary.

7. International transfers

Solace Games, SARL is located in Luxembourg but we use infrastructure or service providers located in other jurisdictions. You will generally be connected to the infrastructure closest to you in order to provide you with the best service.

Your personal data may therefore be processed in a foreign country (a "third country"), where data protection laws may be less stringent than the laws in your country. Whenever we transfer your personal data to a third country, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• The recipient country has been deemed to provide an adequate level of protection for personal data by the relevant supervisory authority or official body; or
• We use specific contracts approved by the relevant supervisory authority or official body which give personal data the same protection it has in the jurisdiction from which it was collected, together with supplementary measures where required.

Please contact the data privacy manager using the contact details above if you want further information on the specific mechanism used by us when transferring your personal data.

8. Data security

Where we have given you (or where you have chosen) a password that enables you to access your account, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

9. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data. See Section 10 below for further information.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymize your personal data (so that it can no longer be associated with you) for analytics or statistical purposes, in which case we may use this information indefinitely without further notice to you.

10. Your legal rights

Depending on the jurisdiction in which you are based, you may have certain rights in relation to your personal data.

For us to process some requests, we will need to verify your identity to confirm that the request came from you. We may contact you (where we have such details) to verify your request. Depending on your request, we will ask for information such as your username, name, an e-mail address or phone number that you have used with us. For certain requests, we may also ask you to provide details about the most recent purchase you made in the Game.

For example, if you are based in the EU or UK, you have the following rights under data protection laws:

• Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request) as well as details of our processing of such personal data. This enables you to check that we are lawfully processing it.
• Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)
• Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it (note that there may be reasons why we cannot comply with your request).
• Objection. Object to us processing your personal data where we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms (note that in some cases, we may refuse your objection).
• Restriction. Request that we restrict or suspend our processing of your personal data: (i) if you want us to establish the data's accuracy; (ii) where our use of the data is unlawful, but you do not want us to erase it; (iii) where we no longer require the data, but you need us to hold onto it to establish, exercise or defend legal claims; or (iv) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
• Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format.
• Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data (note that this does not affect the lawfulness of any processing carried out before you withdraw your consent and we may process your personal data without your consent where we are relying on another lawful basis for doing so).
• Complain to the relevant data protection regulator. If you are unhappy with how we process your personal data, you should contact us first using the details below in line with our complaints procedure so that we have the chance to put it right. We will acknowledge all complaints within 30 days and respond without undue delay. However, you also have the right to make a complaint to the relevant data protection regulator in your jurisdiction at any time.

You can exercise any of these rights at any time by contacting us at: privacy@solacegames.io.

Depending on your country, province, or state of residence, you may have one or more of the following rights:

• Opt Out of Cookies and Sale/Sharing Using Online Tracking Technologies. Our use of online tracking technologies may be considered a "sale" / "sharing" under applicable law.
• Categories of personal information disclosed that may be considered "sale" / "sharing": Game Analytics Data.
• Categories of third parties to whom personal information was disclosed that may be considered "sale"/ "sharing": Google AdMob, as described in this privacy notice.
• We do not sell your personal information as defined under Nevada law. However, to request email confirmation that we do not sell your personal information, please send an email to privacy@solacegames.io with "Nevada Opt-Out of Sale" in the subject line and in the body of your message.
• Residents of Canada can control the use of cookies and other online tracking technologies on the Game by us and by third parties (including advertisers and marketing partners, data analytics providers, and social media networks) through your preferences in the Game.
• Limit the Use of Sensitive Personal Information. As mentioned above, we do not collect or process sensitive personal information for the purpose of inferring characteristics about you. Therefore, we do not offer the right to limit the use of sensitive personal information.
• Managing Communication Preferences
• Email. You can stop receiving promotional e-mails at any time by clicking on the "unsubscribe" link at the bottom of any promotional e-mail that you receive from us.
• SMS. In the event we send you an SMS message, you can stop receiving these at any time by replying "STOP".
• In-App Push Notifications. You can stop receiving in-app push notifications in mobile application by adjusting your Notification Settings.
• Access, Correct, and Delete Personal Information. Depending on your state of residence in the U.S., you may have the right to request access to and receive details about the personal data we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. If you are a resident of Canada (including but not limited to resident of Quebec), you have the right to request access to your personal information, to have your personal information rectified if it is inaccurate, incomplete or out of date, and to withdraw your consent to our collection, use, and disclosure of your personal information (including or use or sharing of your personal information for marketing or other secondary purposes). These rights may be limited in some circumstances by applicable law.
• Access and Deletion. You can submit a request to access or delete your personal information, or withdraw consent, by submitting a request form to: privacy@solacegames.io.
• If you are a Canadian resident and want to withdraw consent to processing, please submit a deletion request by submitting a form to the above email address.
• Corrections. You can correct information related to your account by:
  • Logging into your account; or
  • Emailing privacy@solacegames.io.
• Request a copy. You may submit a request for a copy of the information collected about you by contacting us at: privacy@solacegames.io. Depending on your state of residence, you may request for a copy of the information up to twice per year per customer.

Once you have submitted your request, we will respond within the time frame permitted by the applicable law. Please note that we may charge a reasonable fee for multiple requests in the same 12-month period, where permitted by law.

Depending on your state of residence in the U.S., you may be able to appeal our decision to your request regarding your personal information. To do so, please contact us at: privacy@solacegames.io. We respond to all appeal requests as soon as we reasonably can, and no later than legally required. If you are a resident of Canada, you may have the right to complain to a privacy commissioner about our decision with respect to your request.

Depending on your state of residence in the U.S., you may designate an authorized agent to submit a request on your behalf to access or delete your personal information. To do so, you must: (1) provide that authorized agent written and signed permission to submit such request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

If you have been designated as an authorized agent to submit a request on behalf of another customer, you must make the appropriate selection when you submit a request.

We do not retaliate against players or other individuals who seek to exercise any of their rights described in our privacy notice.

11. Children's privacy

The Game is not intended or directed to those under 13 years old and we do not knowingly collect data relating to children under this age. If we become aware that a child under the age of 13 has provided us with personal data, we will delete the personal data from our records.

12. Notice of Financial Incentive

FIFA Heroes Promotions and Sweepstakes ("Program") is a promotional program offered by Solace. Participation in the Program is subject to the applicable promotion terms and conditions made available at the time of entry.

The Program includes sweepstakes and promotional competitions relating to FIFA Heroes through which eligible participants may have the opportunity to win prizes such as FIFA World Cup tickets and other rewards. These benefits may be considered financial incentives under the California Consumer Privacy Act ("CCPA") and a bona fide loyalty program under the Colorado Privacy Act ("CPA").

Our Program Partners include Motorola Mobility LLC, who provide the FIFA World Cup 2026™ tickets as prizes for our promotions.

Information we collect. To participate in the Program, Solace may collect, at a minimum, your name, telephone number, email address, country/region, city, and any other information necessary to administer the applicable promotion. Depending on the promotion, we may also collect additional information from you, including contact information and account identifiers, information relating to your participation in the promotion or sweepstakes, marketing preferences and communication preferences, and any information you voluntarily provide in connection with the promotion.

How we use the information. We use your information to administer and operate the Program in accordance with the applicable promotion terms and conditions, including to administer sweepstakes entries, select winners, contact participants, deliver prizes, and conduct analytics, fraud prevention, legal compliance, and related research activities.

You may opt into the Program by registering for or participating in the applicable sweepstakes, competition, or promotional event.

Your personal information is required in order to administer the Program, verify eligibility, contact winners, deliver prizes, and comply with applicable legal obligations relating to promotions and sweepstakes. If you request deletion of all of your personal information, we may no longer be able to administer your participation in the Program or provide any prizes or benefits associated with the Program.

You may withdraw from the Program at any time by discontinuing participation in the applicable promotion or contacting us using the contact details provided in this Privacy Notice.

Because the sale of personal information or the processing of your personal information for targeted advertising is not needed to participate in the Program, we will continue to provide you the benefits of the Program if you exercise your right to opt out of the sale of personal information or the processing of personal information for targeted advertising.

Who we disclose your information with. During the course of your participation in the Program, we may disclose your personal information with service providers that assist us with administering promotions, hosting services, analytics, communications, and prize fulfilment; promotional or commercial partners involved in administering the applicable promotion or prize; and other third parties where required by law or as otherwise described in this Privacy Notice.

Value of Consumer's Data. Solely for the purposes of this notice and pursuant to the valuation methods listed in the CCPA regulations, a good faith estimate of the value of consumers' personal information to Solace is reasonably related to the value of the promotional benefits, prizes, and marketing opportunities associated with the Program, less the expenses related to operating and administering the Program. The value of consumer data varies by participant depending on engagement with the Program and participation in promotions.

Appendix A – Additional information for California residents

California law requires us to disclose the following additional information with respect to our privacy practices. If you are a California resident, this Appendix A applies to you in addition to the rest of the privacy notice.

California Shine the Light

Players who are residents of California may request to prevent the disclosure of personal data to third parties for their direct marketing purposes. If you would like to exercise this right, please submit your request to us at this email address: privacy@solacegames.io.

Categories of Personal Information We Collect and Our Purposes for Collection and Use

You can find a list of the categories of personal data that we collect in Section 2 above. For details regarding the sources from which we obtain personal data, please see Section 3 above. We collect and use personal information for the business or commercial purposes described in Section 5 above.

Categories of Personal Information Disclosed and Categories of Recipients

We disclose the following categories of personal data for business or commercial purposes to the categories of recipients listed below:

• We disclose Profile Data and Contact Data with businesses, service providers, and third parties, such as advertising networks, analytics and social media networks.
• We disclose Device Data and Cookies Data with businesses, service providers, and third parties, such as advertising networks, analytics, and social media networks.
• We disclose Usage Data with businesses, service providers, and third parties, such as advertising networks, analytics, and social media networks.
• We disclose Transaction Data with businesses and service providers who process payments.

For more information on how your data is disclosed, please see Section 6, which provides more detail on the third parties with which we share personal data. We may also disclose any of the above categories of information pursuant to a request from a relevant authority, or in the event of a business sale or reorganization. As stated in Section 9 above, we typically retain your personal data for the period necessary to fulfil the purposes outlined in this privacy notice, unless a longer retention period is required or permitted by law.