California HR Data Privacy Notice

FOR CALIFORNIA RESIDENTS ONLY

This HR Data Privacy Policy is effective as of January 1, 2023 and applies to residents of the State of California only.

This privacy policy, applicable to PLAYSTUDIOS, Inc. (“we”, “us”, “our”, and “PLAYSTUDIOS”), describes our processing of California residents’ personal information in various human resources (HR) contexts, as required under California’s privacy law, the California Consumer Privacy Act, which is also known as the “CCPA”.

If you are a California resident and have interacted with us or otherwise provided us with personal information in the following HR contexts in the bulleted lists below, please read this policy carefully as it describes how we collect, use, retain, disclose, and otherwise process your personal information, and the rights you have under California law as to your personal information.

• Current/Former Employees. You are a current or former employee of PLAYSTUDIOS.
• Independent Contractor. You are a current or former contractor of PLAYSTUDIOS.
• Job Applicant. You have applied to a position with PLAYSTUDIOS previously, such as through the portal linked at https://www.playstudios.com/careers/.

This privacy policy also applies to California residents whose family member or friend has provided information about you to PLAYSTUDIOS in an HR context, such as if:

You are listed as an emergency contact for a PLAYSTUDIOS employee or former employee.
You are a beneficiary or dependent of a PLAYSTUDIOS employee or former employee.

Importantly, this privacy policy does not apply to our data practices outside of the HR context. For example, if you visit the consumer-facing aspects of our websites (such as www.playstudios.com or www.playstudios.com/myvip) or play our games on certain social media platforms or our mobile applications, our privacy policy at https://www.playstudios.com/privacy-policy/ (or such other URL as PLAYSTUDIOS may provide and as may be amended from time to time) will apply, and describes our data practices in that context.

In the event of a conflict between any other PLAYSTUDIOS policy, statement or notice and this privacy policy, this privacy policy will prevail as to personal information collected in an HR context, unless stated otherwise.

• Section 1 of this privacy policy provides notice of our data practices, including our collection, use, and disclosure of California residents’ personal information in an HR context.
• Section 2 of this privacy policy provides information regarding California residents’ rights under the CCPA and how you may exercise them.
• Sections 3-5 include other information required by the CCPA or information that we believe is helpful to provide to you as part of this privacy policy.

1. Notice of Data Practices

As required by the CCPA, this privacy policy is designed to provide you with notice of our recent, historical data practices over the prior 12 months (from the Effective Date listed at the top of this privacy policy).

This privacy policy also applies to our current data practices such that it is also meant to provide you with notice of personal information we collect and the purposes for which we process personal information, among other things required by the CCPA. For any new or substantially different processing activities that are not described in this privacy policy, we will notify you as required by the CCPA, including by either notifying you at the time of collecting personal information, or by updating this privacy policy earlier than required.

(a) PI Collection and Retention

The first column in the table below lists the categories of personal information we collect, while the second column provides examples of types of personal information within such category. We collect the following categories of personal information listed in the below table. We disclose or otherwise make available personal information to our vendors, affiliates, and other parties for the purposes as more fully set forth in the table below. Generally, we disclose personal information for business purposes, and may be considered to “sell” and/or “share” certain categories of personal information to Cookie Operators, as more fully described in the “Cookies Settings” section where we describe your rights to opt out of the “sale” and “sharing” of personal information.

A screenshot of the Privacy Preference Center immediately follows this table.

The “Cookies Settings” section is where we describe your rights to opt out of the “sale” and “sharing” of personal information. Here is a screenshot of the Privacy Preference Center:

We also may disclose each category of PI and Sensitive PI in the table to the following categories of recipients in a manner that does not constitute Sale or Sharing:

• The Consumer or to other parties at your direction or through your intentional action
• The government or private parties to comply with law or legal process
• Assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business
• In addition, our Vendors and the other recipients listed in the below table may, subject to contractual restrictions imposed by us and/or legal obligations, also use and disclose your PI for business purposes. For example, our Vendors and the other categories of recipients listed in the table below may engage subcontractors to enable them to perform services for us or process for our business purposes.

Scope of PI: There may be additional information that we collect that meets the definition of PI under the CCPA but is not reflected by a category above, in which case we will treat it as PI as required, but will not include it when we describe our practices by category of PI.

Retention Details: The CCPA requires us to either disclose the length of time we intend to retain each category of personal information listed above, or if that is not possible, the criteria used to determine the period of time it will be retained. Because there are so many different types of personal information in each category, and so many purposes and use cases for different data, we have determined that it is not possible to disclose in a clear manner how long we intend to retain each category. The criteria for determining the retention period is whether we have a legitimate purpose for the retention consistent with the collection purposes and applicable law, and/or a legal obligation or right to retain the data. For instance, we may maintain business records for so long as relevant to our business, and/or may have a legal obligation to hold PI for so long as potentially relevant to prospective or actual litigation or government investigation.

(b) Sources of PI

We may collect your PI from a number of sources, including:

• You, such as when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data), or otherwise during the course of your employment or engagement
• Your devices and our equipment and systems
• From other personnel through interactions in the course of employment or engagement (e.g., performance reviews by your supervisor, information provided by a co-worker, etc.)
• From third parties (e.g., background check and vendors, references, job agencies), including third-party online services.
• Our affiliates
• If you are an emergency contact, beneficiary, or dependent, from your family member or friend who is employed by us

(c) Use of PI

Generally, we collect, retain, use, and disclose your personal information for HR business purposes and as otherwise related to the operation of our business. Our HR business purposes include the following:

• Recruitment
• Employee Intake/ Onboarding/ Offboarding
• Payroll, Reimbursements, and Timekeeping
• Benefits
• Employee activation initiatives and communications
• Training programs and education
• HR IT Systems and Security
• Employee and Performance Management
• Health & Safety/Occupational Health
• Security (including electronic and of premises)
• Other purposes disclosed at the time you provide your information or done at your direction

Additional business purposes that apply to our business more broadly, and that may apply in the HR context, include:

• Debugging
• Performing Services
• Providing Advertising & Marketing Services (e.g., to potential applicants regarding open positions)
• Quality Assurance
• Research and Development

The italicized business purposes in the list are those that are specifically defined in the CCPA. Our vendors may also use your PI for business purposes and may engage their own service providers or subcontractors to enable them to perform services for us.

2. Your HR Data Rights and How to Exercise Them

PLAYSTUDIOS provides California residents the privacy rights described in this section, pursuant to our obligations under the CCPA. To exercise your privacy rights, or, if you are an authorized agent of another exercising privacy rights on behalf of someone else, you can submit a request by emailing us at humanresources@playstudios.com.

Please respond to any follow-up inquiries we make, including in relation to the request verification process that we describe further below. Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media, etc.).

(a) Right to Know/Access

You can make “right to know” (also known as “access”) requests, as described below, up to twice in a 12-month period. For current employees, in addition to making a right to know/access request as described herein, you may be able to access information and, for certain systems and certain information, export your information, by logging in to Dayforce, etc. and accessing the information in your profile.

(1) Categories of Personal Information

You have the right to request that we share with you certain information to you about our collection, use and disclosure of your PI over the 12-month period prior to the request date. You can request that we disclose to you: (1) the categories of PI we collected about you; (2) the categories of sources for the PI; (3) our business or commercial purpose for collecting or selling that PI (i.e., if we have, in fact, sold PI); (4) the categories of third parties with whom we shared that PI; (5) a list of the categories of PI disclosed for a business purpose in the prior 12 months and, for each, the categories of recipients, or that no disclosure occurred; and (6) a list of the categories of PI sold about you in the prior 12 months and, for each, the categories of recipients, or that no sale occurred.

(2) Specific Pieces

You have the right to request a transportable copy of the specific pieces of personal information we collected about you in the 12-month period preceding your request. Please note that personal information is retained by us for various time periods, so there may be certain information that we have collected about you that we do not even retain for 12 months (and thus, it would not be able to be included in our response to you).

(b) Right to Limit Sensitive PI Processing

Certain personal information qualifies as “sensitive” under CCPA, which we refer to in this privacy policy as “Sensitive PI”. You have the right to direct businesses to limit their use and disclosure of Sensitive PI if we use or disclose it beyond certain internal business purposes. We do not believe we use or disclose Sensitive PI beyond such internal business purposes, and therefore, this does not apply to our processing of Sensitive PI.

(c) Do Not Sell / Share

You have the right to opt-out of the “sale” and “sharing” of your personal information, which are defined in the CCPA in ways that are different from their normal meanings as you may understand them. “Sale” of personal information includes “making available” of personal information to a third party, and “sharing” of personal information includes the “making available” of personal information to a third party for targeted advertising that is served based on an individual’s activity across different websites, applications, or services (defined in the CCPA as “cross-context behavioral advertising” and sometimes referred to as “interest-based advertising”). Neither concept requires money to be exchanged.

“Sales” and “sharing” of personal information may occur when third party operators of cookies and other tracking technologies (“Cookie Operators”) collect information on our websites that meet the definition of personal information. We understand that giving access to personal information on our websites to certain Cookie Operators could be deemed a “sale” and/or “sharing” under the CCPA. Therefore, we will treat such personal information (e.g., cookie ID, IP address, and other online IDs and internet or other electronic activity information) collected by Cookie Operators as such, except in circumstances where they are able to act as “service providers”, which are vendors that agree to process personal information pursuant to limited purposes.

As explained above, the categories of information that we may be considered to “sell” or “share” are “identifiers” (e.g., cookie ID, IP address, and other online IDs) and “internet usage information” categories when you visit our websites to apply for a job. As a reminder, for any activity on our websites and other digital services that are not in the HR context, please visit our general privacy policy here.

Below, we provide you instructions on how to opt-out of the activities we have just described that may constitute “sale” and “sharing”.

Our cookie management tool enables you to exercise an opt-out request of the Sale/Sharing of PI and enable certain cookie preferences on your device. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our cookie management tool. Please be aware that if you use ad blocking software, our cookie management tool and/or our cookie banner may not appear when you visit our website, and you may have to use the link above to access the tool.

The CCPA also requires us to state that we do not knowingly “sell” or “share” the PI of Consumers under 16.

(d) Opt-Out Preference Signals (also known as Global Privacy Control or GPC)

The CCPA requires businesses to process opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicates the individual’s choice to opt-out of the “sale” and “sharing” of personal information. The opt-out preference signal is also known as GPC. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC. Visit https://globalprivacycontrol.org/ for more information.

We are required by the CCPA to state the following: we do not (1) charge a fee for use of our website if you have enabled OOPS/GPC, (2) change your experience with our website if you use OOPS/GPC, or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the OOPS/GPC.

We process OOPS/GPC with respect to “sales” and “sharing” that may occur in the context of collection of personal information online by Cookie Operators, discussed above. As to HR data, we do not process OOPS/GPC for opt-outs of “sales” and “sharing” in any other context (e.g., offline data) because our “sale” and “sharing” activities, are limited to personal information collected online by Cookie Operators, as discussed above.

(e) Right to Delete

You have the right to request that we delete personal information that we collected directly from you. However, we may have retention rights or obligations that apply, such as for legal, security, or internal business purposes such as maintaining business records, which we will take into consideration when processing your request.

(f) Correct Your Personal Information

You have the right to request that we correct inaccuracies that you find in your personal information maintained by PLAYSTUDIOS. Your request to correct is subject to our verification (discussed below) and the CCPA’s response standards.

For current employees, in addition to making a request as described above, you may be able to correct certain information in Dayforce,etc. by logging and making the appropriate changes.

(g) Automated Decision Making/Profiling

We may engage in processing that constitutes automated decision-making or profiling under the CCPA. However, as of the Effective Date, the definitions of these concepts, and any associated opt-out and access rights have not been added to the updated CCPA and finalized.

(h) Non-Discrimination / No Retaliation

You have the right to not receive discriminatory treatment or be retaliated against for your exercise of your privacy rights. Accordingly, we will not discriminate or retaliate against you if you exercise your CCPA rights.

3. Verifying your requests, agent requests, and our responses

(a) Request Verification Process

As required by the CCPA, when you make a request, we will verify that you are the person you say you are, or, if you are seeking information on behalf of another person, that you are authorized to make the request on their behalf. In addition, we will compare the information you have provided to ensure that we maintain personal information about you in our systems. We may ask initially that you provide certain verifying information, such as your legal name, date of employment, and/or date of birth. We will review the information provided as part of your request, and may ask you to provide additional information via e-mail or other means as part of this verification process. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. The same verification process does not apply to opt-outs of ”sale” or “sharing”, or Limitation of Sensitive PI requests, but we may apply some verification measures if we suspect fraud.

The verification standards we are required to apply for each type of request vary:

We verify your categories requests and certain deletion and correction requests (e.g., those that are less sensitive in nature) to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. For certain deletion and correction requests (such as those that relate to personal information that is more sensitive in nature) and for specific pieces requests, we apply a verification standard of reasonably high degree of certainty. This standard includes matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you, and may include obtaining a signed declaration from you, under penalty of perjury, that you are the individual whose personal information is the subject of the request.

If we cannot verify you in respect of a certain requests, such as if you do not provide the requested information, we will still take certain action as required by the CCPA. For example:

• If we cannot verify your deletion request, we will refer you to this privacy policy for a general description of our data practices.
• If we cannot verify your specific pieces request, we will treat it as a categories request.

(b) Agent Requests

You may use an authorized agent to make a request for you, subject to our verification of (i) the agent, (ii) the agent’s authority to submit requests on your behalf, and (iii) of you. You can learn how to do this by emailing us at humanresources@playstudios.com. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable U.S. Privacy Laws.

(c) Our Responses

Some personal information that we maintain is insufficiently specific for us to be able to associate it with an individual (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that personal information in response to those requests. If we cannot comply with a request, we will explain the reasons in our response.

We will make commercially reasonable efforts to identify personal information that we maintain to respond to your requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with applicable U.S. Privacy Laws and our interest in the security of your PI, we will not deliver to you your Social Security number, driver’s license number, or other government-issued ID number, financial account number, any health or medical identification number, or an account password, security questions or answers, in response to a Consumer privacy rights request; however, you may be able to access some of this information yourself through Dayforce/our internal HR if you are still employed with us.

4. Our Rights and the Rights of Others

We may collect, use and disclose your PI as required or permitted by applicable law and this may override your rights and our obligations under the CCPA and as otherwise set forth in this privacy policy. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.

5. Contact Us

If you have any questions or concerns about our data practices, please contact us at humanresources@playstudios.com.

For current and former employees and other individuals who have interacted with us in an HR context, such as job applicants, please contact us at humanresources@playstudios.com.