Privacy Policy

SeaPop Entertainment respects the privacy and personal information of the people who interact with us.

This Global Privacy Policy ("Privacy Policy") explains how SeaPop collects, uses, stores, shares, protects, transfers, and otherwise processes personal information in connection with SeaPop websites, domains, subdomains, memberships, fan clubs, accounts, stores, events, promotions, digital platforms, communications, applications, services, and other interactions with SeaPop (collectively, the "Services").

Depending on the applicable Service, personal information may be processed by SeaPop Entertainment DOO, Republic of Serbia, and/or SeaPop Entertainment LLC, United States of America, and their respective parents, subsidiaries, affiliates, successors, assigns, labels, imprints, production companies, rights-holding entities, and other controlled SeaPop businesses where applicable (collectively, "SeaPop," "we," "our," or "us").

The SeaPop entity responsible for a particular Service or transaction may be identified at the point where personal information is collected, in the relevant registration or checkout process, in a service-specific notice, or in another applicable agreement.

This Privacy Policy is intended to provide a global privacy framework, including for users in the Republic of Serbia and the United States of America, while also accommodating additional privacy rights that may apply to users in the European Union, European Economic Area, United Kingdom, and other jurisdictions.

1. Scope of this Privacy Policy

This Privacy Policy applies when you:

• visit a SeaPop website; create an account; join a SeaPop membership or fan club; subscribe to communications
• purchase merchandise, tickets, music, memberships, or services; attend or register for a SeaPop event
• participate in a promotion, contest, giveaway, or campaign; communicate with SeaPop; submit a licensing or business inquiry
• interact with a SeaPop digital platform; participate in an authorized artist or fan experience; use private or restricted-access SeaPop content
• interact with SeaPop through social-media integrations; or otherwise provide personal information to SeaPop

Separate or supplemental privacy notices may apply to specific Services.

If a supplemental notice conflicts with this Privacy Policy regarding a particular processing activity, the more specific notice will govern that processing activity.

2. What is personal information?

For purposes of this Privacy Policy, "personal information," "personal data," and similar terms mean information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked directly or indirectly to an individual or household where applicable law defines it that way.

Personal information may include information that directly identifies you as well as identifiers, device information, behavioral information, location information, account information, or other information capable of being associated with you.

3. Information we may collect

Depending on how you interact with SeaPop, we may collect the categories described below.

3.1 Identity and contact information

This may include first name; last name; display name; username; email address; telephone number; mailing address; billing address; country; region; city; preferred language; and other contact information you provide.

4. Account information

If you create an account, we may process information such as:

• username; account identifier; authentication information; encrypted or hashed password information
• account status; membership status; account preferences; login history; authentication events
• device information; security settings; account recovery information; multifactor-authentication information; one-time authentication tokens; and related account records

We generally seek to avoid storing passwords in readable form.

5. Age and eligibility information

Certain Services may be limited according to age, location, membership type, event eligibility, or other requirements.

We may therefore collect date of birth; year of birth; age or age range; age-verification result; confirmation that a user meets an age requirement; parental or guardian authorization; or other information reasonably necessary to determine eligibility.

Where possible, SeaPop may use age-assurance methods that minimize the amount of personal information retained.

6. Parent and guardian information

Certain SeaPop Services involving minors may require information concerning a parent, guardian, responsible adult, or authorized accompanying person.

Such information may include name; relationship to the minor; email address; telephone number; consent status; authorization records; communication records; and information reasonably necessary to confirm permission or eligibility.

SeaPop may communicate directly with parents or guardians where required for safety, authorization, event administration, legal compliance, or account management.

7. Emergency and event-safety information

For certain physical events or experiences, SeaPop may collect information reasonably necessary to protect participants and administer the event safely.

This may include emergency-contact name; emergency-contact telephone number; relationship to the participant; attendance status; check-in and check-out information; ticket information; access credentials; chaperone or guardian information; safety-related communications; and other information reasonably necessary for event administration or emergency response.

If you provide another person's contact information, such as an emergency contact, you should have authority to provide that information and should inform that person where appropriate.

SeaPop may contact that person when reasonably necessary for the purpose for which the information was provided.

8. Transaction and purchase information

If you purchase something from SeaPop, we may process purchase history; products or services purchased; transaction amount; currency; billing information; shipping information; order number; refund information; transaction status; subscription status; payment-provider identifiers; and related accounting records.

Payment-card information may be processed directly by third-party payment processors.

SeaPop should not receive or retain complete payment-card information where it is unnecessary for SeaPop to do so.

9. Fan club and membership information

If you participate in a SeaPop fan club or membership program, we may process information relating to:

• membership status; membership level; membership start and expiration dates; account eligibility
• benefits used; event eligibility; ticket or access entitlements; merchandise benefits; discount eligibility
• digital-access credentials; community access; member communications; and participation history

Membership information may be used to determine whether you are permitted to access restricted SeaPop benefits or environments.

10. Event and ticketing information

For events, concerts, fan experiences, meet-and-greets, private events, or other experiences, we may process ticket information; event registration; attendance; check-in and check-out; seating or access area; entry credentials; QR codes or other digital credentials; guardian or chaperone information; event communications; security incidents; and records necessary to administer the event.

11. Location information

SeaPop may infer an approximate location from information such as an IP address.

Certain Services may also request more precise location information when a location-based feature requires it.

Where precise location information is collected, SeaPop will seek any consent required by applicable law and will process the information only for disclosed and lawful purposes.

We do not interpret the installation or use of a SeaPop Service as unlimited permission to track a user's location.

12. Communications

When you communicate with SeaPop, we may retain emails; customer-support inquiries; licensing inquiries; business correspondence; messages; complaints; requests; responses; survey responses; and other communications.

We may also retain metadata concerning those communications where reasonably necessary.

13. Marketing preferences

We may maintain information concerning newsletter subscriptions; promotional-message consent; communication preferences; unsubscribe requests; suppression lists; preferred channels; language preferences; areas of interest; and similar marketing information.

SeaPop will honor legally valid unsubscribe and withdrawal-of-consent requests.

14. Device and technical information

When you use a SeaPop Service, technical information may be collected automatically. This can include:

• IP address; browser type; browser version; operating system; device type; device identifiers; language settings
• referring URL; pages viewed; session information; time and date information; network information
• crash information; diagnostic information; authentication records; and security logs

15. Cookies and similar technologies

SeaPop may use cookies; pixels; tags; local storage; session storage; software development kits; authentication tokens; analytics technologies; anti-fraud technologies; and similar technologies.

These technologies may be used for:

• authentication; security; fraud prevention; remembering preferences; maintaining sessions
• measuring website performance; understanding use of the Services; improving functionality
• measuring campaigns; and, where permitted, advertising

Where applicable law requires consent before placing or accessing non-essential technologies, SeaPop will seek that consent.

A separate Cookie Notice or cookie-preference interface may provide additional details.

16. Social media

If you interact with SeaPop through social media or connect a social-media account with a SeaPop Service, we may receive information permitted by the applicable platform and your settings.

This may include account name; username; profile information; public interactions; comments; engagement information; and information you expressly authorize the platform to provide.

Social-media platforms independently process personal information under their own terms and privacy policies.

17. Photographs, audio and video at events

SeaPop events may be photographed, filmed, livestreamed, recorded, or otherwise documented where appropriate.

Depending on the event and applicable law, recordings may capture image; likeness; voice; performance; attendance; and interactions occurring at the event.

Where specific consent or notice is legally required, SeaPop will seek that consent or provide that notice.

Separate appearance releases may apply to participants who are intentionally featured in productions or promotional materials.

18. Sensitive personal information

Certain information may be treated as sensitive under applicable privacy law.

Depending on the Service, this may include precise geolocation; government-issued identification information; account-access credentials; payment-related information; biometric information; information concerning minors; or other information classified as sensitive by applicable law.

SeaPop will seek to collect sensitive information only when reasonably necessary for a legitimate, disclosed purpose and will apply additional protections where required.

19. Biometric information

SeaPop does not treat an ordinary photograph, video, or recording as permission to create biometric identifiers.

If SeaPop introduces technology that processes biometric information for purposes such as uniquely identifying or authenticating an individual, SeaPop will provide additional notice and obtain consent where legally required before doing so.

Biometric information will not be collected merely because the technology to collect it exists.

20. How we collect information

SeaPop may collect personal information:

Directly from you

For example, when you create an account, purchase something, register for an event, communicate with us, or join a membership.

Automatically

For example, through cookies, server logs, security systems, or similar technologies.

From a parent, guardian, or authorized person

For example, where an adult provides information concerning a minor or event participant.

From service providers

For example, payment, ticketing, authentication, communications, analytics, fraud-prevention, or fulfillment providers.

From social-media or platform partners

Where you interact with SeaPop through those services and disclosure is permitted.

From business partners

Where authorized and lawful.

From publicly available sources

Where the information may lawfully be collected and used for the relevant purpose.

21. Why we use personal information

SeaPop may process personal information to:

• operate the Services; provide requested products or services; create and maintain accounts; authenticate users
• administer memberships; administer fan-club benefits; process purchases; process subscriptions; deliver merchandise
• administer tickets; operate events; verify eligibility; communicate with members; provide customer support
• process licensing inquiries; communicate concerning business matters
• prevent fraud; maintain cybersecurity; protect accounts; investigate abuse; enforce our Terms; protect intellectual property
• maintain records; comply with law; respond to lawful governmental requests; establish or defend legal claims
• understand Service performance; improve Services; personalize permitted experiences; administer promotions; conduct analytics
• send marketing where permitted; and protect the safety of SeaPop users, artists, personnel, contractors, event participants, and the public

22. Legal bases for processing

Where applicable law requires SeaPop to identify a legal basis for processing, SeaPop may rely upon one or more of the following.

Contract

Processing may be necessary to perform an agreement with you or take steps at your request before entering into an agreement.

Examples include operating a paid membership, processing an order, providing tickets, or maintaining an account.

Consent

We may rely upon your consent when appropriate.

Examples may include certain marketing communications, non-essential cookies, precise-location functionality, or specific uses of sensitive information.

Where processing relies on consent, you may withdraw that consent subject to applicable law.

Legitimate interests

SeaPop may process personal information when necessary for legitimate business interests that are not overridden by applicable privacy rights.

These interests may include operating and improving Services; cybersecurity; fraud prevention; account security; audience measurement; protecting intellectual property; preventing misuse; business administration; and defending legal rights.

Legal obligation

SeaPop may process information when required to comply with applicable law, accounting requirements, tax requirements, regulatory requirements, court orders, or legally valid government requests.

Protection of individuals

Where permitted by law, information may be processed where reasonably necessary to protect someone's life, health, safety, or other vital interests, including certain emergencies.

Legal claims

Information may be retained or used where reasonably necessary to establish, exercise, or defend legal claims.

23. Data minimization

SeaPop seeks to collect personal information that is adequate, relevant, and reasonably necessary for the purpose for which it is processed.

The existence of a technical capability to collect information does not mean SeaPop should collect it.

Where practical, SeaPop may use less-identifying alternatives such as age ranges, eligibility confirmations, tokens, pseudonymous identifiers, or other privacy-preserving mechanisms.

24. How we share personal information

SeaPop may disclose personal information to the categories described below where necessary and lawful.

SeaPop affiliates

Information may be shared among SeaPop entities where necessary to operate the business and provide the applicable Service.

Service providers and processors

We may use companies that provide web hosting; cloud infrastructure; account authentication; cybersecurity; email; communications; payment processing; analytics; customer relationship management; customer support; ticketing; event administration; fulfillment; shipping; databases; fraud prevention; accounting; legal services; and other infrastructure.

Such providers may process information only as permitted under applicable agreements and law.

Professional advisers

Information may be provided where necessary to lawyers, accountants, auditors, insurers, consultants, and similar advisers.

Government and legal authorities

Information may be disclosed where required by law, legal process, regulation, court order, or other legally valid authority.

Business transactions

Information may be transferred as part of a merger; acquisition; financing; investment; restructuring; reorganization; sale of assets; insolvency; or other legitimate corporate transaction, subject to applicable legal requirements.

Safety and rights protection

SeaPop may disclose information where reasonably necessary to investigate fraud, protect users, prevent harm, enforce rights, protect intellectual property, or maintain security.

25. Sponsors and commercial partners

SeaPop may work with sponsors, advertisers, promotional partners, or other commercial partners.

The existence of a sponsorship relationship does not automatically mean that the sponsor receives SeaPop members' personal contact information.

If SeaPop proposes to provide personal information to a sponsor or partner for that party's own independent marketing purposes, SeaPop will provide any notice, choice, opt-in, or consent required by applicable law.

Aggregated or de-identified information that does not identify an individual may be used for sponsorship reporting, audience measurement, commercial planning, and similar legitimate purposes.

26. Sale and sharing of personal information

SeaPop does not interpret ordinary payments for its products or services as the "sale" of personal information.

SeaPop may use analytics, advertising, or marketing technologies in circumstances where particular privacy laws define certain disclosures as a "sale," "sharing," targeted advertising, or cross-context behavioral advertising even when no money is exchanged for the information.

Where SeaPop conducts activities legally classified in this manner, SeaPop will provide the legally required disclosure and opt-out or opt-in mechanisms.

Where required by applicable law, SeaPop will recognize valid browser-based opt-out preference signals, including a legally recognized Global Privacy Control (GPC) signal.

27. Advertising

SeaPop may advertise its artists, music, events, memberships, products, and Services.

Advertising may include contextual advertising; audience measurement; campaign attribution; retargeting; interest-based advertising; or other advertising practices.

Where applicable law requires consent or provides an opt-out right, SeaPop will provide the required choice.

28. Information concerning minors

SeaPop recognizes that information concerning minors deserves additional protection.

Certain SeaPop programs may be specifically designed for teenagers while others may be intended for adults or a general audience.

Age requirements will be disclosed for relevant Services.

SeaPop may use age-screening or age-assurance mechanisms where reasonably necessary.

29. Children under 13 — United States

SeaPop does not knowingly permit children under thirteen (13) to provide personal information through a general-audience SeaPop online Service except where the collection and processing comply with applicable children's privacy law.

Where the United States Children's Online Privacy Protection Act and its implementing rules ("COPPA") apply, SeaPop will take measures required by applicable law, which may include:

• providing appropriate notice; obtaining verifiable parental consent
• limiting collection; limiting disclosure; protecting children's information
• providing parental rights; and deleting information when it is no longer reasonably necessary

If SeaPop discovers that personal information has been collected from a child under thirteen in circumstances where legally required parental authorization was not obtained, SeaPop may delete, restrict, or otherwise appropriately process that information.

Parents or guardians may contact legal@seapop.art.

30. Users aged 13 to 17

SeaPop may operate Services appropriate for teenage users.

Depending on applicable law, SeaPop may require parental or guardian authorization; restrict certain features; limit advertising; limit profiling; restrict data sharing; apply heightened security; provide special notices; or use additional safeguards.

Where a jurisdiction requires affirmative permission before selling, sharing, or otherwise processing a minor's personal information for specified purposes, SeaPop will comply with those requirements.

31. Parental rights

Where applicable law grants rights to a parent or guardian concerning a minor's information, the parent or guardian may request appropriate access, correction, deletion, withdrawal of consent, or other legally available action.

SeaPop may require reasonable verification of parental or guardianship status before granting access to information concerning a minor.

This is intended to protect the minor from unauthorized disclosure.

32. Serbia — data protection rights

Where the Serbian Law on Personal Data Protection applies, individuals may have rights including, subject to applicable conditions and exceptions:

• the right to receive information about processing; the right of access; the right to correction; the right to deletion
• the right to restriction of processing; the right to data portability where applicable
• the right to object to certain processing; the right to withdraw consent; and rights concerning certain automated decisions

Individuals may also have the right to submit a complaint to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

SeaPop encourages individuals to contact us first where they believe an issue can be resolved directly.

Privacy requests may be sent to legal@seapop.art.

33. European Union and European Economic Area

Where the GDPR applies, a data subject may have rights including access; rectification; erasure; restriction; portability; objection; withdrawal of consent; and rights concerning certain automated decision-making.

Individuals may also have the right to lodge a complaint with the competent supervisory authority.

These rights are subject to applicable legal conditions and exceptions.

34. United Kingdom and other European jurisdictions

Where applicable United Kingdom, Swiss, or other European data-protection laws apply, SeaPop will provide the rights and protections required by those laws.

35. United States state privacy rights

Residents of certain U.S. states may have statutory privacy rights depending on the law and whether SeaPop is subject to that law. These rights may include:

• confirming whether SeaPop processes personal information; accessing personal information; obtaining copies of information
• correcting information; deleting information; data portability
• opting out of sale; opting out of targeted advertising; opting out of certain profiling
• limiting certain sensitive-information processing; and appealing certain denied privacy requests

SeaPop will provide rights required by applicable state law.

36. California privacy rights

If SeaPop is subject to the California Consumer Privacy Act, as amended ("CCPA"), California residents may have rights including:

• the right to know what personal information is collected; the right to request access to personal information
• the right to request deletion; the right to request correction
• the right to opt out of the sale or sharing of personal information
• the right to limit certain uses and disclosures of sensitive personal information
• and the right not to receive unlawful discriminatory treatment for exercising privacy rights

California residents may also use an authorized agent where permitted by law.

SeaPop may take reasonable steps to verify applicable privacy requests.

37. California minors

Where the CCPA applies, SeaPop will comply with applicable opt-in requirements concerning the sale or sharing of personal information of users SeaPop knows are under sixteen (16).

SeaPop will apply heightened protections to information concerning minors where required.

38. Global Privacy Control

Where legally required, SeaPop will treat a valid Global Privacy Control or other legally recognized opt-out preference signal as an applicable request to opt out of sale or sharing.

Users may still have additional privacy choices available through SeaPop's privacy interface.

39. How to exercise privacy rights

Privacy requests may be submitted to legal@seapop.art.

The request should identify the right you wish to exercise and provide sufficient information for SeaPop to locate the relevant records.

SeaPop may need to verify your identity before fulfilling certain requests.

SeaPop will not request more verification information than reasonably necessary for the request.

40. Authorized agents

Where applicable law permits a person to use an authorized agent, SeaPop may request reasonable evidence that the agent has authority to act on the person's behalf.

SeaPop may also ask the individual to verify their identity directly where permitted.

41. Non-discrimination

SeaPop will not unlawfully discriminate against an individual for exercising a privacy right.

This does not prevent SeaPop from offering lawful loyalty, membership, fan-club, promotional, or other programs where different benefits are legitimately associated with participation and the program complies with applicable law.

42. Marketing communications

SeaPop may send marketing communications where legally permitted.

Users may unsubscribe using an unsubscribe mechanism contained in the communication or another method SeaPop provides.

Withdrawal from marketing communications does not prevent SeaPop from sending necessary transactional or administrative messages, including purchase confirmations; security alerts; account notices; membership notices; event information; legal notices; or other non-marketing communications.

43. Email, messaging and other communication channels

Depending on the Services offered and the user's choices, SeaPop may communicate through email; messaging services; push notifications; social-media systems; or other communication technologies.

Consent and opt-out requirements will be followed where applicable.

Communications provided through third-party messaging platforms may also be processed by the platform provider under its own privacy practices.

44. Automated systems and profiling

SeaPop may use automated systems for purposes such as spam detection; fraud detection; account security; content moderation; analytics; audience segmentation; recommendations; membership administration; and system protection.

Where applicable law provides rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, SeaPop will honor those rights.

SeaPop may provide additional notice concerning particular automated systems when legally required.

45. Artificial intelligence

SeaPop may use artificial-intelligence-assisted technologies for legitimate operational purposes such as security; fraud detection; customer support; moderation; analytics; translation; workflow assistance; and improving Services.

Personal information will remain subject to this Privacy Policy when processed through AI-assisted systems.

SeaPop will not treat the existence of AI technology as an independent legal basis for collecting or using personal information.

Where a materially different AI-related use requires additional notice, consent, or another legal basis, SeaPop will provide it.

46. No undisclosed public AI training

SeaPop does not interpret a user's interaction with SeaPop as permission to publish that user's private personal information or intentionally contribute it to a publicly available general-purpose AI training dataset.

If SeaPop proposes a materially different use of personal information for model training that requires consent or additional disclosure under applicable law, SeaPop will provide the required notice or obtain the required permission.

47. De-identified and aggregated information

SeaPop may create aggregated, statistical, anonymized, or de-identified information where permitted by law.

For example, SeaPop might determine total membership numbers; geographic distribution of an audience; attendance totals; aggregate demographic ranges; campaign performance; product demand; or Service usage trends.

Where information has been effectively de-identified, SeaPop will not intentionally attempt to re-identify it except where permitted for legitimate security, testing, or legal purposes.

48. Data security

SeaPop uses administrative, organizational, contractual, and technical safeguards designed to protect personal information. Depending on the system, these safeguards may include:

• access controls; authentication; encryption; encrypted transport; password hashing; multifactor authentication
• network security; logging; monitoring; role-based permissions; backups
• vulnerability management; fraud detection; vendor controls; and incident-response procedures

Access to personal information should be limited to persons and service providers who reasonably require it for authorized purposes.

No internet-based system can be guaranteed to be completely secure.

49. Security incidents and data breaches

If SeaPop becomes aware of a personal-data security incident, SeaPop may investigate the incident; contain the incident; mitigate harm; preserve relevant evidence; secure affected systems; involve appropriate cybersecurity professionals; and take corrective action.

Where applicable law requires notification to individuals, regulators, supervisory authorities, law enforcement, or others, SeaPop will provide required notifications.

50. Data retention

SeaPop does not intend to retain personal information indefinitely merely because storage is available. Retention depends on factors such as:

• the purpose for which information was collected; whether an account remains active; membership duration
• transaction requirements; event-administration needs; safety requirements; contractual obligations
• accounting requirements; tax requirements; applicable limitation periods
• fraud-prevention needs; cybersecurity requirements; legal obligations; regulatory requirements
• litigation; disputes; and legitimate recordkeeping requirements

When information is no longer reasonably necessary and no lawful basis requires continued retention, SeaPop may delete, anonymize, aggregate, or otherwise securely dispose of it.

Information relating to children and minors will be subject to any additional retention limitations required by applicable law.

51. Account deletion

Where SeaPop provides user accounts, users may request account deletion subject to legal and operational exceptions.

Deleting an account does not necessarily require immediate deletion of every record.

SeaPop may retain information necessary for transactions; accounting; fraud prevention; security; dispute resolution; legal claims; enforcement; or compliance with law.

Information retained for these purposes will remain subject to applicable privacy protections.

52. International data transfers

SeaPop operates across jurisdictions.

Personal information may therefore be processed in countries other than the country where it was originally collected, including transfers between Serbia, the United States, and other jurisdictions in which SeaPop or its service providers operate.

Different countries may have different data-protection laws.

Where applicable law requires safeguards for an international transfer, SeaPop will use an appropriate lawful transfer mechanism.

Depending on the circumstances, these safeguards may include adequacy mechanisms; standard contractual clauses; approved contractual provisions; contractual safeguards; consent where legally appropriate; or another legally recognized transfer mechanism.

53. Service provider security

SeaPop may evaluate service providers based on factors such as security practices; privacy practices; contractual protections; technical capabilities; data-processing terms; access controls; and the sensitivity of information processed.

Where required, service providers will be contractually restricted concerning their use of personal information.

54. Links to third-party services

SeaPop Services may link to third-party websites or platforms.

SeaPop does not control the privacy practices of independent third parties.

Users should review the privacy policies of those services before providing them with information.

55. Business transfers

If SeaPop undergoes a merger, acquisition, restructuring, financing, investment, sale, transfer, or similar transaction, personal information may be included among transferred business assets where legally permitted.

Any recipient will remain subject to applicable privacy-law obligations.

Where legally required, affected individuals will receive appropriate notice.

56. Legal requests

SeaPop may preserve or disclose information where SeaPop reasonably believes disclosure is required or permitted by applicable law.

This may include responding to court orders; subpoenas; warrants; regulatory demands; legally valid government requests; or emergencies.

SeaPop may challenge or limit requests where SeaPop believes doing so is appropriate and legally permissible.

57. Protecting SeaPop and others

SeaPop may process personal information where reasonably necessary to:

• investigate fraud; prevent account compromise; investigate unauthorized access
• protect intellectual property; enforce contractual rights
• protect artists; protect event participants; protect staff or contractors
• investigate threats; prevent abuse; and establish, exercise, or defend legal claims

58. Do Not Track

Some browsers provide "Do Not Track" signals.

Because legal and technical standards regarding certain Do Not Track signals may vary, SeaPop's response may depend upon applicable law and the type of signal.

This provision does not limit SeaPop's obligation to recognize legally binding opt-out preference signals such as Global Privacy Control where required.

59. Privacy by design

When developing new SeaPop Services, SeaPop intends to consider privacy and data protection as part of system design.

Depending on the nature and risk of the Service, this may include data minimization; permission controls; limited access; pseudonymization; segregation of information; encryption; privacy-protective defaults; retention controls; and data-protection impact assessments where required.

60. Future technologies

This Privacy Policy is intended to remain technologically neutral.

SeaPop may introduce new technologies, including technologies involving:

• artificial intelligence; machine learning; virtual reality; augmented reality; mixed reality; spatial computing
• digital credentials; virtual environments; interactive media; advanced authentication
• decentralized technologies; wearable devices; and technologies not currently in widespread use

The introduction of new technology does not give SeaPop unlimited permission to use existing personal information for unrelated purposes.

If a new use of personal information is materially incompatible with the purpose for which the information was originally collected, SeaPop will establish an appropriate legal basis and provide notice or obtain consent where required by applicable law.

61. New categories of personal information

If technological or legal developments create new categories of regulated personal information, SeaPop will treat that information according to the legal protections applicable to that category.

Where new technologies involve particularly sensitive information, SeaPop may provide a supplemental privacy notice before processing begins.

62. Changes in privacy law

Privacy law continues to evolve.

SeaPop may update this Privacy Policy to account for new laws; amendments; regulations; regulatory guidance; judicial decisions; technological developments; new Services; or changes in SeaPop's processing activities.

Nothing in this Privacy Policy is intended to waive a privacy right that applicable law does not permit an individual to waive.

63. Changes to this Privacy Policy

SeaPop may update this Privacy Policy from time to time.

The date at the top will identify the most recent revision.

If a change materially affects how SeaPop uses personal information already collected, SeaPop will provide additional notice or obtain consent where required by applicable law.

SeaPop will not rely upon an update to this Privacy Policy as a substitute for obtaining consent where the law requires consent.

64. Request verification

To protect personal information from unauthorized access, SeaPop may verify the identity of a person requesting access, correction, deletion, portability, or another privacy right.

Verification requirements will depend upon the nature of the request; the sensitivity of the information; the risk of unauthorized disclosure; and applicable law.

Information collected solely for verification will be used only for appropriate verification, security, fraud-prevention, and compliance purposes.

65. Requests concerning another person

SeaPop generally will not disclose another person's personal information without appropriate authority.

Parents, guardians, authorized agents, executors, attorneys, representatives, and others requesting information concerning another person may be required to provide evidence of their authority.

66. Privacy rights are not absolute

Certain privacy requests may be denied or limited where permitted or required by law.

Examples may include circumstances where information must be retained to:

• complete a transaction; comply with law; detect fraud; maintain security
• protect another person's rights; exercise freedom-of-expression rights
• maintain legally required records; establish or defend legal claims; or satisfy another lawful exception

Where required, SeaPop will explain the basis for denying a request.

67. Appeals

Where applicable U.S. state privacy law provides a right to appeal a denial of a privacy request, an appeal may be submitted to legal@seapop.art.

The request should identify the original privacy request and state that an appeal is being submitted.

SeaPop will process legally required appeals in accordance with applicable law.

68. Supervisory and regulatory authorities

Nothing in this Privacy Policy restricts an individual's right to contact an applicable privacy regulator or supervisory authority.

For individuals in Serbia, the relevant supervisory authority is the Commissioner for Information of Public Importance and Personal Data Protection.

Users in other jurisdictions may contact the appropriate privacy or data-protection authority for their location where applicable.

69. Data Protection Officer

Where SeaPop is legally required to appoint a Data Protection Officer ("DPO"), SeaPop will publish or otherwise provide appropriate DPO contact information.

Until a separate DPO contact is published, privacy inquiries may be sent to legal@seapop.art.

70. Contact SeaPop about privacy

Questions concerning this Privacy Policy, privacy practices, or privacy rights may be sent to SeaPop Entertainment, Privacy & Legal: legal@seapop.art.

The applicable SeaPop legal entity may also be contacted at its registered office as identified in SeaPop's corporate imprint, legal notice, transaction documents, or applicable Service.

71. Relationship to the Terms of Service

This Privacy Policy forms part of SeaPop's broader legal framework and should be read together with the applicable Terms of Service; Cookie Notice; membership terms; event rules; contest rules; purchase terms; and other service-specific notices.

If these documents conflict concerning how personal information is processed, the provision that most specifically addresses the relevant processing activity will generally control, subject to mandatory law.

72. Final privacy principle

SeaPop's ability to collect, store, analyze, combine, infer, automate, or technologically process information does not itself create a right to do so.

Personal information will be processed according to an applicable lawful purpose and legal basis.

SeaPop reserves the right to develop and operate new technologies and Services, but such development remains subject to applicable privacy and data-protection law.

Where the law grants individuals mandatory privacy rights, those rights remain available regardless of language contained in SeaPop's Terms of Service or other contractual documents.

73. Privacy contact

SeaPop Entertainment DOO, Republic of Serbia. SeaPop Entertainment LLC, United States of America.

Privacy, data protection and legal requests

legal@seapop.art

© 2026 SeaPop Entertainment. All Rights Reserved.