Electronic Arts Privacy and Cookie Policy changes — 20240101_rev01

199

## 5\. Where We Hold Your Information

200

201

ⓘ We store and process your information in the United States and other countries where we operate. When we do this, we utilize technical, physical, and administrative safeguards to meet data transfer requirements set by various privacy laws, such as the European General Data Protection Regulation.

202

203

When you access EA Services, including when available on third-party platforms, your personal information is generally collected by EA directly and processed in the United States. Personal information we collect may be subsequently stored and processed for the purposes set out in this Privacy and Cookie Policy in the United States or any other country in which EA, its subsidiaries, or third-party agents operate. By consenting to the transfer of your personal data outside of your country of residence, you acknowledge that your personal information may be transferred to recipients in the United States and other countries that may not offer the same level of privacy protection as the laws in your country of residence or citizenship.

204

205

EA's privacy practices comply with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System (APEC CBPR). The APEC CBPR System provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework is available here: [https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system](https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system).

205

EA's privacy practices comply with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System (APEC CBPR). The APEC CBPR System provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework is available here: [https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system](https://nam02.safelinks.protection.outlook.com/).

206

207

EA complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. EA has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. EA has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit [https://www.dataprivacyframework.gov/](https://www.dataprivacyframework.gov/).

207

EA complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. EA has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. EA has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit [https://www.dataprivacyframework.gov/](https://nam02.safelinks.protection.outlook.com/).

208

209

EA is responsible for the processing of personal data it receives, under the EU-U.S. DPF and Swiss-U.S. DPF, and subsequently transfers to a third party acting as an agent on its behalf. EA complies with the EU-U.S. DPF and Swiss-U.S. DPF Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions.

210

211

The Federal Trade Commission has jurisdiction over EA's compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, EA may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

212

213

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, EA commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit [U.S.-based third-party dispute resolution provider](https://feedback-form.truste.com/watchdog/request) for more information or to file a complaint. The services of TrustArc are provided at no cost to you**.**

213

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, EA commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit [U.S.-based third-party dispute resolution provider](https://nam02.safelinks.protection.outlook.com/) for more information or to file a complaint. The services of TrustArc are provided at no cost to you**.**

214

215

Under certain conditions, more fully described on the Data Privacy Framework [website](https://www.dataprivacyframework.gov/), you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

215

Under certain conditions, more fully described on the Data Privacy Framework [website](https://nam02.safelinks.protection.outlook.com/), you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

216

217

## 6\. How We Protect Your Information

218

219

ⓘ We use a range of security measures to secure and protect your information.

220

221

Security of your information is a priority at EA and we take a range of technical and organizational measures to help protect it, including encryption of sensitive information. Even so, please be aware that no security measure is perfect. Thus we cannot guarantee the security of your information at all times. You should always be diligent when it comes to the protection of your personal information. Learn more about [EA Security](https://www.ea.com/security).

 ## 5\. Where We Hold Your Information
 ⓘ We store and process your information in the United States and other countries where we operate. When we do this, we utilize technical, physical, and administrative safeguards to meet data transfer requirements set by various privacy laws, such as the European General Data Protection Regulation.
 When you access EA Services, including when available on third-party platforms, your personal information is generally collected by EA directly and processed in the United States. Personal information we collect may be subsequently stored and processed for the purposes set out in this Privacy and Cookie Policy in the United States or any other country in which EA, its subsidiaries, or third-party agents operate. By consenting to the transfer of your personal data outside of your country of residence, you acknowledge that your personal information may be transferred to recipients in the United States and other countries that may not offer the same level of privacy protection as the laws in your country of residence or citizenship.
+EA's privacy practices comply with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System (APEC CBPR). The APEC CBPR System provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework is available here: [https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system](https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system).
+EA's privacy practices comply with the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules System (APEC CBPR). The APEC CBPR System provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework is available here: [https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system](https://nam02.safelinks.protection.outlook.com/).
+EA complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. EA has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. EA has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit [https://www.dataprivacyframework.gov/](https://www.dataprivacyframework.gov/).
+EA complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. EA has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. EA has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit [https://www.dataprivacyframework.gov/](https://nam02.safelinks.protection.outlook.com/).
 EA is responsible for the processing of personal data it receives, under the EU-U.S. DPF and Swiss-U.S. DPF, and subsequently transfers to a third party acting as an agent on its behalf. EA complies with the EU-U.S. DPF and Swiss-U.S. DPF Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions.
 The Federal Trade Commission has jurisdiction over EA's compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, EA may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
+In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, EA commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit [U.S.-based third-party dispute resolution provider](https://feedback-form.truste.com/watchdog/request) for more information or to file a complaint. The services of TrustArc are provided at no cost to you**.**
+In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, EA commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit [U.S.-based third-party dispute resolution provider](https://nam02.safelinks.protection.outlook.com/) for more information or to file a complaint. The services of TrustArc are provided at no cost to you**.**
+Under certain conditions, more fully described on the Data Privacy Framework [website](https://www.dataprivacyframework.gov/), you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
+Under certain conditions, more fully described on the Data Privacy Framework [website](https://nam02.safelinks.protection.outlook.com/), you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
 ## 6\. How We Protect Your Information
 ⓘ We use a range of security measures to secure and protect your information.
 Security of your information is a priority at EA and we take a range of technical and organizational measures to help protect it, including encryption of sensitive information. Even so, please be aware that no security measure is perfect. Thus we cannot guarantee the security of your information at all times. You should always be diligent when it comes to the protection of your personal information. Learn more about [EA Security](https://www.ea.com/security).

Privacy and Cookie Policy

Full text changes — 20231101_rev01 to 20240101_rev01