PRIVACY NOTICE 

Last updated January 01, 2020 

Thank you for choosing to be part of our community at Lokkak, LLC, doing  business as D20 Hobbies ("D20 Hobbies", "we", "us", "our"). We are committed to  protecting your personal information and your right to privacy. If you have any questions or  concerns about this privacy notice, or our practices with regards to your personal information,  please contact us at datapolicy@lokkak.com. 

When you visit our website Internal site only available to staff (the  "Website"), and more generally, use any of our services (the "Services",  which include the Website), we appreciate that you are trusting us with your  personal information. We take your privacy very seriously. In this privacy  notice, we seek to explain to you in the clearest way possible what  information we collect, how we use it and what rights you have in relation to  it. We hope you take some time to read through it carefully, as it is important.  If there are any terms in this privacy notice that you do not agree with, please  discontinue use of our Services immediately. 

This privacy notice applies to all information collected through our Services  (which, as described above, includes our Website), as well as, any related services,  sales, marketing or events. 

Please read this privacy notice carefully as it will help you understand  what we do with the information that we collect. 

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT? 

2. WILL YOUR INFORMATION BE SHARED WITH ANYONE? 3. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES? 4. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY? 5. HOW LONG DO WE KEEP YOUR INFORMATION? 

6. HOW DO WE KEEP YOUR INFORMATION SAFE? 

7. DO WE COLLECT INFORMATION FROM MINORS? 8. WHAT ARE YOUR PRIVACY RIGHTS? 

9. CONTROLS FOR DO-NOT-TRACK FEATURES 

10. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS? 11. DO WE MAKE UPDATES TO THIS NOTICE? 

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE? 13. HOW CAN YOU REVIEW, UPDATE OR DELETE THE DATA WE  COLLECT FROM YOU? 

1. WHAT INFORMATION DO WE COLLECT? 

2. HOW DO WE USE YOUR INFORMATION? 

In Short: We process your information for purposes based on legitimate  business interests, the fulfillment of our contract with you, compliance with  our legal obligations, and/or your consent. 

We use personal information collected via our Website for a variety of  business purposes described below. We process your personal information for  these purposes in reliance on our legitimate business interests, in order to  enter into or perform a contract with you, with your consent, and/or for  compliance with our legal obligations. We indicate the specific processing  grounds we rely on next to each purpose listed below. 

We use the information we collect or receive:

• All users will be staff employees and no information about them will be  used for any purpose other than authentication. The only information  retained will be their login, name, and password hash. 

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE? 

In Short: We only share information with your consent, to comply with laws,  to provide you with services, to protect your rights, or to fulfill business  obligations. 

We may process or share your data that we hold based on the following legal  basis: 

• Consent: We may process your data if you have given us specific  consent to use your personal information for a specific purpose. 

• Legitimate Interests: We may process your data when it is reasonably  necessary to achieve our legitimate business interests. 

• Performance of a Contract: Where we have entered into a contract  with you, we may process your personal information to fulfill the terms  of our contract. 

• Legal Obligations: We may disclose your information where we are  legally required to do so in order to comply with applicable law, 

governmental requests, a judicial proceeding, court order, or legal  process, such as in response to a court order or a subpoena (including in  response to public authorities to meet national security or law  enforcement requirements). 

• Vital Interests: We may disclose your information where we believe it  is necessary to investigate, prevent, or take action regarding potential  violations of our policies, suspected fraud, situations involving  potential threats to the safety of any person and illegal activities, or as  evidence in litigation in which we are involved. 

More specifically, we may need to process your data or share your personal  information in the following situations: 

• Business Transfers. We may share or transfer your information in  connection with, or during negotiations of, any merger, sale of  company assets, financing, or acquisition of all or a portion of our  business to another company. 

In Short:  We may use cookies and other tracking technologies to collect and  store your information. 

We may use cookies and similar tracking technologies (like web beacons and  pixels) to access or store information. Specific information about how we use  such technologies and how you can refuse certain cookies is set out in our  Cookie Notice. 

5. IS YOUR INFORMATION TRANSFERRED  

INTERNATIONALLY?    

In Short: We may transfer, store, and process your information in countries  other than your own. 

Our servers are located in Kentucky and your access to the site is restricted to  our internal staff only network physically onsite. 

6. HOW LONG DO WE KEEP YOUR INFORMATION? 

In Short:  We keep your information for as long as necessary to fulfill the  purposes outlined in this privacy notice unless otherwise required by law. 

We will only keep your personal information for as long as it is necessary for  the purposes set out in this privacy notice, unless a longer retention period is  required or permitted by law (such as tax, accounting or other legal  requirements). 

When we have no ongoing legitimate business need to process your personal  information, we will either delete or anonymize such information, or, if this is  not possible (for example, because your personal information has been stored  

in backup archives), then we will securely store your personal information  and isolate it from any further processing until deletion is possible. 

7. HOW DO WE KEEP YOUR INFORMATION SAFE? 

In Short:  We aim to protect your personal information through a system of  organizational and technical security measures. 

We have implemented appropriate technical and organizational security  measures designed to protect the security of any personal information we  process. However, despite our safeguards and efforts to secure your 

information, no electronic transmission over the Internet or information  storage technology can be guaranteed to be 100% secure, so we cannot  promise or guarantee that hackers, cybercriminals, or other unauthorized third  parties will not be able to defeat our security, and improperly collect, access,  steal, or modify your information. Although we will do our best to protect  your personal information, transmission of personal information to and from  our Website is at your own risk. You should only access the Website within a  secure environment. 

8. DO WE COLLECT INFORMATION FROM MINORS? 

In Short: We do not knowingly collect data from or market to children under  18 years of age. 

We do not knowingly solicit data from or market to children under 18 years  of age. By using the Website, you represent that you are at least 18 or that  you are the parent or guardian of such a minor and consent to such minor  dependent’s use of the Website. If we learn that personal information from  users less than 18 years of age has been collected, we will deactivate the  account and take reasonable measures to promptly delete such data from our  records. If you become aware of any data we may have collected from  children under age 18, please contact us at datapolicy@lokkak.com. 

9. WHAT ARE YOUR PRIVACY RIGHTS? 

In Short: You may review, change, or terminate your account at any time. 

Use of the site is only available to staff employees. You may not use the site  if you quit or are terminated.

Cookies and similar technologies: Most Web browsers are set to accept  cookies by default. If you prefer, you can usually choose to set your browser  to remove cookies and to reject cookies. If you choose to remove cookies or  reject cookies, this could affect certain features or services of our Website.  We do not use internet-based advertising and you will automatically opted out of interest-based advertising. 

10. CONTROLS FOR DO-NOT-TRACK FEATURES 

Most web browsers and some mobile operating systems and mobile  applications include a Do-Not-Track ("DNT") feature or setting you can  activate to signal your privacy preference not to have data about your online  browsing activities monitored and collected. At this stage no uniform  technology standard for recognizing and implementing DNT signals has been  finalized. As such, we do not currently respond to DNT browser signals or  any other mechanism that automatically communicates your choice not to be  tracked online. If a standard for online tracking is adopted that we must  follow in the future, we will inform you about that practice in a revised  version of this privacy notice. 

11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY  RIGHTS? 

In Short:  Yes, if you are a resident of California, you are granted specific  rights regarding access to your personal information. 

Non of our staff are California residents, and as such do not fall under  California Civil Code Section 1798.83, also known as the "Shine The Light"  law, permits our users who are California residents to request and obtain from  us, once a year and free of charge, information about categories of personal 

information (if any) we disclosed to third parties for direct marketing  purposes and the names and addresses of all third parties with which we  shared personal information in the immediately preceding calendar year. If  you are a California resident and would like to make such a request, please  submit your request in writing to us using the contact information provided  below. 

If you are under 18 years of age, reside in California, and have a registered  account with the Website, you have the right to request removal of unwanted  data that you publicly post on the Website. To request removal of such data,  please contact us using the contact information provided below, and include  the email address associated with your account and a statement that you  reside in California. We will make sure the data is not publicly displayed on  the Website, but please be aware that the data may not be completely or  comprehensively removed from all our systems (e.g. backups, etc.). 

12. DO WE MAKE UPDATES TO THIS NOTICE?     

In Short: Yes, we will update this notice as necessary to stay compliant with  relevant laws. 

We may update this privacy notice from time to time. The updated version  will be indicated by an updated "Revised" date and the updated version will  be effective as soon as it is accessible. If we make material changes to this  privacy notice, we may notify you either by prominently posting a notice of  such changes or by directly sending you a notification. We encourage you to  review this privacy notice frequently to be informed of how we are protecting  your information. 

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?    

If you have questions or comments about this notice, you may contact our  Data Protection Officer (DPO), James Risner, by email at  

datapolicy@lokkak.com, by phone at 859-280-3865, or by mail to: 

Lokkak, LLC 

James Risner 

361 Southland Dr 

Lexington, KY 40503 

United States 

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE  COLLECT FROM YOU?     

Based on the applicable laws of your country, you may have the right to  request access to the personal information we collect from you, change that  information, or delete it in some circumstances. To request to review, update,  or delete your personal information, please submit a request form by email to  datapolicy@lokkak.com. We will respond to your request within 30 days.