Global Privacy Notice

XSOLLA ZK, INC.’S GLOBAL PRIVACY NOTICE · Effective: November 6, 2026

Xsolla ZK, Inc., a Delaware corporation, develops and operates websites and software interfaces through which you may choose to interact with the Xsolla ZK network and other blockchain protocols, such as Ethereum. We know your personal information is important. As a result, we process your personal information responsibly and in accordance with applicable laws and regulations. We appreciate the trust you place in us when you use our products and services and when you visit our websites. We understand that many users of blockchain networks value pseudonymity, and we seek to limit the Personal Information we collect to what is necessary to provide and secure the Services. Pseudonymity on a public blockchain has limits that we do not control. These are described in Section 2 below.

This Global Privacy Notice (“Global Privacy Notice”) applies to the websites and software interfaces we operate, including the Xsolla ZK web portal, the block explorer and the bridge interface (collectively, the “Services”). This Global Privacy Notice describes how we process the Personal Information collected when you access the Services. (It does not apply to the Xsolla ZK network itself, or to any other blockchain protocol to which information is transmitted or recorded, including Ethereum. These are public blockchains that we do not own or operate, and information recorded on them is published by users and third parties rather than by us.) This Global Privacy Notice also explains your rights and choices regarding your Personal Information, including how to contact us with any questions or concerns. When you leave the Services, this Global Privacy Notice no longer applies. Any subsequent website, application, or service you access is subject to its own terms of service and privacy notice, not this Global Privacy Notice. Other Xsolla-branded products and services are provided by other entities and are subject to their own privacy notices, terms and conditions.

In this Global Privacy Notice, “Personal Information” means any information relating to an identified or identifiable natural living individual. Personal Information does not include aggregated or anonymized information that cannot reasonably be used to identify you. Please read this Global Privacy Notice carefully. If you do not agree with any part of this Global Privacy Notice, you should not access or use any part of the Services. You may exercise your rights in relation to your Personal Information as set out in this Global Privacy Notice, and you may contact us at any time regarding those rights using the methods described in the “Contact Us” Section below.

Our Services are not intended for minors, and we do not offer them to children. Accordingly, we do not knowingly collect data from you if you are not of the age of majority in your jurisdiction. Please see Section 12 below for more detailed information.

1. Our Relationship With You

Xsolla ZK is the entity that provides the Services and determines the purpose and the means of processing your Personal Information and is the controller of that Personal Information (or the equivalent designation under applicable law). We are not a controller of and do not determine the means of processing information that you or any other person publishes on the Xsolla ZK network or on any other blockchain protocol. Your use of the Services is also governed by our Terms of Use. The Services can be used by organizations or by individual Users. If you are using the Services on behalf of your organization, your organization owns the associated accounts and may take certain actions with respect to your access to or ability to use the Services.

The block explorer we operate displays information that has been recorded on the Xsolla ZK network, including wallet addresses and transaction details. That information originates from the network, is already public, and is not created by us. It may relate to persons who do not use the Services. We index and display that information so it can be searched and read, and we are responsible for the indexed copy we hold. We cannot change or remove the underlying record on the network.

2. Personal Information We Collect

When you access or use the Services, we collect:

• Information that you provide to us.
• Technical Information collected automatically when you access or use the Services, which is used to deliver the Services and for the other purposes described below.
• Information we obtain from other sources, including public blockchain networks and public databases.

Personal Information You Provide to Us

We collect a variety of information that you provide to us. The specific types of information we collect will depend upon your engagement with the Services. Some Personal Information that you provide to us is required for the use of the Services. However, other Personal Information is optional.

• Account and Profile Information: Certain Services require you to create an account or profile. If you create an account or profile to use the Services, we collect Personal Information to allow you to use these Services. When you sign up, you may provide us with your name, password, email address, mobile phone number, account history and/or other information necessary to create and maintain your account or profile.
• Contact Information and Other Information You Choose to Provide: You can provide a variety of information during your interactions with us, such as through emails or other communications. When you contact us via a website contact form, email, or other means, you provide us with Personal Information, such as your name, contact details, and the content of your communications with us.
• Support Information: When you request technical support services, we will process your Personal Information, such as your name and contact details used to contact us, as well as information regarding the reasons for your support request, the support provided and any additional information provided in that context.
• Wallet Information: If you connect a digital wallet to the Services, we receive your wallet address and the information necessary to display balances and transaction history associated with it. We do not receive, hold, or store your private keys or secret recovery phrase, and we cannot access or move assets held in your wallet. Where you connect a wallet while signed in to an account, we associate that wallet address with your account and with the other Personal Information we hold about you. In those circumstances the wallet address, and the activity associated with it, is Personal Information in our hands. When you connect a third-party wallet, the provider of that wallet also processes information about you. Depending on the wallet, this may include your wallet address, your internet protocol (IP) address, the services you connect to and the transactions you sign, including where the wallet routes your requests through its own infrastructure. That processing is carried out by the wallet provider under its own privacy notice and policy and is not covered by this Global Privacy Notice. Please see Section 10.
• Other Information: You may provide us with additional information associated with your use of the Services. If you decide to use the Services offered, we may collect and store content and information that you create or upload. We will inform you if this is necessary.

We do not intentionally collect sensitive Personal Information, such as government identification numbers, financial account numbers, precise geolocation, or information revealing racial or ethnic origin, health, religious or philosophical beliefs, or biometric or genetic data.

Information Collected Automatically

We may automatically collect certain information due to your use of the Services. We use this information to enable the basic functionality of the Services. We strive, where possible, to ensure collected information is de-identified, aggregated and/or anonymized.

• Single Sign-On Through Identity Providers: If you sign in to the Services using credentials from another service, such as Google, Apple or Xsolla ID, that identity provider authenticates you and sends us information about you. This typically includes your name, email address and a unique identifier assigned to you by that provider. Your use of that provider is governed by its own terms and privacy notice.
• Device and Usage Information: When you access and use the Services, including in limited circumstances when you engage with our relevant support platforms to make a request or when you require support from us, we may receive and store information about your interactions. This may include information such as date/time stamps, usage information and statistics, your internet protocol (IP) address, location (e.g., city or state), hardware and software information (including operating system version and type), browser type, device identifiers, device event information, crash data, cookie data and your interactions with the Services. This information could be used to identify you or your device.
• Network and Transaction Requests: When you use the Services to view information from, or to submit a transaction to, a blockchain network, your request is transmitted to a node or remote procedure call (RPC) endpoint. This may result in your internet protocol (IP) address being processed alongside your wallet address or transaction details, either by us or by the provider that operates that endpoint.
• Settlement to Ethereum: The Xsolla ZK network is a Layer 2 network that settles to the Ethereum blockchain. Transaction data from the Xsolla ZK network, which may include your wallet address and transaction details, is periodically batched and published to Ethereum. Ethereum is a public blockchain that we do not own, operate or control. Once published, that information is permanent and publicly visible and cannot be erased, altered or made private by us or by any other person.
• Block Explorer Searches: When you use the block explorer, we collect the search terms you enter, such as a wallet address, transaction identifier or block number, together with technical information such as your internet protocol (IP) address. A search you run through the block explorer may associate your internet protocol address with your interest in a particular address or transaction.
• Bridging Between Networks: If you use the bridge interface to transfer assets between the Xsolla ZK network and another blockchain, such as Ethereum, the transfer is recorded on both networks. That record permanently and publicly links the wallet address you use on one network with the wallet address you use on the other. If either address can be associated with you, that association may extend to the other address and to the transactions made from it. We cannot remove or alter this link once it has been recorded.
• Limits of Pseudonymity: A wallet address does not usually display your name, but it is not anonymous. Every transaction made from an address is public and permanently linked to that address. Third parties, including analytics firms, exchanges, researchers and law enforcement, routinely analyze blockchain data to group addresses that appear to be controlled by the same person and to associate addresses with real-world identities. If your address becomes associated with you through any source, including a transaction with a service that has identified you, that association may extend to your entire transaction history on that address. This analysis is carried out by parties we do not control, and we can neither prevent it nor reverse it.
• Diagnostic and Error Data: We use third-party service providers to monitor, report on and/or diagnose errors in the Services. A report generated when an error occurs may include technical details of the failed request, such as a wallet address or transaction identifier.
• Cookies and Similar Technologies: When you access the Services, we may collect Personal Information via cookies, pixel tags or similar technologies on the Services (collectively referred to as “Cookies”). For more information on our use of Cookies, please read our Cookie Policy.
• Location Information: When using Services, general location information inferred from the IP address may be collected.

Information We Obtain From Other Sources

We also obtain information about you from sources other than you.

• Public Blockchain Data: We obtain information that is publicly recorded on the Xsolla ZK network and on other blockchain protocols. This may include wallet addresses, transaction identifiers, the date and time of transactions, transaction amounts and the assets involved, the addresses of smart contracts you interact with, balances and holdings associated with a wallet address, and digital signatures. Where this information is associated with you, we treat it as Personal Information and process it as described in this Global Privacy Notice.
• Compliance Screening Information: We obtain information about you from publicly available sources and from compliance screening providers in order to determine whether you are subject to sanctions or other restrictions. This may include sanctions and restricted-party lists maintained by government authorities, such as the Specially Designated Nationals and Blocked Persons List maintained by the U.S. Office of Foreign Assets Control and lists maintained by the United Nations, the European Union and the United Kingdom, and information associating wallet addresses with sanctioned persons or with unlawful activity. We also receive the results of that screening.

3. How We Use Personal Information We Collect

We process your Personal Information based on several legal grounds, including your consent where required (e.g., for marketing), performance of a contract (e.g., providing our Services), compliance with legal obligations (e.g., responding to regulatory inquiries) and legitimate interests (e.g., improving our Services and ensuring security). Please review the detailed information on how we use your Personal Information below:

• To create an account/profile if required for use of Services.
• To provide our Services, including displaying blockchain information you request through the Services. (Legal basis: performance of a contract.)
• For personalization to customize our Services to meet your specific needs or requests, such as identifying your requests for regionality to improve your experience with the Services and enabling you to interact with Third Party Platforms (defined below).
• For product improvement, developing new products and/or new Service features.
• To communicate, including for administrative purposes, security support, maintenance purposes, providing services/information you requested and responding to your comments/questions.
• Subject to any consent requirements, to send marketing materials, alerts about the latest developments and features or other promotional materials and to develop new promotional materials that can be useful or relevant to you. You will always have the option to opt out of marketing communications.
• Where required by law, we will obtain your prior explicit consent before sending you any marketing materials. This means you will be given a clear choice to agree to or refuse marketing communications, and we will only send you such materials if you have provided your consent. If you opt in, you can change your preferences and withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
• For customer and third-party relationship management and tracking. Where we use automated decision-making or profiling, we will inform you and provide you with the right to object to such processing if it has a significant effect on your legal rights.
• For aggregation or de-identification of Personal Information, which is a format that does not allow you to be personally identified. We use the resulting information for statistical analysis regarding the use of the Services, including to better understand our customer base and their engagement.
• For administrative and legal purposes, including for compliance purposes. This includes enforcing our Terms of Use or enforcing or defending other legal rights or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency, and to comply with our legal obligations and internal policies as permitted by law, such as preventing the Services from being accessed by individuals in sanctioned territories or by sanctioned individuals. This includes automated screening, as described in Section 6 under “Right Not to Be Subject to Automated Decision-Making, Including Profiling.”
• For safety, security and integrity purposes, including investigating in good faith alleged violations of our Terms of Use, such as unauthorized access and use. To protect the Services and ensure your continued access to them, your Personal Information is collected to prevent (though there are no guarantees) malicious actors from attacking and disrupting the Services.

4. Who We Share Personal Information With

We may disclose Personal Information about you under the following circumstances:

• Group Entities. We may disclose your Personal Information to our affiliates and subsidiaries, if any, for the purpose of providing the Services and conducting business.
• Service Providers. We work with third parties for the purpose of providing the Services, such as hosting, maintenance, network management, cybersecurity, and/or support. These third parties may have access to and/or process your Personal Information as part of providing those services to us. For example:
  • When you use a credit card to pay for our Services, information such as your name, billing address, phone number, email address and credit card information will be submitted to service providers for verification and to manage any recurring payments.
  • We use cloud service providers for data storage, disaster recovery, and to fulfill our obligations to you.
  • We use service providers for certain business communication tools.
  • We use service providers who manage the networks that support the operation of the Services and improve latency for our users.
  • We use service providers to help us prevent malicious actors from threatening the Services and to meet compliance obligations, such as preventing individuals from sanctioned territories or sanctioned individuals from accessing the Services.
• Native Integrations. We do not share data from integrated apps with any other services or clients except as necessary to provide the Services.
• Legal. Personal information about you may be disclosed to law enforcement agencies, regulatory bodies, public authorities, or pursuant to the exercise of legal proceedings if we are legally required to do so, or if we believe, in good faith, that such disclosure is necessary to comply with a legal obligation or request, to enforce our terms and conditions, to prevent or resolve security or technical issues, or to protect the rights, property or safety of Xsolla ZK (or an affiliate), our Users, a third party, or the public.
• Strategic Business Partners. Subject to your consent where required and your applicable opt-out rights, we may share your Personal Information with our strategic business partners. These partners may use your information for marketing and advertising purposes, including sending you promotional materials about products or services that may be of interest to you. We may also share your information for other commercial purposes, such as to develop joint services or products. When we share your Personal Information with third parties for such purposes, we ensure that they comply with applicable data protection laws and maintain the confidentiality and security of your data. When these partners use your Personal Information for their own marketing, advertising or other commercial purposes, they are responsible for those uses under their own privacy notices. We provide you with the consent and opt-out choices described in this Global Privacy Notice and its supplements.
• Third Party Platforms (as defined below). Your Personal Information may be disclosed to Third Party Platforms where you have requested to interact with a third-party service or platform. Please see Third Party Links and Websites (Section 10) for more information.

5. Service Providers

From time to time, we engage Service Providers for the purposes described in Section 4 above. These Service Providers include the unaffiliated entities listed here.

6. Your Rights

You have the following rights associated with the processing of your Personal Information:

• Right to Access or Right to Know. You have the right to obtain access to the Personal Information we hold about you and to request certain information about our processing. Specifically, you have the right to receive an explanation of (i) why we process your Personal Information, (ii) the categories of Personal Information we have about you, (iii) who we share your Personal Information with, (iv) how long we store your Personal Information and (v) who we received your Personal Information from if it was not collected from you directly. We will also inform you about your privacy rights.
• Right to Rectification or Correction. You have the right to correct, update or complete any Personal Information we hold about you that is inaccurate or incomplete. Please note that we may rectify or remove incomplete or inaccurate information at any time and at our own discretion. This right applies to Personal Information held in our systems. It does not extend to information recorded on a blockchain, which cannot be altered or corrected by us or by any other person.
• Right to Erasure or Deletion. You may request to have your Personal Information anonymized, erased or deleted, as appropriate. In this case, if there is no overriding legitimate interest or requirement to continue processing your Personal Information or as otherwise required by law, we will erase your data from our systems. This right does not extend to information recorded on a blockchain. Information recorded on a blockchain is permanent and cannot be erased, altered or made private by us or by any other person.
• Right to Object to Processing. You have the right to object to our processing of your Personal Information where we are relying on a legitimate interest unique to us or if we are processing your Personal Information for direct marketing purposes or for commercial purposes.
• Right Not to Be Subject to Automated Decision-Making, Including Profiling. Where applicable, you have the right to request that you are not subject to decisions based solely on automated processing, including profiling, if such decisions have legal impacts on you or similarly significant impact on you. This right applies when decisions are made without any human involvement, such as automated evaluations of personal characteristics to analyze or predict aspects like your personal preferences or interests. We use automated processes to screen access to the Services. These processes check information such as your wallet address, your IP address and the country inferred from it against sanctions and restricted-party lists and against internal risk criteria, and may automatically prevent or restrict your access to the Services. Where a match is identified, the consequence for you is that you may be unable to access all or part of the Services. No person reviews this screening before it is applied. You may also request human intervention in the decision-making process, express your viewpoint and contest the decision if it significantly impacts your rights or interests. Exceptions to this right may apply where a decision is necessary for entering into or performing a contract with you, is authorized by applicable EU or Member State law that provides suitable safeguards, or is based on your explicit consent.
• Right to Restrict Processing. You have the right, in certain circumstances, to stop us from processing your Personal Information other than for storage purposes.
• Right to Portability. You have the right to receive, in a structured, commonly used and machine-readable format, Personal Information that we hold about you, if we process it based on our contract with you or with your consent and/or to request that we transfer such Personal Information to a third party. Additionally, if technically feasible, you may request that we transfer this information directly to another data controller. Please note that this right only applies to Personal Information that you have provided to us and does not cover data that has been derived from such Personal Information or data we process based on other legal grounds.
• Right to Withdraw Consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal Information at any time and free of charge. We will apply your preferences going forward. This will not affect the lawfulness of the processing before you withdraw your consent.
• Right to Lodge a Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where you believe an incident took place.
• Right Against Discrimination. In accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we will not discriminate against you for exercising any of your privacy rights. This means that if you choose to exercise your rights, such as requesting access to, deletion of, or opting out of the sale or sharing of your Personal Information, we will not: (i) deny you Services; (ii) charge you different prices or rates for Services, including through the use of discounts or other benefits or imposing penalties; (iii) provide you with a different level or quality of Services; or (iv) suggest that you may receive a different price or rate for the Services, or a different level or quality of the Services.
• Right to Opt Out of Targeted Advertising, Sale or Sharing. You can ask us to stop using your Personal Information for targeted advertising, and to stop any sale or sharing when required by law.
• Limits on These Rights in Respect of Blockchain Data. Some of the Personal Information described in this Global Privacy Notice, such as a wallet address or transaction details, may also be recorded on the Xsolla ZK network or on another blockchain protocol. Where we hold a copy of that information in our own systems, the rights described above apply to our copy, and we will act on a valid request in the ordinary way. Those rights cannot be given effect in respect of the underlying record on the blockchain itself. A blockchain is an append-only public ledger that we do not own, operate or control, and information recorded on it is permanent, publicly visible and cannot be erased, rectified, restricted or made private by us or by any other person. Exercising your rights with us therefore will not remove or change information that has already been recorded on a blockchain.

You may exercise these rights by contacting us as set forth in the “Contact Us” Section. Prior to any response to the exercise of such rights, we may require you to verify your identity. In addition, we may have valid legal reasons to reject your request and will inform you if so. Note that applicable laws contain certain exceptions and limitations to each of these rights. Subject to certain restrictions, you can ask an agent to exercise your rights for you. If you have an agent exercising your rights, that person must provide to us your written authorization allowing them to make such a request on your behalf. We reserve the right to deny the agent’s request if we are not reasonably able to confirm proper authorization and/or verify your identity as the requestor.

To appeal any refusal by us to act on a data subject rights request, contact us by email at: privacy-requests@x.la.

7. Retention of Information

We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Global Privacy Notice, to make the Services available to you or as instructed by you, unless a longer retention period is required or permitted by law. In determining that period, we consider the type and sensitivity of the Personal Information, the purpose for which we hold it, whether you continue to use the Services, whether we are required to retain it to comply with a legal obligation, and the period during which a legal claim could be brought. We may also keep your data for as long as it is needed in relation to a legal claim, complaint, litigation or regulatory proceeding.

Information that we obtain from a blockchain and index in order to provide the Services, including information displayed through the block explorer, is retained for as long as we provide that Service. Information recorded on a blockchain itself is retained by the relevant network and is not deleted by us, as described in Section 6.

8. Security and Storage

We implement a variety of security measures that are designed to reasonably protect the safety of your Personal Information from loss, misuse and/or unauthorized access, disclosure, alteration and/or destruction when you enter or submit your Personal Information on the Services. However, no Internet or email transmission is ever fully secure or error-free.

If you believe your privacy has been breached through use of the Services, please contact us immediately.

When you use the Services, your Personal Information will be stored in the United States.

9. Data Analytics & Advertising

We use cookies and similar technologies for analytics and advertising. Where applicable law requires consent, including for advertising cookies in the European Union and United Kingdom, we ask for it before using those technologies. You can change your cookie preferences, including withdrawing consent you have given, at any time through our cookie management tool. Additional rights to opt out of advertising-related uses of Personal Information are described in the U.S. Supplemental Privacy Notice.

Data Analytics. We may use first-party analytics to provide the Services, including analyzing the performance of the Services for product improvement or for marketing purposes (as described above). We may also use third-party web analytics services for the Services (subject to your consent), such as Google Analytics. These third-party services use the sort of technology described in the “Information Collected Automatically” Section above to help us analyze how Users use the Services (such as our Sites), including by noting a third-party website from which you arrive. The information collected by the technology will be disclosed to, or collected directly by, these third parties, who use it to evaluate your use of the Services. We also use Google Analytics for certain advertising-related purposes, as described above. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-Out Browser Add-on.

Advertising. Third-party services, which may include Google Analytics, Google Tag Manager, HubSpot, LivePerson, Segment or LinkedIn, may use cookies and web beacons to collect information about your activities on the Services (such as our Sites) to provide you advertising based on your interests. This means these third-party services may show our ads on sites across the Internet based upon your previous visits to the Services. Together with these third-party services, we may use these cookies and web beacons to report how your ad impressions, other uses of ad services and interactions with these ad impressions and ad services are related to your visits to the Services.

Third parties that provide analytics or advertising technologies on the Services may collect information about your use of the Services as described above. Their processing of that information for their own purposes is also described in their privacy notices.

If you would like to learn more or opt out of receiving online display advertising tailored to your interests, please visit the Network Advertising Initiative at: www.networkadvertising.org/managing/opt_out.asp or the Digital Advertising Alliance at: aboutads.info/choices.

10. Third Party Links and Websites

The Services enable you to interact with certain third-party services, decentralized applications and third-party platforms (collectively, "Third Party Platforms"). However, this Global Privacy Notice does not address, and we are not responsible for, the privacy practices of any third parties, including but not limited to those that operate websites to which the Services link. The inclusion of a link on the Services does not imply that we (or our affiliates) endorse the practices of the linked website. Your use of such Third Party Platforms and those Third Party Platforms’ use of your Personal Information is subject to their respective terms of use and privacy notice (if any) and is not subject to this Global Privacy Notice.

Where you have sought to interact with a Third Party Platform through the Services and to share Personal Information as required for such interaction, we will, where permitted and where possible and practical, seek to limit the Personal Information shared by using proxies.

11. Co-Branded Websites

If our Services link to other websites that include our branding, this Global Privacy Notice does not apply to those other websites. Visitors to those websites are advised to carefully read the notices on each site.

12. Eligibility

Our Services are not intended for minors, and we do not offer them to children. Accordingly, we do not knowingly collect data from you if you are not the age of majority where you reside.

NOTICE TO PARENTS AND GUARDIANS: The Services are prohibited to minors. You are responsible for exercising supervision over your minor’s online activities. If you believe your minor has accessed or used the Services, please contact us using the details in Section 16 so that we can delete any information we hold about them. We recognize the importance of parental supervision of minor’s online activities. We encourage parents to contact us if they have any questions or concerns.

13. Change of Ownership

In the event of a change in ownership or a merger with, acquisition by, or transfer or sale of all or a portion of our assets to another entity, we reserve the right to transfer all your Personal Information to that entity. We will use reasonable efforts to notify you of a transfer to an unaffiliated third party (by a posting on our homepage or by email to your email address that you provided to us, as determined at our discretion).

14. Changes to Our Global Privacy Notice

We reserve the right to amend this Global Privacy Notice from time to time to reflect changes in the law, our data collection, use or sharing practices or advances in technology. We will make the revised Global Privacy Notice accessible throughout the Services (including our Sites). We recommend that you review this Global Privacy Notice periodically. The “Date of Last Revision” at the beginning of this Notice indicates when it was last updated.

To the maximum extent permitted by law, by continuing to access or use the Services (including our Sites), you are confirming you have read, understand and consent to the latest version of this Global Privacy Notice.

15. Complaints

If you wish to lodge a complaint regarding how we process or use your Personal Information, please contact us as described in the “Contact Us” Section below. We will endeavor to respond to your complaint as soon as possible. You may also lodge a claim with the applicable supervisory authority.

16. Contact Us

If you have any questions or comments about this Global Privacy Notice or our privacy practices, or if you would like to exercise your rights with respect to your Personal Information, please contact us by emailing privacy-requests@x.la.

Alternatively, you can write to us at: (via postage-paid, first-class mail) Attention: Global Privacy Notice, Xsolla ZK, Inc., 15260 Ventura Blvd, #2230, Sherman Oaks, California, USA 91403.

Supplemental Privacy Notice (EU, Turkey, Switzerland, United Kingdom (EEA+))

Effective: November 6, 2026

This Supplemental Privacy Notice applies to you only if you are a natural living person and you are located in the European Union, a European Free Trade Association country, Turkey, Switzerland, or the United Kingdom (“EEA+”). If you are located in the EEA+ and engage with the Services, Xsolla ZK is the data controller for the provision of the Services. This Supplemental Privacy Notice is incorporated into and forms part of Xsolla ZK’s Global Privacy Notice.

In accordance with our legal requirements in this region, we are required to identify and inform you of the legal basis that we use for the processing of your Personal Information.

1. Legal Basis for the Processing of Personal Information

• Consent. This is the case where you have consented to the use of your Personal Information.
• Contract. The performance of the contract is used as the legal basis for the processing of your Personal Information for the purpose of providing the Services to you. For example, we need your Personal Information to provide you with our Services, to perform our obligations under our contract with you, such as creating and securing your account, responding to your inquiries, or taking steps you request prior to signing up for the Services.
• Legitimate Interest. We have a legitimate business interest in processing your Personal Information to provide the Services. We rely on legitimate interests as a legal basis only when they do not override your fundamental rights and freedoms related to privacy and data protection, on balance. We ensure that we comply with any requests you make to exercise your associated rights. The processing of your Personal Information where legitimate interests are used as the legal basis may include the following purposes: to communicate with you, to optimize our Services, for compliance, fraud and safety purposes and to provide the Services.
• Legal Obligation. We may have a legal obligation to process your Personal Information, for example to comply with tax and accounting obligations (which may include anti-money laundering (AML) laws and know-your-customer (KYC) requirements). We may process your Personal Information when necessary to establish, exercise or defend legal claims.

2. Data Protection

All questions, issues and concerns regarding data protection should be addressed to: privacy-requests@x.la.

3. International Data Transfers

If you provide us with your Personal Information when using the Services from the EEA+ (including Turkey, Switzerland and the UK) or other regions of the world with laws governing data collection and use that may differ from U.S. laws, then please note that you are transferring your Personal Information outside of those regions to the United States for storage and processing.

When we transfer your Personal Information internationally, we ensure that relevant safeguards are in place to afford adequate protection for your Personal Information and we will comply with applicable data protection laws, by relying on EU Commission adequacy decisions or the current standard contractual protections for the transfer of your Personal Information or a derogation if one is available.

Please contact us using the methods described in Section 16 of the Global Privacy Notice if you want further information about the specific mechanism we use to transfer your personal information out of EEA+.

4. Complaints

You have the right to contact the appropriate supervisory authority at any time to lodge a complaint regarding the processing of your data. The list of EU supervisory authorities is located here. All other supervisory authorities can be found by searching for their website homepage.

Supplemental Privacy Notice to Residents Within the United States with Privacy-related Consumer Protection Laws

Effective: November 6, 2026

This Supplemental Privacy Notice applies to you only if you are a natural person and you are a resident of any state in the United States with a privacy-related Consumer Protection Law. This Supplemental Privacy Notice is incorporated into and forms part of Xsolla ZK’s Global Privacy Notice.

Please note that the rules implementing some of these laws have not yet been finalized. We are continuously working to better comply with these laws, and we will update our processes, disclosures, and this notice as these implementing rules are finalized.

1. Categories of Personal Information We Collect, and How We Use and Share that Information

As of the publication date of this Supplemental Privacy Notice, Xsolla ZK has not collected consumers’ Personal Information or sold, shared, or disclosed it for a business purpose during the preceding 12 months. Our anticipated practices are described in the Global Privacy Notice:

• The Personal Information we expect to collect is described in Section 2.
• How we expect to use that information is described in Section 3.
• With whom we expect to share it is described in Section 4.

2. Manage Cookies

Global Privacy Control (“GPC”) is a browser setting that signals your choice to opt out of the sale or sharing of your Personal Information. When we receive a qualifying GPC signal, we treat it as an opt-out request for that browser or device and any associated consumer profile. If we know which consumer sent the signal, we also apply the request to that consumer. For instructions on enabling GPC, visit globalprivacycontrol.org. You can read our Cookie Policy here.

3. Sharing of Personal Information

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), the term “sharing” of Personal Information has specific legal meanings that may differ from the common understanding of the term.

“Sharing” refers to the disclosure of Personal Information to a third party for cross-context behavioral advertising, whether or not it is for monetary or other valuable consideration. Cross-context behavioral advertising refers to targeting advertising to a consumer based on Personal Information obtained from the consumer’s activity across different businesses, websites, or applications.

It is important to note that certain transfers of Personal Information are not considered a “sharing” under CCPA/CPRA, such as when Personal Information is transferred:

• At the consumer’s direction;
• To a service provider or contractor who processes the data solely on behalf of Xsolla ZK; or
• As part of a merger, acquisition or other corporate transaction.

We may share some of your Personal Information with third-party ad providers for the purposes of advertising and analytics. You may opt out of our sharing of Personal Information for cross-context behavioral advertising as described in Section 5 below.

4. We Do Not Sell Your Personal Information

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the term “sale” refers to the exchange of Personal Information for monetary or other valuable consideration to a third party. This includes instances where data is provided in exchange for something of value, not necessarily just money. You have the right to know whether your Personal Information is being sold. We do not sell your Personal Information. Please note a “sale” does not include when we disclose your Personal Information at your direction or when otherwise permitted under law.

5. Right to Opt-out of Sharing

We may share your Personal Information with third parties for cross-context behavioral advertising as described in Section 3. You may opt out of this sharing by using the “Do Not Sell or Share My Personal Information” link on our website, enabling Global Privacy Control as described in Section 2, or emailing privacy-requests@x.la.

Even if you turn off “sharing,” you may still see personalized ads based on information other companies and ad networks have collected about you, if you have not opted out of sharing with them.

6. Non-Discrimination

U.S. state and federal privacy laws prohibit businesses from discriminating against you for exercising your rights under the law. Discrimination may include denying services, providing a different level or quality of service, or charging different prices. We do not discriminate.