PRIVACY POLICY

Last Updated/Effective Date: December 21, 2022

Table of Contents:

1. SCOPE AND APPLICATION: What and who this Policy covers

2. COLLECTION OF INFORMATION: The sources of and methods by which we and our service providers collect information from and about you, including information about your interaction with the Company Services

3. USE AND DISCLOSURE: How we use the information we collect from and about you, and who we might share it with and why

4. SECURITY: How we protect your information from loss or misuse

5. USER ACCESS AND CONTROL: How you can access and control the information we maintain about you

6. OTHER IMPORTANT INFORMATION: Other things you should know about this Policy and how we handle your information

7. CONTACT US: How to contact us about this Policy

8. CALIFORNIA CONSUMER PRIVACY ACT NOTICE: Other things you should know if you reside in California

9. FOR VIRGINIA CONSUMERS: Other things you should know if you reside in Virginia

10. UK PRIVACY INFORMATION: Information for residents of the United Kingdom

1. SCOPE AND APPLICATION

Blockchain Creative Labs, LLC (“Company” or “we”) operates this website at “wwemoonsault.com” as a licensee of World Wrestling Entertainment, Inc. (“WWE”). We want you to be familiar with how we collect, use, and disclose information from and about you. This Privacy Policy describes our practices in connection with information collected through services such as websites, mobile sites, applications (“apps”), contests, sweepstakes, and other promotions, the purchase, and/or display of non-fungible tokens (“NFTs”), delivering video, audio and other content, and other services (collectively, the “Company Services”) that contain or reference an authorized link to this Privacy Policy.

To access certain features of the Company Services, you may be asked to create or connect a digital wallet (“Wallet”) account, including to enable you to receive, purchase, and/or display NFTs. (These Wallets also are sometimes known as “blockchain wallets” or “crypto wallets.”) Wallet accounts may be created utilizing a wallet provider either on this website or on another website. For certain transactions you may be asked to create a wallet with Eluvio, Inc. (“Eluvio”) (an “Eluvio Wallet”). A Wallet enables you to log-in to participate in certain promotions (e.g., when you log-in to participate in certain events), to purchase NFTs, sell, or to receive NFTs by other means. In addition, a Wallet enables you to access and display NFTs that you have purchased or received. When you create or interact with your Wallet, you are entering a relationship with the Wallet provider and the provider’s privacy policy applies. When you choose to participate in a promotion that requires you to create or interact with an Eluvio Wallet account, you are entering a relationship with Eluvio. You should consult the applicable Eluvio privacy policy at https://live.eluv.io/privacy before you start the process of creating an Eluvio Wallet for such transactions. We may also receive certain information from Eluvio when you interact with the Company Services using an Eluvio Wallet, as described further below.

California residents, please see the California Consumer Privacy Act Notice in Section 8 below. Virginia consumers, please see section 9, and UK residents, section 10. By using Company Services, you agree to the terms and conditions of this Privacy Policy. A list of our affiliated companies (“Company Affiliates”) is available at FoxCorporation.com. As set forth in our Terms and Conditions, the Company Services are for a general audience, are not targeted to children, and do not knowingly collect personal information from or about persons under 18 years of age or the age of majority.

This Privacy Policy applies to all users, including those who use the Company Services without being registered with or subscribing to a Company Service, as well as those who register with, subscribe to, or otherwise participate in a Company Service (including creating or connecting a Wallet, purchasing, and/or displaying content, such as NFTs). This Privacy Policy applies to Company’s collection and use of your personal information (i.e., information that identifies a specific person, such as full name or email address). It also describes generally Company’s practices for handling non-personal information (for example, interests, demographics, and services usage).

2. COLLECTION OF INFORMATION

Company and our service providers may collect or receive the following information from and about you:

Registration Information is the information you submit to register for a Company Service, for example: to create a Wallet with another party through a Company Service; to receive a newsletter; or to participate in an event, sweepstakes, contest, or promotion, including to purchase or receive NFTs. If you use an Eluvio Wallet to interact with the Company Services, we may receive Registration Information from Eluvio. Registration Information may include, for example, name and email address.

Wallet Information. If you use a Wallet to interact with any Company Services, we will receive information about your Wallet activity and transactions, for example, your wallet address, available balance, and information about whether you have sold, purchased, or otherwise obtained or received NFTs and, if so, which ones.

Blockchain transaction information is the information we obtain from public blockchains for certain transactions, such as buying, claiming, transferring, selling, or otherwise obtaining NFTs or moving them out of a wallet. It includes, for example, the sending and receiving of public wallet addresses, the amount of any transfer, and information related to the time of the transaction. We collect this information in connection with primary sales (where we mint an NFT and sell it directly to a specific wallet) and for secondary sales (where the wallet holder sells an NFT to a subsequent purchaser).

Authentication Information. When you create or connect a Wallet on a Company Service, we, or another party, may collect, access, and/or process information, such as email address, other unique identifiers, and cryptographic keys to provide authentication services.

Information from Social Sign-On. If you access or log-in to a Company Service or your Eluvio Wallet on a Company Service through any social media or single sign-on service (“SSO”), such as Google, Apple or Facebook, or connect a Company Service to a social media service, the information we collect or receive may also include your user ID and/or user name, or other unique identifier associated with that SSO, any information or content you have permitted the SSO to share with your Wallet provider or us, such as your profile picture, email address or friends lists, and any information you have made public in connection with that SSO. When you access the Company Services or, in certain circumstances, your Eluvio Wallet on a Company Service through SSO, or when you connect a Company Service to social media services, you are authorizing Company to collect, store, and use such information and content in accordance with this Privacy Policy.

Activity Information. When you access and interact with the Company Services, Company, its service providers, or other parties, may collect certain information about your interactions. For example, depending on how you are interacting with the Company Services, our servers may receive and record information about your computer, device, and browser, including potentially your IP address, browser type, and other software or hardware information. If you access the Company Services from a mobile or other device, we may collect a unique device identifier assigned to that device, geolocation data (including your precise location), or other transactional information for that device.

Cookies and other tracking technologies (such as browser cookies, pixels, beacons, local storage, and other mechanisms) use various approaches to collect and store data. Some of these technologies store data in the browser or on your device. Other technologies may use network-related or other information to recognize your device (e.g., IP address). Company Services use these technologies, for example, when you first request a web page and data is then stored on your computer or other device so the website or app can access information when you make subsequent requests for pages from that service. These technologies may also be used to collect and store information about your usage of the Company Services, such as pages you have visited, search history, and the video and other content you have viewed.

Other parties that support the Company Services, such as by providing services, allowing you to share content or tracking aggregate Company Services usage statistics, may also use these technologies to collect similar information when you use the Company Services or other parties’ services. Those parties may also use these technologies, along with activity information they collect, to recognize you across the devices you use, such as a mobile device and a laptop or other computer.

Your browser may be initially set to accept cookies, but you can change your settings to notify you when a cookie is being set or updated, and to block cookies altogether. Please consult the “Help” section of your browser for more information, including on how to clear data from local storage and, depending on your browser, how to turn off other data collection by the browser. In connection with Google Analytics, please review the site “How Google uses data when you use our partners’ sites or apps,” located at www.google.com/policies/privacy/partners/. To opt out of Google Analytics specifically, please go to https://tools.google.com/dlpage/gaoptout. Please note that the cookies we use may vary by country. In addition, by blocking any or all cookies you may not have access to certain features, content or personalization available through the Company Services.

Information from Other Sources. We may supplement the information we collect with information from other sources, such as publicly available information about your online and offline activity from social media services, public blockchain sources, commercially available sources, and information from our Company Affiliates or business partners.

‘Do Not Track’. At this time, we do not respond to browser 'Do Not Track', as we await the work of interested stakeholders and others to develop standards for how the ‘Do Not Track’ signal should be interpreted.

3. USE AND DISCLOSURE

We may use the information we collect from and about you to provide the Company Services and features to you, including: to allow you to purchase, sell, receive or display NFTs or other content; to enable you to create and use a Wallet through another party; to measure and improve Company Services and to develop new products and services; to improve your experience with both online and off-line Company Services by delivering content you will find relevant and interesting, including NFTs, and marketing messages; to allow you to comment on content, and participate in online games, contests, other promotions, or rewards programs; to provide you with customer support and to respond to inquiries. In order to provide you with content that is more interesting and relevant to you, we may use the information from and about you to make inferences and predictions about your potential areas of interest. When the information collected from or about you does not identify you as a specific person, we may use that information for any purpose or share it with other parties, to the extent permitted by applicable law.

We use the information we collect from and about you for these additional purposes:

To share with the WWE. Consistent with your choices, we may share your information with the WWE and WWE’s use of your information will be governed by its privacy policy, located at: https://www.wwe.com/page/privacy-policy. If you would like to make a privacy rights request to the WWE, please follow the instructions in the WWE’s privacy policy.

To allow service providers to assist us in providing and managing the Company Services. The information we collect from and about you may be made available to certain service providers, such as contractors, analytics and other measurement companies, and agents, who help us analyze and understand your use of the Company Services, and manage, host, and/or provide the Company Services.

To provide co-branded services and features. We may offer co-branded services or features, such as contests, sweepstakes, or other promotions together with other companies (“Co-Branded Services”). These Co-Branded Services may be hosted on Company Services or on that other party’s service. By virtue of these relationships, we may share the information you submit in connection with the Co-Branded Service with that party. That other party’s use of your information will be governed by its privacy policy.

To contact you. Company may periodically send promotional materials or notifications related to the Company Services. If you want to stop receiving promotional materials, follow the unsubscribe instructions at the bottom of each email. There are certain service notifications and other non-promotional emails that you may not opt-out of, such as notifications of changes to the Company Services terms or policies. If you have installed a mobile app and you wish to stop receiving push notifications, you can change the settings either on your mobile device or through the app.

To deliver video, audio, and other content. In the ordinary course of our business, we may share information that we collect from or about you with other parties in order to process your requests and fulfill your orders for video, audio, and other content offered through the Company Services. For example, we may share such information together with content viewed in order to help you select content; to provide recommendations; to enable interoperability across platforms or services; to authenticate you (or your device or software) to us or to other services; and to stream or deliver content.

To share with our Company Affiliates. Company may share your information with Company Affiliates for the purposes described in this Privacy Policy. A link to a website that lists Company Affiliates can be found at the beginning of this policy. Users who visit Company Affiliates’ services should still refer to their separate privacy policies, which may differ in some respects from this Privacy Policy. To share with business partners. Company may share your information with business partners to permit them to send you marketing communications consistent with your choices.

To protect the rights of Company and others. There may be instances when Company may use or disclose your information, including situations where Company has a good faith belief that such use or disclosure is necessary in order to: (i) protect, enforce, or defend the legal rights, privacy, safety, or property of Company, our Company Affiliates or their employees, agents and contractors (including enforcement of our agreements and our terms of use); (ii) protect the safety, privacy, and security of users of the Company Services or members of the public; (iii) protect against fraud or for risk management purposes; (iv) comply with the law or legal process; or (v) respond to requests from public and government authorities.

In connection with a merger, sale of assets, or other corporate transaction. If Company sells all or part of its business or makes a sale or transfer of its assets or is otherwise involved in a reorganization, merger or transfer of all or a material part of its business (including in connection with a bankruptcy or similar proceedings), or other corporate transaction, Company may transfer or disclose your information to the party or parties involved in the transaction as part of that transaction.

4. SECURITY

Company uses commercially reasonable administrative, technical, personnel, and physical measures designed to safeguard information in its possession against loss, theft and unauthorized use, disclosure, or modification. However, no one can guarantee the complete safety of your information.

5. USER ACCESS AND CONTROL

If you would like to access personal information we hold about you, delete, or correct your personal information you have previously provided directly to us, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault and submit a request. Please note that, for security reasons, we will ask you to verify your identity in order to proceed with your request. If you would like to suppress, or otherwise limit our use of your personal information, you may contact us using the mechanism outlined below. In your request, please include your email address, name, address, and telephone number and specify clearly what information you would like to suppress or limit. We will try to comply with your request as soon as reasonably practicable and consistent with applicable law. Please note that, subject to applicable law, in some cases we may not comply with your request where we may require your information in order to comply with applicable law, or to protect, enforce or defend our rights or employee rights, or those of a Company Affiliate.

If you are a resident of California, please see the section entitled “California Consumer Privacy Act Notice,” below, for more information about the rights you have under California law. Similarly, if you are a resident of the UK, please see the section below entitled “UK Information” more details about the rights you have under UK law and for a link to our UK privacy rights portal. If you are a Virginia consumer, please see the section entitled “For Virginia Consumers” below, for more information about your rights under Virginia law.

You may request that we not share your personal information on a going-forward basis with Company Affiliates or unaffiliated third parties for their direct marketing purposes by contacting us at privacy@bcl.xyz. Please provide your email address, your full name, and specific Company Service to which your request relates. We will try to comply with your request(s) as soon as reasonably practicable and consistent with applicable law.

If you chose to share information with the WWE and would like to make a privacy rights request to the WWE, please follow the instructions in the WWE’s privacy policy at https://www.wwe.com/page/privacy-policy.

6. OTHER IMPORTANT INFORMATION

Updates to Privacy Policy. Company may modify this Privacy Policy. Please look at the Effective Date at the top of this Privacy Policy to see when this Privacy Policy was last revised. Any changes to this Privacy Policy will become effective when we notify you, such as by posting the revised Privacy Policy on the Company Services.

Location of Data. The Company Services are hosted in and managed from the United States. If you are a user located outside the United States, by using any of the Company Services you understand and consent to having any personal information processed in the United States or in any other country in which we have facilities or in which we engage service providers. The United States and other countries’ data protection laws may not be the same as those in your jurisdiction. In certain circumstance, courts, law enforcement agencies, regulatory agencies or security authorities in the United States may be entitled to access your personal information.

Eluvio Services. When you interact with your Eluvio Wallet —such as when you log into your Eluvio Wallet or use your Eluvio Wallet to engage in transactions or access and display NFTs — or use other Eluvio functionality, you are interacting with Eluvio. In addition, your NFTs purchased through and held in your Eluvio Wallet are hosted on a blockchain network operated by Eluvio, which is currently known as the Eluvio Content Fabric. You should review the Eluvio privacy policy for information about the collection, use and sharing of your information by Eluvio and the Eluvio Content Fabric, as well as for information about the choices and rights that Eluvio makes available to you.

Other Wallet Services. When you interact with your Wallet — such as by logging in or using it to engage in transactions or to access or display NFTs — you are interacting with that Wallet provider. NFTs purchased through and held on your Wallet may be hosted on a blockchain network operated by another party. You should review the Wallet provider’s privacy policy for information about the collection, use and sharing of your information and the choices and rights the Wallet provider makes available to you.

Linked Services. The Company Services may be linked to sites operated by the WWE or unaffiliated companies, and may carry advertisements or offer content, marketplaces, games, newsletters, contests or sweepstakes, or other functionality or applications developed and maintained by unaffiliated companies. Company is not responsible for the privacy practices of the WWE or unaffiliated companies, and once you leave the Company Services, you should check the applicable privacy policy of the other service. In addition, Company is not responsible for the privacy or data security practices of other organizations, such as Discord, Facebook, Instagram, Twitter, Apple, Google, Microsoft or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider, or device manufacturer, including in connection with any information you disclose to other organizations through or in connection with the Company Services.

Collection of Personal Financial Information by a Payment Service. In some cases, we may use an unaffiliated payment service to allow you to purchase a product or make payments (“Payment Service”). If you wish to purchase a product or make a payment using a Payment Service, you will be directed to a Payment Service. Any information that you provide to a Payment Service will be subject to the applicable Payment Service's privacy policy, rather than this Privacy Policy. We have no control over, and are not responsible for, any Payment Service's use of information collected through any Payment Service. The Payment Service functionality is operated by Eluvio and its partners. Please review the Eluvio privacy policy for more information. Other Payment Services may be offered or provided by other Wallet providers; please read their privacy policies for more information.

Data Retention. We will retain your information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or allowed by law.

Remember that even after you cancel your account, or if you ask us to delete your personal information, copies of some information may remain viewable in some circumstances where, for example, you have shared information with social media or other services. We may also retain backup information related to your account on our servers for some time after cancellation or your request for deletion, for fraud detection, or to comply with applicable law or our internal security or recordkeeping policies. It may not always be possible to completely remove or delete all of your information due to technical constraints or contractual, financial or legal requirements.

7. CONTACT US

If you have questions about this Privacy Policy, please contact us at privacy@bcl.xyz. Please provide your full name and the specific Company Service that your question pertains to in your message.

8. CALIFORNIA CONSUMER PRIVACY ACT NOTICE

This California Consumer Privacy Act Notice Section provides information for California residents in connection with the California Consumer Privacy Act (“CCPA”). California residents who are prospective, current, or former Company employees; or contractors, emergency contacts, or beneficiaries may view our workforce-related California privacy notice at https://www.fox.com/workforce-privacy-notice/. California residents who are business consumers acting as employees, owners, directors, officers or independent contractors of an entity conducting due diligence or providing or receiving a product or service from Company (“Business-to-Business Contacts”) may view our B2B privacy notice at bcl.xyz/b2bprivacy-policy. Under the CCPA, and for purposes of this Section, “Personal Information” generally means information that identifies, relates to, or describes a particular California resident and includes the categories listed below.

This Section 8 provides details about the categories of Personal Information of California residents that Company has collected and/or disclosed during the last 12 months, as well as rights California residents have under California law.

Categories of Personal Information Collected and/or Disclosed:

The categories of Personal Information that we collected and/or disclosed, are below, along with the categories of third parties to whom each category of Personal Information was disclosed. Please note that depending on the California resident’s interactions with us, Company may not have collected, disclosed and/or disclosed each of these categories about each individual.

Category of Personal Information Collected	Categories of Third Parties to Whom Personal Information Is Disclosed
Identifiers such as name, IP address, email address, and online and device identifiers	Service providers, Company Affiliates, WWE (if you sign up to receive emails from WWE, your email address is shared with WWE), and other providers or partners that support our operational business purposes
Personal information, as defined in the California Customer Records law, such as contact and financial information	Service providers, Company Affiliates, and other providers or partners that support our operational business purposes
Commercial information, such as transaction information and purchase history, such as NFTs purchased, sold, or received, and wallet type	Service providers, Company Affiliates, WWE (if you choose to share your information with WWE), and other providers or partners that support our operational business purposes
Internet or network activity information, such as browsing history and interactions with our websites, mobile, or connected TV applications (collectively, “Company Digital Properties”)	Service providers, Company Affiliates, and other providers or partners that support our operational business purposes
Geolocation data, such as device location	Service providers, Company Affiliates, and other providers or partners that support our operational business purposes
Audio, electronic, visual and other similar information, such as call recordings	Service providers, Company Affiliates, and other providers or partners that support our operational business purposes
Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.	Service providers, Company Affiliates, and other providers or partners that support our operational business purposes

Sale and Sharing of Personal Information. We do not “sell” or “share” Personal Information as those terms are defined by the CCPA.

Sources of Personal Information. We collect this Personal Information directly from California residents themselves, and we may also collect this Personal Information from: Eluvio; Wallet providers; blockchains; joint marketing or co-promotional partners; Company Affiliates; and sources of demographic and other information. We also may obtain Personal Information that is made available to Eluvio or us by social media platforms or SSO providers (e.g., if the individual has created an account via SSO or connected a social media account to a Company Service). Depending on the individual’s interactions with us, Company may not have collected Personal Information from each of these categories of sources.

Purposes. We may use this Personal Information and/or disclose it to third parties for the following purposes:

to operate, manage, and maintain our business, including in connection with a sale, acquisition, reorganization, merger, transfer of all or a part of our business, or other corporate transaction (e.g., a bankruptcy or similar proceeding);
to provide our products and services;
to accomplish our business purposes and objectives, including:
- developing, improving, repairing, and maintaining our products and services;
- personalizing, advertising, and marketing our products and services;
- conducting research, analytics, and data analysis;
- maintaining our facilities and infrastructure;
- quality and safety assurance measures;
- conducting risk and security controls and monitoring;
- detecting and preventing fraud;
- performing identity verification;
- performing accounting, audit, and other internal functions;
- complying with law, legal process, and internal policies;
- maintaining records; and
- exercising and defending legal claims.

Depending on the California resident’s interactions with us, Company may not have used Personal Information collected about that resident for each of these purposes.

Sensitive Personal Information. We do not process “sensitive” Personal Information for purposes other than those specified in the CCPA Regulations section 7027(m) (such as to provide the services and for security purposes).

Data Retention. We will retain Personal Information from or about you as reasonably necessary and proportionate to achieve the purpose(s) for which the Personal Information was collected or processed as outlined in this Section 8 unless a longer retention period is required or allowed by law.

California Rights. If you are a California consumer, you have the following rights:

Right to Know. You have the right to request that we disclose to you the following information: The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information; The specific pieces of Personal Information we collected about you for the applicable time period; The business or commercial purpose for collecting, disclosing, or selling Personal Information about you; The categories of Personal Information about you that we sold and the categories of third parties to whom we sold that Personal Information; and The categories of Personal Information about you that we otherwise shared or disclosed and the categories of third parties with whom we shared or disclosed that Personal Information.

To make a request for your Personal Information, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name and email address, along with other details about your request. You will then receive verification instructions by email. In some circumstances, we may need additional information from you to verify your identity or proceed with your request. You can use an authorized agent to submit a request for your Personal Information. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons. Please note that, in some instances, we may decline to honor your request, where, for example, we are unable to verify your identity or an exception to this right applies. If you chose to share information with the WWE and would like to make a privacy rights request to the WWE, please follow the instructions in the WWE’s privacy policy at https://www.wwe.com/page/privacy-policy.

Right to Request Deletion. You have the right to request that we delete Personal Information we collected from you. To make a request for deletion, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name and email address, along with other details about your request. You will then receive verification instructions by email. Please note that you also will be asked to separately confirm that you would like to proceed with your deletion request. In some circumstances, we may need additional information from you to verify your identity or proceed with your request.

You can use an authorized agent to submit a request for deletion. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons. Please note that, in some instances, we may decline to honor your request where, for example, we are unable to verify your identity or an exception to this right applies. If you chose to share information with the WWE and would like to make a privacy rights request to the WWE, please follow the instructions in the WWE’s privacy policy at https://www.wwe.com/page/privacy-policy.

Right to Request Correction. You have the right to request that we correct inaccurate Personal Information we collected about you.

To make a request for correction of inaccurate Personal Information, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name, email address, and the Personal Information you would like to have corrected, along with other details about your request. You will then receive verification instructions by email. In some circumstances, we may need additional information from you to verify your identity or proceed with your request.

You can use an authorized agent to submit a request for correction of inaccurate Personal Information. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons.

Please note that, in some instances, we may decline to honor your request where, for example, we are unable to verify your identity or an exception to this right applies.

Right to be Free from Discrimination. You have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

9. FOR VIRGINIA CONSUMERS

This section provides information for Virginia consumers in connection with the Virginia Consumer Data Protection Act (“VCDPA”). Under the VCDPA, and for purposes of this Section, “Personal Data” generally means information that identifies, relates to, or describes a particular Virginia consumer and includes the categories listed below. This Section 9 provides details about the categories of Personal Data of Virginia consumers that we have collected or disclosed, as well as rights Virginia consumers have under Virginia law. We do not process Personal Data for the purposes of targeted advertising.

Categories of Personal Data Collected or Disclosed:

The categories of Personal Data that we collected or disclosed are below, along with the categories of third parties to whom each category of Personal Data was disclosed. Please note that depending on the Virginia consumer’s interactions with us, Company may not have collected or disclosed each of these categories about each individual.

Category of Personal Data Collected/Processed	Categories of Third Parties to Whom Personal Data Is Disclosed
Identifiers, such as name, IP address, email address, and online and device identifiers	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Personal information, such as contact and financial information	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Commercial information, such as transaction information and purchase history (e.g., NFTs purchased, sold, or received, and wallet type)	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Internet or network activity information, such as browsing history and interactions with our websites, mobile, or connected TV applications (collectively, “Company Digital Properties”)	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Geolocation data, such as device location	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Audio, electronic, visual and other similar information, such as call recordings	Service providers, Affiliates, and other providers or partners that support our operational business purposes
Inferences drawn from any of the Personal Data listed above to create a profile or summary about, for example, an individual’s preferences and characteristics	Service providers, Affiliates, and other providers or partners that support our operational business purposes

Purposes. We may use Personal Data for the following purposes:

to operate, manage, and maintain our business, including in connection with a sale, acquisition, reorganization, merger, transfer of all or a part of our business, or other corporate transaction (e.g., a bankruptcy or similar proceeding);
to provide our products and services;
to accomplish our business purposes and objectives, including:
- developing, improving, repairing, and maintaining our products and services;
- personalizing, advertising, and marketing our products and services ;
- conducting research, analytics, and data analysis;
- maintaining our facilities and infrastructure;
- quality and safety assurance measures;
- conducting risk and security controls and monitoring;
- detecting and preventing fraud;
- performing identity verification;
- performing accounting, audit, and other internal functions;
- complying with law, legal process, and internal policies;
- maintaining records; and exercising and defending legal claims.

Depending on the Virginia consumer’s interactions with us, Company may not have used Personal Data collected about that resident for each of these purposes.

Targeted Advertising and “Sale” of Personal Data.

We do not “sell” Personal Data or process Personal Data in connection with “targeted advertising,” as the terms are defined under the VCDPA. Please note that the VCDPA definition of “sale” is the exchange of information for monetary consideration and does not include, for example, the transfer of Personal Data as an asset that is part of a merger, bankruptcy, or other similar transaction involving of all or any portion of our business

Virginia Rights. If you are a Virginia consumer, you have the following rights:

Right to Access and Portability. You have the right to request that we disclose to you the Personal Data we collected from you, including in a portable form.

To make a request for your Personal Data, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name and email address, along with other details about your request. You will then receive verification instructions by email. In some circumstances, we may need additional information from you to verify your identity or proceed with your request.

You can use an authorized agent to submit a request for your Personal Data. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons.

Please note that, in some instances, we may decline to honor your request where, for example, we are unable to verify your identity or an exception to this right applies.

Right to Request Deletion. You have the right to request that we delete Personal Data we collected from you or about you.

To make a request for deletion, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name and email address, along with other details about your request. You will then receive verification instructions by email. Please note that you also will be asked to separately confirm that you would like to proceed with your deletion request. In some circumstances, we may need additional information from you to verify your identity or proceed with your request.

You can use an authorized agent to submit a request for deletion. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons.

Please note that, in some instances, we may decline to honor your request where, for example, we are unable to verify your identity or an exception to this right applies.

Right to Request Correction. You have the right to request that we correct inaccurate Personal Data we collected about you.

To make a request for correction of inaccurate Personal Data, please visit https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault or call us at 888-596-3929. You will need to provide your name, email address, and the Personal Data you would like to be corrected, along with other details about your request. You will then receive verification instructions by email. In some circumstances, we may need additional information from you to verify your identity or proceed with your request.

You can use an authorized agent to submit a request for correction of inaccurate Personal Data. When submitting a request online, your authorized agent should select the “Other” option on the form and, in the field provided, include your name, your email address, and whether or not you have an account/profile with us. In addition to verifying your identity, as described above, we also will need to verify your authorized agent’s ability to act on your behalf (e.g., by receiving a copy of your signed permission). Once verification is complete, we may communicate directly with you for privacy and security reasons.

Please note that, in some instances, we may decline to honor your request where, for example, we are unable to verify your identity or an exception to this right applies.

Right to Appeal. If you receive a denial of a personal data rights request and would like to request an appeal, please notify us through our privacy rights portal following the instructions provided with the denial of your request.
Right to be Free from Discrimination. You have the right to be free from unlawful discrimination for exercising your rights under the VCDPA.

10. UK INFORMATION

This section of the Privacy Notice applies if you are in the United Kingdom (UK), and supplements the information above in Sections 1 through 7 of this Policy.

Cookies and Other Similar Technologies Browser cookies are small pieces of text data that are stored in your browser when you visit a website. For more information about how we use cookies and other similar technologies, including to learn about choices regarding these technologies, please visit our Cookie Policy.

Legal Bases for Data Processing When processing personal information described in Sections 2 and 3 above, and our processing of personal information requires a lawful basis, we rely upon the following:

To provide the Company Services, including allowing you to purchase, sell, receive or display NFTs and to deliver video, audio, and other content. We process your personal information required to provide the Company Services based on performance of contract. In order to provide the Company Services, as noted above in this Privacy Policy, we may share your personal information with service providers entrusted with processing activities in support of those Services. This processing is necessary, since we otherwise could not provide these services to you.
To share with the WWE. With your consent, we share, Registration Information, Wallet Information and Blockchain History Information with the WWE.
To provide co-branded services and features. With your consent, we may share the information you submit in connection with the co-branded service with that party, such as business partners or Company Affiliates. Participating in these co-branded services and features is optional.
To deliver advertisements. If Company and our service providers use the information we collect from and about you as described above in this Privacy Policy to deliver ads to you when you use the Company Services or another service (on any of your devices), we do so on the basis of legitimate interest. If we or our service providers use your personal information to serve interest-based advertising using non-essential cookies or similar technology, we rely on your consent.
To contact you for marketing purposes. With your consent, we may periodically send promotional materials or notifications related to the Company Services. If you want to stop receiving promotional materials, follow the unsubscribe instructions at the bottom of each email. Providing your email address for marketing is optional..
To protect the rights of Company and others. Where we process your personal information to: (i) protect, enforce, or defend the legal rights, privacy, safety, or property of Company, our Company Affiliates or its employees, agents and contractors (including enforcement of our agreements and our terms of use); (ii) protect the safety, privacy, and security of users of the Company Services or members of the public; (iii) protect against fraud or for risk management purposes; (iv) comply with the law or legal process; or (v) respond to requests from public and government authorities, this processing is necessary for compliance with legal obligations and legitimate interest (when protecting against fraud or asserting similar rights).
In connection with a merger, sale of assets, or other corporate transaction. In the event that Company is involved in a reorganization, merger or transfer of all or a material part of its business (including in connection with a bankruptcy or similar proceedings), or other corporate transaction, this processing is performed on the basis of legitimate interest of the Company and its counterparties to perform such economic activities, which is adequately balanced with your interest because the data processing is performed within the limits strictly necessary to perform these economic activities.

UK Data Subject Rights If you reside in the UK, you have several rights regarding your personal information that we maintain about you, including

The right to access. You may have the right to receive a copy of your personal information and details about how your personal information is processed;
The right to rectification. You may have the right to correct your personal information;
The right to portability. You may have the right to receive a machine-readable copy of your personal information, when applicable, or ask us to transmit electronically the personal information you have provided to us and we still hold about you to a third party;
The right to erasure. You may have the right to ask us to erase or restrict how we use your personal information, unless certain specific exceptions apply (e.g., for the establishment, exercise or defense of legal claims);
The right to lodge a complaint with the Supervisory Authority. You have the right to lodge a complaint with the relevant supervisory authority;
The right to object to or restrict processing. Under certain circumstances, you have the right to object to or restrict our processing of your personal information; and
The right to withdraw consent You have the right to withdraw the consent you previously provided to us to use your personal information.

If you would like to exercise any of these rights, please visit our online UK privacy rights portal at https://fcprivacy.exterro.net/portal/dsar.htm?target=WWE_Moonsault_UK. For more information about how we use cookies and other similar technologies, including to learn about choices regarding these technologies, please visit our Cookie Policy.

Please note that there may be circumstances in which we are not required to comply with a request because of relevant exceptions provided under applicable law. In some instances, for example, this may mean that we are able to retain your personal information even if you withdraw your consent

Retention of Personal Information We will retain your data only for the period necessary to fulfill the purposes for which the data was collected as outlined in this Privacy Policy. Data is retained for the time necessary to enable the Company Services plus the length of any applicable statutory limitation period following the termination of the Company Services.

At the end of the retention period, data will be either deleted, anonymized, or aggregated.

International Data Transfers Your personal information may be transferred to countries outside the UK, including to the United States, which may offer a different level of data protection than applies in the UK. Some non-UK countries are recognized by the UK Secretary of State as providing an adequate level of data protection according to UK standards. The full list of these countries is available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/. For transfers from the UK to countries not considered adequate by the UK Secretary of State, we have put in place appropriate and suitable safeguards designed to protect your personal information and the transfer of your personal information in compliance with applicable data protection laws, such as standard contractual clauses adopted by the UK under Articles 45 and 46 of the UK General Data Protection Regulation (UK GDPR).

You have the right to request a copy of the above measure or further information on your personal information by contacting us using the contact details below.

Contact Us If you have questions about this Privacy Policy, you can contact us by email at privacy@bcl.xyz or you may contact our Article 27 Representative in the UK at:

EDPO UK Ltd.

8 Northumberland Avenue, London, WC2N 5BY, United Kingdom

or by using EDPO’s online request form: https://edpo.com/gdpr-data-request/