Personal Data Processing Policy

Issued in accordance with Law 1581 of 2012, Decree 1377 of 2013 —now compiled in Decree 1074 of 2015— and other concordant regulations.

Last updated: July 20, 2026

This is a courtesy translation. The legally binding version of this document is the Spanish one; in case of any discrepancy, the Spanish version prevails.

1. Data controller

Company name: Daokio
Tax ID (NIT): 1016036611
Address: Cr 134 # 17 - 37, Bogotá, Colombia
Email for personal data matters: support@gamgam.app

2. Legal framework

This policy is issued in compliance with Article 15 of the Political Constitution, Law 1581 of 2012, Decree 1377 of 2013 and the instructions of the Superintendence of Industry and Commerce (SIC), the data protection authority in Colombia.

3. Personal data we collect

Registration data: name, email address, mobile number, date of birth, gender, professional level, profile photo and social network account data if the User chooses to register that way.

Profile data (optional): interests, personal description, Instagram link and other preferences the User chooses to add.

Location data: the device's geographic location, when the User grants the corresponding permission. Used to show nearby events and, in aggregated and anonymous form, to show attendee concentration zones.

Usage and interaction data: events attended or confirmed, matches, messages sent through the App's chats, games played, and technical logs (device, operating system, identifiers, date and time of access).

Multimedia content: photos and videos the User uploads to event albums or recaps.

4. Purposes of processing

Data is processed for the following purposes:

a) Create and manage the User's account and provide the App's features (discover events, play, chat, match).
b) Show nearby events based on the User's location.
c) Show Organizers and users aggregated and anonymized information on attendance and concentration of people.
d) Enable interaction between attendees of the same event.
e) Send notifications about events, matches, messages and service news.
f) Prevent fraud, impersonation and conduct contrary to the Terms.
g) Handle requests, inquiries and complaints.
h) Perform statistical analysis to improve the service.
i) With additional and separate authorization: send commercial and marketing communications.
j) Comply with legal obligations and requirements of competent authorities.

5. Sensitive data and minors

5.1. GamGam does not request sensitive data (health, ethnic origin, religious or political beliefs, biometric data). If the User chooses to include information of this nature in their profile or messages, they do so freely and voluntarily. The User is not required to authorize the processing of sensitive data, and their refusal does not prevent use of the App.

5.2. The App is not directed to persons under 18 years of age, and GamGam does not intentionally collect their data. If a minor's account is detected, it will be deleted together with their data.

6. Authorization

The processing of data requires the prior, express and informed authorization of the data subject, obtained at the time of registration through acceptance of this policy (acceptance checkbox). Location and camera/gallery permissions are requested separately through the device's operating system, and the User may revoke them at any time from settings.

7. Rights of data subjects

Pursuant to Article 8 of Law 1581 of 2012, the data subject has the right to:

a) Know, update and rectify their personal data.
b) Request proof of the authorization granted.
c) Be informed about the use given to their data.
d) File complaints with the Superintendence of Industry and Commerce for violations of the data protection regime.
e) Revoke the authorization and/or request the deletion of their data when no legal or contractual duty prevents it.
f) Access their personal data free of charge.

8. Procedure to exercise rights (inquiries and complaints)

8.1. Channel: the data subject may exercise their rights by writing to support@gamgam.app or from the Profile > Settings > Privacy section of the App. To delete your account and data —including from the web and without installing the App— see the Delete account page.

8.2. Inquiries: will be handled within a maximum term of ten (10) business days from receipt. If it is not possible to handle it within that term, the interested party will be informed before its expiration, indicating the reasons and the response date, which may not exceed the following five (5) business days.

8.3. Complaints: will be handled within a maximum term of fifteen (15) business days. If the complaint is incomplete, the interested party will be requested within the following five (5) days to complete it; after two (2) months without a response, it will be deemed abandoned.

9. Data sharing

GamGam may share personal data with:

Other users: visible profile information, event participation and published content are visible to other users according to the App's settings.
Organizers: information on the attendees of their events limited to visible name (alias) and profile photo / attendee list. Organizers do not receive direct contact data unless the User shares it.
Data processors: technology providers (cloud hosting, analytics, notifications) that process data on GamGam's behalf, under contracts guaranteeing security and confidentiality. Some providers may be located outside Colombia, in which case the transfer will be carried out in accordance with Articles 26 and 27 of Law 1581 of 2012.
Authorities: when there is a legal requirement.

GamGam does not sell personal data to third parties.

10. Information security

GamGam adopts reasonable technical, human and administrative measures to protect data: encryption in transit, access control, and incident response protocols. In the event of a security incident affecting personal data, GamGam will report it to the SIC and to the data subjects in accordance with applicable regulations.

11. Data validity and retention

Data will be retained while the account is active and for the time necessary to fulfill the described purposes or legal obligations. When the User deletes their account, their data will be deleted or anonymized within a maximum of 90 days, except for data that must be retained by legal obligation.

12. National Database Registry

In accordance with Decree 090 of 2018, the obligation to register databases in the National Database Registry administered by the Superintendence of Industry and Commerce applies only to companies and non-profit entities with total assets exceeding 100,000 UVT and to public legal entities. As of this date, Daokio does not exceed said asset threshold and is therefore not obligated to register.

The foregoing does not exempt Daokio from complying with the other duties that Law 1581 of 2012 imposes on Data Controllers, which are set out in this policy. Should the aforementioned asset threshold be exceeded in the future, Daokio will register its databases in the RNBD within the terms established by the applicable regulations.

13. Modifications to this policy

Any substantial change will be communicated to users through the App before it takes effect.