Privacy Policy — Lord of Tokens

Last updated: 15 May 2026

1. Introduction

This Privacy Policy (the "Policy") describes how MAKETOOLS SAS ("MAKETOOLS", "we", "us" or "our") collects, uses, shares and protects the personal data of users of the online browser-based game Lord of Tokens (the "Game"), accessible at https://lordoftokens.com/ (the "Website"), as well as of any visitor to the Website (collectively, "you", "Player" or "User").

This Policy is issued in compliance with:

• Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the "GDPR");
• French Law no. 78-17 of 6 January 1978 on data processing, files and freedoms, as amended (the "French Data Protection Act");
• the recommendations and guidelines of the Commission Nationale de l'Informatique et des Libertés (the "CNIL").

This Policy forms an integral part of the General Terms and Conditions of Use and Sale of the Game and must be read in conjunction with them.

2. Data Controller

The data controller, within the meaning of Article 4, 7° of the GDPR, is:

MAKETOOLS SAS, société par actions simplifiée with a share capital of €1,000 Registered office: 149 avenue du Maine, 75014 Paris, France RCS Paris under number 990 247 603 Intracommunity VAT number: FR63990247603 Legal representative: Charlotte Ledoux, President

For any question relating to the processing of your personal data or the exercise of your rights, you may contact MAKETOOLS:

• By email: charlotte@maketools.ai
• By post: MAKETOOLS SAS — Data Protection — 149 avenue du Maine, 75014 Paris, France

3. Data Protection Contact

MAKETOOLS has designated Florian Gardin as Data Protection Contact (référent données personnelles), in charge of monitoring compliance with applicable data protection law within MAKETOOLS and acting as a point of contact for data subjects and the CNIL.

The Data Protection Contact can be reached:

• By email: charlotte@maketools.ai (please indicate "Data Protection — Lord of Tokens" in the subject line, and Florian Gardin will be associated with the request)
• By post: MAKETOOLS SAS — Data Protection (Florian Gardin) — 149 avenue du Maine, 75014 Paris, France

4. Categories of Data Collected

MAKETOOLS collects only the data that is necessary for the purposes set out in this Policy. The categories of data processed are the following:

4.1 Account and Identification Data

• email address;
• password (stored exclusively in hashed form, never in clear text);
• player nickname / pseudonym (chosen by the Player at signup, mandatory);
• where applicable, identifier from a third-party authentication provider (Google, Apple or similar social SSO) and the information made available to us by that provider (in particular email address and, where applicable, name).

4.2 Billing Data (for paid purchases and subscriptions)

• first name and surname;
• billing address (street, postcode, city, country);
• order history (date, items or subscription purchased, amount, invoice number);
• VAT number (where the Player is a professional).

Payment card details (number, expiry date, CVC) are not collected or stored by MAKETOOLS. They are collected and processed directly by our payment service provider Stripe, which is certified PCI-DSS compliant.

4.3 Technical and Connection Data

• IP address;
• characteristics of the device used and browser fingerprint (operating system, browser, language, screen resolution, time zone, etc.);
• approximate geolocation data (country, region, city) derived from the IP address;
• connection logs (date, time, duration of sessions);
• pages visited and content displayed.

4.4 Game Data

• character data (name, level, progression, statistics, in-game inventory);
• behavioural and game telemetry data (actions performed in the Game, clicks, choices, playtime, in-game social interactions, participation in guilds, alliances or PvP);
• balance of virtual currency and history of in-game purchases.

4.5 Communications

• the content of messages exchanged via in-game chat functionalities (subject to the moderation policy set out in the General Terms);
• the content of exchanges with our customer support team (emails, support tickets);
• where applicable, reports submitted by Players concerning other Players' behaviour or content.

4.6 Data Relating to Marketing

• consent or refusal to receive marketing communications;
• consent given or refused for the deposit of non-essential cookies;
• responses to surveys or interactions with our marketing emails (opens, clicks).

5. Purposes and Legal Bases of Processing

Each processing activity is based on one of the legal bases provided for in Article 6 of the GDPR. The following table summarises the main processing activities:

Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Where processing is based on our legitimate interest, you have the right to object at any time, on grounds relating to your particular situation, in accordance with Article 21 of the GDPR.

6. Recipients of the Data

Personal data is accessible, within the limits of what is strictly necessary, to:

• duly authorised personnel of MAKETOOLS (customer support, moderation, technical, marketing, accounting);
• our processors, acting on our instructions and under contracts compliant with Article 28 of the GDPR, in the following categories:

The names and details of the main processors used by MAKETOOLS may be communicated to Players upon written request to the Data Protection Contact.

Personal data may also be communicated, where strictly necessary, to:

• competent administrative or judicial authorities, in response to a legal request;
• our legal, accounting or audit advisors, subject to professional secrecy;
• a third party in the context of a sale, merger, reorganisation or transfer of all or part of our business, subject to compliance with applicable law and prior information of data subjects.

7. International Data Transfers

MAKETOOLS hosts its main infrastructure on Amazon Web Services, in the Paris region (eu-west-3), located within the European Union. By default, personal data is stored within the EU/EEA.

Some of our processors (in particular certain marketing, analytics or customer support providers) may, depending on their location and infrastructure, transfer data outside the EU/EEA. Where this is the case, MAKETOOLS ensures that such transfers are governed by adequate safeguards within the meaning of Chapter V of the GDPR, in particular:

• transfers to countries benefiting from an adequacy decision of the European Commission (in particular, where applicable, the United States under the EU-US Data Privacy Framework for certified organisations);
• transfers governed by the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), supplemented where necessary by additional technical, organisational or contractual measures.

A copy of the safeguards in place may be obtained by writing to the Data Protection Contact.

8. In-Game Advertising

The Game and the Website may display advertising content (banner ads, sponsored content), the conditions of which are described in Article 9 of the General Terms.

8.1 Contextual vs. Personalised Advertising

• Contextual advertising is displayed without using the Player's personal data and without profiling. The selection of the advertisement depends solely on the context of consultation (page or screen displayed). No consent is required for this purpose. The processing is based on the legitimate interest of MAKETOOLS in monetising the free version of the Game.

• Personalised advertising is displayed only with the Player's prior, free, specific, informed and unambiguous consent, given through the consent management mechanism. Personalised advertising involves the processing of Account, technical and game data in order to select advertisements likely to correspond to the Player's interests and to measure their performance.

You may at any time grant, refuse or withdraw your consent for personalised advertising via the dedicated tool accessible from your Account settings or, where applicable, the cookie/consent banner. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

8.2 Players Aged 13 to 17

In accordance with Article 28, paragraph 2 of Regulation (EU) 2022/2065 (Digital Services Act), MAKETOOLS does not display personalised advertising to Players whom it knows or has reasonable grounds to believe to be minors (under 18). Players aged 13 to 17 are shown only contextual advertising, without profiling or behavioural targeting based on their personal data.

8.3 Advertising Partners

Where personalised advertising is displayed, data may be shared with advertising platforms and intermediaries (ad servers, ad exchanges, attribution and measurement providers) acting as joint controllers or independent controllers, in accordance with their own privacy policies. The current list of main advertising partners can be obtained on request to the Data Protection Contact.

8.4 Subscription and Removal of Advertising

In accordance with Article 9.4 of the General Terms, holders of an active paid Subscription do not see in-game advertising. The personal data processing described in this Article is therefore not carried out for them in relation to advertising.

9. Cookies and Similar Technologies

The Website uses cookies and similar tracking technologies (the "Cookies"). Cookies are small text files placed on your device when you visit the Website, allowing us to recognise you, analyse your use of the Services and personalise certain content.

9.1 Categories of Cookies Used

9.2 Management of Your Choices

When you first visit the Website, a cookie consent banner allows you to accept, refuse or personalise the depositing of non-essential Cookies. Cookies subject to consent are not deposited until you have given your explicit consent.

You may modify your choices at any time, for example via the dedicated link or icon displayed at the bottom of the Website.

You may also configure your browser to refuse all or part of the Cookies. Note that refusing strictly necessary Cookies may prevent the proper functioning of the Services.

The duration of validity of consent and of consent refusal is set at six (6) months, in accordance with CNIL recommendations. After that period, you will be asked again to make a choice.

The retention period for the data collected via Cookies is in principle thirteen (13) months, in accordance with CNIL guidelines.

10. Data Retention

MAKETOOLS retains personal data only for the time strictly necessary to achieve the purposes for which it is processed, in accordance with the following durations:

At the end of these periods, data is either deleted, anonymised in such a way that no re-identification is possible, or archived in restricted access (intermediate archiving) for the strict needs of the relevant legal obligations.

11. Your Rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR): obtain confirmation of whether or not personal data concerning you is being processed and, where applicable, obtain a copy of that data;
• Right to rectification (Art. 16 GDPR): obtain the correction of inaccurate data or the completion of incomplete data;
• Right to erasure ("right to be forgotten", Art. 17 GDPR): obtain the deletion of your data in the cases provided for by law;
• Right to restriction of processing (Art. 18 GDPR): obtain the restriction of processing in certain situations;
• Right to data portability (Art. 20 GDPR): receive the data you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller;
• Right to object (Art. 21 GDPR): object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest; the right to object to marketing processing is absolute and may be exercised at any time without justification;
• Right to withdraw consent (Art. 7.3 GDPR): withdraw consent at any time, for processing based on consent;
• Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR): MAKETOOLS does not currently carry out fully automated decision-making producing legal effects on Players. Where this becomes the case, you will be specifically informed and your rights set out in Article 22 will be guaranteed;
• Right to define directives on the fate of your data after death (Art. 85 French Data Protection Act): you may give general directives to a digital trusted third party, or specific directives directly to MAKETOOLS, on the retention, deletion and communication of your data after death.

How to exercise your rights

You may exercise your rights at any time by contacting the Data Protection Contact at charlotte@maketools.ai or by post at the address indicated in Article 3.

In order to verify your identity and avoid the disclosure of data to a third party, we may ask you to provide proof of identity in case of reasonable doubt about your identity.

We undertake to reply to your request within one (1) month from receipt. This period may be extended by two (2) months where necessary, given the complexity and number of requests, in which case you will be informed of the extension and the reasons for it.

Right to lodge a complaint with the CNIL

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) if you consider that the processing of your personal data infringes the GDPR or the French Data Protection Act:

CNIL 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France Telephone: +33 (0)1 53 73 22 22 Website: www.cnil.fr

12. Minors

The Game is accessible to Players aged thirteen (13) and over, as set out in the General Terms. The purchase of Virtual Items and the subscription to paid plans are reserved to Players aged eighteen (18) or older.

The processing of personal data of minors is carried out with particular care. Where the Player is a minor under the age of fifteen (15), and where the processing is based on consent, MAKETOOLS shall obtain the consent of the holder of parental authority, in accordance with Article 7-1 of the French Data Protection Act.

The parents or legal guardians of a minor Player may at any time contact MAKETOOLS at charlotte@maketools.ai to exercise the rights of the minor or to request the closure of the minor's Account.

13. Security of the Data

MAKETOOLS implements appropriate technical and organisational measures to ensure a level of security adapted to the risks presented by the processing, in accordance with Article 32 of the GDPR, in particular:

• encryption of communications via HTTPS/TLS;
• hashing of passwords using a strong algorithm with salt;
• segregation of environments (production, staging, development);
• restricted and logged access to data, based on the principle of least privilege;
• regular backups, including off-site;
• monitoring, intrusion detection and protection against denial-of-service attacks;
• training and awareness of staff on data protection;
• contractual commitments with all processors, requiring an equivalent level of security.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, MAKETOOLS shall notify the CNIL within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk, the affected data subjects will also be informed without undue delay, in accordance with Article 34 of the GDPR.

14. Modification of the Policy

This Policy may be modified at any time to reflect developments in our practices, technical evolutions, or legal and regulatory changes. The version in force is the one published on the Website on the date of your visit. The date of the last update appears at the top of this document.

In the event of a material modification (in particular, addition of a new purpose of processing, new category of processor outside the EU/EEA, or modification affecting your rights), you will be informed at least fifteen (15) days before its entry into force, by notification within the Game and/or by email.

15. Contact

For any question relating to this Policy or to the processing of your personal data, please contact:

MAKETOOLS SAS — Data Protection Contact Email: charlotte@maketools.ai Postal address: 149 avenue du Maine, 75014 Paris, France

End of the Privacy Policy — version of 15 May 2026.