PRIVACY POLICY — World Cup Millionaire

PRIVACY POLICY Last Updated: January 2026 1. INTRODUCTION This Privacy Policy describes how the Platform (“Company,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information obtained through the website, mobile interfaces, Contest systems, and related services (collectively, the “Platform”). By accessing or using the Platform, you agree to this Privacy Policy. This Privacy Policy operates together with the Terms of Service, Official Contest Rules, and all incorporated legal documents. If you do not agree with this Privacy Policy, do not use the Platform. 2. AGE REQUIREMENTS & CHILDREN’S PRIVACY The Platform is intended exclusively for individuals 18 years of age or older. The Company does not knowingly collect or process personal information from individuals under 18. If we become aware that an individual under 18 has provided personal data, we will delete it promptly. This approach complies with COPPA (United States), Article 8 of the GDPR (EU/EEA), PIPEDA (Canada), and equivalent international standards. 3. DATA CONTROLLER & LEGAL ENTITY STATUS For purposes of international privacy laws (including GDPR, PIPEDA, LGPD, CCPA/CPRA, and similar statutes), the Data Controller is: [Your Name], Sole Proprietor Operating from Montreal, Quebec, Canada This designation remains in effect until a corporate entity is formally established, after which this Policy will be updated accordingly. Liability for data processing rests with the Platform as defined in this Policy. 4. INFORMATION WE COLLECT We may collect the following categories of personal information: A. Account Information • Username • Email address • Password (hashed) B. Usage & Device Data • IP address • Browser type and version • Device type and operating system • Referring URLs • Crash logs and performance data • Analytics signals (e.g., session duration, pages viewed) C. Contest Activity • Bracket data and tournament predictions • Scoring metrics • Submission timestamps • Entry history (free and paid) D. Financial & Transaction Data (only if User makes a purchase or receives prizes) • Transaction records • Wallet addresses (for cryptocurrency payouts) • Payment processor identifiers • Anti-fraud metadata E. Verification Data (Prize Winners Only) If required for prize distribution: • Age confirmation • Identity verification (KYC/AML) • Tax reporting information We do **not** collect: • Government ID unless required for prize payout • Biometric data • Financial account access credentials • Sensitive health or racial/ethnic data 5. PURPOSES OF DATA PROCESSING & LEGAL BASES We process personal information for the following purposes and legal bases: • Provide access to the Platform and Contest functionality — Contract performance • Maintain Contest integrity and prevent fraud, abuse, and cheating — Legitimate interests • Process optional purchases and deliver Entry Credits — Contract performance • Distribute monetary prizes and comply with sanctions, AML, KYC, and tax laws — Legal obligations & legitimate interests • Communicate with Users (e.g., account notifications, Contest updates) — Contract performance & legitimate interests • Improve Platform performance, security, and user experience — Legitimate interests • Comply with legal obligations (e.g., tax reporting, sanctions screening) — Legal obligations For cryptocurrency prize payouts and fraud prevention, wallet addresses may be processed under legitimate interests and legal compliance. 6. NO SALE OF PERSONAL INFORMATION We do not sell, rent, or monetize personal information via advertising or any other means. Under CCPA/CPRA (California), we make the affirmative declaration that personal information is **not sold or shared** as defined by those laws. 7. INTERNATIONAL DATA TRANSFERS Data may be processed in: • Canada (PIPEDA jurisdiction) • United States (via cloud and analytics vendors) • European Union (for Users located in EU/EEA) For EU/EEA Users, transfers occur under Standard Contractual Clauses (SCCs), adequacy decisions, or other equivalent safeguards compliant with GDPR Chapter V. 8. RETENTION OF INFORMATION We retain personal information only for as long as necessary to fulfill the purposes outlined in this Policy or as required by law. Examples: • Account data → maintained while account is active + 1 year after closure (for dispute resolution) • Contest & scoring records → maintained for audit, gameplay integrity, and dispute resolution • Anti-fraud, payment, and compliance data → retained up to 7 years (AML/tax requirements) • KYC documents (if collected) → retained only for verification and compliance purposes Users may request deletion subject to legal exceptions (see Section 9). 9. USER RIGHTS Depending on your jurisdiction, you may have the right to: • Access your personal data • Correct inaccurate or incomplete data • Request deletion (“right to be forgotten”) • Request restriction of processing • Request data portability • Object to certain processing • Withdraw consent (where processing is based on consent) **Canada (PIPEDA)**: You may request access, correction, or deletion through our contact channel. **EU/EEA (GDPR)**: You may exercise rights via email. We respond within one month (extendable under GDPR). **California (CCPA/CPRA)**: You may request access, correction, deletion, and disclosure of categories of data collected/shared. We do not sell or share personal information. **Brazil (LGPD)**: You may exercise rights to access, correction, deletion, anonymization, and information about data sharing. To exercise any of these rights, contact us at the email below. We may require identity verification before processing requests. 10. SECURITY We employ reasonable technical and organizational measures to protect personal data, including: • TLS encryption in transit • Hashed passwords • Access controls • Audit logging • Rate limiting • Anti-bot systems • Data segmentation No method of transmission or storage is 100% secure. Users assume the inherent risk of online services. 11. PAYMENT PROCESSING & CRYPTOCURRENCY Optional purchases are processed via regulated third-party providers (e.g., Stripe, Wise, crypto payment processors). The Company does not store credit card numbers, bank account passwords, or full payment credentials. For cryptocurrency transactions: • Wallet addresses are stored solely for payout purposes • AML/sanctions checks may apply • Network fees are outside Company control 12. PRIZE DISTRIBUTION & KYC/AML For monetary prize winners, the Company may require: • Age verification • Identity verification (KYC) • Tax documentation These measures satisfy anti-money-laundering (AML), counter-terrorist-financing (CTF), OFAC, and tax compliance obligations. Failure to complete verification may result in prize forfeiture. 13. ANTI-FRAUD & SANCTIONS COMPLIANCE We may use automated and manual systems to detect multi-account abuse, referral manipulation, VPN/proxy masking, automated bots/scripts, sanctioned-country access, or chargeback fraud. We may block access from sanctioned jurisdictions under OFAC, EU restrictive measures, U.N. sanctions, Canadian sanctions, or similar regimes. These measures are essential for Contest integrity and legal compliance. 14. COOKIES & TRACKING We use: • Essential cookies (for login, security, and core functionality) • Analytics cookies (for performance insights and user experience improvement) We do not use advertising cookies, behavioral ad trackers, or third-party marketing cookies. Users may disable cookies in browser settings, but this may impact functionality. 15. OPT-OUT & PREFERENCES Users may: • Opt out of marketing communications (via unsubscribe links) • Close their account (contact support) • Request deletion of personal data (subject to legal exceptions) 16. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. We will provide reasonable notice of material changes via email (if available) and/or prominent notice on the Platform. Continued use after updates constitutes acceptance of the revised Policy. 17. CONTACT For privacy inquiries, data subject rights requests, or other privacy-related matters: Email: bonjour@worldcupmillionaire.com Jurisdiction: Montreal, Quebec, Canada COOKIE POLICY 1. INTRODUCTION This Cookie Policy explains how the Platform (“Company,” “we,” “us,” or “our”) uses cookies, web beacons, pixels, local storage, and similar technologies (collectively, “Cookies”) when you access or use the Platform (website, mobile interfaces, and related services). This Policy is part of our Privacy Policy and Terms of Service. By continuing to use the Platform, you consent to the use of Cookies as described below. You may manage your Cookie preferences at any time (see Section 6). 2. WHAT ARE COOKIES? Cookies are small text files placed on your device (computer, tablet, mobile phone) when you visit a website. They allow the website to recognize your device and remember certain information. We use Cookies to: • Make the Platform work properly • Improve user experience • Provide basic analytics • Enhance security We do not use Cookies for targeted advertising, behavioral profiling, or third-party marketing. 3. TYPES OF COOKIES WE USE A. Strictly Necessary Cookies These Cookies are essential for the Platform to function and cannot be disabled. They include: • Authentication Cookies (to keep you logged in) • Security Cookies (to prevent fraud and abuse) • Session Cookies (to remember your actions during a visit) Legal basis: Legitimate interest & contract performance. No consent required. B. Performance & Analytics Cookies These Cookies help us understand how users interact with the Platform, improve performance, and fix issues. Examples: • Google Analytics (anonymized IP) • Page views and navigation patterns • Crash reports Legal basis: Legitimate interest. Consent optional (you may opt out). C. Functional Cookies These Cookies remember your preferences and choices (e.g., language, dark mode). Legal basis: Legitimate interest or consent (where applicable). We do **not** use: • Advertising Cookies • Third-party tracking Cookies for marketing • Social media tracking pixels (except when you actively interact with social features) 4. THIRD-PARTY COOKIES & SERVICES We may allow limited third-party Cookies for essential services, such as: • Payment processors (e.g., Stripe session Cookies) • Analytics providers (e.g., Google Analytics) • Cloud hosting providers (e.g., AWS, Cloudflare security Cookies) These third parties do not have access to your personal predictions, Contest Entries, or sensitive data beyond what is strictly necessary for their service. 5. HOW LONG COOKIES LAST • Session Cookies: Deleted when you close your browser • Persistent Cookies: Remain for a set period (typically 30 days to 2 years) or until you delete them 6. MANAGING & DISABLING COOKIES You can manage Cookies at any time: • In your browser settings (disable all or specific Cookies) • Via the Platform’s Cookie banner (if displayed) Note: Disabling necessary Cookies may prevent the Platform from functioning properly (e.g., login, Entry submission). Disabling analytics Cookies does not affect Contest participation or prize eligibility. 7. DO NOT TRACK SIGNALS We do not respond to Do Not Track (“DNT”) browser signals because we do not engage in cross-site tracking for advertising purposes. 8. INTERNATIONAL USERS & COMPLIANCE We comply with applicable cookie laws, including: • ePrivacy Directive / GDPR (EU/EEA) – consent for non-essential Cookies • PIPEDA (Canada) – transparency and reasonable purposes • CCPA/CPRA (California) – no sale of personal information via Cookies For EU/EEA users, we display a Cookie consent banner where required. 9. CHANGES TO THIS POLICY We may update this Cookie Policy from time to time. Material changes will be communicated via notice on the Platform or email (if available). Continued use after updates constitutes acceptance. 10. CONTACT INFORMATION For questions regarding Cookies or this Policy: Email: bonjour@worldcupmillionaire.com Jurisdiction: Montreal, Quebec, Canada