PERSONAL DATA PROTECTION POLICY

This Personal Data Protection Policy ("Policy") is part of the Terms of Service Agreement for Users of GAMOTA's digital content services, setting out how we collect, receive, store, aggregate, process, use, disclose, and share the information of individuals ("Users") when accessing and using GAMOTA's products and services provided through websites, applications, and other available interactive channels.

This Personal Data Protection Policy may be adjusted and amended from time to time; Users should visit and check regularly to stay updated on the latest changes. GAMOTA reserves the right to amend, supplement, or adjust the terms of this Policy at any time by publishing updates on GAMOTA's official information channels and/or displaying them on GAMOTA's applications/products.

By continuing to use GAMOTA's products and services after the date on which changes to this Personal Data Protection Policy take effect, Users confirm their acceptance of the content of the amended and updated Policy.

In this Policy, "GAMOTA," "we," and "our" refer to Gamota Joint Stock Company.

GAMOTA respectfully informs Users of its latest Personal Data Protection Policy, issued by GAMOTA and effective from June 1, 2026.

This Policy includes the following contents:

• General provisions

• Definition of the types of personal data collected and processed

• Purposes of collecting and processing personal data

• Methods of collecting and processing personal data

• Methods of sharing personal data

• Unintended consequences and damages that may occur during the collection and processing of personal data

• Start and end time of personal data processing

• Rights and obligations of Users

• Contact methods

1. GENERAL PROVISIONS

By registering to use, using GAMOTA's products and services, entering into agreements, and/or allowing GAMOTA to use personal information and process Users' personal data, Users accept all provisions set out in this Personal Data Protection Policy.

GAMOTA will only collect, use, store, and process Users' personal data in accordance with: the 2025 Law on Personal Data Protection (including Decree No. 356/2025/ND-CP dated December 31, 2025 on personal data protection and any documents amending, supplementing, or replacing this Decree from time to time); this Personal Data Protection Policy; and other contracts and agreements between Users and GAMOTA. Where a User provides GAMOTA with the personal data of a third party (such as information of a spouse, child, and/or parent and/or guardian, friend, beneficiary, authorized person, partner, guarantor, emergency contact, legal representative, chief accountant, point of contact, shareholder, or other individual related to the User), the User represents and warrants that the User has provided such third party with full information about the content of this Personal Data Protection Policy and has obtained the lawful consent of that third party for GAMOTA to process such personal data for the purposes set out in this Personal Data Protection Policy. Users also understand that GAMOTA may rely on the User's representation that lawful consent of the third party has been obtained when the User provides the third party's personal data to GAMOTA.

Depending on GAMOTA's role in each specific situation — as (i) a personal data controller; (ii) a personal data processor; or (iii) a personal data controller and processor — GAMOTA will exercise the corresponding rights and obligations in accordance with applicable law.

GAMOTA notes that the collection and processing of Users' personal data is a necessary and sufficient condition for GAMOTA to be able to provide products and services to Users.

Gamota processes Users' personal data based on one or more of the following legal grounds:

1. The User's consent to the processing of personal data;

2. Data processing is necessary for the performance of a contract or agreement between Gamota and the User;

3. Data processing is necessary to comply with a legal obligation under the law;

4. Data processing is necessary to protect the legitimate interests of Gamota or a third party, provided it does not affect the User's lawful rights and interests;

5. Other cases as provided by relevant law.

2. TYPES OF PERSONAL DATA PROCESSED

In order for GAMOTA to fulfill Users' requests (including but not limited to requests to provide video game services and other products and services) and/or to provide a general overview of GAMOTA's products/utilities, GAMOTA and any personal data processor with whom GAMOTA has an agreement will need to use Users' personal data (including but not limited to the following activities: collecting, recording, analyzing, verifying, storing, editing, disclosing, combining, accessing, retrieving, withdrawing, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data, or other related actions).

The personal data used by Users may include sensitive personal data. The types of personal data that may be used are those listed below and may change depending on the time and the User's relationship with GAMOTA:

(i) Basic personal data:

• Full name;
• Date of birth;
• Gender;
• Contact address;
• Phone number;
• Email address;
• Personal photo/image;
• User account information on the Gamota system;
• Login information, account authentication information;
• Other information associated with a specific User or that helps identify a specific User.

(ii) Sensitive personal data:

• Transaction information on the Gamota system;
• Product/service usage history;
• Device data, IP address, cookies and similar tracking technologies, access logs, and activity data on the system;
• Payment information;
• Bank account information or other payment method information;
• Location data where the Customer uses services that require location tracking;
• Other personal data that the law requires to be kept confidential or to be subject to strict security measures.

(iii) And other personal data provided by Users to GAMOTA when registering to use products/services, as well as data generated during Users' use of GAMOTA's products/services.

3. PURPOSES OF COLLECTING AND PROCESSING PERSONAL DATA

Users agree to allow GAMOTA to collect and use Users' personal data and to share the results of personal data processing for the following purposes:

(i) Evaluating and providing GAMOTA's products/services and products/services that GAMOTA cooperates with partners to provide to Users;

(ii) Identifying, verifying, and maintaining accurate information for User identification; ensuring the security and safety of GAMOTA's information systems and other User due-diligence requirements in accordance with the law;

(iii) Supporting Users and updating User information when registering to use, or using, products/services provided by GAMOTA or GAMOTA's partners;

(iv) Performing obligations under contracts/agreements between GAMOTA and Users (if any);

(v) Assessing risk, analyzing trends, conducting statistics, and planning, including data processing and analysis for statistics, credit, and anti-money laundering purposes;

(vi) Detecting, preventing, and investigating crimes, attacks, or violations, including fraud, money laundering, terrorism, financing of the proliferation of weapons of mass destruction, bribery, corruption, or tax evasion;

(vii) Organizing introductions and trade promotion, market research, opinion polls, brokerage, product introductions, and advertising. Contacting Users, direct and indirect marketing of products/services to Users, and implementing promotional programs, gift exchanges, prize awards, and gift deliveries;

(viii) Recording Users' service usage credibility to help GAMOTA provide products/services to Users in the best possible way, as well as organizing frequent-user and loyal-user programs to bring Users the best consumer benefits;

(ix) Aggregating, analyzing, researching, and developing new products/services and providing suitable products/services to Users;

(x) Evaluating in order to improve and enhance the quality of products/services that GAMOTA provides to Users. Developing new features and products and supporting payment and financial solutions related to GAMOTA's services;

(xi) Verifying User information to secure the safety of Users' accounts in connection with requests to answer inquiries, trace transactions, and handle complaints.

(xii) Protecting or enforcing GAMOTA's lawful rights and interests, including the right to collect fees, and to recover and handle debts owed by Users on GAMOTA's system (if any).

Where a User has agreed to allow GAMOTA to use their personal data for marketing and advertising business purposes, the User agrees that GAMOTA has the right to market and introduce products in the following content, form, and frequency:

(i) Content: Marketing and introducing products of GAMOTA and its partners.

(ii) Method: Via advertising messages, notifications on GAMOTA's official websites and applications, or other methods in accordance with the law.

(iii) Form: GAMOTA sends directly to Users via cyberspace, devices, electronic means, or other forms in accordance with the law.

(iv) Frequency: In accordance with the law on advertising.

4. METHODS OF COLLECTING AND PROCESSING PERSONAL DATA

Users' personal data is collected and processed by GAMOTA in accordance with this Policy and for specific purposes. GAMOTA only collects and processes Users' personal data when there is a sufficient legal basis to do so, including but not limited to: based on the User's permission; based on the fact that the processing is necessary to perform an agreement with the User, or to protect the rights and interests of the User or other related parties; where required to ensure compliance with the law; or where there is reasonable cause to believe that such data is for the legitimate interests of GAMOTA or others, taking into account the rights, interests, and expectations of the User.

GAMOTA does not have a policy of providing Users' personal data to any third party for their own direct marketing purposes or any other purpose, unless GAMOTA has complied with the procedures permitted under data protection laws to do so lawfully.

Users' personal data may be collected and processed through the following methods:

(i) GAMOTA's digital content applications/products require the User to proactively fill in information and data for the purpose of creating an account and using such digital content applications/products.

(ii) Calls, messages, and/or other forms of contact from and/or to GAMOTA: including but not limited to recording of audio, video, whether automatic or active, etc.

(iii) Research, analysis, testing, survey, and development activities including but not limited to data analysis, surveys, product and service development, and/or creation of User profiles, etc.

(iv) In certain cases related to the use of a specific service and/or requiring the User's specific consent, GAMOTA will request the User's permission to use Personal Data, and such use will only be carried out after this permission has been obtained.

(v) Other methods in accordance with the law.

5. INFORMATION ABOUT ORGANIZATIONS AND INDIVIDUALS INVOLVED IN DATA PROCESSING; OTHER INDIVIDUALS AND ORGANIZATIONS RELATED TO THE PURPOSES OF PERSONAL DATA PROCESSING

To serve the User experience and to enable GAMOTA to carry out the purposes of using personal data set out in this Personal Data Protection Policy, Users agree that GAMOTA may share Users' personal data with the following organizations and individuals:

(i) providers of products and services to GAMOTA, including and without limitation information technology services, marketing services, market research services, training services, legal services, audit services, and shipping/delivery services;

(ii) consulting companies, auditors, law firms, and lawyers of GAMOTA;

(iii) payment service providers/payment intermediaries and e-commerce service providers for GAMOTA;

(iv) GAMOTA's employees and workers;

(v) GAMOTA's parent company, subsidiaries, and affiliated companies;

(vi) any individual, competent authority, or regulatory body, or any third party that GAMOTA is permitted or required to disclose to under the laws of any country, or under any other contract or commitment between the third party and GAMOTA;

(vii) any individual involved in enforcing or maintaining any right or obligation under the agreement(s) between the User and GAMOTA;

(viii) service providers to GAMOTA where sharing/disclosing data to them is necessary for GAMOTA to perform its obligations to the User;

(ix) third parties responsible for processing personal data under their contracts/agreements with GAMOTA, including research companies, survey companies, and rating agencies;

(x) competent State authorities;

(xi) parties to whom the User has consented, or to whom GAMOTA has a legal basis to share the User's personal data.

In certain necessary cases, Users' personal data may be stored or processed on server systems located outside the territory of Vietnam through information technology service providers or Gamota's partners.

Gamota commits that the cross-border transfer of personal data will be carried out in accordance with Vietnamese law on personal data protection, and will apply necessary security measures to protect Users' personal data.

In addition to the cases above, GAMOTA will not disclose Users' personal data to any other party unless:

(i) the User has given consent;

(ii) GAMOTA is required or permitted to disclose it under the law;

(iii) GAMOTA transfers its rights and obligations under the agreement(s) between the User and GAMOTA.

6. POTENTIAL UNINTENDED CONSEQUENCES AND DAMAGES

Gamota applies appropriate technical and organizational measures to protect Customers' personal data in accordance with the law and Gamota's internal security standards, to ensure that Users' personal data is not leaked, misused, used, or shared unintentionally.

Some potential unintended consequences and damages include but are not limited to: (a) hardware or software errors during data processing resulting in loss of Users' data; (b) security vulnerabilities beyond GAMOTA's control, or the system being hacked resulting in data leakage; (c) Users inadvertently leaking their own personal data due to: carelessness, being defrauded, or accessing websites/downloading applications containing malicious software; (d) natural disasters, etc.

GAMOTA advises Users to keep information related to their login name, account login password, OTP codes, etc. confidential and not to share such information with anyone else.

Users should safeguard their electronic devices during use, and should lock, log out, or exit their account on GAMOTA's website or application when not using the account.

In the event of an incident or a detected violation affecting Users' personal data, GAMOTA will immediately report the personal data protection violation to the competent State authority and make every effort to implement remedial measures to prevent further consequences.

7. TIME PERIOD OF PERSONAL DATA PROCESSING

Start time of personal data processing: From the time the User accepts this Personal Data Protection Policy, or at the time the User registers to use GAMOTA's products/services.

Users' personal data will be stored for the period necessary to carry out the data processing purposes set out in this Policy, except where:

• The law requires a longer storage period; or

• Storage is necessary to protect GAMOTA's lawful rights and interests.

End time of personal data processing: Until the time the User requests GAMOTA to terminate the processing of their personal data, or when GAMOTA no longer has any obligation to provide products/services to the User, or another period as provided by law.

8. RIGHTS AND OBLIGATIONS OF USERS

8.1 As the data subject, Users have the following rights: (i) the right to be informed; (ii) the right to consent; (iii) the right to access; (iv) the right to withdraw consent; (v) the right to request deletion of data; (vi) the right to restrict data processing; (vii) the right to provide data; (viii) the right to object to data processing; (ix) the right to complain, denounce, and initiate lawsuits; (x) the right to request compensation for damages; (xi) the right to self-protection and other related rights in accordance with the law.

8.2 To the extent permitted by law, Users may exercise their rights by: (i) taking direct action on GAMOTA's website/application/product/service, or (ii) contacting GAMOTA using the information provided in detail in Section 9 below. GAMOTA will carry out lawful and valid requests from Users within the timeframe prescribed by law from the time a valid request is received from the User.

8.3 Where a User withdraws their consent to the processing of personal data, requests deletion of data, or exercises other related rights with respect to any or all of the User's personal data, such actions may: (i) affect the legal validity of the contract or legal relationship between GAMOTA and the User; (ii) result in GAMOTA's products/services to the User being limited, restricted, suspended, or cancelled depending on the case. Such a change may result in costs or damages that the User and/or a third party will have to bear.

GAMOTA will continue to use the User's personal data to the extent still required (if any) or as provided by law.

8.4 Obligations of Users:

(i) To comply with the law, this Personal Data Protection Policy, and GAMOTA's regulations and guidance relating to the processing of Users' personal data.

(ii) To provide complete, truthful, and accurate personal data and other information as requested by GAMOTA when registering for and using GAMOTA's products/services, and whenever such information changes. GAMOTA will secure Users' personal data based on the information the User has registered; accordingly, if any information is inaccurate, GAMOTA will not be responsible where such information affects or limits the User's rights and interests. If the User fails to notify GAMOTA of a change and any risk or loss arises, the User shall be responsible for any errors or fraudulent/abusive conduct arising from service use due to their own fault, or due to failure to provide correct, complete, accurate, and timely updates to their information; including financial damages and costs arising from incorrect or inconsistent information provided.

(iii) To cooperate with GAMOTA, competent State authorities, or third parties in the event of issues affecting the User's personal data.

(iv) To self-protect their personal data; to proactively apply measures to protect their own personal data while using GAMOTA's products/services; to promptly notify GAMOTA upon discovering errors or mistakes in their personal data, or upon suspecting that their personal data is being compromised.

(v) To be solely responsible for information, data, and consents that the User creates or provides in the online environment; to be solely responsible in the event that personal data is leaked or compromised due to the User's own fault.

(vi) To regularly stay updated on GAMOTA's Personal Data Protection Policy and regulations as notified to Users from time to time or posted on GAMOTA's official information channels or product/service applications. To take actions as instructed by GAMOTA to clearly indicate full consent, partial consent, conditional consent, or non-consent to the purposes of personal data processing that GAMOTA notifies to Users from time to time.

(vii) To respect and protect the personal data of others.

(viii) Other obligations as provided by law.

9. HOW TO CONTACT GAMOTA

To exercise their rights, or whenever they wish to communicate with GAMOTA regarding the content of this Personal Data Protection Policy, Users are kindly requested to contact GAMOTA through one of the following methods:

(i) Customer Support Hotline 19006855 (from 8:00 AM to 10:00 PM daily)

(ii) Customer Support System at: https://support.gamota.com/tickets.php

(iii) Zalo OA GAMOTA

(iv) Official Fanpage: https://www.facebook.com/nph.gamota

(v) Customer Support Email: cskh@gamota.com

10. DEVICE ACCESS PERMISSIONS AND PROCESSING OF IMAGE, AUDIO, AND AUGMENTED REALITY (AR) DATA

10.1. Principles for requesting access permissions

In the course of providing Gamota's services, Gamota may request that Users grant certain access permissions to system features on their devices. Users have full discretion to consent to or decline these requests. Declining to grant permission may render certain auxiliary features unavailable, but this is committed not to affect access to, or the experience of, the Service's core functions.

10.2. Scope and purpose of device data collection

With the User's consent, Gamota will access the following permissions for the purpose of optimizing the Service experience:

• Camera & Photo Album: Used for QR code scanning, taking profile photos, saving screenshots, or uploading images to the interactive system.

• Microphone: Used for voice chat features, direct voice calls, or participating in in-game livestream broadcasts.

• Location: Used for the feature of displaying and searching for nearby players (if supported by the game feature).

10.3. Permission revocation mechanism and effect

Users may proactively turn off or reconfigure these access permissions at any time in their device's system settings (iOS/Android). Disabling a permission is equivalent to withdrawing consent to provide such data to Gamota; however, this will not affect the lawfulness of data processing activities carried out before the time of revocation.

10.4. Special provisions

When a User uses a device that supports depth-sensing cameras (such as an iOS device with TrueDepth capability, or equivalent Android devices) and consents to enable the camera to experience AR features, Gamota will receive a small amount of facial expression characteristic data in order to map (synchronize) expressions onto the in-game virtual character.

Information security commitment: Gamota confirms that it does not access or collect any core biometric identification information (including Face ID) from the device. All expression data received via the TrueDepth API is temporary in nature, cannot identify any individual, will be immediately deleted from temporary memory, and will not be stored in any form (including cache or cloud storage); sharing this data with any third party is strictly prohibited.

Where a User only projects a virtual character or virtual setting onto real space through the camera without pressing the save/capture button, Gamota does not collect any image information from the User's device whatsoever.