Spain Privacy Policy

Triumph Privacy Policy

*Effective Date: July 9, 2026*

​*Updated: July 9, 2026*

This Privacy Policy describes how Triumph (as defined below) processes the information and data that users provide to us, or that relates to users, in order to manage their relationship with Triumph and provide Triumph’s online games, digital services, tournaments, leaderboards, match-making features, websites, applications, software development kit and related services.

For the purposes of this Privacy Policy, the term “Services” means the Triumph apps, websites, the Triumph SDK, leaderboards, player match-making, online games, real-cash tournaments where legally available, collectible transactions, customer support channels, in-app communications, SMS and related digital services.

This Privacy Policy is intended specifically for users located in Spain and has been prepared taking into account the GDPR, the LOPDGDD, the LSSI and, where applicable, Spanish gambling, consumer protection, advertising, tax, anti-fraud, anti-money laundering and player protection requirements.

Accepting this Privacy Policy does not mean that you consent to every processing activity described below. Where consent is required, Triumph will request it separately through the appropriate mechanism. If you do not accept this Privacy Policy, please do not use the Services or provide us with personal data.

1. Identity of the Data Controller

Any reference to “Triumph”, “we” or “our” in this Privacy Policy refers to SIA Triumph Arcade Europe, whose registered office is located at Laipu iela 6, Rīga, LV-1050, Latvija. Triumph determines the purposes and means of the processing of your personal data in connection with the Services and acts as the data controller for the purposes of applicable European data protection legislation.

Privacy contact: Jamin Horn, Esq ([e-mail]).

Data Protection Officer, if appointed: Jamin Horn, Esq.

Where a specific product is provided by or with the involvement of Triumph Labs, Inc., Triumph Arcade, LLC, Triumph TCG, LLC, SIA Triumph Arcade Europe or Triumph Arcade UK LTD those entities may act as independent controllers, joint controllers or processors depending on their actual role. Where required, Triumph will provide additional product-specific information.

With regard to payment processing, payment, withdrawal and transaction operations may be handled by payment processors, financial institutions or a merchant-of-record entity, where applicable. Such entities may process payment data in accordance with their own legal obligations and privacy policies. Triumph will cooperate with them to ensure that personal data is processed securely and in accordance with applicable data protection law.

In addition, certain identity verification, KYC, fraud prevention, payment, geolocation, communications, SMS, analytics, hosting, support and security functions may be provided by third-party service providers. These providers may act as processors, independent controllers or other legally recognized roles depending on the relevant processing activity. For identity verification, Triumph uses Footprint, a US-based provider which acts as an independent controller for the verification process. Personal data transferred to Footprint in the United States is protected by Standard Contractual Clauses approved by the European Commission. Where a provider acts as an independent controller, users should review that provider’s terms and privacy policy before providing their data. The Footprint Terms of Service can be accessed at [Footprint Terms of Service URL] and the Footprint Privacy Policy can be accessed at [Footprint Privacy Policy URL]. Where any other third party acts as an independent controller, its own privacy notice and terms may also apply.

If you have any concerns or would like to know more about how we process your personal data, you can contact us at [e-mail].

2. Purposes of processing

Your personal data is protected by law. This means that we can only process your personal data where there is a valid legal basis to do so, which may be one of the following:

• To perform a contract entered into with you or to take steps at your request before entering into a contract.

• To comply with a legal obligation applicable to Triumph.

• Because you have given your consent for a specific purpose.

• Because it is in our legitimate interest.

• Because it is necessary for the establishment, exercise or defense of legal claims.

When we process personal data on the basis of legitimate interest, we will do so only after assessing that the processing is necessary and proportionate and that it does not override your rights and freedoms. You may object to this processing in the cases provided by applicable law.

Purpose of processing	Data processed	Legal basis
User account management	Identification data, contact data, date of birth, username, access credentials, account preferences and account status.	Performance of the contract and, where applicable, compliance with legal obligations relating to age or eligibility verification.
Provision of the Services, games, leaderboards and match-making	Account data, game activity, scores, results, rankings, skill level, usage data, technical data and identifiers.	Performance of the contract and legitimate interest in maintaining the functionality, integrity and quality of the Services.
Real-cash tournaments and prize games, where legally available	Identification data, age, jurisdiction, game activity, balances, deposits, withdrawals, prize outcomes, transaction data and technical data.	Performance of the contract, compliance with legal obligations and legitimate interest in preventing fraud and abuse.
Payment processing, deposits, withdrawals and refunds	Payment method, billing details, transaction records, withdrawal details, account balance, refund and chargeback information, payment tokens, payment identifiers, stored payment method status, payment provider responses and information necessary to verify that the payment method belongs to or is authorized by the user.	Performance of the contract, compliance with tax, accounting, financial and anti-fraud obligations, and legitimate interest in verifying payment ownership, preventing unauthorized payments, resolving disputes and complying with payment security requirements.
Identity, age, eligibility and authentication checks	Identity document, document image, document details, live video, selfie or similar verification image, facial image where applicable, date of birth, telephone number, IP address, location, GPS or device location data where strictly necessary, device data, time of access and authentication signals.	Compliance with legal obligations applicable to identity verification, age verification, KYC, anti-money laundering, counter-terrorist financing, gambling regulation and player protection (including Ley 10/2010, Ley 13/2011 and applicable Spanish and EU regulatory requirements), performance of the contract and legitimate interest in security, access control, fraud prevention and user protection. Where biometric data is processed for facial matching or liveness detection, Triumph relies on: (i) compliance with legal obligations requiring robust identity verification for real-cash gaming and regulated services; and (ii) explicit consent, which is obtained and documented before the biometric verification process begins. Biometric data is processed momentarily to perform the verification and is immediately discarded without being stored.
Geographic location verification and territorial restrictions	IP address, geolocation data, connection data, device information, network provider and other technical location signals.	Compliance with legal obligations where applicable, performance of the contract and legitimate interest in preventing access from unauthorized territories.
Fraud prevention, anti-cheating, bot detection and platform security	Game data, score patterns, account history, transaction data, device data, IP address, location data, communications and authentication data.	Legitimate interest in protecting security and service integrity, compliance with legal obligations where applicable, and establishment, exercise or defense of legal claims.
Customer support, complaints and rights requests	Identification and contact data, account data, communications, support tickets, files, documents and relevant technical data.	Performance of the contract, compliance with legal obligations and legitimate interest in handling requests, complaints and claims.
Service, transactional and SMS communications	Email address, telephone number, account identifiers, device or push notification identifiers, communication preferences and data needed to notify security, payment, withdrawal, operational or legal matters.	Performance of the contract, legitimate interest in service and security communications, compliance with legal obligations and consent for promotional SMS where required.
Marketing communications and advertising	Contact data, marketing preferences, consent records, opt-out records, usage or purchase history, campaign interactions, cookies and advertising identifiers where applicable.	Consent for electronic marketing and non-essential cookies where required. Legitimate interest may apply to similar products or services for existing users where legally permitted and a simple opt-out is provided.
Analytics, surveys and service improvement	Usage data, technical metrics, survey responses, product feedback, satisfaction scores, incident data and aggregated or pseudonymized data where possible.	Legitimate interest in improving the Services and consent where required by applicable law.
Compliance, user protection and responsible gambling where applicable	Identity data, account data, game activity, transaction data, communications, technical logs, behavioral indicators, sanctions screening information, AML/CTF checks, account restriction records, withdrawal review records, responsible gaming records where applicable, and legally required records.	Compliance with applicable legal obligations and legitimate interest in cooperating with authorities, protecting users and defending Triumph’s rights, including anti-money laundering, counter-terrorist financing, sanctions, tax, gaming, consumer protection and player protection obligations where applicable.
Corporate management and transactions	Strictly necessary contact, account, transaction, usage and contractual relationship data.	Legitimate interest in corporate administration, reorganizations, mergers, acquisitions, asset sales or succession, subject to appropriate safeguards.
Account suspension, restriction, bans, forfeiture and enforcement of the Terms	Account data, gameplay data, score data, transaction data, payment data, withdrawal data, KYC data, device data, IP address, location data, technical signals, fraud indicators, cheating indicators, communications and investigation records.	Performance of the contract; legitimate interest in enforcing the Terms, protecting the Platform and other users, preventing fraud, cheating and misuse; compliance with legal obligations where applicable; establishment, exercise or defense of legal claims.

If you decide not to provide personal data that is mandatory for a specific feature, we may not be able to create or maintain your account, provide the Services, verify your age or identity, process payments or withdrawals, allow access to tournaments or real-cash features, resolve incidents, prevent fraud or comply with applicable legal obligations.

3. Retention period

Personal data will be retained for as long as your account remains active and for the time strictly necessary to fulfil the purposes described in this Privacy Policy or to comply with applicable legal obligations, after which it will be deleted, anonymized or, where applicable, blocked or restricted so that it is only available for legal, regulatory, security, fraud prevention or claims purposes.

Account data (identification, contact data, date of birth, username and account preferences) will be retained while the account is active. After account deletion or termination, this data will be deleted or anonymized within 30 days, except where longer retention is required to comply with legal obligations, resolve disputes, prevent fraud or enforce the Terms. Where retention is justified for fraud prevention purposes (for example, to prevent re-registration by banned users), Triumph may retain a limited subset of data (such as telephone number or device identifiers) for a maximum period of 5 years after account deletion, after which it will be securely deleted.

Payment, transaction, prize and withdrawal data will be retained during the relationship and afterwards for the applicable tax, accounting, financial, anti-fraud, gambling, anti-money laundering and limitation periods, where applicable.

Records relating to KYC verification, withdrawal reviews, fraud prevention, anti-cheating investigations, sanctions screening, account restrictions, bans, forfeiture, disputes and enforcement of the Terms will be retained for the period necessary to document the relevant decision and comply with applicable legal obligations. Where AML/CTF obligations apply, KYC records will be retained for 10 years after the end of the business relationship. For fraud prevention, anti-cheating and enforcement records, retention will be limited to 5 years after the relevant decision, unless longer retention is required by law or to defend ongoing legal claims.

Identity verification documents (such as ID scans and selfies used for verification) will be retained for the time strictly necessary to complete the verification process. Once verification is complete, identity documents will be deleted within 30 days, unless longer retention is required under AML/CTF obligations (in which case the 10-year period described above will apply) or to resolve disputes or defend legal claims. Biometric data processed for facial matching or liveness detection is computed and immediately discarded without being stored.

Game, leaderboard, match-making and activity data will be retained while the account is active and for a period of 5 years after account deletion or termination. This retention period is justified by Triumph’s legitimate interest in maintaining competition integrity, investigating fraud or cheating patterns, handling support requests related to past activity, and defending potential legal claims. After this period, game history will be anonymized, so that Triumph may continue to use aggregated or anonymized data for fraud pattern analysis, platform security and service improvement purposes without retaining personal data.

Marketing data will be retained until you withdraw your consent or object to the processing. Triumph may keep a minimal suppression list to ensure that your opt-out is respected.

Where a user transfers a balance to another Triumph application or compatible service, Triumph may retain records of the transfer, the user’s instruction, the receiving application and related transaction information for the period necessary to evidence the transaction, resolve disputes, prevent fraud and comply with applicable legal obligations.

When personal data is no longer necessary, Triumph will securely delete, anonymize or restrict it or, where applicable, block it, unless continued retention is required by law, security, fraud prevention or pending liabilities.

4. Information we collect

We may collect and process different categories of personal data in the context of your relationship with Triumph, including:

• Data provided directly by you, for example when registering, creating an account, completing forms, contacting customer support, participating in tournaments, requesting withdrawals or sending us information by email or through the Services.

• Identification and contact data, such as name, surname, username or alias, email address, telephone number, date of birth, country or region, and information needed to create and maintain an account.

• Account and credentials data, such as user IDs, authentication data, passwords or authentication mechanisms, account preferences, balances, deposits, withdrawals, purchases, prizes, transaction history and account status.

• Game and activity data, such as scores, results, game history, tournament participation, competition results, skill level, rankings, interaction data, buttons or commands used in the app, leaderboard data and match-making data.

• Public account or posted data, such as username, avatar or selected image, general location where displayed or necessary for a public or semi-public feature, scores, rankings, prize outcomes, tournament participation or other information displayed in public or semi-public areas of the Services. Such information may be viewed, copied or retained by third parties outside Triumph’s control.

• Identity verification and authentication data, such as identity document images, document details, live video, short video, selfie or similar verification image, facial image where applicable, location of access, IP address, browser or software data, time of access, device identifiers, authentication signals, KYC verification results, verification provider responses and fraud or eligibility indicators.

• Payment and transaction data, such as payment method, billing details, payment identifiers, transaction records, withdrawal details, refunds, chargeback information and data needed to prevent fraud or comply with financial, tax or regulatory obligations. This may also include payment tokens, stored payment method status, payment provider responses, instant withdrawal fee information and balance transfer records.

• Technical and device data, such as IP address, unique device identifiers, operating system, browser type, mobile network data, service provider, access logs, connection data, cookies and similar technologies. This may also include jailbreak or device integrity indicators, VPN or proxy indicators, bot detection signals, artificial intelligence tool detection indicators, emulator or device farm indicators and other technical signals used to protect the integrity and security of the Platform.

• Location data, which may include approximate or precise location, including GPS or device location data where strictly necessary and permitted, where necessary to verify the jurisdiction of access, prevent fraud or restrict features that are unavailable or unlawful in a given territory.

• Communications and support data, such as queries, complaints, customer support communications, in-app messages, chat records, support tickets, forms, emails, SMS and files or documents provided by you.

• Marketing and preference data, such as marketing preferences, consent records, opt-out records, communication history, campaign interactions, advertising measurement data and, where lawful, data used to create or measure advertising audiences.

• Survey and research data, such as survey responses, product feedback, user testing information, satisfaction scores and research participation data.

• Enforcement and integrity data, such as account restriction records, suspension or ban records, disqualification records, score adjustment records, prize restriction records, forfeiture records, fraud investigation records, cheating investigation records, sanctions screening records and information used to document decisions taken under the Terms.

When necessary and always respecting your rights and freedoms, we may also obtain personal data from legitimate third-party sources, public sources, payment providers, identity verification providers, fraud prevention providers, app stores or other partners, only where relevant for legitimate and previously disclosed purposes.

5. Cookies, SDKs and similar technologies

We use cookies, SDKs, mobile identifiers, device permissions and similar technologies on our websites, apps and digital services to ensure their proper functioning, provide requested features, remember preferences, improve the user experience, perform statistical analysis and, where permitted, display personalized advertising or measure campaigns.

Strictly necessary or technical cookies and similar technologies may be used without consent where they are essential to provide a service requested by the user. Before installing cookies or similar technologies that are not strictly necessary, including analytics cookies, non-exempt personalization cookies, behavioral advertising cookies or similar technologies, we will ask for your consent through a cookie banner or preference panel that allows you to accept, reject or configure cookies in a clear and accessible way.

You can manage or revoke your cookie consent at any time through the cookie settings available on our website or app. For more information about our use of cookies, their categories, third parties, purposes, duration and settings, please see our Cookie Policy.

Some SDKs and similar technologies may be necessary for technical operation, security, fraud prevention, anti-cheating, geolocation, identity verification, payment processing, analytics, advertising measurement or other functions described in this Privacy Policy. Where consent is required under applicable law for non-essential cookies, SDKs or similar technologies, Triumph will request such consent through an appropriate cookie banner, preference center, device permission or other legally recognized mechanism.

6. Personal data we share with third parties

We may share your personal data with the following categories of recipients, always in accordance with applicable regulations and only to the extent necessary for the purposes described in this Privacy Policy:

• Triumph group companies involved in providing, supporting, securing, administering or complying with the Services, including the operation of affiliated applications and products. The relevant group companies, their locations and, where applicable, their roles in relation to the processing of personal data are identified.

• Competent authorities, tax authorities, law enforcement agencies, gambling or regulatory authorities, supervisory authorities, courts or any other administrative or judicial authority that may legally require it.

• Service providers and business partners who help us operate the Services and provide essential services, such as hosting, infrastructure, maintenance, analytics, security, identity verification, KYC, document verification, facial matching or selfie verification where applicable, fraud prevention, device authentication, geolocation, payment processing, communications, SMS, customer support or technical support, including providers such as Footprint where applicable.

• Other Triumph applications or compatible services, where the user requests or authorizes a balance transfer or other interoperability feature.

• Financial institutions, payment processors, withdrawal providers, chargeback providers and transaction verification providers that manage or support transactions made through the Services.

• Companies that provide analysis, marketing, advertising measurement and communication services, only where there is a valid legal basis and consent where required.

• Third parties to whom you request or expressly authorize us to disclose your data.

• Other users or the public, where information is made visible through public or semi-public Platform features, such as profiles, general location where displayed or necessary for the relevant feature, leaderboards, rankings, match results, tournament participation, prize outcomes, social features or similar functionality.

• Legal advisers, auditors, insurers, financial entities and other third parties necessary for compliance, audits, risk management, legal claims or corporate transactions.

• Buyers, investors or legitimate successors in the context of a merger, acquisition, restructuring, insolvency, sale of assets or similar corporate transaction, subject to confidentiality and appropriate safeguards.

Processors acting on Triumph’s behalf will process personal data only under Triumph’s documented instructions and under agreements containing the safeguards required by the GDPR. Where a third party acts as an independent controller, it will process personal data under its own privacy notice.

Mobile information and SMS opt-in consent will not be shared with third parties or affiliates for their own marketing or promotional purposes. We may share such information with service providers that help us deliver SMS messages on our behalf, subject to contractual restrictions and only for that purpose.

Where personal data is disclosed to third parties for KYC, payment, withdrawal, fraud prevention, sanctions screening, geolocation, balance transfer or other operational purposes, Triumph will disclose only the data necessary for the relevant purpose and will apply appropriate contractual, technical and organizational safeguards where required.

7. Transfer of data outside the EEA

We may transfer your personal data to countries outside the European Economic Area (“EEA”), including the United States, only in the following cases:

• When necessary for the provision of the Services, including hosting, support, identity verification, KYC, document verification, facial matching or selfie verification where applicable, sanctions screening, geolocation, anti-cheating, fraud prevention, payment processing, communications, SMS, analytics, security or other operational services.

• When you have given us your explicit consent, where this is the appropriate legal basis.

• When it is necessary to comply with an applicable legal obligation or for the establishment, exercise or defense of legal claims.

In all cases, we will ensure that the transfer of your personal data is subject to appropriate safeguards to maintain a level of protection equivalent to that required in the EEA. To this end, we may rely on:

• An adequacy decision by the European Commission recognizing that the recipient country offers an adequate level of protection.

• Standard Contractual Clauses approved by the European Commission or other legally binding instruments that require the recipient to protect your data. For example, transfers to Footprint (identity verification) in the United States are protected by Standard Contractual Clauses.

• Binding corporate rules, certification mechanisms or other mechanisms recognized by data protection regulations.

• Supplementary technical, contractual or organizational measures where required after assessing the transfer.

In some cases, we may be legally required to provide personal data to authorities or third parties located outside the EEA. In such cases, although we will apply reasonable measures to protect the information, we must point out that our control over the subsequent use of the data by such entities may be limited.

8. Your rights regarding your personal data

Under applicable data protection laws, and subject to the conditions and limits set out in those laws, you have the following rights in relation to your personal data, which you can generally exercise free of charge through the contact channels indicated in this Privacy Policy:

• Withdraw your consent at any time when the processing is based on consent. The withdrawal will not affect the lawfulness of the processing carried out previously.

• Access the personal data we hold about you and obtain information about how we process it.

• Rectify inaccurate or incomplete personal data.

• Request the deletion of your personal data when it is no longer necessary, when you withdraw consent, when you object to the processing or when another legal ground applies.

• Request the restriction of the processing of your personal data in certain circumstances.

• Exercise the right to portability, requesting that we provide you with your personal data in a structured, commonly used and machine-readable format, or that we transmit it directly to another controller where technically possible.

• Object to the processing of your data where it is based on legitimate interest, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms. You may object to direct marketing at any time.

• Request human intervention, express your point of view and contest a decision where a decision is based solely on automated processing and produces legal effects on you or similarly significantly affects you. This may be relevant, for example, where automated systems or profiling contribute to account blocking, suspension or termination, prize restriction, withdrawal rejection, KYC failure, fraud suspension, disqualification, score adjustment, forfeiture, exclusion from tournaments or other features, or similar decisions that produce legal effects concerning you or similarly significantly affect you.

• Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD) or with the competent supervisory authority in your place of residence if you consider that your right to data protection has been violated.

Please note that some rights may be subject to legal limits. For example, Triumph may need to retain or restrict certain data where necessary to comply with legal obligations, prevent fraud or cheating, investigate misuse of the Platform, protect other users, resolve disputes, enforce the Terms, or establish, exercise or defend legal claims. Where this applies, Triumph will assess the request in accordance with applicable data protection laws.

To exercise your rights, you may contact Triumph at [e-mail], identifying the right you wish to exercise and providing the information necessary to verify your identity. Triumph will respond within the time limits established by applicable law. In some cases, Triumph may request additional information to confirm your identity or may refuse requests that are manifestly unfounded, excessive or unlawful.

9. Automated systems, profiling and enforcement decisions

Triumph may use automated systems, profiling and risk indicators to operate the Platform, provide skill-based match-making, create score and skill profiles, personalize certain prize offerings in single-player games, detect fraud or cheating, verify identity, assess withdrawal requests, detect bots or prohibited tools, enforce the Terms, protect users and maintain the security and integrity of the Platform.

These systems may use gameplay data, score data, skill indicators, account data, transaction data, payment data, withdrawal data, KYC data, device data, IP address, location data, technical signals, communications and other information described in this Privacy Policy.

Where such systems are used only to support human review, Triumph will take appropriate steps to ensure that relevant decisions are reviewed where necessary. Where a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you, you will have the right, subject to applicable legal limits, to request human intervention, express your point of view and contest the decision.

Triumph may restrict the information provided about certain anti-fraud, anti-cheating, security or enforcement measures where disclosure would compromise investigations, platform security, fraud prevention, cheating prevention or the rights and freedoms of other users.

10. Changes to our Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, applicable legislation or the Services we offer, including changes to the Terms, product features, verification processes, payment flows, fraud prevention measures, profiling systems, third-party providers or other processing activities described in this Privacy Policy. The current version will always be available through the Services, indicating the date of the last update.

In the event of material changes that significantly affect your rights or the way we process your personal data, we will inform you clearly and in advance through appropriate communication channels, such as email, in-app notice or website notification. Where a new consent is required, we will request it before starting the relevant processing.

Under no circumstances will we make substantial changes to the Privacy Policy without informing you where required by applicable law and giving you the opportunity to consider their implications.

11. Security of personal data

We take appropriate technical and organizational measures designed to ensure the security of your personal data, prevent unauthorized access and prevent its loss, alteration, improper disclosure or destruction.

These measures may include encryption, access controls, authentication, logging, monitoring, segregation of permissions, supplier review and incident-response processes. We also require persons authorized to process personal data to comply with confidentiality obligations.

For security, fraud prevention and platform integrity purposes, Triumph may use technical and organizational measures designed to detect suspicious activity, unauthorized access, bots, artificial intelligence tools, VPN or proxy use, device manipulation, jailbroken devices, emulator or device farm use, fraudulent transactions, account misuse and other conduct that may compromise the Platform or other users. These measures will be applied in accordance with this Privacy Policy and applicable data protection laws.

The security of your information also depends on you. You are responsible for using strong passwords, keeping your credentials confidential, avoiding credential sharing and notifying Triumph immediately if you suspect unauthorized access. Triumph will never ask you to disclose your full password through unsecured channels.

No internet-connected system can be guaranteed to be completely secure. If a personal data breach occurs and is likely to affect your rights and freedoms, Triumph will act in accordance with GDPR notification obligations.

12. Minors and age-restricted features

The Services are not intended for children who do not meet the minimum age required by applicable law or by the relevant service terms. In Spain, where processing relies on the consent of a minor in relation to information society services, Triumph must apply the Spanish rules on the minimum age for valid digital consent and, where applicable, parental or guardian authorization.

Real-cash tournaments, deposits, withdrawals and any other feature requiring legal adulthood are restricted to users aged 18 or over, or any higher age required by the applicable jurisdiction or product-specific rules.

Where age verification, identity verification or eligibility checks are required to access age-restricted features, withdrawals, real-cash tournaments or other restricted services, Triumph may request and process the information necessary to verify that the user satisfies the applicable requirements. If the verification fails or cannot be completed, Triumph may restrict access to the relevant features in accordance with the Terms, this Privacy Policy and applicable law.

Triumph may use age assurance, identity verification and eligibility checks to prevent minors from accessing restricted features. Such checks must be proportionate, privacy-preserving and limited to what is necessary for the relevant purpose.

If Triumph becomes aware that it has processed a minor’s data without a valid legal basis, or that a minor has accessed restricted features, Triumph will take reasonable steps to block access, delete or restrict the data where appropriate and comply with applicable legal obligations.