OFFICIAL MEMBERSHIP, PRIVACY POLICY

PLAY, ACCOUNT AND KING’S LANDING

PRIVACY POLICY

Last Updated: July 24, 2026
Effective Date: [INSERT PUBLIC WEBSITE LAUNCH DATE]

IMPORTANT PRIVACY NOTICE

This Privacy Policy explains how King’s Landing collects, receives, uses, stores, protects, discloses, and otherwise processes personal information in connection with:

The King’s Landing public website;

Membership registration;

Identity, age, and location verification;

The King’s Landing member dashboard;

Third-party entertainment-platform access;

Promotional programs;

Referral programs;

Account-funding transactions;

Redemption requests;

Customer support;

Email and text-message communications;

Social-media pages, groups, advertisements, and messages;

Cookies, pixels, analytics, and advertising technologies; and

Other King’s Landing services that link to this Privacy Policy.

This Privacy Policy does not replace the privacy policies of HighLevel, Tierlock, payment processors, third-party entertainment platforms, Meta, or other independent providers. Those companies may collect and process information under their own privacy notices when members use their services.

King’s Landing will not use government identification, identity-verification photographs, complete payment credentials, precise location information, tax information, or redemption records for targeted advertising.

Members should read this Privacy Policy before:

Registering an Account;

Submitting identification;

Entering payment information;

Accessing a third-party Platform;

Participating in a promotion;

Joining a referral program;

Submitting a redemption request;

Consenting to text or email marketing; or

Otherwise using the Website or Services.

WEBSITE AND SERVICE DESCRIPTION

King’s Landing is a private, membership-based online promotional entertainment community.

The King’s Landing Website may allow eligible members to:

Create and maintain a membership Account;

Verify identity, age, and geographic eligibility;

Access a secure member dashboard;

Select an available third-party entertainment Platform;

Receive or request Platform credentials;

Submit an Account-Funding Transaction;

Review available promotions;

Receive Standard Account Credits or Promotional Credits;

Participate in referral and loyalty programs;

Submit redemption requests;

Review Account and request information;

Receive transaction and security notifications;

Communicate with support; and

Access other services offered through the Website.

The categories of personal information collected depend on which portions of the Website or Services a person uses.

1. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal information King’s Landing collects:

Directly through the Website;

Through HighLevel forms, surveys, chat widgets, calendars, workflows, member records, or communications;

Through King’s Landing customer-support channels;

Through official King’s Landing social-media pages, groups, advertisements, and direct messages;

Through referrals and promotional programs;

From Tierlock or another approved transaction, wallet, verification, or payment provider;

From an approved third-party Platform;

From identity, age, fraud, security, or location-verification providers;

Automatically through cookies, pixels, analytics, server logs, and similar technologies;

From service providers working on behalf of King’s Landing; and

From lawful public, commercial, or governmental sources when necessary for verification, fraud prevention, or compliance.

This Privacy Policy does not govern information collected independently by:

HighLevel for its own corporate purposes;

Tierlock under Tierlock’s own Privacy Policy;

A bank, card issuer, wallet provider, or payment processor;

A third-party entertainment Platform;

Meta, Facebook, Instagram, Messenger, or another social-media provider;

A telecommunications carrier;

A government agency;

An independently operated website linked from the King’s Landing Website; or

Another third party that determines its own data-processing practices.

2. DEFINITIONS

For purposes of this Privacy Policy:

2.1 “Account”

“Account” means a membership profile registered through the King’s Landing Website, including the member dashboard, registration information, verification records, transaction history, Platform information, referral information, communications, and support records.

2.2 “Account-Funding Transaction”

“Account-Funding Transaction” means a member-authorized transaction submitted through an approved payment or transaction provider for the purpose of assigning Standard Account Credits to an approved Platform Account.

2.3 “Controller”

“Controller” means the person or business that determines the purpose and means of processing personal information.

King’s Landing generally acts as the Controller of information collected directly for King’s Landing’s membership, promotional, transaction-support, redemption, security, and customer-service operations.

2.4 “Personal Information”

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly with an individual or household.

Personal Information does not generally include:

Publicly available information as defined by applicable law;

Lawfully deidentified information;

Lawfully aggregated information; or

Information excluded from applicable privacy-law definitions.

2.5 “Platform”

“Platform” means an independently operated third-party promotional entertainment platform made available through or referenced by King’s Landing.

2.6 “Processing”

“Processing” means any operation performed on Personal Information, including:

Collection;

Recording;

Organization;

Storage;

Use;

Analysis;

Disclosure;

Transmission;

Restriction;

Correction;

Deletion; or

Destruction.

2.7 “Promotional Credits”

“Promotional Credits” means complimentary, match-play, referral, loyalty, bonus, free-play, or other promotional credits issued under an applicable offer.

2.8 “Sensitive Personal Information”

“Sensitive Personal Information” may include, depending on applicable law:

Government-issued identification numbers;

Precise geolocation;

Financial-account credentials;

Account login credentials;

Biometric identifiers;

Information revealing racial or ethnic origin;

Religious beliefs;

Health information;

Sexual orientation;

Citizenship or immigration status;

Information collected from a known child; and

Other information classified as sensitive by applicable law.

2.9 “Service Provider” or “Processor”

“Service Provider” or “Processor” means a person or company that processes Personal Information on behalf of King’s Landing under instructions or contractual restrictions.

2.10 “Services”

“Services” means the Website, membership system, member dashboard, identity-verification process, Platform-access support, promotional programs, referral programs, transaction-support functions, redemption-request process, communications, and customer support.

2.11 “Standard Account Credits”

“Standard Account Credits” means credits assigned to an approved Platform Account after verification of an accepted Account-Funding Transaction.

2.12 “Website”

“Website” means the official King’s Landing domain and any authorized King’s Landing registration page, landing page, member portal, support page, promotional page, or related webpage.

3. INFORMATION COLLECTED

King’s Landing may collect the following categories of Personal Information:

3.1 Identifiers

Full legal name;

Username;

Account number or internal member identifier;

Date of birth;

Email address;

Telephone number;

Residential address;

Mailing address;

IP address;

Device identifier;

Cookie identifier;

Social-media username;

Referral code;

Platform username; and

Other similar identifiers.

3.2 Government and Identity Information

Driver’s-license information;

State-identification information;

Passport information;

Images of identification documents;

Document expiration dates;

Identity-verification results;

Age-verification results;

Selfies or live photographs submitted for identity matching;

Verification-provider reference numbers; and

Records showing whether verification was approved, denied, or requires review.

King’s Landing should collect only the portions of an identity document reasonably necessary for eligibility, fraud prevention, transaction verification, and compliance.

3.3 Contact Information

Email address;

Mobile telephone number;

Mailing address;

Preferred communication method;

Communication-consent status;

Marketing preferences;

Opt-out records; and

Records showing whether an email or telephone number has been verified.

3.4 Account and Registration Information

Registration date and time;

Account status;

Acceptance of policies;

Preferred Platform;

Referring member;

Referral code;

Member preferences;

Platform credentials or credential-reference information;

Account restrictions;

Account-closure information;

Responsible-participation requests; and

Other information submitted through registration or Account-management forms.

3.5 Commercial and Transaction Information

Account-Funding Transaction amount;

Transaction date and time;

Transaction status;

Payment-provider reference number;

Payment method type;

Last four digits or tokenized payment identifier when supplied by a provider;

Standard Account Credits assigned;

Promotional Credits assigned;

Promotional participation history;

Referral-reward history;

Redemption-request amount;

Redemption destination;

Redemption status;

Processing fees;

Refund, reversal, or chargeback information;

Platform-balance information;

Transaction-related support records; and

Records required for accounting, tax, fraud, and dispute purposes.

King’s Landing should not receive or store complete card numbers, card-security codes, complete bank-account login credentials, or complete digital-wallet passwords.

Those credentials should be entered directly into the approved provider’s secure system.

3.6 Internet and Website-Activity Information

Pages viewed;

Links selected;

Buttons selected;

Forms started or submitted;

Referring website;

Exit page;

Session duration;

Date and time of visits;

Browser type;

Operating system;

Device type;

Screen resolution;

Approximate location derived from IP address;

Advertising identifiers;

Cookie identifiers;

Website errors;

Chat-widget interactions;

Email engagement;

Marketing attribution;

Advertisement interactions;

Conversion events; and

Other electronic activity involving the Website.

3.7 Device and Security Information

IP address;

Device identifier;

Browser configuration;

Operating system;

Login history;

Authentication attempts;

Password-reset requests;

Verification codes;

Fraud-risk indicators;

Device relationships between Accounts;

Security alerts;

Network information;

Proxy or VPN indicators;

Emulator indicators;

Location-manipulation indicators; and

Other information used to protect the Website and Accounts.

3.8 Location Information

King’s Landing may collect:

State and city entered during registration;

Billing or payment address;

Approximate location based on IP address;

Device-location data;

Geolocation-verification results;

Location mismatch indicators; and

Records establishing whether a member was physically located in an approved jurisdiction.

Precise geolocation will be collected only when reasonably necessary and with any consent required by applicable law.

Precise geolocation will not be used for targeted advertising.

3.9 Communications

Emails;

Text messages;

Support tickets;

Web-chat conversations;

Social-media direct messages;

Telephone-call notes;

Complaint records;

Dispute notices;

Promotion inquiries;

Account-closure requests;

Security reports;

Documents attached to support messages; and

Other communications with King’s Landing.

Calls may be monitored or recorded when permitted by law and after any required notice.

3.10 Social and Community Information

When a person interacts with an official King’s Landing social-media page or group, King’s Landing may receive:

Public profile name;

Profile photograph;

Social-media username;

Public posts;

Comments;

Reactions;

Group-membership information;

Direct messages;

Advertisement responses;

Lead-form submissions;

Referral information;

Contest or promotion entries; and

Other information the person makes available through the social platform.

3.11 Promotional and Referral Information

Promotion claimed;

Offer code;

Promotional period;

Qualifying transaction;

Promotional Credits received;

Playthrough status;

Maximum-redemption information;

Referral link or code;

Referring member;

Referred member;

Referral qualification status;

Referral-reward status;

Promotion eligibility;

Promotion disqualification reasons; and

Fraud-review information.

3.12 Tax and Compliance Information

When legally or operationally required, King’s Landing may collect:

Legal name;

Mailing address;

Taxpayer-identification information;

Form W-9 information;

Tax-withholding information;

Tax-reporting classification;

Payment-reporting information;

Records of tax documents issued; and

Other information required to satisfy tax or legal obligations.

Tax information will not be used for advertising.

3.13 Inferences

King’s Landing or its providers may derive limited inferences concerning:

Fraud risk;

Duplicate-Account risk;

Location eligibility;

Promotion eligibility;

Communication preferences;

Platform preferences;

Website engagement; and

Likelihood that a Website visitor will complete registration.

King’s Landing will not use Sensitive Personal Information to infer characteristics for targeted advertising.

4. CONTACT AND REGISTRATION DATA

When a person registers or requests information, King’s Landing may collect:

Full legal name;

Date of birth;

Residential address;

Email address;

Mobile number;

Preferred username;

Password or password-protected authentication information;

Preferred Platform;

Referral source;

Referring-member information;

Communication preferences;

Policy-acceptance records;

Registration IP address;

Registration date and time;

Device information;

Identity-verification information; and

Other information shown on the registration form.

King’s Landing uses registration data to:

Create and administer the Account;

Confirm age and identity;

Determine geographic eligibility;

Prevent duplicate Accounts;

Provide Platform access;

Communicate about the Account;

Process transactions and redemption requests;

Administer promotions and referrals;

Detect fraud and unauthorized access;

Maintain records of policy acceptance; and

Comply with legal and provider requirements.

Registration data must be accurate and belong to the person creating the Account.

A person may not register using another individual’s identity, telephone number, email address, government identification, or payment information without lawful authorization.

5. IDENTITY, AGE AND LOCATION VERIFICATION

King’s Landing may require identity, age, and location verification:

During registration;

Before Platform access;

Before an Account-Funding Transaction;

Before a redemption request;

When Account information changes;

When fraud indicators are detected;

When multiple Accounts appear related;

When required by a provider; or

When otherwise reasonably necessary.

Verification may involve:

Government identification;

Identity-document analysis;

Selfie or liveness verification;

Date-of-birth comparison;

Address comparison;

Telephone verification;

Email verification;

IP-address analysis;

Device-location information;

Payment-account verification;

Fraud databases; and

Manual review.

King’s Landing may receive the underlying verification documents or only the verification result, depending on the provider and system configuration.

King’s Landing will not:

Post identity documents publicly;

Use identity documents in advertisements;

Include identity documents in social-media tools;

Send identity documents through Meta Pixel;

Use verification selfies as testimonials; or

use government-identification information for unrelated marketing.

A separate consent disclosure will be presented before collecting biometric information when applicable law requires consent.

6. PAYMENT, TRANSACTION AND REDEMPTION INFORMATION

King’s Landing may receive transaction information from:

Tierlock;

A card processor;

A bank or financial institution;

A digital-wallet provider;

A payment gateway;

A Platform provider;

A member;

A fraud-prevention provider; or

Another approved transaction provider.

The information received may include:

Member name;

Transaction amount;

Transaction date;

Transaction status;

Payment method type;

Tokenized payment reference;

Last four digits of an account;

Billing ZIP code;

Provider reference number;

Chargeback or reversal status;

Settlement status;

Redemption destination;

Redemption status; and

Related risk indicators.

Complete payment credentials should be entered directly into the payment provider’s secure interface.

King’s Landing will use payment and redemption information to:

Confirm transactions;

Assign credits;

Review promotion eligibility;

Process redemption requests;

Prevent duplicate processing;

Investigate disputes;

Detect fraud;

Maintain accounting records;

Reconcile provider records;

Respond to chargebacks;

Satisfy tax obligations; and

Enforce the Official Rules and Terms of Use.

Payment and redemption information will not be used for targeted advertising.

7. PLATFORM INFORMATION

King’s Landing may receive information from an approved Platform concerning:

Platform username;

Account status;

Credentials issuance;

Credit assignment;

Promotional Credits;

Balance information;

Participation history;

Playthrough status;

Technical errors;

Suspicious activity;

Account restrictions;

Redemption eligibility; and

Other records necessary to provide administrative or support services.

The applicable Platform may independently collect additional information under its own privacy policy.

King’s Landing does not control an independent Platform’s collection, security, retention, disclosure, or use of information except to the extent required by a contract or applicable law.

Members should review the privacy notice of each Platform they use.

8. WEBSITE-USAGE DATA

King’s Landing may automatically collect Website-usage information when a visitor:

Opens the Website;

Views a page;

Selects a link;

Starts or submits a form;

Uses web chat;

Creates an Account;

Logs into an Account;

Views a promotion;

Selects a Platform;

Submits a transaction request;

Submits a redemption request;

Opens an email;

Selects a link in an email;

Arrives through an advertisement; or

Otherwise interacts with the Website.

This data may be used to:

Operate and improve the Website;

Remember user settings;

Diagnose technical problems;

Understand Website traffic;

Protect Accounts;

Measure marketing results;

Prevent fraud;

Attribute registrations to advertisements or referrals;

Determine whether communications were delivered;

Improve page design;

Maintain security logs; and

Comply with provider requirements.

King’s Landing will not intentionally configure analytics or advertising tools to capture:

Passwords;

Complete payment credentials;

Government-identification images;

Taxpayer-identification numbers;

Verification selfies;

Support-message free text containing sensitive information;

Precise redemption destinations; or

Other information that is unnecessary for analytics or advertising.

9. COOKIES AND TRACKING TECHNOLOGIES

King’s Landing and its providers may use:

Cookies;

Local storage;

Session storage;

Tracking pixels;

Web beacons;

Software-development kits;

Device identifiers;

Advertising identifiers;

Conversion APIs;

Server logs;

Analytics tags; and

Similar technologies.

9.1 Strictly Necessary Technologies

Strictly necessary technologies may be used to:

Operate the Website;

Maintain a session;

Authenticate Accounts;

Secure forms;

Prevent fraud;

Remember privacy choices;

Load required Website features; and

Process user requests.

These technologies may be required for the Website to function.

9.2 Functional Technologies

Functional technologies may:

Remember language or display preferences;

Preserve form progress;

Remember Platform preferences;

Support web chat;

Maintain user settings; and

Improve Website convenience.

9.3 Analytics Technologies

Analytics technologies may collect information concerning:

Page views;

Traffic sources;

Session duration;

Device type;

Browser type;

General location;

Link selections;

Form completion; and

Website performance.

Analytics information is used to understand and improve the Website.

9.4 Advertising Technologies

Advertising technologies may be used to:

Measure advertisements;

Attribute registrations;

Create advertising audiences;

Limit repeated advertisements;

Deliver relevant advertisements;

Understand campaign performance; and

Conduct targeted advertising where legally permitted.

Depending on applicable law, use of advertising technologies may be considered:

Targeted advertising;

Cross-context behavioral advertising;

Sharing of Personal Information; or

A sale of Personal Information even when no money is exchanged.

9.5 Cookie Consent

Where required, nonessential analytics and advertising technologies will not be activated until the visitor has made an applicable privacy choice.

The Website should provide a cookie-consent interface that allows visitors to:

Accept nonessential cookies;

Reject nonessential cookies;

Adjust cookie categories;

Review cookie information; and

Change prior choices.

9.6 Browser Settings

A visitor may be able to block or delete cookies through browser settings.

Blocking strictly necessary cookies may prevent portions of the Website from functioning correctly.

9.7 Cookie List

Before publication, King’s Landing must maintain an accurate cookie list identifying:

Cookie or technology name;

Provider;

Purpose;

Category;

Duration; and

Whether the technology is first-party or third-party.

10. SOURCES OF PERSONAL INFORMATION

King’s Landing may collect Personal Information from:

The individual;

A referring member;

HighLevel;

Tierlock;

Payment processors;

Wallet providers;

Identity-verification providers;

Age-verification providers;

Geolocation providers;

Fraud-prevention providers;

Third-party Platforms;

Meta, Facebook, Instagram, or Messenger;

Advertising providers;

Analytics providers;

Telecommunications providers;

Website-hosting and security providers;

Publicly available sources;

Governmental records where legally permitted;

Consumer-reporting or fraud databases where lawfully used;

A person authorized to act for the member; and

Other providers used to operate the Services.

King’s Landing will not purchase sensitive identity or financial information from unknown or unverified sources.

11. HOW INFORMATION IS USED

King’s Landing may use Personal Information to:

11.1 Operate the Services

Provide the Website;

Create Accounts;

Maintain member records;

Authenticate users;

Provide member-dashboard access;

Provide Platform-access support;

Assign or reconcile credits;

Process redemption requests; and

Provide customer support.

11.2 Verify Eligibility

Confirm identity;

Confirm age;

Confirm geographic location;

Verify contact information;

Verify payment ownership;

Detect duplicate Accounts; and

Determine promotion eligibility.

11.3 Process Transactions

Verify Account-Funding Transactions;

Assign Standard Account Credits;

Assign Promotional Credits;

Reconcile records;

Process redemption requests;

Investigate failed transactions;

Address refunds, reversals, and chargebacks; and

Maintain accounting and tax records.

11.4 Administer Promotions and Referrals

Determine qualification;

Apply promotional terms;

Issue Promotional Credits;

Verify Active Referrals;

Prevent self-referrals;

Detect coordinated Accounts;

Enforce limits;

Select or verify promotion winners; and

Communicate promotion status.

11.5 Communicate

Send verification codes;

Send Account notices;

Send transaction confirmations;

Send redemption updates;

Respond to support requests;

Send security alerts;

Send legal notices;

Send service announcements;

Send marketing communications with applicable consent; and

Maintain communication-preference records.

11.6 Secure the Website and Services

Detect unauthorized access;

Detect VPN or proxy misuse;

Detect location manipulation;

Investigate suspicious transactions;

Prevent Account takeovers;

Detect malicious software;

Protect Website infrastructure;

Maintain security logs;

Enforce the Terms and Official Rules; and

Protect members, providers, and King’s Landing.

11.7 Improve the Website and Business

Diagnose errors;

Analyze Website performance;

Understand user interactions;

Improve registration flows;

Improve support procedures;

Measure promotions;

Measure advertising;

Develop new features;

Conduct internal reporting; and

Train authorized personnel.

11.8 Satisfy Legal and Compliance Requirements

Respond to lawful process;

Maintain tax records;

Investigate fraud;

Enforce agreements;

Protect legal rights;

Conduct audits;

Respond to privacy requests;

Preserve records subject to legal hold; and

Comply with applicable laws and provider obligations.

12. LEGAL AND OPERATIONAL BASES FOR PROCESSING

Depending on the applicable law and activity, King’s Landing may process Personal Information based on:

Performance of a contract;

Steps requested before entering a contract;

Consent;

Compliance with legal obligations;

Protection against fraud and security threats;

Protection of legal rights;

Legitimate business purposes;

Completion of requested transactions;

Delivery of requested communications; or

Another lawful basis.

Where consent is required, a person may withdraw consent as described in this Privacy Policy.

Withdrawal does not make prior lawful processing invalid.

Certain Services may not be available after withdrawal when the information is necessary to:

Verify identity;

Confirm age;

Confirm location;

Process a transaction;

Protect Account security;

Comply with law; or

Maintain required records.

13. AUTOMATED PROCESSING AND FRAUD REVIEW

King’s Landing and its providers may use automated tools to identify:

Duplicate Accounts;

Suspicious devices;

Unusual transaction activity;

Payment risk;

Account takeover risk;

Location mismatch;

Promotion abuse;

Referral abuse; and

Other security concerns.

An automated risk indicator may result in:

Additional verification;

Delayed processing;

Manual review;

Temporary restriction; or

A request for supporting information.

King’s Landing should not make a decision producing a legal or similarly significant effect solely through automated processing when applicable law requires human review or provides a right to opt out.

A member may contact support to request review of a qualifying automated decision.

14. SMS AND EMAIL COMMUNICATIONS

14.1 Transactional Communications

King’s Landing may send nonmarketing communications reasonably necessary to operate and protect an Account, including:

Verification codes;

Registration confirmations;

Password-reset messages;

Security alerts;

Platform credentials;

Transaction confirmations;

Redemption updates;

Support responses;

Policy notices;

Account restrictions;

Closure notices; and

Service announcements.

Transactional communications may be necessary even when a member has opted out of promotional marketing.

14.2 Promotional Email

With applicable permission, King’s Landing may send emails concerning:

Promotions;

Match-play windows;

Referral offers;

New Platforms;

Member events;

Loyalty rewards;

Community announcements; and

Other marketing messages.

Marketing emails will include an unsubscribe method when required.

A member may unsubscribe by:

Selecting the unsubscribe link;

Updating communication preferences; or

Contacting King’s Landing support.

14.3 Promotional Text Messages

Where a member has provided applicable consent, King’s Landing may send promotional text messages using manual or automated technology.

Text disclosures should state:

The identity of King’s Landing;

The types of messages;

That message frequency may vary;

That message and data rates may apply;

That consent is not a condition of registration, participation, or a transaction;

How to obtain help; and

How to opt out.

A member may opt out of promotional texts by replying:

STOP;

END;

CANCEL;

UNSUBSCRIBE;

QUIT; or

Another clear request to stop.

King’s Landing may send one nonpromotional confirmation of the opt-out request.

14.4 HELP Requests

A member may reply HELP or contact the published support information for assistance.

14.5 Consent Records

King’s Landing may retain records showing:

Consent language presented;

Date and time of consent;

Source page or form;

Telephone number or email involved;

IP address;

Consent status;

Opt-out date;

Opt-out method; and

Confirmation of the request.

14.6 No Sale of SMS Consent Data

Mobile opt-in data and consent records will not be sold, rented, or shared with unaffiliated third parties for those parties’ independent text-message marketing.

King’s Landing may disclose SMS information to service providers that deliver messages, maintain consent records, prevent fraud, or support the communication program.

15. INFORMATION SHARING

King’s Landing may disclose Personal Information to the following categories of recipients:

15.1 Service Providers

Providers that support:

Website hosting;

Customer relationship management;

Form processing;

Email and text delivery;

Identity verification;

Age verification;

Geolocation;

Fraud prevention;

Cybersecurity;

Analytics;

Advertising;

Customer support;

Accounting;

Tax reporting;

Document storage; and

Professional services.

15.2 Transaction and Payment Providers

King’s Landing may share transaction-related information with:

Tierlock;

Payment processors;

Banks;

Card networks;

Wallet providers;

Fraud-screening providers;

Settlement providers; and

Redemption providers.

15.3 Third-Party Platforms

Information may be provided to a Platform to:

Create or access a Platform Account;

Assign credits;

Verify balances;

Review participation;

Enforce Platform rules;

Investigate technical issues;

Investigate fraud; and

Review redemption eligibility.

15.4 Social and Advertising Providers

Where advertising tools are enabled, King’s Landing may provide limited identifiers and Website-event information to:

Meta;

Facebook;

Instagram;

Advertising networks;

Campaign-measurement providers; and

Similar providers.

This sharing will be subject to available consent and opt-out controls.

15.5 Professional Advisers

Information may be disclosed to:

Attorneys;

Accountants;

Auditors;

Compliance consultants;

Insurance providers;

Cybersecurity professionals; and

Other professional advisers.

15.6 Legal and Safety Disclosures

King’s Landing may disclose information when reasonably believed necessary to:

Comply with a law;

Respond to a subpoena, warrant, court order, or lawful request;

Investigate fraud;

Protect a person’s safety;

Prevent unauthorized activity;

Enforce the Terms or Official Rules;

Protect King’s Landing’s legal rights;

Respond to a government agency; or

Establish, exercise, or defend a legal claim.

15.7 Business Transactions

Information may be transferred in connection with:

A merger;

Acquisition;

Financing;

Reorganization;

Sale of assets;

Change in control;

Bankruptcy; or

Transfer of the King’s Landing business.

Any recipient will remain subject to applicable privacy and security obligations.

15.8 At the Individual’s Direction

King’s Landing may disclose information:

At the member’s request;

With the member’s consent;

To an authorized representative; or

As otherwise clearly disclosed when the information is collected.

16. HIGHLEVEL AND OTHER SERVICE PROVIDERS

King’s Landing expects to use HighLevel for functions that may include:

Website hosting or page-building;

Registration forms;

Surveys;

Web chat;

Customer relationship management;

Contact records;

Workflow automation;

Email;

Text messaging;

Telephone features;

Support records;

Calendars;

Member communications;

Consent records; and

Marketing attribution.

For Personal Information King’s Landing collects and manages through HighLevel, King’s Landing generally determines the business purposes for processing, while HighLevel provides processing and storage services under King’s Landing’s instructions and applicable agreements.

HighLevel may separately process information for its own purposes when a person:

Visits HighLevel’s own website;

Creates a direct HighLevel Account;

Contacts HighLevel directly;

Uses a HighLevel service independently of King’s Landing; or

Otherwise interacts directly with HighLevel.

King’s Landing may also use additional providers for:

Website hosting;

Domains;

cybersecurity;

analytics;

document storage;

accounting;

tax reporting;

identity verification;

communications; and

customer support.

Before a provider is given access to Personal Information, King’s Landing should evaluate:

The information required;

The provider’s role;

Security safeguards;

Contract terms;

Retention practices;

Subprocessors;

Incident procedures; and

Deletion or return procedures.

Service providers should receive only the information reasonably necessary to perform their contracted functions.

17. TIERLOCK OR PAYMENT-SERVICE PROVIDERS

King’s Landing may use Tierlock or another approved provider for:

Member onboarding;

Identity or age verification;

Wallet-related functions;

Payment-related functions;

Transaction support;

Settlement support;

Account-Funding Transactions;

Redemption support;

Alternative methods of entry;

Operator-related functions; and

Fraud prevention.

Tierlock and other payment providers may collect Personal Information directly from members through their own forms, interfaces, applications, or systems.

That information may include:

Identity information;

Contact information;

Verification information;

Payment information;

Wallet information;

Transaction information;

Device information;

IP address;

Fraud-risk information;

Account information; and

Communications.

Tierlock and other providers may process this information under their own:

Privacy policies;

Terms of service;

Payment agreements;

Verification disclosures;

Cookie policies; and

Security procedures.

King’s Landing may receive only a portion of the information provided to Tierlock or a payment provider, such as:

Verification status;

Transaction amount;

Transaction status;

Tokenized reference;

Payment method type;

Fraud result;

Settlement result; or

Redemption status.

King’s Landing is not responsible for an independent provider’s privacy practices outside King’s Landing’s control.

Members should review the provider’s privacy policy before submitting information.

18. FACEBOOK, META AND OTHER SOCIAL PLATFORMS

King’s Landing may maintain:

Facebook Pages;

Facebook Groups;

Instagram profiles;

Messenger accounts;

Social-media advertisements;

Lead-generation forms;

Community posts;

Promotional posts;

Direct-message channels; and

Other social-media features.

When a person interacts with King’s Landing through a social platform, the platform may provide King’s Landing with information based on:

The person’s privacy settings;

The person’s public profile;

The type of interaction;

The lead-form fields;

The advertisement selected;

The message sent; and

The platform’s policies.

The social platform independently determines how it collects and uses information through its service.

18.1 Meta Pixel and Conversions API

King’s Landing may use Meta Pixel, Conversions API, or another Meta Business Tool to:

Measure Website traffic;

Measure advertisements;

Attribute registrations;

Create advertising audiences;

Understand campaign performance;

Retarget Website visitors; and

Improve advertising.

Depending on configuration, information sent to Meta may include:

Page viewed;

Date and time;

Browser information;

IP address;

Cookie or device identifier;

Advertisement identifier;

Registration event;

General conversion event;

Hashed email address;

Hashed telephone number; and

Other approved event data.

King’s Landing will not intentionally send Meta:

Government-identification images;

Government-identification numbers;

Passwords;

Verification selfies;

Complete payment credentials;

Complete bank-account information;

Tax information;

Precise geolocation;

Detailed redemption information;

Detailed Platform activity;

Support-message content; or

Sensitive information unnecessary for advertising.

18.2 Social Lead Forms

Information submitted through a Facebook or Instagram lead form may be transmitted to King’s Landing and stored in HighLevel or another CRM.

The form should provide:

A clear description of King’s Landing;

A link to this Privacy Policy;

Any required marketing-consent language;

A description of how the information will be used; and

A separate consent mechanism for promotional texts when required.

18.3 Public Social Content

Comments, reactions, group posts, reviews, and other public social interactions may be visible to:

King’s Landing;

Other platform users;

Group members;

Search engines;

Meta; and

Other parties according to the social platform’s settings.

Members should not post government identification, passwords, complete payment information, or other sensitive information publicly.

19. ANALYTICS AND ADVERTISING

King’s Landing may use analytics and advertising providers to:

Measure Website use;

Measure advertisement performance;

Identify referral sources;

Understand registration completion;

Improve promotions;

Detect technical errors;

Prevent repeated advertisements;

Create advertising audiences; and

Conduct targeted advertising.

King’s Landing will not create targeted-advertising audiences from:

Government-identification data;

Verification photographs;

Payment credentials;

Tax records;

Redemption details;

Precise geolocation;

Sensitive support requests; or

Information revealing a legally protected sensitive characteristic.

Advertising providers may use their own cookies, identifiers, and technologies under their own privacy policies.

A visitor may exercise applicable advertising choices through:

The Website cookie-preference center;

The Website’s “Your Privacy Choices” link;

Browser controls;

Global Privacy Control;

Platform advertising settings; or

A privacy request submitted to King’s Landing.

20. SALE, SHARING AND TARGETED ADVERTISING

King’s Landing does not sell Personal Information in exchange for money.

King’s Landing does not sell:

Government-identification information;

Verification photographs;

Financial-account credentials;

Taxpayer-identification information;

Precise geolocation;

SMS opt-in consent;

Redemption-destination information; or

Account passwords.

However, when King’s Landing uses advertising cookies, Meta Pixel, Conversions API, or similar advertising technologies, disclosure of identifiers and Website-activity data may be legally classified in some states as:

A sale;

Sharing;

Cross-context behavioral advertising; or

Targeted advertising.

Where applicable, visitors may opt out through:

“Your Privacy Choices”;

The cookie-preference center;

A recognized Global Privacy Control signal;

A state privacy-request form; or

The privacy contact information listed below.

King’s Landing will not discriminate against a person for exercising a qualifying privacy right.

King’s Landing may continue using information for:

Security;

Fraud prevention;

Requested transactions;

Account administration;

First-party measurement;

Legal compliance; and

Other purposes permitted after an advertising opt-out.

21. DEIDENTIFIED AND AGGREGATED INFORMATION

King’s Landing may create information that is:

Aggregated;

Anonymized;

Deidentified; or

Otherwise not reasonably linkable to a specific individual.

This information may be used for:

Business reporting;

Website analytics;

Security analysis;

Platform performance;

Promotion analysis;

Service improvement; and

Other lawful purposes.

King’s Landing will not attempt to reidentify deidentified information except:

To test whether deidentification methods are effective;

To protect security;

To comply with law; or

When otherwise legally permitted.

Recipients of deidentified information should be contractually prohibited from attempting to reidentify it where required.

22. DATA RETENTION

King’s Landing retains Personal Information only for as long as reasonably necessary for:

The purposes described in this Privacy Policy;

Account administration;

Transaction processing;

Redemption processing;

Fraud prevention;

Security;

Legal compliance;

Tax reporting;

Dispute resolution;

Enforcement; and

Establishment, exercise, or defense of legal claims.

Unless a different period is required by law, a legal hold, or a provider agreement, King’s Landing’s intended default retention schedule is:

22.1 Incomplete or Unapproved Registrations

Incomplete or unapproved registration records may be retained for up to 90 days.

Records associated with suspected fraud, duplicate Accounts, security threats, or legal claims may be retained longer.

22.2 Active Account Information

Account and registration information may be retained for the life of the Account.

22.3 Closed Account Information

Core Account records may be retained for up to five years after Account closure when needed for:

Fraud prevention;

Duplicate-Account prevention;

Transaction disputes;

Legal compliance;

Provider reconciliation; or

Enforcement.

22.4 Identity and Verification Records

Verification results and necessary supporting records may be retained for the Account’s active period and up to five years after closure.

King’s Landing should avoid retaining complete identity-document images when a verification result or token is sufficient.

22.5 Transaction, Redemption and Tax Records

Transaction, redemption, accounting, payment-dispute, and tax records may be retained for up to seven years after the applicable transaction or longer when required by law.

22.6 Communication-Consent Records

Marketing consent and opt-out records may be retained for at least five years after the last applicable communication or longer if needed to demonstrate compliance.

22.7 Customer-Support Records

General support records may be retained for up to three years after resolution.

Support records involving fraud, transactions, redemptions, threats, or legal disputes may be retained longer.

22.8 Security and Website Logs

Security, authentication, IP-address, and Website logs may be retained for up to 24 months unless needed for an active investigation.

22.9 Advertising and Analytics Data

Advertising and analytics data will be retained according to:

King’s Landing’s settings;

The provider’s retention controls;

Cookie durations; and

Applicable legal requirements.

22.10 Backups

Deleted information may remain in encrypted or access-restricted backups for up to 90 additional days before routine deletion or overwrite.

22.11 Legal Holds

King’s Landing may retain information beyond the normal period when necessary to:

Preserve evidence;

Respond to a government request;

Address litigation;

Investigate fraud;

Resolve a dispute;

Satisfy tax requirements; or

Enforce an agreement.

When the purpose ends, information will be deleted, deidentified, or securely archived as appropriate.

23. DATA SECURITY

King’s Landing will use reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information processed.

Safeguards may include:

Role-based access controls;

Unique administrator credentials;

Multifactor authentication;

Password requirements;

Encryption in transit;

Encryption at rest where supported;

Secure provider interfaces;

Access logging;

Security monitoring;

Staff confidentiality requirements;

Provider reviews;

Data minimization;

Restricted access to identity documents;

Restricted access to transaction records;

Secure backups;

Malware protection;

Incident-response procedures;

Account-verification procedures; and

Periodic access reviews.

Only authorized persons with a legitimate business need should access sensitive member information.

King’s Landing administrators must not:

Share administrator passwords;

Store member identification on personal devices;

Send complete payment information through personal text messages;

Download member records without a business need;

Use member data for personal purposes;

Send member data to unapproved applications; or

Retain member documents outside approved systems.

No security system is completely secure.

King’s Landing cannot guarantee that unauthorized access, loss, alteration, or disclosure will never occur.

Members are responsible for protecting their own:

Password;

Email Account;

Mobile device;

Verification codes;

Platform credentials; and

Payment credentials.

24. SECURITY INCIDENTS

King’s Landing will maintain procedures for reviewing suspected security incidents.

Depending on the circumstances, King’s Landing may:

Restrict affected Accounts;

Reset credentials;

Preserve logs;

Investigate the incident;

Notify affected providers;

Engage cybersecurity professionals;

Notify law enforcement;

Notify affected individuals;

Notify regulators; and

Take corrective action.

Notifications will be provided when required by applicable law.

Members should promptly notify King’s Landing if they believe:

Their Account was accessed without permission;

Their credentials were exposed;

Their identity was misused;

Their device was lost;

An unauthorized transaction occurred; or

A message requesting sensitive information appears fraudulent.

King’s Landing will never request a member’s complete password through a social-media comment or unsolicited direct message.

25. USER CHOICES AND OPT-OUTS

Members may have the following choices:

25.1 Account Information

Members may request correction of inaccurate Account information through:

The member dashboard;

Support; or

The privacy-request process.

Certain changes may require reverification.

25.2 Marketing Emails

Members may unsubscribe using the link in a marketing email or by contacting support.

25.3 Marketing Texts

Members may opt out by replying STOP or another clear opt-out command.

25.4 Cookies

Visitors may manage nonessential cookies through the Website’s cookie-preference center.

25.5 Targeted Advertising

Visitors may use:

“Your Privacy Choices”;

Cookie controls;

Global Privacy Control;

Provider advertising settings; or

A privacy request.

25.6 Social-Media Settings

Users may adjust information available to King’s Landing through the privacy and advertising settings of the applicable social platform.

25.7 Account Closure

Members may request Account closure through support.

Certain information may remain retained for legal, security, tax, fraud, dispute, and recordkeeping purposes.

25.8 Withdrawal of Consent

A person may withdraw consent when processing is based on consent.

Withdrawal may not affect:

Processing completed before withdrawal;

Required transactional communications;

Fraud-prevention records;

Legal obligations;

Security requirements; or

Contractual services that cannot be provided without the information.

25.9 Responsible-Participation Requests

Members may request:

Promotional-message restrictions;

Temporary Account restrictions;

Cooling-off measures; or

Account closure.

26. DO NOT TRACK AND GLOBAL PRIVACY CONTROL

Some browsers provide “Do Not Track” settings.

Because there is no single universally accepted technical standard governing all Do Not Track signals, the Website may not respond to every traditional Do Not Track setting.

Where required by applicable law, King’s Landing will recognize supported opt-out preference signals, including Global Privacy Control, as a request to opt out of qualifying:

Sale;

Sharing;

Targeted advertising; or

Cross-context behavioral advertising

for the applicable browser or device.

A visitor may need to submit an Account-level request for an opt-out to apply across devices.

27. STATE PRIVACY RIGHTS

Depending on the person’s state of residence, the nature of the processing, and whether the applicable law applies to King’s Landing, a person may have the right to:

Confirm whether King’s Landing processes Personal Information;

Access Personal Information;

Receive a copy of qualifying Personal Information;

Correct inaccurate Personal Information;

Delete Personal Information;

Obtain Personal Information in a portable format;

Opt out of the sale of Personal Information;

Opt out of targeted advertising;

Opt out of qualifying profiling;

Opt out of sharing for cross-context behavioral advertising;

Limit certain uses of Sensitive Personal Information;

Withdraw consent;

Appeal the denial of a privacy request; and

Receive equal service without unlawful discrimination.

These rights are subject to legal exceptions.

King’s Landing may retain or continue processing information when reasonably necessary to:

Complete a requested transaction;

Maintain an Account;

Detect fraud;

Protect security;

Comply with law;

Exercise legal rights;

Defend a claim;

Maintain tax records;

Honor an opt-out;

Prevent duplicate Accounts;

Fulfill a contract; or

Perform another purpose permitted by applicable law.

28. TEXAS PRIVACY RIGHTS

When the Texas Data Privacy and Security Act applies, an eligible Texas consumer may request to:

Confirm whether King’s Landing is processing the consumer’s Personal Information;

Access the Personal Information;

Correct inaccuracies;

Delete Personal Information provided by or obtained about the consumer;

Receive a portable copy of qualifying Personal Information;

Opt out of targeted advertising;

Opt out of the sale of Personal Information; and

Opt out of qualifying profiling in furtherance of a decision producing a legal or similarly significant effect.

King’s Landing will obtain consent before processing Sensitive Personal Information when required.

King’s Landing will provide a process to appeal a denied Texas privacy request.

An eligible Texas consumer may submit a request using:

The Website privacy-request form;

The “Your Privacy Choices” page;

The privacy email listed below; or

Another method published on the Website.

Texas law may not apply to every business, person, record, or processing activity.

King’s Landing may voluntarily honor reasonable requests even when a particular law does not technically apply.

29. CALIFORNIA AND OTHER U.S. STATE DISCLOSURES

When California privacy law applies, a California resident may have rights to:

Know the categories and specific pieces of Personal Information collected;

Know the sources and purposes;

Know the categories of recipients;

Delete qualifying Personal Information;

Correct inaccurate Personal Information;

Opt out of sale or sharing;

Limit qualifying use of Sensitive Personal Information; and

Receive nondiscriminatory treatment.

King’s Landing does not sell Personal Information for money.

Advertising-cookie disclosures may qualify as sale or sharing under certain state-law definitions.

King’s Landing will provide an opt-out method where applicable.

Residents of other states may have similar rights under their state laws.

This section will apply only to the extent the applicable state law covers King’s Landing or the relevant processing activity.

30. EXERCISING A PRIVACY RIGHT

A person may submit a request through:

Privacy Request Page: [INSERT PRIVACY-REQUEST PAGE]

Privacy Email: [INSERT PRIVACY EMAIL]

Mailing Address: [INSERT COMPLETE MAILING ADDRESS]

The request should include:

Full legal name;

Registered email address;

Registered telephone number;

State of residence;

Account username, if applicable;

The right being requested; and

Sufficient information to locate and verify the relevant records.

A person should not send:

Account passwords;

Full card numbers;

Complete banking credentials; or

Unnecessary sensitive information.

31. VERIFYING PRIVACY REQUESTS

King’s Landing may verify a privacy request by comparing information provided with information already maintained.

Verification may require:

Confirmation through the registered email;

Confirmation through the registered telephone number;

Account login;

Government identification;

A signed declaration;

Transaction information;

Additional identity information; or

Other reasonable verification measures.

King’s Landing will request only the information reasonably necessary to verify the request.

A request may be denied or limited when:

Identity cannot reasonably be verified;

The requester lacks authority;

The request is fraudulent;

The request conflicts with legal obligations;

An exception applies;

The information belongs to another person;

Compliance would compromise security; or

The request is excessive or manifestly unfounded as defined by applicable law.

King’s Landing will explain qualifying denials as required.

32. AUTHORIZED AGENTS

Where applicable law permits, a person may authorize an agent to submit a privacy request.

King’s Landing may require:

Written permission signed by the consumer;

Proof of the agent’s identity;

Proof of authority;

Direct confirmation from the consumer; or

A valid power of attorney.

An authorized agent may use information received only for:

Submitting the request;

Verification;

Fraud prevention; or

Another legally permitted purpose.

Global Privacy Control signals will be treated as direct browser-based opt-out requests where required.

33. RESPONSE TIMES AND APPEALS

King’s Landing will respond within the period required by applicable law.

For many state privacy requests, the initial response period is 45 days, subject to a legally permitted extension.

King’s Landing may notify the requester when additional time is reasonably necessary.

If a qualifying request is denied, the person may appeal by:

Replying to the denial;

Using the Website appeal form; or

Emailing the privacy contact with the subject line “Privacy Request Appeal.”

The appeal should identify:

The original request;

The response received;

The reason the person believes the decision was incorrect; and

Any relevant additional information.

King’s Landing will review the appeal and provide a written response within the period required by applicable law.

34. NONDISCRIMINATION

King’s Landing will not unlawfully discriminate against a person for exercising an applicable privacy right.

King’s Landing will not, solely because a person exercised a qualifying privacy right:

Deny services;

Charge an unlawful different price;

Provide an unlawful different quality of service;

Retaliate against the person; or

Suggest that the person will receive unlawful discriminatory treatment.

King’s Landing may offer lawful loyalty, referral, promotional, or membership programs when participation is voluntary and any required disclosures are provided.

Some Services may be unavailable when deleted or withheld information is reasonably necessary to provide the requested Service.

35. CHILDREN’S PRIVACY

The King’s Landing Website and Services are intended only for adults who are at least 21 years old.

King’s Landing does not knowingly permit persons under 21 to create Accounts or participate in the Services.

King’s Landing does not knowingly collect Personal Information online from children under 13.

A parent or guardian who believes a child submitted Personal Information should contact King’s Landing immediately.

After appropriate verification, King’s Landing will take reasonable steps to:

Restrict the associated Account;

Delete the child’s information;

Prevent further collection;

Preserve only records legally required for security or compliance; and

Notify relevant providers when necessary.

A parent, guardian, or other adult may not create or operate an Account on behalf of a minor.

36. THIRD-PARTY LINKS AND SERVICES

The Website may contain links to:

Platforms;

Tierlock;

Payment providers;

Social-media websites;

Responsible-participation resources;

Government resources;

Support providers; and

Other external websites.

King’s Landing does not control the privacy practices of independent third parties.

A link does not mean King’s Landing:

Owns the third party;

Controls its data practices;

Endorses all of its content;

Guarantees its security; or

Accepts responsibility for its conduct.

Members should review the privacy notice of each external service before submitting information.

37. INTERNATIONAL ACCESS AND DATA TRANSFERS

The Services are intended for approved United States jurisdictions unless King’s Landing expressly states otherwise.

Information may be processed in the United States or another location where an approved provider maintains personnel or systems.

A person accessing the Website from outside the United States acknowledges that information may be transferred to and processed in the United States, subject to applicable law and provider safeguards.

King’s Landing should not intentionally activate international jurisdictions without reviewing:

Local eligibility requirements;

Privacy laws;

Cross-border-transfer requirements;

Marketing laws;

Payment restrictions; and

Platform restrictions.

38. POLICY CHANGES

King’s Landing may update this Privacy Policy to reflect:

Changes to the Website;

New or discontinued Platforms;

Changes in providers;

Changes in payment methods;

New communication systems;

New cookies or advertising tools;

New promotional programs;

Security improvements;

Legal requirements;

Changes in data practices; or

Business-operation changes.

The revised Privacy Policy will display a new “Last Updated” date.

Material changes may also be communicated through:

Email;

Text message;

Member-dashboard notice;

Website banner;

Registration notice; or

Another reasonable method.

When consent is legally required for a new use, King’s Landing will request consent before beginning that use.

A policy update will not retroactively authorize a materially different use of previously collected Sensitive Personal Information without any consent required by law.

39. CONTACT INFORMATION

Website Operator:
[INSERT FULL LEGAL ENTITY NAME]

Brand Name:
King’s Landing

Official Website:
[INSERT OFFICIAL WEBSITE DOMAIN]

General Support Email:
[INSERT SUPPORT EMAIL]

Privacy Email:
[INSERT PRIVACY EMAIL]

Security Incident Email:
[INSERT SECURITY EMAIL]

Legal Notice Email:
[INSERT LEGAL EMAIL]

Privacy Request Page:
[INSERT PRIVACY-REQUEST PAGE]

Your Privacy Choices Page:
[INSERT PRIVACY-CHOICES PAGE]

Business Mailing Address:
[INSERT COMPLETE BUSINESS MAILING ADDRESS]

Support Hours:
[INSERT SUPPORT DAYS, HOURS AND TIME ZONE]

Privacy requests should be submitted only through the official Website, privacy email, or mailing address.

Members should not submit sensitive information to:

Unofficial social-media profiles;

Impersonators;

Personal administrator Accounts;

Unapproved payment contacts;

Public social-media comments; or

Any contact not published or linked through the official Website.

40. EFFECTIVE DATE

This Privacy Policy becomes effective on:

[INSERT PUBLIC WEBSITE LAUNCH DATE]

Last Updated: July 24, 2026

The effective date must match the date on which the Website begins collecting registration or member information.

PREPUBLICATION IMPLEMENTATION REQUIREMENTS

Before publishing this Privacy Policy or collecting Personal Information, King’s Landing must complete the following:

Business and Contact Information

Insert the complete legal entity name.

Insert the official Website domain.

Insert the public launch date.

Insert the complete business mailing address.

Create a general support email.

Create a dedicated privacy email.

Create a security-incident email.

Create a legal-notice email.

Create a privacy-request webpage.

Create a “Your Privacy Choices” webpage.

Data Inventory

Identify every registration field.

Identify every identity-verification field.

Identify every payment field.

Identify every redemption field.

Identify every referral field.

Identify every Platform-data field.

Identify every HighLevel custom field.

Identify every cookie and tracking technology.

Identify every marketing audience.

Identify every provider receiving member information.

Identify where each category of information is stored.

Identify which personnel can access each category.

Remove fields that are not reasonably necessary.

HighLevel Configuration

Create a dedicated Privacy Policy page in HighLevel.

Link the Privacy Policy from every form.

Link the Privacy Policy from every survey.

Link the Privacy Policy from web chat.

Link the Privacy Policy from registration.

Link the Privacy Policy from payment and redemption pages.

Record policy acceptance date and version.

Create separate custom fields for transactional and marketing consent.

Create separate SMS and email opt-out fields.

Restrict staff access to government-identification records.

Enable multifactor authentication for administrators.

Remove former employees and unused users.

Review all HighLevel workflows for accidental disclosure.

Review all custom values and merge fields for sensitive information.

Confirm that support messages do not expose sensitive records to unauthorized users.

Cookie and Tracking Configuration

Enable a compliant cookie-consent banner.

Categorize each cookie as necessary, functional, analytics, or advertising.

Prevent nonessential cookies from loading before consent where required.

Create an accurate cookie list.

Provide reject and preference-management options.

Save consent records.

Honor Global Privacy Control where required.

Create a persistent “Cookie Settings” link.

Create a persistent “Your Privacy Choices” link.

Meta and Social-Platform Controls

Audit Meta Pixel.

Audit Conversions API.

Disable automatic event collection on sensitive pages unless properly configured.

Do not place advertising pixels on ID-upload pages.

Do not place advertising pixels on payment-credential pages.

Do not place advertising pixels on tax-information pages.

Do not place advertising pixels on detailed redemption pages.

Do not send Platform balances to Meta.

Do not send government-ID data to Meta.

Do not send support free text to Meta.

Limit Meta event names to general, nonsensitive actions.

Configure consent-based firing of advertising tags where required.

Link the Privacy Policy from Facebook and Instagram lead forms.

Place separate SMS consent on lead forms where required.

Review Facebook Page, Group, Messenger, and advertising permissions.

Tierlock and Payment Providers

Confirm Tierlock’s exact operational role.

Link Tierlock’s Privacy Policy where members enter Tierlock.

Link applicable payment-provider privacy notices.

Confirm whether Tierlock or another provider stores government identification.

Confirm which verification results King’s Landing receives.

Confirm whether King’s Landing receives payment tokens or complete credentials.

Ensure complete card numbers are never stored in HighLevel.

Ensure card-security codes are never stored.

Ensure online-banking passwords are never collected.

Confirm transaction-retention periods.

Confirm chargeback-data handling.

Confirm redemption-provider data practices.

Sign required data-processing or service-provider agreements.

Identity and Sensitive Information

Collect only necessary identity-document information.

Determine whether complete ID images must be retained.

Use verification tokens or results when sufficient.

Restrict access to identity documents.

Encrypt identity records where supported.

Establish a secure deletion procedure.

Obtain required consent for biometric or precise-location processing.

Do not use identity documents for marketing.

Do not publish verification photographs.

Do not send sensitive information through ordinary social-media messages.

Communications

Separate transactional communication from promotional consent.

Use an unchecked SMS-marketing consent box.

Use an unchecked email-marketing consent box where required.

Identify King’s Landing as the message sender.

State that message frequency varies.

State that message and data rates may apply.

State that marketing consent is not a condition of registration or a transaction.

Provide STOP and HELP instructions.

Maintain consent evidence.

Process opt-out requests promptly.

Prevent opted-out numbers from being re-added without new consent.

Include an unsubscribe link in promotional emails.

Maintain suppression lists.

Privacy Rights

Create an access-request workflow.

Create a correction-request workflow.

Create a deletion-request workflow.

Create a portability-request workflow.

Create a targeted-advertising opt-out workflow.

Create a sale-or-sharing opt-out workflow.

Create a Sensitive Personal Information request workflow.

Create an authorized-agent procedure.

Create a request-verification procedure.

Create an appeal procedure.

Track request deadlines.

Document the reason for any denial.

Maintain a record of completed requests.

Train support personnel to recognize privacy requests.

Retention and Deletion

Approve a written retention schedule.

Configure deletion of incomplete registrations.

Configure deletion of expired support attachments.

Confirm the retention of identity documents.

Confirm the retention of transaction records.

Confirm the retention of tax records.

Confirm the retention of communication consent.

Confirm provider backup-deletion periods.

Create a legal-hold procedure.

Document secure destruction methods.

Ensure deletion requests are communicated to applicable providers.

Security

Require unique staff Accounts.

Require multifactor authentication.

Apply least-privilege access.

Review user permissions quarterly.

Prohibit password sharing.

Prohibit storing member records on personal devices.

Encrypt sensitive files where supported.

Maintain secure backups.

Maintain an incident-response plan.

Designate an incident-response contact.

Maintain provider contact information.

Create an Account-takeover procedure.

Create a lost-device procedure.

Train staff concerning phishing and impersonation.

Maintain logs of administrator access.

Review integrations and API keys.

Revoke unused integrations.

Test Website forms before launch.

Legal Review

Have qualified privacy counsel review this Privacy Policy.

Have Texas counsel review the Texas Data Privacy and Security Act.

Determine which other state privacy laws apply.

Determine whether California privacy disclosures are required.

Review precise-geolocation practices.

Review identity and biometric-verification practices.

Review Meta Pixel and advertising practices.

Review SMS and email consent.

Review Tierlock and payment-provider agreements.

Review data-retention periods.

Review security-incident notification requirements.

Review Platform data-sharing agreements.

Review the Privacy Policy, Terms of Use, Official Rules, and all consent language together.

Confirm that the final published policy accurately describes the systems actually active on launch day. RULES