[BAGELCODE PORTAL] PRIVACY POLICY

Last Modified: [January 27, 2026]

1. INTRODUCTION

Bagelcode, Inc. and its affiliates ("Bagelcode," "we," "us," or "our") respect your privacy. This Privacy Policy ("Policy") describes the privacy practices for our platform, the [Bagelcode Portal], including any related websites, applications, application programming interface (“APIs”), software development kits (“SDKs”), dashboards, and other services accessible via our portal domains (collectively, the "Services" or "Portal"). This Policy is a legal statement that explains how Bagelcode, Inc. and its affiliates ("Bagelcode," "we," "us," or "our") may collect information from you, how we may use, maintain, protect, and share your information, and how you can control your information.

This Policy is incorporated by reference into our Terms of Service (the "Terms"). Please read this Policy and the Terms carefully before you start to use the Services to understand our policies and practices regarding how we treat your information. By accessing or using the Services (including logging in via Single Sign-On (“SSO”)) or by accepting (including by clicking to accept or agree when the option is made available to you) any Terms that incorporate this Policy, you accept and agree to be bound and abide by this Policy and the Terms. If you do not agree with any terms of this Policy or the Terms, you may not access or use the Services for any purpose.

This Policy applies specifically to "authorized users" (e.g., employees of third-party developers, partners, and internal staff) who access the Portal for professional business purposes. This Policy does not apply to end-users (players) of Bagelcode’s games.

2. INFORMATION WE COLLECT

We collect information necessary to authenticate your identity, manage access privileges to our proprietary data, and ensure the security of our platform.

1. Information You Provide to Us

When you access or use the Services (including via SSO), we may collect the following information ("Profile Data"):

• First name and/or last name
• E-mail address
• Region (country, state, etc.)
• Title
• Country
• Default device and format types
• Preferred currency
• Application names
• Phone number
• Account IDs and login data for third-party developer platforms
• Keywords and search terms
• Site customizations
• Electronic notification preferences

Note: Access to the Portal is strictly controlled via SSO providers (e.g., Google, Okta/Auth0). We do not collect or store your passwords; authentication is handled entirely by the third-party identity provider.

2. Information We Collect Automatically

We typically collect certain personal information automatically through a variety of tracking technologies when you use our websites and applications or interact with our Services, including (i) cookies or small data files that are stored on an individual’s device or computer, (ii) mobile SDKs, and (iii) other related technologies, such as pixels and logging technologies (collectively, "tracking technologies"). In some circumstances, we may use third-party partners or technologies to collect this information. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.

Web Beacons

Pages of the Portal and our electronic communications (e.g., emails) may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us**,** for example, to count users who have visited those pages or opened an e-mail and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Other Technologies

We may also use device identifiers, local storage, HTML modifiers, and different types of caching to help us understand the devices and users who access the Services. Those methods include device identifiers that are either hardware-based or software-based, persistent or non-persistent, and which may identify either a device or a software module within a device (such as a web browser).

Depending on which of our Services you interact with, we may collect and process the following types of information:

• Analytics and Usage Data: Including the approximate location that you access the Services from, the site/applications from which you came and the site/application to which you are going when you leave the Services, the pages you visit, the links you click, your interactions on the Services, and other actions you take on the Services.

• Device Data: Including the tablet, smartphone, or other electronic device you use to connect to the Services. This information can include details about the type of device, browsers and applications connected to the Services through the device, your mobile network, and your IP address.

• Approximate Location Data: Including your location such as the city, region, and country you are in based on your Internet Protocol ("IP").

All of the information collected automatically through these tools allows us to improve your user experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Services, and to improve the effectiveness of our Services, offers, communications, and customer service. We may also use the information collected through tracking technologies to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the Services; (b) provide and monitor the effectiveness of our Services; (c) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (d) diagnose or fix technology problems; and (e) otherwise to plan for and enhance our Services.

Personal Information We Collect Automatically

3. Artificial Intelligence Features

To enhance our Services, we may offer features powered by artificial intelligence ("AI Features"). These may include predictive analytics, data analysis tools that respond to your natural language queries, and an interactive AI chatbot designed to assist you. When you use these AI Features, we collect and process the information you provide, which may include text queries, uploaded documents, user preferences, and other contextual data you submit ("Inputs"), and may retain a history of your Inputs to better understand your context in current and future interactions.

4. Customer and Applicant Data

In some cases during prospect and customer engagements, or when interviewing applicants for employment, we may record our meetings. These recordings are used for internal educational purposes only. For such recordings, we use a third-party vendors:

• Google Meet: Google's Privacy Policy can be viewed at https://policies.google.com/privacy.
• Zoom: Zoom's Privacy Policy can be viewed at https://www.microsoft.com/en-us/privacy/privacystatement.
• Microsoft Teams: Microsoft's Privacy Statement can be viewed at https://www.microsoft.com/en-us/privacy/privacystatement.

5. Sensitive Data

We never intentionally receive or process information regarding your sexual orientation, ethnicity, religious affiliation, refugee status, health, or personal finances.

6. Anonymized Data

Personal Information does not include anonymized data, which is data that has been rendered anonymous in such a way that you are no longer identifiable ("Anonymized Data"). We may use Anonymized Data for our own purposes in any manner and without attribution or compensation to any person.

7. Personal Information We Collect from Third Parties

We may also obtain personal information listed above and other supplementary information from third parties, which we often combine with personal information we collect either automatically or directly from an individual. For example:

• Business Partners: We may receive information from our business partners, analytics providers, or marketing partners to inform business analytics or enhance the Services.
• Social Networking Sites / SSO Providers: When you access the Services via a third-party login (e.g., Google, Okta), we receive authentication data, profile information, and other information you have authorized the third party to share.
• Information Providers: We may obtain information from third-party data providers to correct or supplement personal information we collect (e.g., to verify business contact details).

3. HOW WE USE YOUR INFORMATION

We use the collected information for the following business purposes:

• Service Provision & Maintenance: To provide and maintain the Services (including SDKs, APIs, and analytics data);
• Personalization: To personalize the Services to your preferences and role;
• Customer Support: To provide customer support and respond to your inquiries;
• Technical Issues: To detect, prevent, and address technical issues with the Services;
• Monitoring: To monitor usage of the Services to ensure stability and performance;
• Security: To secure the Services, including detecting and preventing unauthorized access, fraud, or data leakage of Bagelcode’s confidential KPI information;
• Research & Development: To conduct research and development, including the development of new features, tools, and functionality;
• Notifications: To notify you regarding changes to our Services including features, tools, and functionality provided by the Services;
• New Offerings: To notify you about our current or new offerings;
• Authentication & Access Control: To verify your identity and grant appropriate access levels to specific dashboards (e.g., restricted access for different publishing partners);
• Legal Compliance: To comply with applicable legal obligations and enforce our Terms of Service.

4. DISCLOSURE OF YOUR INFORMATION

We do not sell your personal information. We may share your information only in the following circumstances:

1. Service Providers (Subprocessors)

We engage third-party companies to perform services on our behalf. These providers are authorized to use your personal information only as necessary to provide these services to us.

2. Legal Requirements

We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Bagelcode (including our proprietary game data), or (iii) prevent imminent harm to safety.

3. Corporate Transactions

We may disclose or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. With Your Consent

We may disclose your personal information to certain other third parties or publicly with your explicit consent or direction.

5. DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes set out in this policy, or as required by law.

1. Retention Criteria

We determine the appropriate retention period based on the nature and sensitivity of the data, the potential risk of harm from unauthorized use, and applicable legal requirements.

• Active Accounts: We retain your account information and access privileges for as long as your account is active and you remain an authorized user of the Portal.
• Legitimate Business Interests: Even after you stop using the Portal, we may retain certain information (such as audit logs or contract records) as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and protect our operations.
• Security & Audit Logs: IP addresses and access logs are retained for a specific period to monitor for security threats, debug issues, and maintain the integrity of our systems.
• Anonymized Data: We may retain de-identified or aggregated data (which does not identify you personally) indefinitely for analytics, research, and service improvement purposes.

2. Deletion & Anonymization

When we no longer have a legitimate business need to process your personal information, we will either delete or anonymize it. If deletion is not immediately possible (for example, because your data has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. SECURITY

We implement robust administrative, technical, and physical security measures to protect your information. These include:

• Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest where appropriate.
• Access Control: Strict Role-Based Access Control (RBAC) ensures you only see data relevant to your partnership.
• Monitoring: Continuous monitoring of access logs to detect anomalous behavior.

7. ACCESSING, UPDATING, AND MANAGING YOUR INFORMATION

Bagelcode enables you to access a wide range of information about your account and your interactions with Bagelcode Services. You may contact us about your information and your intentions for limiting the use and disclosure of your information by emailing us at support@bagelcode.com. Please refer to our Region-Specific Disclosures below for information about additional privacy choices that may be available to you.

1. Direct Marketing Preferences

We will only send you marketing materials where we have your consent to do so. You can withdraw your consent to marketing materials by clicking on the unsubscribe link in the footer of our marketing emails or by contacting us at support@bagelcode.com. We make every effort to promptly process all unsubscribe requests. You may not opt-out of service-related communications (e.g., account verification, transactional communications, changes/updates to the features of the services, technical and security notices).

2. “Your Privacy Choices” Link

Additionally, please see our “Your Privacy Choices” link to exercise your opt-out rights accordingly, or to ask any other privacy related requests. You can also request opt out of all marketing emails through this request. Please note that we reserve the right to send you non-promotional, account or administrative emails even if you opt out of receiving promotional e-newsletters.

Depending on your location, you may have the following rights regarding your personal information:

• Access & Correction: Request access to or correction of your business contact information.
• Deletion: Request deletion of your account (subject to ongoing business contracts).
• Objection: Object to the processing of your data.

To exercise these rights, please contact us at support@bagelcode.com.

8. CHILDREN'S PRIVACY

The Portal is intended for use by business professionals and is not directed to children.

We do not knowingly collect or solicit personal information from anyone under the age of 18 (or the applicable age of majority in your jurisdiction). If you are under 18, you are not permitted to use or register for the Portal.

Since we use third-party OAuth providers (like Google), it is possible for a minor to attempt login using a personal account. If we become aware that we have inadvertently collected personal information from a child without parental consent, we will take steps to delete that information from our servers immediately. If you believe that we might have any information from or about a child, please contact us at support@bagelcode.com.

9. LINKS TO THIRD PARTY SITES

The Services may, from time to time, contain links to and from third party websites, including those of other users, our partner networks, advertisers, partner merchants, news publications, social media platforms, retailers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

10. CHANGES TO PRIVACY POLICY

We may revise this Privacy Policy at any time, as we deem appropriate. When we post changes to this Privacy Policy, we will revise the "last modified" date at the top of this page. We advise you to regularly review this Privacy Policy to be informed of how Bagelcode collects, uses, and secures your information.

11. CONTACT US

If you have any questions, comments, concerns or complaints regarding our Privacy Policy or any other privacy issue please contact us at support@bagelcode.com

12. REGION-SPECIFIC DISCLOSURES

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal information about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:

• United States: If you are a resident of the United States, please review the additional U.S.-specific privacy disclosures, for further information about our processing of your personal information, including a description of the personal information rights made available to residents of certain states under applicable law.

• European Economic Area, United Kingdom or Switzerland: If you are located in the European Economic Area (Member States of the European Union together with Iceland, Norway, and Liechtenstein), the United Kingdom, or Switzerland, please review the additional European-specific privacy disclosures, for further information about our processing of your personal information including a description of the personal information rights made available to individuals located in those jurisdictions under applicable law.

• Republic of Korea: If you are a resident of the Republic of Korea, please review the additional PIPA disclosures, for further information about our processing of your personal information in accordance with the Personal Information Protection Act.

1. ADDITIONAL U.S. DISCLOSURES

For residents of the state of California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, this U.S. State Privacy Notice supplements the information contained in our Privacy Policy by providing additional information under the consumer privacy laws of those states as and when they are effective (the “State Privacy Laws”).

1. Your Privacy Rights

Depending on your state of residency, you may exercise the following rights under the State Privacy Laws in relation to the personal information about you that we have collected about you (subject to certain limitations under such laws, such as exceptions in the State Privacy Laws or the inability to verify your identity):

• The Right to Access
  Under the State Privacy Laws, you have the right to obtain confirmation regarding whether we are processing your personal information and to access that personal information. You also have the right to access that personal information in a portable, readily usable format, unless not technically feasible to provide in such a format.

  Under certain laws, you may also have the right to request the following: (a) the specific pieces of personal information the business has collected about you and (b) the categories of personal information collected, the sources of collection, the business/commercial purpose for collecting or “selling/sharing” personal information, and the categories of third party to whom the business discloses personal information.

• The Right to Deletion
  You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions under the State Privacy Laws. Each request will be handled properly according to our internal guidelines.

• The Right to Correction
  You have the right to request that inaccuracies in your personal information be corrected, taking into account the nature of the personal information and the purposes of the processing of your personal information. Each request will be handled properly according to our internal guidelines.

• Opt-Out Rights
  Under State Privacy Laws, you have the right to opt-out of “sales” and “shares” of personal information, “targeted advertising,” and certain use/disclosure of “sensitive” personal information.

  As further described in this Privacy Policy, we disclose the following to our advertising/marketing and analytics partners (e.g., advertisers/agencies, social media networks, adtech partners) for advertising and marketing purposes, including direct marketing: Identifiers, commercial information, geolocation data, internet or other network information, and data that may be considered “sensitive” personal information under certain State Privacy Laws. Please see the “Your Privacy Choices” link (found in the website footer or relevant app settings) to exercise your opt-out rights accordingly. There should be no significant disadvantages even if you choose to proceed this way.

For Residents of Minnesota, and Oregon

• The Right to a List of Third Parties The right to request a list of the specific third parties (as defined under applicable law) to whom we disclose personal information. To exercise this right, please email us at support@bagelcode.com.

We do not have actual knowledge of “selling” or “sharing” personal information of consumers under eighteen (18) years of age. We only use or disclose sensitive personal information where reasonably necessary and proportionate for the purposes of providing the Services.

2. To Exercise Your Privacy Rights

To submit a request to exercise your right to access, deletion, or correction, please use the “Your Privacy Choices” link.

To exercise your right to opt-out of “sales,” “shares,” “targeted advertising,” or certain use/disclosure of “sensitive” personal information, please click our Your Privacy Choices link (found in the website footer) and follow the instructions therein. As discussed in such link, you may also visit our website with the Global Privacy Control (GPC) signal enabled to opt-out of “sales/shares” via tracking technologies (learn more about GPC at www.globalprivacycontrol.org) and we will honor such choice as required under the State Privacy Laws. In either case, these opt-outs are controlled on an account level to the extent possible, and also on the browser level for the device you use to opt out.

Unless otherwise prohibited by the State Privacy Laws, we may need to verify your identity and confirm your residency before processing your request. In order to verify your identity, we will generally either require the successful authentication of your account or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional personal information from you, including, but not limited to, your email address, or phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we cannot comply with a request, we will explain the reasons in our response.

3. Non-Discrimination and Appeals

You have the right to not receive “discriminatory” treatment for exercising the rights discussed in the table above. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

Further, depending on your state of residency, you may have the right to appeal our decision not to take action on your rights request. All appeals should be submitted by emailing support@bagelcode.com, along with a copy of the decision that you are appealing.

4. Authorized Agents

In certain circumstances under the State Privacy Laws, you may be permitted to use an authorized agent to submit requests on your behalf (using the mechanisms for submitting requests above), where we can verify the authorized agent’s authority to act on your behalf.

For requests to access, delete, or correct personal information, we require the following for verification purposes:

• a power of attorney from you or your authorized agent that is valid under the laws of the applicable state where you reside; or
• sufficient evidence to show that you have:
• provided the authorized agent signed permission to act on your behalf; and verified your own identity directly with us or directly confirmed with us that you provided the authorized agent’s permission to submit the request on your behalf.

For requests to opt-out of “sales,” “shares,” or the processing of your personal information for “targeted advertising” under the State Privacy Laws, we require a signed permission demonstrating your authorized agent has been authorized by you to act on your behalf.

5. Automated decision-making

We may use automated decision-making technologies to support our data processing activities. Our automated decision-making capabilities include logic that provides special offers relevant to your usage. By using this logic, it helps us improve customer experience. We do not conduct automated processing of personal information for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

6. Deidentified Information

Where we process “deidentified information” (as such term is defined under the State Privacy Laws) and are required to keep such information deidentified, we commit to maintain and use the information in deidentified form and will not attempt to reidentify the information, except in instances where necessary for determining whether the deidentification process we used satisfies the requirements under applicable law.

7. Notice at Collection for California Residents

The following additional disclosures apply to California residents.

Categories/Use of personal information: In the last 12 months, we have collected the categories of personal information listed below. Further, please see the sections “OUR COLLECTION AND USE OF PERSONAL INFORMATION” and “ADDITIONAL USES OF PERSONAL INFORMATION” of this Privacy Policy for the purposes for which such personal information is used.

• Identifiers, such as your name, email address, date of birth, online identifiers, or other similar identifiers.
• California Customer Records (Cal. Civ. Code § 1798.80(e)), such as birth date, contact information, and payment information.
• Protected Classification Characteristics, such as age and gender.
• Commercial Information, such as payment and purchase history.
• Internet/Network Information, such as device information, logs, and analytics data.
• Geolocation Data, such as location information from your device or generated based on IP address or Wi-Fi.
• Other Personal Information, such as information you post on our social media pages or otherwise provide to us.
• Inferences, such as predictions about your interests and preferences.
• Sensitive Personal Information, such as account username and password, and non-recipient message content.

“Sales” and “Shares”: We disclose all of the categories of personal information we collect to the categories of recipients set forth in the “OUR DISCLOSURE OF PERSONAL INFORMATION” section of this Privacy Policy. Our disclosure of personal information to the following categories of third parties qualifies as the sale of personal information or the sharing or processing of personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services under certain privacy laws: Advertisement Partners and Third-Party Partners.

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit or opt-out of the sale of personal information or the processing of personal information for purposes of targeted advertising. To submit a request to not sell or share your personal information, please use the form available via the “Your Privacy Choices” link.

2. ADDITIONAL EEA, UK AND SWISS DISCLOSURES

These disclosures supplement the information contained in our Privacy Policy by providing additional information about our personal information processing practices relating to individuals who access and use our website or services or otherwise interact with us from the EEA, UK and Switzerland.

1. Our Role in Processing Your Personal Information

Bagelcode acts as the controller of your personal information. This means we determine the means and purposes of the processing of your personal information, as set out in this Privacy Policy.

2. Questions or Complaints

If you have a concern about our processing of personal information, you have the right to lodge a complaint with the Data Protection Authority where you reside, where you work, or where an alleged violation of the law has occurred. Contact details for applicable Data Protection Authorities can be found using the links below:

• European Economic Area: https://edpb.europa.eu/about-edpb/board/members\_en
• United Kingdom: https://ico.org.uk/global/contact-us/
• Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

We would, however, appreciate the chance to handle your concerns directly prior to a complaint being filed, so please contact us directly at support@bagelcode.com if you have any concerns.

3. Purposes and Legal Bases of Processing

When we process your personal information, we will do so in reliance on the following lawful bases. You are not required to provide personal information to us, but we do rely on your personal information to provide certain of our products and services. If you choose not to provide us with your personal information, we may not be able to provide you with a service or product you request. We will inform you at the point that we collect personal information from you if the provision of certain personal information is mandatory or optional for receipt of our products and services.

We use personal information that you submit directly to us, that we collect automatically or that we collect from third parties, when you access our website, contact us or use the services, as follows:

4. Personal Information You Provide When You Use the Services

5. Personal Information We Generate About You

6. Personal Information We Collect from Third Parties

7. International Transfers of Personal Information

We operate and engage third-party partners and providers in various jurisdictions. Therefore, we and our third-party providers may transfer personal information to, or store, access, or process personal information in, a country other than the one in which it was collected, including, but not limited to, the United States. The country to which personal information is transferred may not provide the same level of protection for personal information as the country from which it was transferred.

We may transfer personal information about you outside of the EEA, UK, and Switzerland, and when we do so we rely on appropriate or suitable safeguards recognized under applicable law, including adequacy decisions, standard contractual clauses, and the DPF (defined below). If you would like more information on the specific safeguards we use (and to obtain a copy of such safeguards, where applicable), please contact us at support@bagelcode.com.

8. Adequacy Decisions

We may transfer personal information about you to countries that the relevant regulatory authority has deemed to adequately safeguard personal information, either automatically or in connection with a specific safe harbor framework.

9. Standard Contractual Clauses

Certain regulatory authorities have adopted standard contractual clauses, which provide safeguards for personal information transferred outside of the originating jurisdiction. We may use these standard contractual clauses when transferring personal information to a third country that has not been deemed to adequately safeguard personal information.

10. Data Privacy Framework

The EU-U.S., Swiss-U.S. Data Privacy Framework and UK Extension (“DPF”) was designed by the U.S. Department of Commerce and the European Commission (and respectively the Swiss Council and UK Secretary of State) to ensure adequate protection for personal information transferred to a company participating in the DPF. If we transfer any personal information about you from the EEA, UK or Switzerland to a third party outside the EEA, UK or Switzerland who is participating in the DPF, we may rely on their participation in the DPF to ensure adequate protection for personal information so transferred.

We may transfer your personal information to, or store your personal information in, the following countries:

11. Your Additional EEA, UK, and Swiss Privacy Choices

Subject to certain limitations at law, you may be able to exercise the following rights:

• Right to Access: The right to obtain confirmation of whether we are processing personal information about you, access to and a copy of the personal information we are processing about you, and information relating to its processing, including:

  • The categories of personal information being processed; The purposes of the processing; The categories of the sources of the personal information; The categories of recipients to whom the personal information have been or will be disclosed; The envisaged period for which the personal information will be stored, or the criteria used to determine that period; Any automated decision-making or profiling performed in connection with your personal information; andThe safeguards relied upon for the transfer of personal information to any third country.

• Right of Portability: The right to obtain a copy of the personal information we have collected about you in a structured, commonly used, and machine-readable format, and the right to transmit that personal information to another controller without hindrance.

• Right to Rectification: The right to correct or update any personal information about you that is inaccurate or incomplete.

• Right to Restriction of Processing: The right to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.

• Right to Withdraw Consent: The right to withdraw your previously provided consent to our processing of your personal information. Please note withdrawing your consent will not affect the lawfulness of our use of your personal information before your consent was withdrawn, nor our processing of personal information pursuant to a different lawful basis for processing.

• Right to Erasure: The right to have us erase your personal information if the continued processing of that personal information is not otherwise justified.

Please note that if the exercise of these rights limits our ability to process personal information, we may not be able to provide our services to you, or otherwise engage with you in the same manner.

12. Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by sending an email to support@bagelcode.com.

Before processing your request to exercise certain rights (taking into account the confidential nature of any personal information we maintain), we will need to verify your identity and confirm you are accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted to include first and last name, email address, phone number, state of residency and/or the date of your last transaction with us.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity as needed to protect your personal information or locate your information in our systems, or where you are not accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland.

13. Direct Marketing Preferences

We will only send you marketing materials where we have your consent to do so. You can withdraw your consent to marketing materials by clicking on the unsubscribe link in the footer of our marketing emails or by contacting us at support@bagelcode.com. We make every effort to promptly process all unsubscribe requests. You may not opt-out of service-related communications (e.g., account verification, transactional communications, changes/updates to the features of the services, technical and security notices).

14. “Your Privacy Choices” Link

Additionally, please see our “Your Privacy Choices” link (found in the website footer) to exercise your opt-out rights accordingly, or to ask any other privacy related requests. You can also request to opt out of all marketing emails through this request. Please note that we reserve the right to send you non-promotional, account or administrative emails even if you opt out of receiving promotional e-newsletters.

15. Questions or Complaints

If you have any questions, comments, concerns or complaints regarding our Privacy Policy or any other privacy issue, please contact us at support@bagelcode.com

General Data Protection Regulation (GDPR) – European Representative Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Bagelcode Inc. has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding this Policy and matters pertaining to our processing under the GDPR:

• By using EDPO’s online request form: https://edpo.com/gdpr-data-request/
• By writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
• UK General Data Protection Regulation (GDPR) – UK Representative

Pursuant to Article 27 of the UK GDPR, Bagelcode Inc. has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding this Policy and matters pertaining to our processing under the UK GDPR:

By using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/

By writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom

3. ADDITIONAL PIPA DISCLOSURES (SOUTH KOREA)

If you are residing in South Korea, the following additional terms apply in accordance with the Personal Information Protection Act (PIPA) of the Republic of Korea. In the event of any conflict between this section and the main body of the Privacy Policy, this section shall prevail for Korean users.

1. ITEMS OF PERSONAL INFORMATION COLLECTED AND METHODS OF COLLECTION

Bagelcode collects only the minimum amount of personal information necessary to provide the Portal services.

(1) Items of Personal Information Collected

• Sign-up (SSO Registration) & Profile Management:
  (Mandatory):

  • Name
  • Email address
  • Company name
  • Department and/or job title (if provided by your organization or SSO provider)

  (Optional / if enabled or provided):

  • Phone number
  • Region/country
  • Partner/publisher account identifier
  • Role/access permission information (as assigned by your organization)
  • Application name(s) and related identifiers (if you register or manage applications through the Portal)
  • Notification preferences
  • Profile picture (URL) (if provided by your SSO provider)

• Service Usage (Automated Collection):
  (Mandatory):

  • IP address
  • Cookies and similar technologies
  • Access logs (e.g., date/time of access)
  • Service usage records (e.g., pages viewed, features used, SDK/resource download history)
  • Device and browser information (e.g., OS, browser type, device identifiers)
  • Approximate location derived from IP address (where applicable)

  (Optional / if enabled or provided):

  • Search keywords/terms used within the Portal (if search is available and logging is enabled)
  • Default device/format preferences (if you set these in the Portal)
  • Preferred currency (if you set this in the Portal)

• Customer Support & Inquiries:
  (Mandatory):

  • Contact information you provide (name, email address)
  • Content of your inquiry and any information you choose to include

  (Optional / if provided):

  • Attachments or documents you submit
  • Invitation details (name and email address of users you invite, if you use the invitation feature)

(2) Methods of Collection

• Collection via website (Portal) registration and login (SSO integration).
• Automatic collection via information collection tools (cookies, log analysis tools) during service use.
• Collection via written forms, fax, telephone, e-mail, or bulletin boards during customer service interactions.

2. PROVISION AND CONSIGNMENT OF PERSONAL INFORMATION

To provide smooth services, Bagelcode manages the provision (sharing) and consignment (outsourcing) of personal information as follows.

(1) Provision of Personal Information to Third Parties

We do not provide your personal information to third parties for their own independent use (e.g., marketing) without your explicit consent.

• General Rule: We do not provide personal information to any third party.
• Exceptions: We may provide personal information without consent in the following cases as prescribed by law:
  • When required by other laws or regulations.
  • When necessary for the emergency safety of the life or body of the data subject or a third party.
  • When necessary for the investigation of a crime, indictment, and prosecution prescribed by the Criminal Procedure Act.

(2) Consignment (Outsourcing) of Personal Information Processing

Bagelcode entrusts personal information processing tasks to external professional companies ("Trustees") to ensure service efficiency. We supervise these trustees strictly in accordance with Article 26 of PIPA.

• Domestic Consignment: Currently, we do not entrust personal information to domestic (Korean) vendors for the Portal service. All processing is handled via global cloud infrastructure.
• Overseas Consignment (Cross-Border Transfer): Since we use global cloud and authentication services, your data is transferred to and processed in foreign countries.

• Refusal of Transfer: You may refuse the overseas transfer of your personal information by contacting the CPO or Data Privacy Department (support@bagelcode.com). However, please note that if you refuse the transfer, you may not be able to use the Portal services, as these essential functions (hosting, authentication) are provided by the overseas vendors listed above.

3. PURPOSE OF COLLECTION AND USE OF PERSONAL INFORMATION

We collect and use personal information for the following specific purposes. We do not use personal information for any purposes other than those set forth below.

• Member Management: Identification and authentication of users for Portal access; maintenance and management of membership qualifications; prevention of unauthorized use of services; confirmation of intent to join; handling of complaints and inquiries.
• Service Provision: Granting access to specific dashboards (NebulaScope, KPIs); providing software resources (SDKs, APIs); managing download permissions.
• New Service Development & Marketing: Development of new statistics/analysis tools; statistical analysis of service usage; delivery of advertising information such as events (only with optional consent).
• Security & Safety: Access control; detection of abnormal usage patterns; preservation of records for dispute resolution.

4. PERIOD OF RETENTION AND USE OF PERSONAL INFORMATION

(1) General Principle

In principle, we destroy personal information without delay once the purpose of collection and use has been achieved (e.g., upon deactivation of your Portal account/access or termination of our Service agreement with you).

(2) Statutory Retention Requirements

However, if retention is required by relevant laws and regulations, we retain the information for the period specified by such laws. During this period, the information is stored in a separate database (DB) and used only for the purpose of retention.

5. PROCEDURE AND METHOD OF DESTRUCTION OF PERSONAL INFORMATION

Bagelcode destroys personal information immediately after the purpose of collection is achieved or the retention period expires. The procedure and method are as follows:

(1) Destruction Procedure

• Information entered by the user is transferred to a separate database (or a separate storage location for paper documents) after the purpose is achieved.
• It is stored for a certain period according to internal policies and relevant laws (see "Period of Retention and Use") and then destroyed.
• Personal information stored in the separate database is not used for any other purpose unless required by law.

(2) Destruction Method

• Electronic Files: Permanently deleted using technical methods that prevent the reproduction of records.
• Paper Documents: Shredded with a shredder or incinerated.

6. RIGHTS AND OBLIGATIONS OF DATA SUBJECTS AND METHODS OF EXERCISE

(1) Rights of Data Subjects

• Users may exercise the right to view, correct, delete, or suspend the processing of their personal information at any time.
• Requests can be made in writing, by email, or facsimile to the department in charge. Bagelcode will take action without delay.

(2) Legal Representatives

• If a user is unable to exercise their rights directly (e.g., legally incapacitated), a legal representative or an agent authorized by the user may exercise the rights. In this case, a Power of Attorney (in the format of Annex No. 11 of the Enforcement Rules of the Personal Information Protection Act) must be submitted.

(3) Limitations

• Requests for deletion may be denied if the personal information is required to be collected by other laws.
• Requests for suspension of processing may be denied where there are special provisions in the law or it is unavoidable to comply with legal obligations.

7. MEASURES TO ENSURE SAFETY OF PERSONAL INFORMATION

Bagelcode takes the following technical, administrative, and physical measures to ensure safety and prevent loss, theft, leakage, forgery, or damage of personal information.

(1) Administrative Measures

• Establishment and implementation of internal management plans for personal information protection.
• Regular training for employees handling personal information.
• Designation of a Privacy Officer and minimization of personnel handling personal information.

(2) Technical Measures

• Access Control: Strict control of access rights to personal information processing systems; installation of intrusion detection systems to prevent unauthorized access.
• Encryption: Passwords (managed by SSO providers) and identifiable unique information are encrypted; data is encrypted during transmission (SSL/TLS).
• Security Programs: Installation and periodic update of vaccine software and security programs to prevent hacking or viruses.
• Access Records: Storage and management of access records to the personal information processing system for at least 2 years.

(3) Physical Measures

• Access control to computer rooms and data storage archives (managed via AWS cloud security protocols).
• Procedures to prevent unauthorized persons from entering areas where personal information is stored.

8. MATTERS CONCERNING INSTALLATION/OPERATION OF AUTOMATIC COLLECTION TOOLS AND REFUSAL

(1) Use of Cookies

Bagelcode uses "cookies" to store and retrieve usage information to provide personalized services. A cookie is a small amount of information sent by the server to the user's browser and stored on the user's hard drive.

(2) Purpose of Use

To analyze the frequency of access and visit times, identify usage patterns, and strictly for secure authentication maintenance (session management).

(3) Installation, Operation, and Refusal of Cookies

• Users have the option to accept or reject cookies.
• Method:
  • Internet Explorer: Tools > Internet Options > Privacy > Advanced.
  • Chrome: Settings > Privacy and security > Cookies and other site data.
  • Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data.
• Note: If you refuse the installation of cookies, there may be difficulties in using some services (especially logging in).

9. PRIVACY OFFICER (CPO) AND DEPARTMENT IN CHARGE

To protect personal information and handle complaints related to personal information, Bagelcode has designated a Chief Privacy Officer (CPO) as follows:

• Chief Privacy Officer (CPO): Head of Platform Division
• Department: Security / Legal Team
• Contact: support@bagelcode.com

Remedies for Infringement of Rights

If you need to report or consult on other personal information infringements, please contact the following organizations:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office (Cyber Investigation Division): www.spo.go.kr / 1301
• National Police Agency (Cyber Bureau): ecrm.cyber.go.kr / 182