Privacy Policy of SuperHeroes Amsterdam B.V.

This is the privacy policy of SuperHeroes Amsterdam B.V. ( Keizersgracht 585 1017 DR Amsterdam, Chamber of Commerce (KvK) number: 34356615) (hereinafter: "SuperHeroes"). SuperHeroes handles your personal data confidential. On this page, you can read how SuperHeroes handles the personal data obtained through the website. SuperHeroes always complies with the General Data Protection Regulation (GDPR).

Changes to this privacy policy This privacy policy may be revised from time to time. If there is a fundamental change in the nature of the use of your personal data or if the change is otherwise relevant to you, we will ensure that this information is provided well in advance before the change actually takes effect.

Do you have any questions regarding our privacy policy? If you have any questions about our privacy policy or wish to exercise your rights, you can contact us using the contact information below: By email: airmail@hellosuperheroes.com By phone:+31 (0)20 846 38 06

Chamber of Commerce (KvK) number: 34356615 VAT NL821191299B01

Definitions a. Privacy statement: this privacy statement; b. User: any user of the Website; c. Respondent: SuperHeroes B.V., Keizersgracht 585 1017 DR Amsterdam, airmail@hellosuperheroes.com, +31 (0)20 846 38 06 d. Website: the website under hellosuperheroes.com.

5 Modification/deletion of personal data 5.1 The User has the right to access, correct, supplement, delete and protect his or her personal data, in accordance with the provisions of the Personal Data Protection Act. 5.2 If the User wishes to make use of any of these rights, or if the User has any questions about this Privacy Statement, the User can reach Respondent at airmail@hellosuperheroes.com or postal address Keizersgracht 585 1017DR Amsterdam. 5.3 Users can unsubscribe from the newsletter by sending an e-mail to airmail@hellosuperheroes.com.

8 Amendments to the Privacy Statement. 8.1 Respondent reserves the right to modify this Privacy Statement. Any modification will be announced on this page. Therefore, Respondent advises the User to check this page regularly to see if any modifications have been made. The current Privacy Statement has been updated on March 15, 2024. Owner and Data Controller SuperHeroes Amsterdam B.V. Keizersgracht 585, 1017 DR Amsterdam, Netherlands K.v.K. te Amsterdam 34356615 = BTW nummer NL821191299B01 Data Protection Officer: airmail@hellosuperheroes.com Owner contact email: airmail@hellosuperheroes.com Types of Data collected Among the types of Personal Data that this Website collects, by itself or through third parties, there are: email address; password; Data communicated while using the service; Trackers; Usage Data; first name; last name; various types of Data; invoicing information; Universally unique identifier (UUID); purchase history; device information; phone number; physical address; user subscriptions; IP address; page views; device logs; operating systems; browsing history; browser information; clicks; interaction events; scroll-to-page interactions; scroll position; crash data; number of Users; session statistics. Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection. Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Website. Unless specified otherwise, all Data requested by this Website is mandatory and failure to provide this Data may make it impossible for this Website to provide its services. In cases where this Website specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service. Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner. Any use of Cookies – or of other tracking tools — by this Website or by the owners of third-party services used by this Website serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy. Users are responsible for any third-party Personal Data obtained, published or shared through this Website. Mode and place of processing the Data Methods of processing The Owner takes appropriate security measures to prevent unauthorised access, disclosure, modification, or unauthorised destruction of the Data. The Data processing is carried out using computers and/or IT enabled tools, following organisational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time. Place The Data is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data. Retention time Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on the Users’ consent.

The purposes of processing The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Contacting the User, Registration and authentication provided directly by this Website, Access to third-party accounts, Managing support and contact requests, Hosting and backend infrastructure, Remarketing and behavioural targeting, Traffic optimization and distribution, Advertising, Analytics, Infrastructure monitoring, Handling payments, Commercial affiliation, Data transfer outside the EU, Collection of privacy-related preferences, Interaction with live chat platforms, User database management, Interaction with data collection platforms and other third parties, Registration and authentication, Managing web conferencing and online telephony, Tag Management, Displaying content from external platforms, Managing contacts and sending messages, Connecting Data, Selling goods and services online, Internal processing tools, Content performance and features testing (A/B testing), Building and running this Website, Handling activities related to compliance and Heat mapping and session recording. For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”. Meta permissions asked by this Website This Website may ask for some Facebook or Instagram permissions allowing it to perform actions with the User's Facebook account and to retrieve information, including Personal Data, from it. This service allows this Website to connect with the User's account on the Facebook and Instagram social network, provided by Meta Inc. For more information about the following permissions, refer to the Facebook permissions documentation and to the Facebook privacy policy.

The permissions asked are the following: Basic information By default, this includes certain User’s Data such as id, name, picture, gender, and their locale. Certain connections of the User, such as the Friends, are also available. If the User has made more of their Data public, more information will be available. device information

Email Provides access to the User's primary email address. Detailed information on the processing of Personal Data Personal Data is collected for the following purposes and using the following services:

Access to third-party accounts This type of service allows this Website to access Data from your account on a third-party service and perform actions with it. These services are not activated automatically, but require explicit authorization by the User. Facebook account access (Meta Platforms, Inc.) This service allows this Website to connect with the User's account on the Facebook social network, provided by Meta Platforms, Inc. Permissions asked: device information; Email; Trackers. Legal basis for processing: Consent. Place of processing: United States – Privacy Policy. Legal basis for data transfer: Standard data protection clauses. Category of personal information collected according to the CCPA: identifiers; internet or other electronic network activity information. Analytics The services contained in this section enable the Owner to monitor and analyse web traffic and can be used to keep track of User behaviour.

TikTok (Bytedance) The Display API is used to collect TikTok creator's videos and their profile information to target influencers for products and services and track performance of our own videos. Users can learn more by consulting TikTok official documentation. Personal Data processed: basic profile information, Get the metadata of a TikTok user's recently uploaded videos., Get the metadata of TikTok a user's videos filtered by video Id.

Legal basis for processing: Consent. Place of processing: Netherlands. Category of personal information collected according to the CCPA: internet or other electronic network activity information.

Google Analytics 4 (Google Ireland Limited) Google Analytics 4 is a web analysis service provided by Google Ireland Limited (“Google”). Google utilises the Data collected to track and examine the use of this Website, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualise and personalise the ads of its own advertising network. In Google Analytics 4, IP addresses are used at collection time and then discarded before Data is logged in any data centre or server. Users can learn more by consulting Google’s official documentation. Personal Data processed: number of Users; session statistics; Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: Ireland – Privacy Policy – Opt Out. Category of personal information collected according to the CCPA: internet or other electronic network activity information. Connecting Data This type of service allows the Owner to connect Data with third-party services disclosed within this privacy policy. This results in Data flowing through these services, potentially causing the retention of this Data.

Make.com Make.com is a workflow automation service provided by Make.com. that automates the movement of Data between (third-party) services. Personal Data processed: Data communicated while using the service. Place of processing: EU – Privacy Policy. Category of personal information collected according to the CCPA: internet or other electronic network activity information. Advertising This type of service allows User Data to be utilised for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on this Website, possibly based on User interests. This does not mean that all Personal Data are used for this purpose. Information and conditions of use are shown below. Some of the services listed below may use Trackers for identifying Users, behavioural retargeting i.e. displaying ads tailored to the User’s interests and behaviour, or to measure ads performance. For more information, please check the privacy policies of the relevant services. Services of this kind usually offer the possibility to opt out of such tracking. In addition to any opt-out feature offered by any of the services below, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section "How to opt-out of interest-based advertising" in this document. TikTok Pixel (Bytedance) TikTok ads conversion tracking is an analytics service provided by Bytedance Platforms, Inc. that connects data from the TikTok with actions performed on this Website. The TikTok pixel tracks conversions that can be attributed to ads on TikTok. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: United States – Privacy Policy – Opt out. Legal basis for data transfer: Standard data protection clauses. Category of personal information collected according to the CCPA: internet or other electronic network activity information. This processing constitutes: a sale according to the CCPA, VCDPA, CPA, CTDPA and UCPA a sharing according to the CCPA targeted advertising according to the VCDPA, CPA, CTDPA and UCPA

Google Ads conversion tracking (Google Ireland Limited) Google Ads conversion tracking is an analytics service provided by Google Ireland Limited that connects data from the Google Ads advertising network with actions performed on this Website. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: Ireland – Privacy Policy. Legal basis for data transfer: No data transfer. Category of personal information collected according to the CCPA: internet or other electronic network activity information. Meta ads conversion tracking (Meta pixel) (Meta Platforms, Inc.) Meta ads conversion tracking (Meta pixel) is an analytics service provided by Meta Platforms, Inc. that connects data from the Meta with actions performed on this Website. The Meta pixel tracks conversions that can be attributed to ads on Facebook, Instagram and Meta.. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: United States – Privacy Policy – Opt out. Legal basis for data transfer: Standard data protection clauses. Category of personal information collected according to the CCPA: internet or other electronic network activity information. This processing constitutes: a sale according to the CCPA, VCDPA, CPA, CTDPA and UCPA a sharing according to the CCPA targeted advertising according to the VCDPA, CPA, CTDPA and UCPA Meta Lookalike Audience (Meta Platforms Ireland Limited) Meta Lookalike Audience is an advertising and behavioral targeting service provided by Meta Platforms Ireland Limited that uses Data collected through Meta's Custom Audience in order to display ads to Users with similar behavior to Users who are already in a Custom Audience list on the basis of their past use of this Website or engagement with relevant content across Meta's apps and services. On the basis of these Data, personalised ads will be shown to Users suggested by Meta Lookalike Audience. Users can opt out of Meta's use of Trackers for ads personalization by visiting this opt-out page. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: Ireland – Privacy Policy – Opt out. Category of personal information collected according to the CCPA: internet or other electronic network activity information. Microsoft Advertising (Microsoft Corporation) Microsoft Advertising is an advertising service provided by Microsoft Corporation. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: United States – Privacy Policy – Opt Out. Category of personal information collected according to the CCPA: internet or other electronic network activity information.

Google Ads Similar audiences (Google Ireland Limited) Similar audiences is an advertising and behavioral targeting service provided by Google Ireland Limited that uses Data from Google Ads Remarketing in order to display ads to Users with similar behavior to Users who are already on the remarketing list due to their past use of this Website. On the basis of this Data, personalized ads will be shown to Users suggested by Google Ads Similar audiences. Users who don't want to be included in Similar audiences can opt out and disable the use of advertising Trackers by going to: Google Ad Settings. In order to understand Google's use of Data, consult Google's partner policy. Personal Data processed: Trackers; Usage Data. Legal basis for processing: Consent. Place of processing: Ireland – Privacy Policy – Opt Out. Legal basis for data transfer: Standard data protection clauses. Category of personal information collected according to the CCPA: internet or other electronic network activity information. This processing constitutes: