INTRODUCTION

Hi. We’re Square Enix. You probably know us from all the SQUARE ENIX, branded entertainment content we develop, publish, distribute and license, including: FINAL FANTASY, DRAGON QUEST and SPACE INVADERS.

Please take the time to read this Privacy Notice, as it explains how we collect, use and protect your Personal information.

Square Enix is a valid licensee, and participating member, of the Entertainment Software Rating Board's Privacy Certified Program (“ESRB Privacy Certified”). To protect your privacy, we have voluntarily undertaken this privacy initiative, and all of our Services where this Privacy Notice is posted and an ESRB Privacy Certified seal is shown have been reviewed and certified by ESRB Privacy Certified to meet established online information collection, use, and disclosure practices. As a licensee of this privacy program, we are subject to audits of our Services and other enforcement and accountability mechanisms administered independently by ESRB Privacy Certified.

HOW & WHEN WE COLLECT YOUR PERSONAL INFORMATION

From the moment you begin interacting with Square Enix, we are collecting Personal information. Sometimes the Personal information we collect is provided by you and sometimes it is collected automatically.

You give us data when you: register or update a Square Enix Members account or Square Enix Account, use our paid-for services, play one of our games, enter one of our tournaments, apply for a job with us, attend an interview or interview assessment, opt-in to receive our marketing messages, subscribe to our mailing lists, call us, email us, live chat with us online, chat to us in-game, make a purchase from us, enter one of our prize draws or competitions, answer one of our surveys, fill in a form, conduct a search or post content on our website, interact with other users on our online services, register to attend our events, ‘follow’, ‘like’, post to or interact with our social media accounts or apply to be a Square Enix “influencer” on our website.

We collect your data automatically when you: access our website pages, interact with other users on our online services, open an email from us, login to your Square Enix Members or Square Enix Account, play our games online, live chat with us, message us or other users in-game or make a purchase from us.

TYPES OF PERSONAL INFORMATION WE COLLECT

Depending on the specific services you use and how you interact with us, we may collect various types of Personal information as further described in this section.

Contact details
Your name, address, telephone number and email address.

Account profile data
Your name, email address, birth date, gender, username and password.

Financial information
Truncated payment card or account number, electronic payment processor details, and billing address.

Information that identifies you
Your birth date, IP address, login information, social media username(s), browser type and version, time zone setting, browser plug-in types, IP general geolocation information, operating system and version, cookies, Google AdID, Apple IDFA and other unique device IDs.

Information on how you use our websites
Your URL clickstreams (the path you take through our site), products/services you view or purchase, page response times, download errors, how long you stay on our pages, what you do on those pages and other actions.

Information on how you purchase and use our games and services
Your gaming platform, game version, mobile and hardware identifiers, device event information, crash reports, language or subtitle options, game scores, game metrics, achievements, rankings, play time, feature usage, player performance and progression, purchases, time zone, timestamp, session duration, challenges or gifts sent to other players and number of friends on the platform.

Survey information
Any information that you decide to provide to us when you complete one of our surveys.

Employment information (only when you apply for job roles with us)
Name, email address, employment history, references, education history, results of pre-employment screening and background checks, relevant experience, achievements, skills and qualifications and the outcome of any interviews or tests that are part of the recruitment process.

Information recorded at Live Square Enix Events
Photographs and videos of you.

Information provided to us by third parties
Game Platforms
Nickname, username, user ID, friends list, email address, IP general geolocation, language, user preferences, date of birth and games you have played.

Mobile Platform Providers and App Stores
Username, device ID, purchase history and IP general geolocation.

When you log in with your Facebook account
Account ID, email address and friends playing the same game.

When you link a Square Enix Membership or Square Enix Account to a Game Platform Account
Account ID, nickname, user ID, email address and our games which you are playing.

What about sensitive personal information?
If you have been selected to participate in an accessibility-related player research group, we may ask for health data related to your accessibility needs for the purpose of analysing accessibility as it relates to our game development. Certain specific smartphone games also process precise geolocation information. This is only done where it is necessary for the game to function and in such cases permission to allow the app to access your GPS is requested. Additionally, in some circumstances, we may request Government Issued ID to verify account holder identity. Otherwise, we do not actively collect any sensitive personal information about you (data that is intended to identify your racial or ethnic origin, political opinions, religious/philosophical beliefs or trade union membership, genetic data, biometric data, health data, or data about your sexual life or orientation, criminal offences or alleged offences).

Please don’t send us your unsolicited special categories of data or post them anywhere on our services.

What about children’s data?
You must be at least 13 years old to use any of our services or games, as we do not target our games to children under 13 and do not knowingly collect any Personal information from any person under 13.

If you think we have unintentionally collected Personal information from someone under the age of 13, please let us know by contacting us at dpo@eu.square-enix.com.

WHY & HOW WE USE YOUR PERSONAL INFORMATION

We will use your Personal information only for certain specified reasons and only when we have a lawful basis to do so. Which of the following reasons is applicable to you depends on the type of relationship we have with you and how we interact with you. For example, we will not use your Personal information for the purpose of processing payments unless you’ve made, or attempted to make, a purchase from us.

Registering your account
When you sign up to use our services or register a Square Enix Account or Square Enix Membership account with us, we will use the details you provide on your account registration form to process your registration and provide the services you’ve agreed to receive.

Keeping our websites and gaming services running
Providing you our games and services online, access to our websites, login authentication, age verification, remembering your settings, processing payments, populating leaderboards, hosting and back-end infrastructure and keeping our websites and services secure.

Enabling you to communicate with other users
Certain parts of our websites and online services enable you to communicate and interact with other users. We will use information you have provided us to enable these interactions and communications on our websites and online services.

Processing Orders
We will use your information to process, accept and dispatch your orders. If your order includes physical delivery of a product, we will use your information to organise and notify you of the delivery.

Processing payments
We will use your information to process payments for our goods and services. If your bank provides account update services and you have registered your payment card number or expiry date in our systems, we may automatically update this information when it changes.

Social media
We will use your information to communicate with you if you message us, respond to our posts, “like” our posts, tweet or retweet us or otherwise interact with us directly on social media platforms. We also analyse social media postings and trends to understand customer sentiment about our games and services.

Anti-cheat, anti-tampering, fraud, and unauthorised and unlawful activity detection, prevention and investigation
We use the information you provide us and the information we collect about you to enforce our rules and policies, protect our customers and business, maintain the competitive integrity of our games, and investigate and respond to fraudulent, unauthorised or illegal activity on or related to our current or future services. We may also use your information for machine learning behavioural predictions to detect and prevent fraudulent activities on our services.

Square Enix “Press Centre” registration
When you register your details to join the Square Enix Press Centre, we will use the information you provide to process your application and, in some cases, to send you press releases and assets as part of the Press Centre program.

Square Enix “influencer” registration and suitability monitoring
When you apply to become a Square Enix influencer through the Square Enix partner program, we will use the information you provide to process your application and, in some cases, to contact you about your potential participation in the program.

Community and customer support
When you use our communities or customer support, we will use your information for handling enquiries or complaints, troubleshooting and solving technical issues over live chat, phone, email and in-game chat, making necessary changes to our products and services and monitoring your participation in our forums and all parts of our services that allow you to publicly post information or interact with other users.

Improving and continually developing our games, services and websites
We carry out analytics and research on in-game data collection and related metrics to understand how our customers are playing games and the effectiveness of our marketing campaigns. We also use your information to undertake player segmentation (profiling), cheat detection and prevention, machine learning (we sometimes use carefully selected third parties to do this on our behalf), general management of our websites, traffic optimisation and heat mapping (including through the creation of animated representations) of your usage of our websites.

Recruitment
To evaluate your suitability for a role that you have applied for we will use your information to verify your application details, academic qualifications and work experience, perform background checks, review and audit our recruitment processes and its outcomes and identify any future employment opportunities that you may be suitable for.

Contests, prize draws, and tournaments
When you participate in our contests, prize draws, tournaments or other promotional events we run from time to time, should you decide to participate in them, we will use your information to process your entry as well as to communicate with you and award and send you certain prizes or rewards, either digitally or physically, if you have qualified to receive them. In some cases our promotional events may have a “leaderboard,” entry list, or similar element, in which case we may display your name or other information you submitted on such a publicly accessible list. Some contests, prize draws, and tournaments will also involve publicly displaying your entry in media throughout the world.

Live Square Enix Events
When you attend or join our live events, we may photograph you and record videos in which you, your appearance, or your voice may be recognisable.

Targeted advertising
Through cookies, clear GIFs, web beacons and tracking pixels we will use your information to deliver relevant advertisements and offers to you and measure the effectiveness of the advertising and offers. These technologies connect your behaviour across different websites, mobile apps and devices and enable tailored advertising to be served to your game, web browser, or mobile device. Please also see our Cookie Policy.

Digital marketing and advertising
We will use your information to provide you with promotional communications and paid advertisements on our services and on third-party platforms. This includes using your personal information for matching your data across our websites, games and services to measure the effectiveness of marketing campaigns, profiling and segmentation and to tailor promotional communications and paid advertisements to those which you are more likely to be interested in. We also use machine learning to predict the effectiveness of digital marketing campaigns for our customers and to tailor campaigns and digital marketing communications, including through purchase history and game play behavioural analysis.

Direct marketing
Where you have consented, we will use your information to send you communications about our services, products and features that you have agreed to receive directly via email. We also use machine learning to predict the effectiveness of direct marketing campaigns for our customers and to tailor campaigns and direct marketing communications, including through purchase history and game play behavioural analysis.

Health Apps
Some of our mobile games have the ability to make use of your device‘s ‘health app’ (Apple HealthKit for Apple devices, Google Fit for Android devices, or its equivalent) in order to process your fitness activity in the game.

Where you have chosen to connect your device’s health app to one of our games, we use the data obtained from your device's health app only for the purpose of providing health management, movement, or exercise services in connection with the specific game. We do not use data collected through your device's health app for marketing or advertising purposes and our use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

We will only collect the health data you give us permission to collect and you will always be in control of this data collection; we cannot use your device's health app without your specific consent and you can withdraw consent to this data collection at any time in your device’s health app settings.

WHO WE DISCLOSE PERSONAL INFORMATION TO

Depending on the purpose for which we collect your personal information or the nature of our interaction with you, we may use third parties to process some of your personal information (for example, we engage third parties to process information about your purchases and use of our games). We require that these third parties use only the information they need to perform their specific services as specified in our contract with them. If we stop using any such third party’s services, we require that your personal information held by them is either securely and permanently deleted or rendered irreversibly anonymous. In all cases, we apply measures to keep your data safe and your privacy protected.

We disclose your personal information with third-party IT companies who support our website, online services and other business systems, payment services providers who process your payments for goods and services, fraud detection, investigation and prevention companies who help us detect, investigate and prevent cheating, abuse, fraud, tampering or other unauthorised use of or disclosure of non-public information about our current and future services and direct marketing companies who help us manage our electronic communications with you.

Where you have ordered products to be delivered to you, we will disclose your personal information with selected third-party warehouses and delivery partners. We will only disclose the information necessary to organise and fulfil your order.

We may disclose your personal information with Google, Facebook and other third-party advertising partners so they can show you our products and services that might be of interest to you while you are on a social media platform, browsing the internet or playing our mobile games. For example, if you provide us with your email address we may disclose it to Facebook so that you can receive tailored advertising from us when you use Facebook, and so that other users of Facebook who disclose similar interests to you can also receive tailored advertising from us. This is based on your consent to marketing.

Under very specific circumstances, we will disclose your personal information with third parties (including law enforcement bodies) in order to respond to or investigate fraudulent, unauthorised or criminal (or potentially fraudulent, unauthorised or criminal) activity on or related to our systems, services, or events, including the unauthorized disclosure of non-public information related to current or future services. We may also be required by law to disclose your personal information to the police or to another law enforcement, regulatory or government body in your country of origin or elsewhere, including upon receiving a legally valid request to do so. We may also be required by law to disclose your personal information to third parties in response to a court order, subpoena, or other compulsory process.

YOUR CHOICES

There are various ways in which you can exercise choice and control over the information you provide to us. Below are some examples.

Limit the Information You Provide to Us
You can stop all prospective collection of information on our Services by uninstalling and ceasing to interact with the Services. You can also decline to provide information we request from you, although doing so may prevent you from using certain parts of the Services (e.g., you will not be able to create an account with us if you do not provide your email address and other information we need to process your registration). With respect to our mobile applications, you may use the standard uninstall process supported by your device, the app, or the marketplace or software through which you acquired the app to stop all prospective information collection through the app.

Change Your Communications Preferences
You may cancel or modify the email communications you receive from us by clicking on the “unsubscribe” link in our emails or, where applicable, by logging into your account and adjusting your settings. This will not affect subsequent access to the Services. Please note that we reserve the right to send you certain communications relating to your account or use of our Services, such as administrative and service announcements, and you will continue to receive these transactional account messages even if you opt-out of receiving our promotional email communications.

Website Analytics
You may exercise choices regarding the use of cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout and downloading the Google Analytics Opt-out Browser Add-on.

Interest-Based Advertising Opt Outs
Some of the advertisers and parties that perform advertising-related services for us and our partners may participate in the Digital Advertising Alliance ("DAA") Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding interest-based advertising, visit http://www.aboutads.info/choices for website opt-out choices and http://www.aboutads.info/appchoices for mobile app opt-out choices. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, see http://www.networkadvertising.org/choices. Please be aware that, even if you are able to opt out of certain kinds of interest-based advertising, you may continue to receive other types of ads. Opting out only means that those selected members should no longer deliver certain interest-based advertising to you, but does not mean you will no longer receive any targeted content or ads (e.g., from other ad networks). We are not responsible for the effectiveness of, or compliance with, any opt-out options or programs of any other parties or the accuracy of their statements regarding their programs.

Do Not Track
Your browser settings may allow you to automatically transmit a "Do Not Track" signal to websites and online services you visit. There is no consensus among industry participants as to what "Do Not Track" means in this context. Like many websites and online services, unless and until the law is interpreted to require us to do so, we do not alter our practices when we receive a "Do Not Track" signal from a visitor's browser. To find out more about "Do Not Track," you may wish to visit http://www.allaboutdnt.com/.

WHERE YOUR PERSONAL INFORMATION IS PROCESSED

We are a global organisation, so we sometimes need to disclose your personal information with our other offices, or with other third parties and suppliers. Please be aware that information we collect may be transferred, processed, stored, and used internationally, including in the United States, Japan, the United Kingdom, and the European Union.

When it is necessary for us to transfer your personal data out of the EEA, Switzerland, and/or the UK, we will do so only when the transfer is authorized under applicable law, including when the transfer is made to a country the EEA and/or UK has deemed to have adequate data protection laws, is governed by the Standard Contractual Clauses and/or the U.K. Addendum or is authorized by another recognized transfer mechanism recognized by the EEA, Swiss, or UK authorities, such as the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Square Enix, Inc., Square Enix L.L.C., and Square Enix of America Holdings, Inc. comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. Square Enix, Inc has certified to the U.S. Department of Commerce that it and its U.S. entities adhere to the EU-U.S. DPF Principles with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Square Enix, Inc. has certified to the U.S. Department of Commerce that it and its U.S. entities adhere to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Square Enix, Inc. is responsible for the processing of personal data it receives under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, and subsequently transfers to a third party acting as an agent on its behalf. Square Enix, Inc., Square Enix L.L.C., and Square Enix of America Holdings, Inc comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions.

The Federal Trade Commission has jurisdiction over Square Enix, Inc.’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, Square Enix may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Square Enix commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit the U.S.-based third-party dispute resolution provider for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Under certain conditions, more fully described on the Data Privacy Framework website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

In compliance with the EU-US DPF Principles, Square Enix, Inc. commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, Swiss and United Kingdom individuals with DPF inquiries or complaints should first contact Square Enix, Attn: Privacy Team and DPO, Square Enix 240 Blackfriars Road SE1 8NW or by email at dpo@eu.square-enix.com

YOUR CONTROL OVER YOUR PERSONAL INFORMATION

This section describes the various controls you have over your personal information, including your rights over your personal information under California, Colorado, Connecticut and Virginia Privacy Laws and how you can invoke these rights with us.

Your right of access
You have the right to request copies of your personal information. However, there are some exemptions, which means you may not always receive all the personal information you request.

Your right to correction
You have the right to request that we rectify information you think is inaccurate or complete information you think is incomplete.

Your right to data portability
You have the right to request that we transfer certain personal information to another organisation, or that we provide a copy of it to you.

Your right to erasure
You have the right to request that we erase your personal information in certain circumstances.

Your right to opt-out
To the extent we sell or share your personal information as the term “sell” or “share” is defined under California, Colorado, Connecticut, Nevada and Virginia Privacy Laws, you have the right to opt-out of the sale or sharing of your personal information by us to third parties at any time. You can submit a request to opt-out by clicking here: Do Not Sell or Share, or calling our toll-free number at 1-800-715-2450.

Notice of collection
In the past 12 months, we have collected the following categories of personal information enumerated in the California Consumer Protection Act (CCPA):

• Identifiers, including name, postal address, email address, and online identifiers (such as IP address).
• Customer records, including phone number, billing address, and credit or debit card information.
• Characteristics of protected classifications under California or federal law, including gender.
• Commercial or transactions information, including records of products or services purchased, obtained, or considered.
• Internet activity, including browsing history, search history, and interactions with a website, email, application, or advertisement.
• IP general geolocation data.
• Employment and education information.
• Inferences drawn from the above information about your predicted characteristics and preferences.

For further details on information we collect, including the sources from which we receive information, review “TYPES OF PERSONAL INFORMATION WE COLLECT” above. We collect and use these categories of personal information for the business purposes described in “WHY & HOW WE USE YOUR PERSONAL INFORMATION” above.

We do not generally sell information as the term “sell” is traditionally understood. To the extent “sale” or “share” under the CCPA or California Privacy Rights Act (CPRA) is interpreted to include the activities set out in this Privacy Notice, such as those disclosed in the “Ads and Analytics” section above, we will comply with applicable law as to such activity. We disclose the following categories of personal information for commercial purposes: identifiers, characteristics, commercial or transactions information, internet activity, IP general geolocation data, and inferences drawn. Please review “WHO WE SHARE PERSONAL INFORMATION WITH” above for further details about the categories of parties with whom we share information.

Right to know and delete
You have the right to know certain details about our data practices. In particular, you have the right to request copies of the following from us:

• The categories of personal information we collected about you;
• The categories of sources from which the personal information was collected;
• The categories of personal information we disclosed for a business purpose or sold or shared;
• The business or commercial purpose of our use, sale or sharing of your personal information;
• The categories of third parties with whom we share your personal information; and
• The specific pieces of personal information we have collected about you.

You also have the right to request that we delete your personal information.

Authorized agent
You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly, unless the request relates to your right to opt out of the sale or sharing of your personal information.

Your right to non-discrimination
You have the right not to be discriminated against in service or price if you exercise your privacy rights.

Shine the light
Customers who are residents of California may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To submit a request, please write us at the email or postal address set out in “Questions or Complaints” below and specify that you are making a “California Shine the Light Request.” We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.

To exercise any of your privacy rights, please submit a request through our Online Form, contact us at RightsRequests [at] us.square-enix [dot] com, or call our toll free number at 1-800-715-2450. In the request, please specify which right you are seeking to exercise and the scope of the request. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests.

Global Privacy Control
We recognize the Global Privacy Control opt-out preference as a valid request to opt-out of the sale and sharing of the personal information processed through the browser you are using. This controls whether your browser sets third-party cookies on our websites that are used for targeted advertising. This is only based on browser settings and not your device settings. Please see the list of browsers that support GPC and instructions on how to enable it.

Colorado, Connecticut, and Virginia consumers right to appeal
Where your privacy rights request has been denied by us, you have the right to appeal that decision. Please contact us RightsRequests [at] us.square-enix [dot] com to appeal such a decision.

CHANGES AND UPDATES TO THIS PRIVACY NOTICE

As our services and products change from time to time, you should expect this Privacy Notice to change as well. We reserve the right to amend this Privacy Notice at any time, for any reason. We will make all reasonable endeavours to notify you of any changes. We may also email periodic reminders of this Privacy Notice, and will email customers who have a registered Square Enix Account or Square Enix Members account, of any material changes to this Privacy Notice. Nevertheless, you should check here regularly to see the current Privacy Notice that is in effect and any changes that may have been made to it.

COMPLAINTS

If you wish to file a complaint, please contact us at PrivacyNotice [at] us.square-enix [dot] com

As previously mentioned, we are a licensee of ESRB’s Privacy Certified Program. If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact ESRB Privacy Certified at http://www.esrb.org/privacy/contact.aspx. You may also email them at privacy@esrb.org.

This Privacy Notice has been designed to be accessible. If you experience any difficulties accessing the information here, please contact us at PrivacyNotice [at] us.square-enix [dot] com.