Privacy Policy for California Residents

This Policy explains the Personal Information we collect through the Sites, why we collect and use it, who we share it with, and the rights available to you, including the rights of California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). By accessing or using the Sites, you consent to collection, use and sharing of your Personal Information as set forth in this Policy.

Scope of This Policy

This Privacy Policy (“Policy”) applies only to your use of the following websites accessed through a desktop or mobile web browser: hardrockgames.com and any subdomains (Neverland Casino, hardrock.neverlandcasino.com) and (JackpotPlanet, hardrock.jackpotplanet.com) (each, a “Site,” together the “Sites”). It does not apply to the Jackpot Planet or Neverland Casino native mobile applications, which are governed by a separate privacy policy.

Who We Are

HRD Games, LLC, a Delaware limited liability company, its service providers, and its affiliates (collectively referred to in this Policy as “HRG”, “we”, “us”, “our” and other similar pronouns) know that your privacy is important to you. This Policy explains the types of information we collect through the Sites, referred to collectively in this Policy as the “Service(s)”.

Our Age Policy

Our Services aren’t directed at children under 13 years old. If you believe we have any Personal Information of a person under 13 years old, let us know by using the details in the Contact Us section below.

The Personal Information We Collect

“Personal Information” is any information that can be used to identify you as an individual or that is defined as “personal information” or “personal data” or similar term under laws applicable to us. In the preceding twelve (12) months, we have collected the following categories of Personal Information through the Sites:

Sources of Personal Information

• Directly from you - for example, when you register, make a purchase, or contact support
• Indirectly from your use of the Sites - for example, from cookies and similar technologies, as described in our Cookie Policy for California Residents
• From other sources - for example, publicly available information, social media platforms, and our advertising and analytics partners

How We Use Your Personal Information

We use the Personal Information we collect from and about you for the purposes below. If we process your Personal Information for other reasons, we'll inform you and ask for any required consent.

What we do: Create and manage your account and profile so you can use our products and services. Process any payments that you make, and prevent transactional fraud.

Our legal basis: Necessary for the performance of a contract

What we do: Providing you with access to play our products and services, both directly and through our affiliations with other providers

Our legal basis: Necessary for the performance of a contract

What we do: Analyze and profile your information to understand what you like, enjoy, and respond to

Our legal basis: Our legitimate interest to understand our customers and have good products

What we do: Decide if you might enjoy any of our offers, products, or services and let you know about them

Our legal basis: Our legitimate interests to let you know about other products you might enjoy. You can update your marketing preferences and opt out at any time. It is not necessary to make a purchase before you may receive these messages.

What we do: Assess how effective our marketing is

Our legal basis: Our legitimate interests to have effective marketing

What we do: Provide product features such as leaderboards and competitions

Our legal basis: Our legitimate interests to have an engaging product, and your consent wherever needed

What we do: Ensure that we meet all legal, regulatory, and contractual obligations

Our legal basis: We're legally obliged to do this

What we do: Provide customer support and handle complaints for our website

Our legal basis: Our legitimate interest to provide a fun, efficient, and functional service

What we do: Record and listen to telephone calls to and from our Customer Services department

Our legal basis: Our legitimate interest to train staff, ensure quality, and investigate issues

What we do: Send service messages to you, such as changes to our Services, Terms, or this Policy

Our legal basis: Necessary for the performance of a contract and legally required

What we do: Provide you with a personalized use of our Services

Our legal basis: Our legitimate interests to give each customer a quality tailored experience

What we do: Test, maintain, improve, and update existing products and services; develop and test new products and services

Our legal basis: Our legitimate interests in developing and improving our products and services

What we do: Monitor and maintain the security and functionality of our technical systems, including through bot-detection and fraud-prevention cookies

Our legal basis: Our legitimate interests to protect our systems, and your Personal Information

What we do: Detect and prevent crime, and respond to law enforcement requests as required by applicable law

Our legal basis: Necessary to comply with a legal obligation, and also in our legitimate interests to protect customers and ourselves from the impacts of crime

What we do: Detect and prevent improper use

Our legal basis: Our legitimate interests to ensure quality of service and provide an enjoyable experience for all players

What we do: Provide responsible gaming support

Our legal basis: Our legitimate interest in promoting responsible play, and in some cases a legal obligation under applicable gaming regulations

What we do: Evaluate or conduct a merger, divestiture, restructuring, or similar transaction

Our legal basis: Our legitimate interests in corporate transactions; Personal Information transferred as part of such a transaction remains subject to this Policy

What we do: If you download our mobile application, you will be provided the option to receive notifications and ‘push messages’

Our legal basis: Your consent. You can change your preferences at any time on your device

What we do: Confirm your physical location, including to verify jurisdictional eligibility to offer our games - see “Sensitive Personal Information” below

Our legal basis: Necessary to comply with a legal obligation, and our legitimate interests to comply with the spirit of laws prohibiting certain types of activity or application in certain jurisdictions

What we do: Deliver, measure, and improve advertising for our Services, including through Google advertising cookies and similar technologies described in our Cookie Policy for California Residents

Our legal basis: Your consent where required, and/or our legitimate interest in effective advertising. Where this activity constitutes a “sale” or “sharing” of Personal Information under California law, you have the right to opt out - see “Your Rights – United States: California” below.

Cookies and Similar Technologies

We and our service providers and advertising partners use cookies and similar technologies (such as pixels and tags) on the Sites. We use cookies for four purposes: to operate the Sites (Strictly Necessary), to provide enhanced functionality (Functional), to measure and improve performance (Performance), and to support advertising, including advertising delivered by Google, on other websites and platforms (Targeted Advertising). A full, current list of the specific cookies we use, organized by category, is set out in our Cookie Policy for California Residents, which forms part of this Policy.

You can control cookies through the preference center provided on the Sites (currently managed via OneTrust), which lets you view each category and switch Functional, Performance, and Targeted Advertising cookies on or off. Strictly Necessary cookies cannot be switched off, as the Sites cannot function properly without them.

Global Privacy Control and Other Opt-Out Preference Signals

1. We honor the Global Privacy Control (“GPC”) signal and other qualifying opt-out preference signals as a request to opt out of the sale and sharing of your Personal Information. We apply a GPC signal to the browser and device that sent it. See “Your Rights – United States: California” below for more detail.
2. A statement that the business processes opt-out preference signals in a frictionless manner;
3. Information on how consumers can implement opt-out preference signals for the business to process in frictionless manner. This means that the business shall not:

(i.) Charge a fee or require any valuable consideration if the consumer uses an opt-out preference signal.

(ii.) Change the consumer's experience with the product or service offered by the business. For example, the consumer who uses an opt-out preference signal shall have the same experience with regard to how the business's product or service functions compared to a consumer who does not use an opt-out preference signal.

(iii.) Display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial content in response to the opt-out preference signal.

Web Beacons

Web beacons (also known as pixel tags, clear gifs and single-pixel gifs) are tiny images on our Services and in our emails that help us understand whether our products, services, offers, and content are interesting and effective, including whether you've visited our Sites or opened an email we sent you.

Do-Not-Track Disclosures

Our Services don't recognize the browser “Do Not Track” signal, which is a different and separate signal from the Global Privacy Control described above. We do recognize and honor the Global Privacy Control as described in the Cookies section.

Sensitive Personal Information

We collect state-level location information that you provide directly to us at sign-up, and we may also use your IP address to approximate your general location. We use this information to verify that our games and promotions are made available only to individuals in jurisdictions where we are legally permitted to offer them, and to avoid sending marketing communications to individuals in ineligible jurisdictions. We may share this information with service providers who perform analytics on our behalf; these providers are contractually restricted from using this information for their own purposes. This information does not identify your location with the precision required to constitute "precise geolocation" under California law, and is not Sensitive Personal Information on that basis. We do not collect other categories of Sensitive Personal Information, such as information about your health, race, religion, or sexual orientation.

Social Media

We communicate with you through social media, and some of those sites are run by other companies like Facebook, Instagram, TikTok, and Snapchat. We are not responsible for how those companies process your Personal Information; they have their own privacy policies and we encourage you to read them.

Some of our Services allow you to share Personal Information with us that you've already given to a third-party social media site - for example, using your Facebook or Google account to log in. We also let you share or publicly post content from our Services to third-party social media sites.

Refer a Friend

In some locations we have a way for you to recommend us to your friends. If you use these tools, we'll ask you for some contact information about the other person, and we'll manage that information as described in this Policy.

Who We Share, Sell, and Disclose Your Personal Information

We share your Personal Information with others for a range of reasons. Some of the sharing you'll expect, like sharing content you post in public areas of our Services with other users. We also share your Personal Information with:

• our corporate parents, and within the Hard Rock group
• service providers
• identity verification agencies
• payment management or debt collection companies
• affiliates and partners
• marketing, advertising, and market access partners, including Google, for the advertising purposes described in our Cookie Policy for California Residents
• co-sponsor(s) of events or sweepstakes
• governmental agencies, regulatory authorities, and licensing bodies
• law enforcement agencies
• fraud prevention agencies
• organizations that introduce you to us
• third parties involved in a business transfer, sale, change, or dissolution
• third parties you permit us to share your data with

We also share non-personally identifiable Service Use Information (e.g. statistics or summaries) in a form that does not include your name or contact information.

Sale of Personal Information

In the preceding twelve (12) months, we have sold the following categories of Personal Information, through advertising cookies and pixels described in our Cookie Policy for California Residents:

• Category A: Identifiers
• Category F: Internet or other similar network activity

We sell this Personal Information to the following categories of third parties: advertising and marketing technology partners, including Google LLC.

Sharing of Personal Information for Cross-Context Behavioral Advertising

Separately from “sale,” in the preceding twelve (12) months we have shared the following categories of Personal Information with third parties for cross-context behavioral advertising, regardless of whether any payment was involved:

• Category A: Identifiers (including cookie and device identifiers)
• Category F: Internet or other similar network activity

We share this Personal Information with the following categories of third parties: advertising technology partners, including Google LLC, through the advertising cookies and pixels described in our Cookie Policy for California Residents.

Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, we have disclosed the following categories of Personal Information to a service provider or contractor for a business purpose:

Category A (Identifiers) - to operate and maintain the Sites (hosting, infrastructure, and security providers); to verify user identity and prevent fraud (identity verification and fraud-prevention providers); to provide customer support; and to measure and improve advertising effectiveness (analytics and advertising technology partners).

⦁Category B (California Customer Records) - to process payments and prevent transactional fraud (payment processors and fraud-prevention providers); and to verify identity when required.

⦁Category D (Commercial information) - to fulfill in-game purchases and manage transaction history; to provide customer support related to purchases; and to analyze product and service usage to improve our offerings.

⦁Category F (Internet or similar network activity) - to operate, secure, and improve the Sites (hosting, security, and analytics providers); to detect bots and prevent abuse; and to measure advertising performance.

⦁Category K (Inferences) - to personalize the user experience and deliver relevant content and marketing communications.

Advertising Cookies, Pixels, and Similar Technologies

We use advertising cookies - including Google advertising tags - to advertise our Services on other websites and platforms and to measure the effectiveness of that advertising. This may constitute a “sale” and/or “sharing” of Personal Information under the California Consumer Privacy Act. You have the right to opt out - see “Your Rights – United States: California” below and our Cookie Policy for California Residents. For information about third-party advertisers generally and how to limit their use of your information, visit Aboutads.info or Your Online Choices.

Categories of Personal Information Sold or Shared
In the 12 months preceding the "Last Updated" date of this Privacy Policy, we sold or shared the following categories of personal information with the following categories of third parties:

• Category of Personal Information: Identifiers (e.g., IP address, device/cookie identifiers) and Internet or other electronic network activity information
• Category of Third Party: Social media advertising platforms (including Meta Platforms, Inc.)
• Period: [start of 12-month lookback] through March 1, 2026

We discontinued this sharing as of March 1, 2026, and no longer use this third party's tracking technology on our site or app.

Your Rights

The rights you have over your Personal Information can depend on where you are. For more information, or to use any of your rights, please reach out to us using the details in the Contact Us section.

United States: California

This section is our Notice for California Residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”). Terms defined in the CCPA have the same meaning here. California residents have the following rights, subject to our records retention policies and applicable law.

Right to Know and Data Portability

You have the right to request that we disclose: what Personal Information we have collected about you including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.

Right to Delete

You have the right to request that we delete Personal Information we collected from you, subject to exceptions including where retention is necessary to complete a transaction, detect security incidents or fraud, debug the Sites, exercise free speech, comply with the California Electronic Communications Privacy Act, conduct permitted research, fulfil internal uses reasonably aligned with your expectations, or comply with a legal obligation.

Right to Correct

You have the right to request that we correct inaccurate Personal Information we maintain about you.

Right to Opt Out of Sale and Sharing

If you are 16 or older, you have the right to direct us not to sell or share your Personal Information at any time. We do not knowingly sell or share the Personal Information of consumers under 16 without affirmative authorization from the consumer (if 13–15) or a parent/guardian (if under 13). You may exercise this right by:

• Using the cookie preference tool on the Sites (managed via OneTrust), which lets you decline Targeted Advertising and Performance cookies
• Sending a Global Privacy Control (“GPC”) signal from a supporting browser or browser extension - we treat a valid GPC signal as a request to opt out of sale and sharing for the browser/device that sent it
• Emailing [email protected] or calling the number in the Contact Us section below

Right to Limit Use of Sensitive Personal Information

As explained in “Sensitive Personal Information” above, our use of Sensitive Personal Information is currently limited to a purpose permitted under California law and is not used to infer characteristics about you, so there is nothing further to limit at this time. If our practices change, we will update this Policy and, if required, provide a “Limit the Use of My Sensitive Personal Information” mechanism.

Non-Discrimination

You have a right not to receive discriminatory treatment for exercising any CCPA right. Unless permitted by law, we will not deny you goods or services, charge different prices or rates, or provide a different level or quality of goods or services because you exercised a CCPA right. We may offer CCPA-permitted financial incentives, which will reasonably relate to the value of your Personal Information and require your prior opt-in consent, revocable at any time.

Exercising Your Rights

To exercise any of the rights above, please submit a verifiable consumer request by:

• Emailing us at [email protected]

Only you, or someone legally authorized to act on your behalf, such as an authorized agent, may make a verifiable consumer request. You may also make a request on behalf of your minor child. You may make a request for access or data portability no more than twice within a 12-month period. Requests to know, delete or correct must provide sufficient information for us to reasonably verify your identity or authority, which may include your name, account information, mailing address, email address, and telephone number, along with a description of your request in sufficient detail for us to understand, evaluate, and respond to it.

We cannot respond to a request, or provide Personal Information, if we cannot verify your identity or authority, or confirm that the Personal Information relates to you. Making a request does not require you to create an account with us; however, we treat requests made through your password-protected account (if applicable) as sufficiently verified for information associated with that account. We only use information provided in a verifiable consumer request to verify identity or authority to make the request.

If an authorized agent is making a request on you behalf, we may ask the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to (1) verify your own identity directly with us or (1) directly confirm with us that you have provided the authorized agent permission to submit the request.

Response Timing and Format

We aim to respond to a verifiable consumer request within forty-five (45) days of receipt. If we need more time (up to 90 days total), we will tell you why and how much more time we need, in writing. Any disclosures we provide will cover only the 12-month period preceding the request, unless a longer period is requested and permitted by applicable law. We do not charge a fee to process a request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain why before completing the request.

Appealing Our Decision Regarding Your Personal Information Rights

Residents of the Commonwealth of Virginia have a right to appeal any decision we make regarding provision of their personal information rights. To exercise this appeal, please email [email protected] within a reasonable period following our decision, including any internal reference number and the reasons for your appeal. This is an appeals process; emails will not receive a response if the standard process was not used first or the required information is not included.

Data Deletion Requests

How to Delete Your Account and Data

If you wish to delete your account and associated data on the Sites, you can also do so through the account settings on the Sites, or by contacting our support team via live chat or by emailing us at [email protected]. Our support team will guide you through the process and ensure your data is deleted as requested.

Once you confirm the deletion, we will permanently remove your account and any associated personal data from our systems in a manner that complies with relevant laws and the requirements of any platform on which we operate. Please note that this action is irreversible. All deletion requests will be processed within 30 days.

Keeping You Up to Date

If you'd rather not receive marketing information from us, you can change your account preferences, click the opt-out link in a marketing email, or contact us using the details in the Contact Us section. It may take us a few days to fully process an opt-out, and you might still receive some messages during that time. If you'd like us to stop sharing your Personal Information with third parties for their own advertising purposes, contact us using the details below; to opt out with third parties who already have your information, please contact them directly. If you choose not to receive marketing, we will still contact you with information about your account, balance, and similar service-related matters.

Security

HRG, our partners, and our affiliates take reasonable physical, technical, and process steps to protect your Personal Information. However, we can never promise that your Personal Information will be absolutely safe. If we need to notify you of a security incident, we normally use email so we can let you know quickly. If you'd prefer we use the U.S. Postal Service instead, let us know using the details in the Contact Us section. You can also ask us for a free copy of any email alert we've sent you.

How Long We Keep Your Personal Information

We keep your Personal Information for as long as it takes to achieve the purposes explained in this Policy and to comply with applicable laws and regulations, such as accounting, insurance, and regulatory reporting requirements. Retention periods differ by category of information and purpose.

“Linked-To” Web Sites

Our Services contain links, banners, widgets, or advertisements that lead to other websites that we do not own or control. We're not responsible for these other websites; each will have its own privacy policy, and we encourage you to read them.

Your Choices

We sometimes share your Personal Information with other parts of the Hard Rock group. If we ever plan to use your information for something materially different from what we've already told you, or to share it outside our group or our service providers in a way not already described here, we'll let you know and give you a way to say no.

Changes to this Privacy Policy

This Policy will change from time to time. If a change is important, we'll actively inform you and ask for your consent where required. If a change isn't significant, we'll post the updated Policy on this page with a new “Last Updated” date. Please check back often.

Contact Us

If you have any questions or comments regarding our privacy practices, you can reach us using the details below:

• Website: hardrockgames.com
• Email: [email protected]
• Postal Address: 5440 S State Road 7, Davie, FL 33314
• Our DPO can be contacted directly at: [email protected]

Effective Date: August 3^rd, 2026