Privacy Policy

Personal Data Protection Policy – PSFP Regulated Platform
Last updated: August 27, 2026

The present privacy policy (hereinafter the "Policy") is intended to describe in a detailed and transparent manner the procedures by which Gamevestor collects, uses, stores and protects the personal data of the platform's users.

Gamevestor attaches particular importance to the protection of privacy and personal data, and undertakes to process such data in strict compliance with:

• Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data (GDPR);
• the amended French Data Protection Act (Loi Informatique et Libertés);
• regulations applicable to crowdfunding service providers (PSFP), particularly in terms of anti-money laundering and combating the financing of terrorism (AML-CFT);
• the requirements of the competent supervisory authorities, in particular the AMF and the ACPR.

1. Identity of the data controller

The data controller is Gamevestor, a simplified joint-stock company under French law, registered in the Annecy Trade and Companies Register under number 938 196 714, whose registered office is located at 5 rue de l’Industrie, 74000 Annecy, France.

Contact email for any questions relating to personal data: [email protected].

Gamevestor has not appointed a data protection officer. The contact point for any question relating to personal data is Arthur Van Ceulen, General Manager, reachable at that same address.

2. Persons concerned by the processing

The personal data processing operations implemented by Gamevestor concern the following categories of persons:

• site visitors;
• contributors (donations / contributions);
• investors (natural and legal persons);
• project owners / studios (legal persons);
• legal representatives, corporate officers and ultimate beneficial owners of legal persons.

3. Nature of the personal data collected

3.1 Data collected concerning natural persons

Depending on the features used, Gamevestor may collect in particular:

• first and last name;
• date and place of birth;
• nationality;
• postal address;
• email address;
• phone number;
• login credentials and password (encrypted);
• proof of identity (national identity card, passport);
• proof of address;
• bank details (RIB, IBAN, BIC);
• tax information and tax preferences;
• responses to regulatory questionnaires (investor profile, financial knowledge, ability to bear losses);
• amounts invested or contributed and history of operations;
• contractual documents signed electronically;
• communications exchanged with Gamevestor;
• IP address, connection logs and browsing data;
• cookie and tracker technical identifiers;
• an irreversible technical fingerprint of the email address, transmitted to our advertising providers in order to measure the conversions of our campaigns;
• campaign source — the utm_source, utm_medium and utm_campaign parameters present in the address through which you reached the Platform — and, where applicable, referral code.

3.2 Data collected concerning legal persons

For project owners and legal entity investors, the data collected may include:

• company name;
• legal form;
• SIREN / SIRET number;
• address of the registered office;
• articles of association;
• Kbis extract;
• declaration of ultimate beneficial owners;
• identity and contact details of legal representatives;
• identity documents of corporate officers and beneficial owners;
• valid professional bank details opened in the name of the legal person;
• financial, legal and operational documents necessary for the analysis and monitoring of projects.

3.3 Data collected through marketing emails

Our marketing communications allow tracking of their opening and of the links clicked. The following is collected:

• whether or not the message was opened;
• the date and time of opening;
• the links clicked.

Consent and withdrawal arrangements are described in section 12.3.

4. Purposes of processing and legal grounds

Personal data is collected and processed for the following purposes:

• creation and management of user accounts;
• access and use of the platform's services;
• management of contributions and investments;
• analysis, selection and monitoring of funded projects;
• compliance with the legal and regulatory obligations applicable to PSFPs, in particular regarding customer identity verification (Know Your Customer – KYC), verification of the identity of legal persons (Know Your Business – KYB), anti-money laundering and combating the financing of terrorism (AML-CFT) and anti-fraud;
• management of payments and payment accounts via approved providers;
• communication with users (notifications, contractual information);
• sending personalised marketing communications and measuring their opening, subject to prior consent; telephone canvassing for commercial purposes only takes place with your prior agreement;
• improving the Platform and audience measurement;
• advertising and measuring the conversions of our campaigns;
• customer relationship management and customer knowledge;
• technical supervision of the Platform and error detection;
• security of information systems.

5. Legal bases for processing

The legal bases applicable to the processing operations described above are as follows:

• the execution of a contract or pre-contractual measures;
• compliance with legal and regulatory obligations;
• Gamevestor's legitimate interest: security, fraud prevention and improvement of services, as well as its commercial legitimate interest for audience measurement, browsing analysis and customer knowledge;
• user consent, in particular for marketing communications and non-essential cookies.

Storing trackers on your device and processing your data are two distinct things, exercised separately: refusing trackers does not cancel your subscription to our communications, and accepting trackers does not amount to agreeing to be canvassed. Browsing analysis based on our commercial legitimate interest may be objected to at any time (section 13.1).

6. Regulatory processing, controls and automated decisions

As part of its regulatory obligations, Gamevestor may be required to carry out automated processing, including profiling operations, in particular for:

• identity verification;
• risk profile assessment;
• prevention of money laundering and terrorist financing.

These processing operations may lead to decisions such as refusing access to certain services or projects, in accordance with applicable legal requirements.

Gamevestor also carries out browsing and behaviour analysis for commercial purposes — customer knowledge, segmentation, relevance of communications — on the basis of its commercial legitimate interest. This profiling has no effect on access to the services and may be objected to at any time (section 13.1).

7. Recipients of the data

7.1 Recipients

Personal data is accessible only to authorized persons of Gamevestor and may be transmitted, within the limits of their respective duties, to the following recipients:

• Technical and hosting providers (in particular EasyCrowd, Cloudflare, Amazon Web Services (AWS), Heroku);
• Payment and financial services provider: Lemonway, acting as an independent data controller;
• Electronic signature provider: Yousign;
• Project companies (SPVs) set up as part of the financing operations, in order to ensure the maintenance of bond registers, the management of financial flows and the monitoring of investor rights;
• Project owner studios, only for the data strictly necessary for the execution of the financed projects;
• Customer relationship management and marketing emailing provider: HubSpot;
• Audience measurement, advertising and conversion measurement providers: Google (Google Analytics, Google Ads, reCAPTCHA), Meta, TikTok, Reddit;
• Tracker consent management provider: CookieScript;
• Technical supervision and error detection provider: Raygun;
• Internal search engine provider: Algolia;
• Conversational assistant provider: Zapier.

In this context, project owner studios act as independent data controllers for the processing operations they implement under their own responsibility.

7.2 Transfers outside the European Union

Customer relationship management data is hosted in the European Union, in HubSpot's German data centre. Access from the United States by HubSpot, its affiliates or its sub-processors remains possible for the operation of the service.

Certain other providers are established outside the European Union or may transfer data there: Google, Meta and Reddit in the United States, Raygun in New Zealand, and TikTok to entities of the ByteDance group that may be located outside the European Economic Area.

These transfers, like the access mentioned above, are governed depending on the provider by an adequacy decision of the European Commission or by the standard contractual clauses it has adopted. A copy of the applicable safeguards may be requested at [email protected].

8. Publicly available data and non-public data

As part of the use of the Platform, certain information may be made accessible to other users or stakeholders of the funded projects, under strictly defined conditions.

8.1 Data that may be made accessible

• first name and first letter of the user's surname;
• pseudonym or public identifier;
• total amount invested or contributed to a project;
• investor or contributor status on a project.

This information is used exclusively for transparency purposes and for the monitoring of funded projects.

8.2 Data never made public

• password and login credentials;
• identity documents and proofs (ID card, proof of address, KYC / KYB);
• bank details (IBAN, BIC);
• full postal address, email and telephone number;
• IP address and detailed connection data;
• private communications with Gamevestor;
• tax information and responses to regulatory questionnaires.

9. Business continuity and run-off management

In accordance with the regulations applicable to PSFPs, Gamevestor has set up a continuity and run-off management system aimed at ensuring the continued monitoring of financing operations until their term.

The purpose of this system is to guarantee, in the event of interruption or cessation of the platform's activity, the continued monitoring of financing operations until their term, in the interest of investors and project owners.

In this context, certain personal data may be retained and, where applicable, transmitted to identified providers (in particular Easycrowd) or authorities.

10. Retention periods

• account data: duration of the contractual relationship, then archiving for up to 5 years;
• regulatory and financial data: 5 to 10 years in accordance with legal obligations;
• data related to security and fraud prevention: up to 1 year;
• browsing data linked to your account: 13 months from its collection; beyond that, only aggregated statistics remain, which do not allow you to be identified;
• marketing data: 3 years from the last contact or withdrawal of consent;
• cookies and trackers: 13 months maximum, with the exception of Google Analytics audience measurement cookies, whose duration is 400 days;
• data stored locally on your device by the Platform: until deleted by you, by the withdrawal of your consent, or by clearing the site's data in your browser (section 12.2).

11. Data security

Gamevestor implements appropriate technical and organizational measures to guarantee the security, integrity and confidentiality of personal data, in particular through the encryption of sensitive data, access limitation and secure hosting in Europe.

Data is hosted in the European Union, including the data entrusted to our customer relationship management tool. Certain recipients mentioned in section 7.1 are, however, established outside the Union: the corresponding transfers are governed as indicated in section 7.2.

12. Cookies, trackers and local storage

The Platform uses cookies and equivalent storage technologies on your device (local storage and session storage). Their storage and reading are subject to your consent, with the exception of those that are strictly necessary for the operation of the service or that record a choice you have expressed.

12.1 The categories used

These are the five categories of the cookie manager, and you will find them there under the same names:

• strictly necessary — exempt from consent: login session, recording of your consent choice itself, language choice, internal search engine (Algolia), error detection (Raygun), bot detection and fraud protection (Google reCAPTCHA, Cloudflare);
• performance: audience measurement (Google Analytics), customer relationship tracking (HubSpot), conversational assistant (Zapier), and part of the TikTok tracker;
• advertising and targeting: Meta, Reddit, Google Ads and DoubleClick;
• functionality: recognition of your browser by HubSpot;
• unclassified: two TikTok trackers whose purpose is not yet documented by our consent manager. They are subject to your consent in the same way as the others.

The details of each cookie — name, provider, purpose, duration — are presented in the cookie manager, which is authoritative: it carries the up-to-date declaration, and it also governs what each category allows. The declaration in force lists 27 cookies and 10 storage items, recorded across 61 pages of the Platform on August 27, 2026.

The storage items it recorded are all classified there among the strictly necessary ones. The three keys that the Platform stores itself for measurement purposes are, for their part, subject to your consent — section 12.2.

12.2 Storage placed by the Platform itself

The last three keys are deleted when you withdraw your consent.

12.3 Tracking pixels in marketing emails

Our marketing communications are personalised. By consenting to receive them, you also consent to the measurement of their opening and of the links they contain (section 3.3). Sending and measurement pursue a common purpose and are inseparable: it is this information that allows the content and frequency of messages to be adapted, and therefore allows you to be sent personalised communications rather than an undifferentiated mailing.

This data is used solely to adapt the content of our communications to your interests and to adjust the frequency of mailings. It is not used for advertising targeting on any other channel.

Legal basis: your consent (Article 6.1.a GDPR and Article 82 of the French Data Protection Act).

These trackers are not included in contractual, regulatory or transactional messages.

You may withdraw your consent at any time, and as easily as it was given: from your client area, under Contact details, by unticking "I would like to stay informed about Gamevestor news"; or via the unsubscribe link included in every message. This withdrawal ends all marketing mailings and results in the deletion of the corresponding tracking data. As messages already sent are beyond our control, you may also disable the automatic loading of images in your email client.

12.4 Changing your preferences

Your preferences can be modified at any time via the cookie manager, accessible from the badge displayed at the bottom of every page. The manager only governs trackers placed on your device; the tracking of our marketing emails is withdrawn under the conditions of section 12.3.

If you refuse trackers, no non-essential cookie or storage is placed on your device. Aggregated audience measurement, without any identifier allowing you to be recognised from one visit to the next, may nevertheless remain on the basis of our commercial legitimate interest; you may object to it under the conditions provided for in section 13.1.

13. Rights of individuals

In accordance with applicable regulations, users have the following rights:

• right of access;
• right of rectification;
• right to erasure;
• right to restriction;
• right to object;
• right to portability;
• right to withdraw their consent.

These rights can be exercised by contacting [email protected]. Proof of identity may be requested. Gamevestor responds within one month of receipt of the request.

13.1 Objecting to tracking for commercial purposes

You may object at any time, and without having to justify yourself, to the use of your data for prospecting purposes as well as to the profiling that prepares it. This objection is exercised by a request sent to [email protected], or verbally during a telephone conversation with our teams.

Once the objection is recorded, Gamevestor ceases all analysis of your browsing for commercial purposes and no longer sends you any commercial communication. Certain connection data remains on the basis of our legal obligations of security and traceability, as well as of the performance of your contract.

13.2 Complaint

You have the right to lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés – CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

14. Changes to the policy

This Policy may be modified at any time to reflect legal, regulatory or operational changes. The version in force is the one published on the Platform.