Cookie Policy

Applicable entities:

Vuly Play Pty Ltd, 95 Ingleston Road, Wakerley, Brisbane QLD 4154, Australia (Australian visitors)

Europe Play Operations B.V., Hofplein 20, 3032 AC Rotterdam, The Netherlands (EU visitors)

United Kingdom Play Ltd (Co. No. 16492883), C/O Windsor House, Station Court, Station Road, Great Shelford, Cambridge, England, CB22 5NE (UK visitors)

Vuly Canada Operations Corp., 1055 W. Georgia St, Unit 1500, Vancouver, BC V6E 4N7, Canada (Canadian visitors)

American Play LLC (EIN 99-2968094), 4201 Redwood Ave, 1st Floor, Los Angeles, CA 90066, United States (US visitors)

Vuly NZ Limited (Company Number 6340414) Suite 1091 Unit A Level G 26 Hobson Street Auckland City 1010 New Zealand (NZ visitors)

1. INTRODUCTION

This Cookie Policy explains how Vuly Play Group and its affiliated entities (collectively "Vuly Play", "we", "us", "our") use cookies and similar tracking technologies on our websites, including vulyplay.com and any regional or localised versions thereof (collectively, the "Sites").

By using our Sites, you acknowledge that we use cookies as described in this policy. Depending on your location, we may ask for your consent before placing certain cookies. Where consent is required, you can manage your preferences at any time through our Consent Management Platform, Cookiebot by Usercentrics, accessible via the "Cookie Settings" link in the footer of our Sites.

Where we do not require consent for certain cookies (for example, strictly necessary cookies, or in the UK, certain analytics and preference cookies that qualify for exemption under PECR as amended by the Data (Use and Access) Act 2025), we will still provide clear information about those cookies and a means for you to object or opt out.

2. WHAT ARE COOKIES?

2.1 Cookies are small text files placed on your device (computer, tablet, or mobile) when you visit a website. They allow the website to recognise your device, remember your preferences, and collect information about how you use the site.

2.2 We also use similar technologies including:

• Web beacons / pixels: small transparent images embedded in pages or emails that track whether content has been viewed;
• Local storage: browser-based storage used to retain preferences between sessions;
• Session tokens: temporary identifiers used to maintain your session while browsing; and
• Tags: code snippets (such as those managed via Google Tag Manager) that trigger the loading of third-party scripts and tracking tools. Where Google Tag Manager or a similar tag management system is used to deploy third-party cookies, the act of triggering those scripts constitutes "instigating" the storage of or access to information on your device and is subject to the same consent and transparency requirements as direct cookie placement.

3.0 CATEGORIES OF COOKIES WE USE

3.1 Strictly Necessary Cookies

These cookies are essential for the Sites to function and cannot be disabled. They include:

• session management (keeping you logged in, maintaining your shopping cart);
• security tokens (fraud prevention, authentication);
• load balancing and server routing; and
• Cookiebot by Usercentrics (consent management and preference storage).
• Legal basis: Strictly necessary cookies are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive (EU) and the equivalent UK PECR provisions, because they are technically necessary to provide a service explicitly requested by the user. No consent is required for these cookies. To the extent any personal data is incidentally processed, the applicable GDPR / UK GDPR legal basis is performance of a contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)).

3.2 Functional / Preference Cookies

• These cookies remember your choices and personalise your experience, such as language preferences, region selection, and display settings.
• Legal basis (EU): Consent (Article 6(1)(a) GDPR).
• Legal basis (UK): For UK visitors, preference and appearance cookies that are used solely to adapt the Sites to reflect and save user preferences, or to improve the Sites' appearance and functionality, may qualify for the consent exemption introduced by the Data (Use and Access) Act 2025 amending PECR. Where this exemption applies, we will provide clear information about these cookies and a means to opt out, but will not require prior consent. Where the exemption does not apply, we rely on consent.
• Legal basis (all other jurisdictions): Consent or implied consent as applicable under local law.

3.3 Analytics and Performance Cookies

These cookies collect information about how visitors use our Sites, including which pages are visited most often, how long visitors spend on pages, and any error messages received. Information is aggregated and anonymised where possible.

Below are Tools, Provider and Purpose:

Google Analytics - Google LLC - Website traffic analysis, user behaviour reporting

Google Tag Manager - Google LLC - Tag and script management (container for other tools)

Microsoft Clarity - Microsoft Corporation - Session recording, heatmaps, user behaviour analysis

• Legal basis (EU): Consent (Article 6(1)(a) GDPR).
• Legal basis (UK): Where Google Analytics is configured with IP anonymisation enabled, cross-site tracking disabled, and data is not shared with third parties or used for advertising purposes, it may qualify for the analytics consent exemption under PECR as amended by the Data (Use and Access) Act 2025. In those circumstances, we will provide clear information about the cookie and an opt-out mechanism, but will not require prior consent. Microsoft Clarity (which involves session recording and behavioural analysis) does not meet the conditions for the analytics exemption and requires consent. Where the exemption conditions are not met for any analytics tool, we rely on consent.
• Legal basis (Canada — Quebec): Express consent (Law 25 / Act Respecting the Protection of Personal Information in the Private Sector).
• Legal basis (all other jurisdictions): Consent.

3.4 Advertising and Targeting Cookies

• These cookies are used to deliver advertisements relevant to you and your interests, to retarget visitors who have previously visited our Sites, and to measure the effectiveness of advertising campaigns. They may be set by us or by third-party advertising partners and may track your activity across other websites. Tool - Provider - Purpose are listed below:

Meta Pixel - Meta Platforms, Inc. - Facebook and Instagram ad targeting and conversion tracking

Google Ads - Google LLC - Search and display ad targeting and conversion tracking

TikTok Pixel - TikTok Inc - TikTok ad targeting and conversion tracking

Reddit Ads Pixel - Reddit, Inc. - Reddit ad targeting and conversion tracking

AdRoll (NextRoll) - NextRoll, Inc - Cross-platform retargeting and display advertising

Microsoft / Bing Ads - Microsoft Corporation - Bing search ad targeting and conversion tracking

Twitter / X Ads - X Corp. - Twitter/X ad targeting and conversion tracking

Pinterest Tag - Pinterest, Inc. - Pinterest ad targeting and conversion tracking

• Legal basis (EU / UK): Consent (Article 6(1)(a) GDPR / UK GDPR). Advertising and targeting cookies do not qualify for any consent exemption and require prior, freely given, specific, informed, and unambiguous consent in all circumstances.
• Legal basis (all other jurisdictions): Consent or opt-out as applicable under local law (see Section 6).
• Automated profiling: Some advertising tools listed above (including AdRoll, Meta Pixel custom audiences, and Google Ads remarketing) use personal information collected through cookies to create profiles about your preferences and interests and to make automated advertising decisions. See Section 6 for jurisdiction-specific rights in relation to automated decision-making and profiling.

4.0 THIRD-PARTY COOKIE POLICIES

4.1 Cookies set by third parties are subject to those parties' own privacy and cookie policies. Key third-party privacy policies are listed below:

Google LLC https://policies.google.com/privacy

Meta Platforms, Inc. https://www.facebook.com/privacy/policy

Microsoft Corporation https://privacy.microsoft.com/en-us/privacystatement

TikTok Inc. https://www.tiktok.com/legal/privacy-policy

Reddit, Inc. https://www.reddit.com/policies/privacy-policy

NextRoll, Inc. (AdRoll) https://www.nextroll.com/privacy

X Corp. (Twitter/X) https://twitter.com/en/privacy

Pinterest, Inc. https://policy.pinterest.com/en/privacy-policy

Usercentrics (Cookiebot) https://www.usercentrics.com/privacy-policy/

HOW TO MANAGE COOKIES

5.1 Cookiebot by Usercentrics (Cookie Preference Centre)

We use Cookiebot by Usercentrics as our Consent Management Platform. You can view, update, or withdraw your cookie consent at any time by clicking "Cookie Settings" in the footer of our Sites. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal.

Cookiebot allows you to consent selectively by category (Necessary, Preferences, Statistics, Marketing). Your preferences are stored and respected on each subsequent visit.

For cookies that do not require consent (such as strictly necessary cookies, or in the UK, analytics and preference cookies that qualify for the PECR exemption), the Cookiebot preference centre provides an opt-out toggle so you can object to those cookies at any time.

5.2 Opt-Out Preference Signals (Global Privacy Control)

We recognise and honour browser-enabled opt-out preference signals, including the Global Privacy Control (GPC) signal. If your browser or browser extension sends a GPC signal, we will treat it as a valid request to opt out of the sale and sharing of your personal information for cross-context behavioural advertising purposes, consistent with our obligations under the CCPA / CPRA and applicable US state privacy laws.

The GPC signal will be processed automatically. You do not need to take any additional steps to make the opt-out effective for your browser. If you are logged in to an account with us, we will also apply the opt-out to your known consumer profile where we can reasonably associate your browser with your account.

Honouring a GPC signal does not affect the use of strictly necessary cookies or cookies that do not constitute a "sale" or "sharing" of personal information under applicable law.

5.3 Browser Settings

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Sites:

• Chrome: chrome://settings/cookies
• Firefox: about:preferences#privacy
• Safari: Preferences > Privacy
• Edge: edge://settings/privacy

5.4 Opt-Out Tools

Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

Google Ads settings: https://adssettings.google.com

Meta ad preferences: https://www.facebook.com/ads/preferences

TikTok ad settings: https://www.tiktok.com/settings/privacy

Microsoft ad opt-out: https://account.microsoft.com/privacy/ad-settings

AdRoll / NextRoll opt-out: https://app.adroll.com/optout/safari

Pinterest ad settings: https://www.pinterest.com/settings/privacy

Network Advertising Initiative (US): https://optout.networkadvertising.org

Digital Advertising Alliance (US): https://optout.aboutads.info

Your Online Choices (EU/UK): https://www.youronlinechoices.eu

DAAC AdChoices (Canada): https://youradchoices.ca/en/tools

JURISDICTION-SPECIFIC PROVISIONS

1. 6.1 European Union (GDPR / ePrivacy Directive)
   1. The data controller for EU visitors is:

• Europe Play Operations B.V. Hofplein 20, 3032 AC Rotterdam, The Netherlands. Data Protection Contact: Legal & Compliance Manager,

  Legal@vulyplay.com

  . We will not place non-essential cookies on your device without your prior, freely given, specific, informed, and unambiguous consent, obtained through Cookiebot by Usercentrics. You may withdraw consent at any time without detriment by clicking "Cookie Settings" in the footer of our Sites. Your rights under GDPR include:

  • - Right of access (Article 15);

  • - Right to rectification (Article 16);

  • - Right to erasure (Article 17);

  • - Right to restriction of processing (Article 18);

  • - Right to data portability (Article 20);

  • - Right to object (Article 21); and

  • - Right to withdraw consent at any time (Article 7(3)).

  • To exercise these rights, contact us at

    Legal@vulyplay.com

    .

  • EU residents may lodge a complaint with their national supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

International data transfers: Where cookies result in personal data being transferred outside the EU (for example, to US-based service providers such as Google, Meta, or TikTok), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the applicable transfer mechanism. Where the EU-US Data Privacy Framework applies, we rely on that framework as an additional transfer basis.

6.2 United Kingdom (UK GDPR / PECR as amended by the Data (Use and Access) Act 2025). The data controller for UK visitors is:

• United Kingdom Play Ltd (Co. No. 16492883), C/O Windsor House, Station Court, Station Road, Great Shelford, Cambridge, England, CB22 5NE. Data Protection Contact: Legal & Compliance Manager,

  Legal@vulyplay.com

  . We handle cookies for UK visitors in accordance with UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR) as amended by the Data (Use and Access) Act 2025 (DUAA). Consent requirements: We will not place advertising, targeting, or profiling cookies on your device without your prior consent. For analytics cookies that meet the conditions for the PECR consent exemption introduced by the DUAA (first-party, anonymised, not used for cross-site tracking or advertising), we will provide clear information and an opt-out mechanism but will not require prior consent. For all other non-essential cookies, we rely on consent obtained through Cookiebot by Usercentrics. Tag management: Where we use Google Tag Manager or similar tools to deploy third-party scripts, the triggering of those scripts constitutes "instigating" the storage of or access to information on your device within the meaning of PECR. Consent obtained through Cookiebot governs whether those scripts are triggered. Your rights under UK GDPR include:

- Right of access (Article 15);

- Right to rectification (Article 16);

- Right to erasure (Article 17);

- Right to restriction of processing (Article 18);

- Right to data portability (Article 20);

- Right to object (Article 21); and

- Right to withdraw consent at any time (Article 7(3)).

To exercise these rights, or to make a data protection complaint, contact us at Legal@vulyplay.com. We will acknowledge your complaint and respond within a reasonable timeframe in accordance with our data protection complaints-handling procedure.

UK residents may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

International data transfers: Where cookies result in personal data being transferred outside the UK (for example, to US-based service providers), we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs as the applicable transfer mechanism.

6.3 Canada (PIPEDA / CASL / Provincial Privacy Legislation) The responsible entity for Canadian visitors is:

• Vuly Canada Operations Corp. 1055 W. Georgia St, Unit 1500, Vancouver, BC V6E 4N7, Canada. Privacy Contact: Legal & Compliance Manager,

  Legal@vulyplay.com

  . We collect personal information through cookies in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including the Personal Information Protection Act (PIPA) in British Columbia and Alberta, and the Act Respecting the Protection of Personal Information in the Private Sector (Law 25) in Quebec. Consent: For cookies that collect personal information beyond what is strictly necessary, we rely on express consent obtained through Cookiebot by Usercentrics. This applies to analytics, advertising, and profiling cookies for all Canadian visitors, including Quebec residents. Your rights under PIPEDA include:

- the right to access personal information we hold about you;

- the right to withdraw consent at any time (subject to legal or contractual restrictions);

- the right to request correction of inaccurate information; and

- the right to challenge our compliance with applicable privacy legislation.

To exercise these rights or to opt out of non-essential cookies, use the Cookiebot preference centre or contact us at sales@vulyplay.com.

Quebec residents (Law 25): You have additional rights including the right to data portability and the right to be informed of automated decision-making. You also have the right to be informed before your personal information is communicated outside Quebec, including to US-based service providers. To exercise these rights, contact us at sales@vulyplay.com.

International data transfers (Quebec): Where analytics or advertising cookies result in personal information being transferred to US-based service providers (including Google LLC and Microsoft Corporation), we have conducted a privacy impact assessment and have implemented contractual safeguards to protect your information. Details of these transfers are available on request.

Note on upcoming legislation: Canada's Parliament introduced the Protecting Privacy and Consumer Data Act (Bill C-36) on 15 June 2026. While this Bill is at first reading and PIPEDA currently governs, we are monitoring its progress and will update this policy as required if it is enacted.

6.4 United States — California and Other States (CCPA / CPRA) The responsible entity for US visitors is:

• American Play LLC, 4201 Redwood Ave, 1st Floor, Los Angeles, CA 90066. Privacy Contact: Legal & Compliance Manager,

  Legal@vulyplay.com

California Residents — Your Rights Under CCPA / CPRA:

- Right to Know: You have the right to know what personal information we collect, use, disclose, sell, or share, including through cookies and tracking technologies.

- Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.

- Right to Correct: You may request correction of inaccurate personal information we hold about you.

- Right to Opt Out of Sale or Sharing: We may "sell" or "share" your personal information (as defined under CCPA/CPRA) through advertising cookies such as Meta Pixel, Google Ads, TikTok Pixel, Reddit Ads Pixel, AdRoll, Microsoft/Bing Ads, Twitter/X Ads, and Pinterest Tag. To opt out, click "Do Not Sell or Share My Personal Information" in the footer of our Sites, or manage your preferences through Cookiebot.

- Opt-Out Preference Signals (GPC): We recognise and honour the Global Privacy Control (GPC) signal as a valid opt-out of the sale and sharing of personal information. If your browser sends a GPC signal, we will automatically treat it as an opt-out request for that browser and, where applicable, your known consumer profile. You do not need to take any additional steps. Our Consent Management Platform and tag management configuration are set up to suppress advertising and sharing cookies when a GPC signal is detected.

- Right to Limit Use of Sensitive Personal Information: You may direct us to limit the use of sensitive personal information to what is necessary to provide the services.

- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

- Automated Decision-Making and Profiling: Some of our advertising tools (including AdRoll, Meta Pixel custom audiences, and Google Ads remarketing lists) use personal information collected through cookies to create profiles about your preferences and interests and to make automated advertising decisions. You have the right to opt out of automated decision-making and profiling used for targeted advertising. To exercise this right, use the Cookiebot preference centre or click "Do Not Sell or Share My Personal Information" in the footer of our Sites.

Categories of personal information collected through cookies:

- Identifiers (IP address, device ID, cookie ID, hashed email address);

- Internet or other electronic network activity (browsing history, pages visited, interactions with our Sites and advertisements);

- Geolocation data (approximate location based on IP address); and

- Inferences drawn from the above to create a profile about your preferences and interests.

Submitting a verifiable consumer request: Contact sales@vulyplay.com. We will respond within 45 days of receipt. You may designate an authorised agent to submit a request on your behalf.

Other US States: Residents of the following states have rights to access, delete, correct, and opt out of targeted advertising under applicable state privacy laws: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Montana, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Indiana, Kentucky, Rhode Island, and other states that have enacted comprehensive privacy legislation. To exercise any applicable rights, contact us at sales@vulyplay.com.

Note on Oregon and Maryland: Oregon's 2026 privacy amendments and Maryland's Online Data Privacy Act impose additional restrictions on the sale of precise geolocation data and the processing of personal data of minors under 16. We do not knowingly sell or share precise geolocation data or the personal data of minors under 16 for targeted advertising purposes.

6.5 Australia (Privacy Act 1988 — Australian Privacy Principles) The responsible entity for Australian visitors is:

• Vuly Play Pty Ltd. 95 Ingleston Road, Wakerley, Brisbane QLD 4154. Privacy Contact: Legal & Compliance Manager,

  Legal@vulyplay.com

We handle personal information collected through cookies in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our full Privacy Policy, which sets out how we collect, use, store, and disclose personal information, is available at Privacy Policy .

Australian privacy law does not require explicit cookie consent banners; however, APP 1 requires that we are transparent about our data collection practices. By continuing to use our Sites, you consent to the use of cookies as described in this policy. You may withdraw consent at any time by adjusting your browser settings or using the Cookiebot preference centre.

Automated decision-making (from 10 December 2026): Amendments to APP 1 commencing 10 December 2026 will require us to disclose the kinds of personal information used in significant automated decisions and the types of decisions made. Some of our analytics and advertising tools (including Microsoft Clarity, AdRoll, and Google Ads) use personal information collected through cookies to inform automated profiling and advertising decisions. We will update this policy before 10 December 2026 to include the specific disclosures required by the amended APP 1.

Children's Online Privacy Code: The Office of the Australian Information Commissioner (OAIC) is required to register a Children's Online Privacy Code (COPC) by 10 December 2026. The COPC is expected to introduce stricter obligations regarding the collection and use of personal information of children online, including restrictions on tracking and profiling. We will review and update our practices and this policy in response to the registered COPC.

To access or correct personal information we hold about you, or to make a privacy complaint, contact us at Legal@vulyplay.com. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

7. COOKIE RETENTION PERIODS

Cookie Category Typical Retention Period

Strictly Necessary Session to 12 months

Functional / Preference Up to 12 months

Analytics (Google Analytics, Microsoft Clarity) Up to 26 months

Advertising / Targeting Up to 13 months

Specific retention periods for individual cookies are disclosed within the Cookiebot consent banner on our Sites. Retention periods may vary depending on the third-party provider.

8. CHILDREN'S PRIVACY

1. Our Sites are not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We apply a minimum age threshold of 16 across all jurisdictions, which is more conservative than the US federal COPPA minimum age of 13. We do not knowingly use advertising or profiling cookies in relation to children.
2. If you believe a child has provided personal information through our Sites, please contact us at the relevant privacy contact address in Section 10.
3. Australian visitors: The OAIC is required to register a Children's Online Privacy Code (COPC) by 10 December 2026. We will update our practices and this policy in response to the registered COPC. See Section 6.5.5.

9. CHANGES TO THIS POLICY

We may update this Cookie Policy from time to time to reflect changes in technology, legislation, or our data practices. The "Last updated" date at the top of this policy reflects the most recent revision Where changes are material, we will notify you via a prominent notice on our Sites or, where required by law, seek fresh consent through Cookiebot.

10. CONTACT US

For any questions about this Cookie Policy or to exercise your privacy rights, please contact the relevant entity for your jurisdiction:

Australia

Vuly Play Pty Ltd. 95 Ingleston Road, Wakerley, Brisbane QLD 4154. Legal@vulyplay.com

Phone: 1300 667 514

International: +61 7 3914 1300

European Union

Europe Play Operations B.V. Hofplein 20, 3032 AC Rotterdam, The Netherlands

Data Protection Contact: Legal & Compliance Manager, Legal@vulyplay.com

United Kingdom

United Kingdom Play Ltd (Co. No. 16492883). C/O Windsor House, Station Court, Station Road, Great Shelford, Cambridge, CB22 5NE

Data Protection Contact: Legal & Compliance Manager, Legal@vulyplay.com

Canada

Vuly Canada Operations Corp. 1055 W. Georgia St, Unit 1500, Vancouver, BC V6E 4N7

Legal@vulyplay.com

United States

American Play LLC. 4201 Redwood Ave, 1st Floor, Los Angeles, CA 90066

Legal@vulyplay.com

US/Canada (866) 866-8858

New Zealand

Vuly NZ Limited. Suite 1091 Unit A Level G 26 Hobson Street Auckland City 1010 New Zealand (NZ visitors) Legal@vulyplay.com