Processing of personal data

DEAR CUSTOMER, DEAR BUSINESS PARTNER! The protection of your privacy is our highest priority. This Personal Data Processing Policy explains what personal data we process about you, in what way, why we process it, and to whom the personal data is provided or disclosed, regardless of which communication channel or means (online or in person) you use when communicating with us. Therefore, please read this Personal Data Processing Policy carefully. WHO PROCESSES YOUR PERSONAL DATA? The company STEAM FACTORY a.s., with its registered office at Moldavská cesta 32, Košice 04011, ID No. (IČO): 50938355, registered in the Commercial Register of the District Court Košice, Section: Sro, Insert No.: 41648/V (hereinafter referred to as the "Company"), processes your personal data as a controller to the extent and under the conditions set out in this notice. When processing your personal data in our information systems as a controller, we act exclusively in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also referred to as the "Regulation") and Act No. 18/2018 Coll. on Personal Data Protection (hereinafter also referred to as the "Act"). FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS ARE YOUR PERSONAL DATA PROCESSED? In order for you to use the services of our entertainment center, we need to process some of your personal data, which is necessary to make a reservation and subsequently provide services or deliver goods, make payments, and fulfill other contractual obligations, particularly related to exercising rights from warranty, complaints, and the like. (Legal basis: Art. 6, paragraph 1, letter b) of the Regulation). We will therefore obtain and further process your personal data on the basis of generally

binding legal regulations or on the basis of your consent. The legal basis of processing for purposes where your consent is not required is, in particular, the purpose of concluding and performing a contract (or accepting and confirming a reservation), fulfilling obligations under generally binding legal regulations, or protecting our rights and legally protected interests. If we process your data on the legal basis of Art. 6, paragraph 1, letter a) of the Regulation – consent to processing, we process your data exclusively under the conditions and for the purposes for which you have given us your consent. Such purposes are in particular: advertising, marketing, and promotional activities of our company, sending newsletters, operating your user account, issuing a Loyalty Card. Please remember that when we ask you to fill in your personal data to provide you with access to any function or service of the Platform, certain fields will be marked as mandatory. We do so because these are data that are necessary to provide the given service or for access to the given function. Please keep in mind that if you decide not to provide us with these data, you may not be able to complete your registration as a user, or you may not be able to use the given services or functions. If you choose the function to save payment card data for subsequent purchases when purchasing through our Website, we will need to process your data for the purpose of activating and expanding this function. Consent to the activation of this function allows your payment details to be filled in automatically for subsequent purchases, so you will not have to enter them for each purchase, and they will be considered valid and effective for each subsequent purchase. You can change or delete your payment card details at any time through the relevant section in the payment information from your registered user account on the Website. On our website, it is possible to make a booking for a time slot in our entertainment and sports center not only as a user but also as a guest. For this type of purchase, only data necessary to process your reservation will be required from you. After completing the reservation process, you will be offered the option to register and create a user account or continue as an unregistered user. Establishing a user account is subject to granting consent to the processing of personal data. After establishing

user account, you will receive a confirmation email about the establishment along with information on the conditions of processing your data. WHAT IS THE SCOPE OF THE PROCESSED DATA? According to this notice, we will process mainly the following personal data: ✓ first name, surname, residence, and date of birth of the data subject, and in the case of a minor, also of their legal representative, ✓ contact telephone number and email address, ✓ bank details and payment card details, ✓ if the data subject has specific needs arising, for example, from their state of health, these data may also be processed, ✓ photographs or videos capturing the likeness of the data subject, ✓ other personal data that we necessarily need to process in accordance with the stated purposes. Upon written request, we will inform you in more detail whether we also store other data about you. HOW LONG DO WE PROCESS YOUR DATA FOR? We obtain your personal data directly from you, and throughout the processing period, they will be stored securely, in accordance with the security policy. The processing period of your personal data lasts only for the time necessary to fulfill the purpose of processing in accordance with the statutory periods and the periods established by the registry and archival regulations. In the event that we process your data on the basis of

granted consent, we will process these data only for the duration of this consent, unless a generally binding legal regulation obliges us to store these data even after the withdrawal of your consent. TO WHOM DO WE PROVIDE YOUR DATA? We do not share, sell, transfer, or otherwise distribute your personal data to third parties, and we will not do so in the future unless required by law, required for the purpose of the contract, or unless you give explicit consent to do so. For the purposes of contract performance and the use of cookies, it is necessary to provide your personal data to the following third parties: ✓ providers of technological services, ✓ providers and partners in the field of logistics, transport, and delivery, ✓ providers of services related to customer service, ✓ providers and partners in the field of services related to marketing and advertising. The Company has a legal obligation to provide your personal data, in particular during inspections, supervisory activities, or at the request of authorized state authorities or institutions, if so required by special regulations. WHAT ARE THE RIGHTS OF THE DATA SUBJECT? Under the Regulation, and unless generally binding legal regulations provide otherwise, you have the right:

✓ to access your personal data and the right to obtain confirmation as to whether or not personal data concerning you are being processed, and if so, what personal data we process, for what purpose, for what period of time and other details relating in particular to controllers, processors and other entities to whom this data may be provided; ✓ to withdraw your consent at any time if your personal data are processed on the basis of your consent; ✓ to request the correction or update of your personal data so that they are always accurate and up to date; ✓ to the erasure of your personal data if the period of their lawful processing has expired; ✓ to restrict the processing of your personal data, for example if you have contested the accuracy of your personal data, for a period enabling us to verify its accuracy; ✓ to obtain your personal data in electronic format, which you have provided to us, for yourself or for another controller; ✓ to lodge a complaint with us and/or with the Office for Personal Data Protection of the Slovak Republic. You may exercise these rights by sending a written request to our address or by email to recepcia@steamfactory.sk WEBSITE AND COOKIES PROTECTION

It is our duty to protect the privacy of our website users as well. When you visit our website, our web servers always, for security reasons, store the connection data of the computer connecting to our site, a list of the web pages you visit within our site, the date and duration of your visit, the identification data of the type of browser and operating system used, as well as the website through which you connect to our site. We use tracking software to determine how many users visit our website and how often. We do not use this software to collect personal data or individual IP addresses. This data is used solely in an anonymous and aggregated form for statistical purposes and website development. We use cookies and similar technologies to facilitate the browsing of the Platform, to obtain information about how you interact with us, and, in certain cases, to be able to display advertising to you based on your browsing habits. Please read our Cookies Policy to learn more about the cookies and similar technologies we use, their purpose, and other similar information. INFORMATION ABOUT "COOKIES" A "cookie" is a small text file with information about your navigation on the site, which the website stores on your computer, phone, or other device. "Cookies" are necessary to facilitate and simplify browsing and do not damage your computer in any way. Although we use the general term "cookies" in these Rules, as they are the main method of storing information used by the site, the "local storage" space in the browser is also used for the same purpose as "cookies". All information provided in this section also applies to "local storage". "Cookies" are an essential part of how the website works. The main purpose of our "cookies" is to improve your browsing experience. For example, they are used to remember your preferences (language, country, etc.) during browsing and future visits. The information collected by "cookies" also allows us to improve the site

by estimating numbers and usage patterns, its suitability for individual user interests, faster searching, etc. Occasionally, if you have given us your prior informed consent, we may use cookies, tags, and similar devices to obtain information that enables us to show you, either on our own site or on third-party sites or otherwise, advertising based on the analysis of your browsing habits. We do not store sensitive personal information such as address, password, credit or debit card details in the cookies we use. The information stored in the cookies from our site is used solely by us, with the exception of those identified below as "third-party cookies", which are used and managed by external entities to provide services requested by us to improve our services and the user's experience when browsing the site. The main services for which we use these "third-party cookies" are to obtain access to statistics and to ensure the execution of payment operations. If you wish to avoid the use of cookies on the site, taking into account the limitations mentioned above, you must first disable their use in your browser and then delete the cookies saved in the browser associated with this site. You can use this option at any time to prevent the use of cookies. You can restrict, block, or delete cookies from this site at any time by changing your browser configuration. Although each browser has different settings, cookies are usually configured in the "Preferences" or "Tools" menu.