Privacy Notice for the “Blue Fortune App” (Effective from: 19 July 2026)

When you use the Blue Fortune app (hereinafter the “App” or “Blue Fortune”), we process personal data and other information about you. Personal data means any information relating to an identified natural person.

The information below is intended to explain which personal data we process when you use the App and how we handle that data. We also inform you of the legal basis for processing your data and, where processing is necessary for the purposes of our legitimate interests, of those legitimate interests.

You can access this Privacy Notice at any time in the privacy section of the App and at the following address:

https://bluefortune.net/privacy

A. General Information on Data Protection and Data Subject Rights

I. Who is responsible for processing my data, and whom can I contact if I have questions?

This App is provided by Volutria1 UG (haftungsbeschränkt), c/o Hanyka, Hauptstr. 21, 85586 Poing, info@volutria.net (hereinafter the “Provider” or “we”), as the controller within the meaning of the EU General Data Protection Regulation (“GDPR”). Where we collect, process or use data and other information, we comply with the applicable statutory provisions, in particular the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

The App provides access to and displays the following information and functions:

• various games and game histories;
• virtual game progress and virtual Action Points (“AP”);
• virtual stakes, payouts, bonuses, inventories and rewards;
• Mystery Boxes, boosters, skills and Skill Cards;
• predefined in-app avatars;
• public profiles and leaderboards;
• Category multiplayer lobbies with free-text answers and ratings;
• optional internal usage analytics;
• banner advertising and optional rewarded advertisements (“Rewarded Ads”) through Google AdMob;
• data export and functions for deleting analytics data and user accounts.

II. What rights do I have in relation to my personal data?

If your personal data is processed, you may have the rights described below as a “data subject” within the meaning of the GDPR. When exercising your rights against us as the “controller”, we recommend that you use the contact details set out above:

• Right of access (Article 15 GDPR): You may request information about the data processed, its source, the recipients and the purpose of the processing.
• Right to rectification (Article 16 GDPR): If data is inaccurate or incomplete, you may request that it be corrected.

• Right to erasure (Article 17 GDPR): You have the right to request the deletion of your data, provided that no statutory retention periods or legitimate interests prevent its deletion.
• Right to restriction of processing (Article 18 GDPR): Under certain conditions, you may request that processing be restricted.
• Right to data portability (Article 20 GDPR): You may request that we provide data you have supplied to us in a structured, commonly used and machine-readable format.
• Right to object (Article 21 GDPR): You may object to the processing of your data at any time where the processing is based on a legitimate interest.
• Withdrawal of consent (Article 7(3) GDPR): Where you have given us consent to process your data, you may withdraw that consent at any time with effect for the future.
• Right to lodge a complaint (Article 77 GDPR): If you believe that applicable data protection law has been infringed, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach; telephone: +49 (0) 981 180093-0; email: poststelle@lda.bayern.de.

III. Data Processing in Connection with the App

Certain data and information are processed automatically as soon as you use the App. The data and information processed are set out below.

1. Data and information collected when the App is downloaded

When you download the App, certain necessary data and information are transmitted to the app store you have selected and through which the App is offered (e.g. Google Play or the Apple App Store). In particular, this may include your username, email address, the customer number associated with your account, the time of download, payment information and the individual device identifier. The data and information are processed exclusively by the relevant app store and are outside our responsibility and control.

2. Data and information collected during use

When you use the App, we collect certain data and information that are necessary for use of the App. This includes:

The data and information listed above are automatically transmitted to us in order to (1) provide you with the App and its associated functions; (2) improve the functions and features of the App; and (3) prevent and remedy misuse and malfunctions.

The processing of data is justified because it is necessary for the performance of the user agreement between you and us concerning use of the App, based on our Terms of Use applicable at the relevant time, pursuant to Article 6(1)(b) GDPR. In addition, we have a legitimate interest in ensuring that the App functions and operates without errors and in offering a service that meets market requirements and user interests. Our legitimate interests are not overridden by any conflicting interests or fundamental rights and freedoms on your part that require the protection of your personal data within the meaning of Article 6(1)(f) GDPR. The foregoing information is also necessary to provide the service pursuant to Section 25(2) no. 2 TDDDG.

3. Who receives my data?

Except in the cases expressly stated in this Privacy Notice, your data will be disclosed without your express prior consent only where this is permitted or required by law.

The following recipients receive your data for the purpose of entering into or performing the user agreement concerning the App pursuant to Article 6(1), first sentence, point (b) GDPR, or on the basis of our legitimate interests pursuant to Article 6(1), first sentence, point (f) GDPR:

Your data is made available only to those employees or organisational units that require it in order to meet our contractual and legal obligations or to handle or pursue our legitimate interests.

Where we use a service provider as a processor within the meaning of Article 28 GDPR, we nevertheless remain responsible for protecting your data. Where required by law, processors are contractually obliged under a data processing agreement to keep your data confidential and to process it only in connection with the provision of their services. The processors we engage receive your data where they require it to provide the respective services for which we have engaged them.

Your data is transferred to public bodies and authorities, or collected for that purpose, only where required by mandatory provisions of national law.

4. Use without a registered user account, creation of a user account and login

You may use Blue Fortune without a registered user account. During such unregistered use, our system creates a random internal user ID and an unregistered user reference. This data is required to associate your game progress, AP, games and rewards with that unregistered use. An inactive unregistered user reference and the associated data are deleted after 30 days without activity, unless there are permissible grounds for continued storage.

For a registered user account, we process your chosen username, your password, your internal user ID and, where applicable, your optional display name and a predefined avatar selected by you. The password is not stored in plain text.

Blue Fortune does not require an email address, telephone number, legal name, postal address or social login account for registration. Because no email address or telephone number is collected for account recovery, conventional password recovery by email or SMS is not possible.

We use the mandatory information to create and manage your user account, authenticate you when you log in, retain any existing progress from unregistered use when you register, and enforce the Terms of Use. Optional profile information is displayed in accordance with the relevant App function and may be accessible to other users.

Processing is carried out pursuant to Article 6(1)(b) GDPR. Measures to protect against unauthorised access, abusive registrations and manipulation are additionally based on Article 6(1)(f) GDPR.

5. General data processing when using the App

Unless we ask you for consent pursuant to Article 6(1)(a) GDPR or Section 25(1) TDDDG, usage data is processed in order to provide the service. This processing is justified because it is necessary for the performance of the agreement between you and us concerning use of the App pursuant to Article 6(1)(b) GDPR. In this case, the information stored on or collected from your device is also necessary to provide the service pursuant to Section 25(2) no. 2 TDDDG.

Permissions

For the functions you use, Blue Fortune may use internet and network access, secure or local device storage, audio output and haptic feedback. Where you request a data export, it may also use temporary file storage and the operating system’s share menu. Advertising identifiers are used only where permitted by your privacy choices and the operating-system settings.

Blue Fortune does not require access to your contacts, camera, microphone, precise GPS location, health, fitness or biometric data, Bluetooth information, bank-account data or payment-card data for its own App functions. You cannot upload your own profile photographs; you may select only from the avatars provided in the App.

Profiles, avatars and leaderboards

When you use profile, leaderboard or multiplayer functions, other authenticated users may, depending on the function, see your username, optional display name, predefined avatar, public profile, game statistics, leaderboard positions, results, and your participation and scores in a Category lobby.

This visibility is part of the function you use and is based on Article 6(1)(b) GDPR. Do not choose a username or display name, or enter free text, that discloses information you do not want other users to see.

Game progress, AP, virtual content and game history

To operate the games, we process your game progress, AP and virtual transactions, bonuses, inventory, Mystery Boxes, rewards, boosters and skills, as well as game and round information, actions and results. We use this data to operate games, maintain game progress and provide virtual content, calculate results and AP correctly, display game histories and leaderboards, restore interrupted processes, and prevent misuse or manipulation.

Game results are generated automatically. The calculations relate exclusively to gameplay, virtual AP and virtual items. They do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

Category multiplayer mode and free-text answers

When you use the Category multiplayer mode, we process the participant, game, free-text, rating and score data required for the lobby and the multiplayer game. Participants in the same lobby can see the information required for the multiplayer game.

Free-text answers may contain any content. In particular, do not enter contact details, passwords, confidential information, health data, political or religious information, or the personal data of other individuals.

A lobby expires twelve hours after it is created. The lobby and the associated participant, round, free-text, rating and score data are automatically deleted no later than approximately 36 hours after creation. Free-text answers are not permanently stored as part of the game history.

Reports, moderation, complaints and sanctions

If you believe that a display name, Category answer, lobby or other user content made accessible through Blue Fortune infringes rights, violates statutory provisions or breaches the Terms of Use, you may report the content using the “Report” function provided in the App or by email to info@volutria.net. When submitting a report by email, please provide as precise a description as possible of the content concerned, an explanation of why the content may be unlawful or may breach the Terms of Use, and your contact details for any follow-up questions. Provide only the information required for the review.

In this context, we process in particular the user references of the reporting and reported users, the content or lobby concerned, the reason for the report, any voluntary explanation, the time and technical context of the report, as well as review notes, decisions, measures, communications and, where applicable, a complaint against the decision. Reports are carefully reviewed by authorised personnel. We do not generally and continuously monitor user content; final moderation decisions are not made solely by automated means.

Depending on the outcome, we may in particular reset a display name, remove content or block access to it, remove users from a lobby, restrict individual functions, correct results, leaderboard positions, AP or virtual content, issue a warning, temporarily or permanently suspend a user account, or terminate the user agreement. As a general rule, the affected user will be informed of the measure, the principal reasons for it and the available avenues for complaint, unless prevented by legal, security-related or abuse-prevention considerations. Complaints may be submitted through the channel specified in the notice or by email to info@volutria.net and will be carefully reviewed again by authorised personnel.

As a general rule, the identity and contact details of the reporting user are not disclosed to the affected user. Disclosure takes place only where necessary to handle a report or complaint, required by law, or necessary for the establishment, exercise or defence of legal claims.

Processing is carried out pursuant to Article 6(1)(b) GDPR where necessary to enforce the Terms of Use and administer the user relationship; pursuant to Article 6(1)(c) GDPR where we fulfil statutory review, information or remedial obligations; and otherwise pursuant to Article 6(1)(f) GDPR. Our legitimate interest is to review content or conduct that is unlawful or breaches the agreement, protect Blue Fortune and its users, prevent misuse, implement proportionate measures and document decisions.

Optional internal usage analytics

Blue Fortune offers its own optional usage analytics. This is separate from privacy choices for advertising and remains disabled unless you actively enable it.

When analytics is enabled, pseudonymous usage events, App sections and game types used, changes in virtual AP, results and times may be processed. We use this information to understand how the App is used, identify technical or product-related issues, evaluate the virtual in-game economy and improve Blue Fortune. We do not use internal analytics data to select personalised advertising.

Advertising and Rewarded Ads

Blue Fortune uses Google AdMob to display banner advertising and optional Rewarded Ads. The Google User Messaging Platform (“UMP”) is used to display required privacy messages, record your selection and provide privacy options.

Depending on your location, your choices and the operating-system settings, personalised advertising, non-personalised advertising, restricted advertising (“Limited Ads”) or no advertising may be displayed. Personalised advertising, cross-app tracking and non-essential advertising measurement are used only where the required consent has been given. On iOS, additional authorisation under App Tracking Transparency (“ATT”) may be required. ATT authorisation does not replace any consent required under the GDPR or the TDDDG.

Rewarded Ads are optional. If you select such an advertisement, Blue Fortune may grant a virtual reward after the advertisement has been completed successfully. For this purpose, limited transaction and confirmation data is processed in order to allocate the reward correctly and prevent duplicate or abusive granting of rewards. Further information about Google AdMob and UMP is provided in Section A.III.6.2.

Data export and deletion

Registered users may request a structured JSON export of their own information through the App. In particular, the export may contain account and profile information, settings, game progress, virtual transactions and content, your own game histories, multiplayer data that is still stored, internal analytics data, and a limited history of privacy-related and Rewarded Ad events. Security-sensitive data and private information concerning other users are not included.

The App creates the export file temporarily and opens the operating system’s share menu. The file is disclosed only to the app, service or person selected by you. That recipient processes the file in accordance with its own privacy policy.

You may delete existing internal analytics data without deleting your user account. You may delete a registered user account through the App or at the following address:

https://bluefortune.net/delete

When an account is deleted, the data associated with it is deleted unless a legal obligation or another permissible ground requires limited continued storage. A record of privacy choices reduced to the necessary minimum may be retained until the applicable retention period expires. Following a permanent suspension or termination for cause, a minimised ban record kept separately from the deleted user account may also be retained where necessary to prevent an impermissible new registration or circumvention of the measure.

External Discord link

Blue Fortune may display a link to Discord. Merely displaying the link does not transmit any data to Discord. If you select the link, the operating system opens Discord or a browser. From that point onwards, further processing is governed by the privacy policies of Discord, the browser and the operating system.

6. Services and service providers integrated for use of the App

6.1. Hosting by Hetzner and creation of log files

We use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as the technical hosting service provider for hosting the App and storing personal data.

When the App is used, technically necessary connection and log data are transmitted to our servers operated by Hetzner. In particular, the following data may be processed:

• IP address
• date and time of access
• operating system used
• App version or technical device information
• technically necessary request and log data

Hetzner processes this data on our behalf. We have entered into a data processing agreement with Hetzner pursuant to Article 28 GDPR.

The processing is necessary to make the App technically available and to ensure its secure, stable and functional operation. The legal basis for processing in connection with hosting is Article 6(1)(b) GDPR where the processing is necessary to provide the App and administer the user relationship. Where data is processed to ensure IT security, analyse errors, detect misuse and optimise technical stability, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in providing the App securely, reliably and without errors.

Where information on the device is accessed, or where such information is processed because this is technically necessary, the processing is based on Section 25(2) no. 2 TDDDG.

6.2 Google AdMob and Google User Messaging Platform

Blue Fortune uses Google AdMob to display banner advertising and optional Rewarded Ads, and the Google User Messaging Platform (“UMP”) to display and manage privacy choices for advertising.

The contracting party for our German AdMob publisher account is:

Google Ireland Limited

Gordon House

Barrow Street

Dublin 4

Ireland

Depending on the relevant service and processing operation, data may also be processed by Google LLC in the United States, other Google group companies, subcontractors and the advertising-technology partners identified through Google’s privacy interface. Blue Fortune and the respective Google entity may each be independent controllers for their own processing activities.

Depending on the device, location, privacy choice and advertising mode, the following data in particular may be processed: the IP address, an approximate region derived from it, device, App and operating-system information, permitted advertising or App identifiers, App and advertising interactions, diagnostic and security data and, where personalised advertising is permitted, inferred interests or advertising profiles.

UMP is used to determine whether a privacy message is required, display the appropriate message, record your decision and provide available privacy options. You can change your selection through “Manage Ad Privacy” or “Datenschutz für Werbung verwalten”. To implement and document your selection, we may store a limited record of your privacy status. A refusal is not treated as consent; withdrawal takes effect for the future.

Personalised advertising, cross-app tracking, access to advertising identifiers and other non-essential access to, or storage of, information on your device take place only with the required consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. On iOS, an advertising identifier is used for tracking only where the required ATT authorisation has also been granted.

Where personalised advertising is not permitted, Google may, depending on the choices available and technical suitability, deliver non-personalised advertising, Limited Ads or no advertising. Data may also be processed in connection with non-personalised or restricted advertising where this is necessary and legally permissible for delivery, frequency capping, measurement, security and fraud prevention. Where such processing is not subject to a consent requirement, it may be based on Article 6(1)(f) GDPR. Our legitimate interest lies in providing the App securely and on an economically sustainable basis, and in preventing advertising fraud.

For Rewarded Ads, our backend receives limited transaction and confirmation data following successful completion. We use this data to allocate the virtual reward requested by you correctly and to prevent duplicate or abusive granting of rewards. Performance of the requested reward transaction is based on Article 6(1)(b) GDPR; verification and fraud-prevention measures are additionally based on Article 6(1)(f) GDPR.

Processing that is necessary to display and implement privacy choices and maintain records required by law may be based on Article 6(1)(c) and (f) GDPR. The technically necessary local storage of the current choice is carried out pursuant to Section 25(2) no. 2 TDDDG.

The advertising-technology partners available at the relevant time and their privacy information are displayed through the Google UMP privacy interface. Blue Fortune does not use any additional external analytics provider.

Further information about data processing by Google is available at:

https://policies.google.com/privacy

https://business.safety.google/privacy/

VI. How long is my data stored?

Your data is used only for the purpose for which you provided it to us or for which you consented to its processing, and is stored until that specific purpose has been fulfilled. Once that purpose has been fully achieved, or as soon as you ask us to delete your data, your data is retained only for as long as necessary due to statutory limitation periods or retention periods, particularly those arising under tax and commercial law. In any event, the data will be deleted no later than the expiry of all applicable periods unless you have expressly consented to further or different use. You may also exercise rights during the retention periods, for example by requesting restriction of the processing of your data. See Section A.II in this regard.

Unless otherwise stated, we store your personal data for the duration of the user or contractual relationship concerning the App, plus an appropriate period under data protection law during which we retain backups after deletion, unless the data is required for a longer period for criminal prosecution in cases of misuse or for the preservation, establishment or enforcement of legal claims.

Specific information in this Privacy Notice or legal requirements concerning the retention and deletion of personal data, in particular data that we are required to retain for tax-law purposes, remain unaffected.

• Information processed by Google and participating advertising partners is stored in accordance with the published retention rules of the respective provider.

Where a specific security incident, statutory, judicial or administrative proceeding, or the preservation of legal claims requires further storage, the relevant data may be blocked and retained for longer until that reason ceases to apply. It will then be deleted.

V. Is personal data transferred to a third country?

The Blue Fortune backend, database, logs and backups are hosted on Hetzner infrastructure in Germany. Through this hosting infrastructure, we do not transfer the backend and database data stored there to a third country outside the European Economic Area.

International data processing may take place in connection with Google AdMob, UMP, Rewarded Ads and the advertising-technology partners involved in an advertising request. In particular, personal data may be processed by Google LLC, other Google group companies, subcontractors or advertising partners outside the European Economic Area, especially in the United States.

Google Ireland Limited is the contracting party for our German AdMob publisher account. Depending on the recipient and processing operation, transfers may be based on an adequacy decision, valid certification under the EU–US Data Privacy Framework, standard contractual clauses approved by the European Commission, or another legally recognised transfer mechanism. Google publishes information about its transfer frameworks at:

https://policies.google.com/privacy/frameworks

For individual advertising-technology partners, the destination country, role and transfer basis depend on the current partner list and the specific advertising request. You can view the available partners and their privacy information through the Google UMP privacy interface. You may request further information about a specific transfer by contacting info@volutria.net.

Processing carried out independently by Apple or Google in connection with app stores and operating-system functions, by Discord after the external link is opened, or by a recipient selected by you through the share menu is governed by the privacy policy of the respective provider.

B. Miscellaneous

As a result of the further development of our App or our other offerings, or due to changes in statutory or regulatory requirements, it may become necessary to amend this Privacy Notice. You can access the current version of the Privacy Notice in the App at any time.