PRIVACY POLICY

1. Introduction and Scope

This Privacy Policy (the “Policy”) describes the categories of personal information that are collected, used, disclosed, and otherwise processed in connection with the website located at https://truebloodtheband.com and any subdomains, pages, features, and functionality operated therefrom (collectively, the “Site”). This Policy also describes the rights available to individuals whose personal information is processed and the means by which those rights may be exercised.

The Site is developed, operated, and maintained by PERSPECTIVE GLOBAL PTY LTD (ACN 697 873 368; ABN 34 697 873 368), an Australian proprietary company referred to in this Policy as PIXELVERSE DIGITAL (https://pixelverse.tech) (“PIXELVERSE DIGITAL,” “PERSPECTIVE GLOBAL PTY LTD,” “we,” “us,” or “our”), for the recording artist Trueblood (“Trueblood” or the “Artist”).

This Policy does not apply to any third-party website, platform, application, storefront, or service that may be linked to or embedded within the Site, including but not limited to the Trueblood online store located at shop.truebloodtheband.com, social media platforms, digital music services, and ticketing services. Such third parties operate under their own privacy policies, and we do not control and are not responsible for their data practices. Individuals are advised to review the privacy notices of any third party before providing personal information to that third party.

By accessing or otherwise using the Site, you acknowledge that you have read and understood this Policy, including the disclaimers and limitations of liability in Section 16, which affect the remedies available to you and which you should read before using the Site. Where consent constitutes the applicable legal basis for processing, such processing will be undertaken only upon obtaining your consent in accordance with Section 7 and applicable law.

2. Identity of the Controller and Contact Details

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK General Data Protection Regulation and the Data Protection Act 2018 (together, the “UK GDPR”), and analogous legislation, the controller of personal information collected through the Site is PERSPECTIVE GLOBAL PTY LTD, which operates the Site for the Artist.

Controller particulars. PERSPECTIVE GLOBAL PTY LTD, an Australian proprietary company registered under the Corporations Act 2001 (Cth), ACN 697 873 368, ABN 34 697 873 368, having its principal place of business in South Australia, Australia, and referred to in this Policy as PIXELVERSE DIGITAL.

As the controller is established in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles contained in Schedule 1 thereto (the “APPs”) are relevant to the processing described in this Policy. To the extent that the Privacy Act applies to us, we handle personal information in accordance with it. Irrespective of whether we are an “APP entity” within the meaning of section 6 of that Act, and irrespective of the operation of the small business operator exemption in section 6D, we handle personal information in accordance with the APPs as a matter of policy. That voluntary adoption is a statement of our practice; it is not an admission that any particular statute applies to us, and it does not of itself confer on any person rights beyond those conferred by the law applicable to that person. Section 11.3 sets out the rights available under Australian privacy law.

All inquiries concerning this Policy, the processing of personal information, or the exercise of data subject or consumer rights should be directed to:

Privacy Contact — PERSPECTIVE GLOBAL PTY LTD (PIXELVERSE DIGITAL)
Electronic mail: management@pixelverse.tech

3. Categories of Personal Information Collected

3.1 Information You Provide Directly

• Contact form submissions. Where you elect to submit a business inquiry or fan inquiry through the contact form, we collect the name, electronic mail address, and free-text message content that you provide. Submissions are transmitted to and processed by PixelVerse Forms, as further described in Section 6.
• Event registrations and subscription requests. Where you interact with the Laylo registration and subscription module embedded on the Site, Laylo, Inc. may collect your name, electronic mail address, mobile telephone number, and related preference data directly from you. Such information is collected by Laylo in its own capacity and is subject to Laylo’s privacy policy.
• Direct correspondence. Where you contact us by electronic mail at the addresses published on the Site, or by postal mail at the fan mail address published on the Site, we receive the contents of your correspondence together with any personal information you elect to include, which may include your name, return address, and any enclosed materials.

3.2 Information Collected Automatically

When you access the Site, certain information is collected automatically by us and by the third-party service providers identified in Section 6. Such information may include:

• Internet Protocol (IP) address and derived approximate geographic location (typically at the level of city, region, or country);
• Browser type, browser version, user-agent string, operating system, device type, device identifiers, screen resolution, and language settings;
• Referring uniform resource locator (URL), pages and content viewed, date and time of access, duration of visit, navigation paths, clicks, scroll behaviour, and other interaction events;
• Diagnostic and telemetry data, including error messages, stack traces, console output, performance timings, and, where sampling criteria are met, session replay recordings of interactions with the Site (see Section 6.3);
• Server access logs generated by our hosting infrastructure provider in the ordinary course of delivering the Site;
• Cookie identifiers, advertising identifiers, and values stored in browser cookies, local storage, and session storage, as further described in Section 5.

3.3 Information Received From Third Parties

We may receive aggregated, de-identified, or pseudonymised reporting from analytics and advertising service providers concerning Site traffic, audience characteristics, campaign performance, and conversion events. We may also receive information from Meta Platforms concerning the attribution of Site activity to advertising campaigns, and from Laylo concerning registration and subscription activity.

4. Purposes of Processing and Legal Bases

Personal information is processed for the purposes enumerated below. Where the GDPR or UK GDPR applies, the corresponding legal basis for each purpose is identified.

• Provision and delivery of the Site. To render, transmit, secure, and maintain the availability of the Site and its content. Legal basis: legitimate interests (Article 6(1)(f)) in operating and securing our web presence.
• Security, fraud prevention, and abuse mitigation. To detect, prevent, and respond to automated abuse, spam submissions, and malicious activity, including through the operation of reCAPTCHA and rate-limiting controls. Legal basis: legitimate interests (Article 6(1)(f)); compliance with legal obligations (Article 6(1)(c)).
• Responding to inquiries. To receive, evaluate, and respond to business inquiries, fan inquiries, merchandise support requests, and other correspondence. Legal basis: performance of, or steps preparatory to, a contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)).
• Error monitoring and performance management. To identify, diagnose, reproduce, and remediate defects and performance degradation. Legal basis: legitimate interests (Article 6(1)(f)); consent (Article 6(1)(a)) where session replay or non-essential telemetry is employed.
• Analytics and audience measurement. To measure Site traffic, evaluate content performance, and inform editorial and design decisions. Legal basis: consent (Article 6(1)(a)).
• Marketing, advertising, and campaign measurement. To measure the reach and effectiveness of advertising campaigns, to attribute conversions, and to enable the delivery of interest-based advertising across Meta technologies and other platforms. Legal basis: consent (Article 6(1)(a)).
• Event, release, and community engagement. To administer registrations, notify registrants of releases, performances, and announcements, and to measure engagement with such communications. Legal basis: consent (Article 6(1)(a)); legitimate interests (Article 6(1)(f)).
• Legal compliance and defence of claims. To comply with applicable law and legal process, to enforce our terms, and to establish, exercise, or defend legal claims. Legal basis: compliance with legal obligations (Article 6(1)(c)); legitimate interests (Article 6(1)(f)).

Personal information will not be processed for any materially different, unrelated, or incompatible purpose without first providing notice and, where required by applicable law, obtaining consent.

5. Cookies, Local Storage, and Similar Technologies

The Site employs cookies, browser local storage, session storage, pixels, software development kits, and similar tracking technologies (collectively, “Tracking Technologies”). Tracking Technologies may be set by us (first-party) or by the third-party providers identified in Section 6 (third-party).

5.1 Categories of Tracking Technologies

• Strictly necessary. Required for the Site to function and to record your preferences. These include the first-party cookie tb-consent, which records the consent choices you have made and persists for approximately one hundred and eighty (180) days, and reCAPTCHA cookies set by Google for the purpose of distinguishing human users from automated agents. Cookies in this category are exempt from the consent requirement and cannot be disabled.
• Functional. Used to preserve interface state. These include the browser session storage key tb-watchpopup-2026aug-paintapicture-video-seen, which records that a promotional notice has been displayed during the current browser session and is discarded when the session ends.
• Analytics and performance. Set by Google Analytics and Sentry to measure usage, attribute sessions, and monitor stability and performance.
• Advertising and targeting. Set by Meta Platforms in connection with the Meta Pixel to measure advertising performance and to facilitate the delivery of interest-based advertising.
• Embedded third-party content. Set by providers of embedded media and modules, including YouTube, TikTok, and Laylo, upon the loading of such embedded content. Embedded content of this kind is not loaded, and no request is made to the provider, unless the functional category is in force for you (Section 5.2); where it is not, a placeholder is displayed in its stead.

5.2 Consent Management on the Site

The optional categories operate by default. Analytics, embedded third-party content, and advertising measurement are active from your first page view and continue to operate unless and until you switch them off. We do not wait for you to opt in, and your continued use of the Site is not treated as, and is not relied upon as, consent for the purposes of any law that requires consent to be obtained in advance.

A notice is presented on your first visit stating that this is the position and affording you the options to accept all categories, to reject all optional categories, or to configure each category individually. Rejection is afforded equal prominence to acceptance, and access to the Site is not conditioned upon your acceptance. The preference panel opens showing the categories that are in fact in operation, and your selection takes effect upon your selecting Save preferences. Where this Policy states that a category is in force for you, it means a category that is operating by default under this Section or that you have subsequently permitted.

Where your browser transmits a Global Privacy Control signal, we treat that signal as a standing refusal of the analytics and advertising categories. Those categories do not operate by default in that event, and the corresponding controls are shown as locked off. This is the one circumstance in which the default described above does not apply.

Your choices may be reviewed or altered at any time by selecting Your Privacy Choices in the footer of any page of the Site. Where you switch off a category, the cookies associated with that category are deleted and the page is reloaded so that the relevant provider’s tag is not executed further, whether that category had been operating by default or by your permission.

Independently of the foregoing, most browsers permit the refusal, restriction, or deletion of cookies and the clearing of local and session storage through their settings interfaces. Disabling cookies may impair the availability or functionality of certain features of the Site. Additional opt-out mechanisms specific to individual providers are set out in Sections 6 and 11.

6. Third-Party Service Providers and Processors

The following third parties process personal information in connection with the operation of the Site. Each provider processes personal information in accordance with its own privacy policy, which is linked below and which is incorporated herein by reference for informational purposes.

6.1 Analytics

• Google Analytics 4 — Google LLC and Google Ireland Limited. Property identifier G-E1EMRTL2V9. Processes IP address (subject to Google’s IP anonymisation controls), device and browser characteristics, pages viewed, interaction events, referral source, and approximate geographic location, for the purpose of audience measurement and traffic analysis. The Google tag is configured in manual initialisation mode and Google Consent Mode v2 is set to deny all storage by default; neither the tag nor any Google request is made unless the analytics category is in force for you (Section 5.2). Privacy policy: policies.google.com/privacy.

6.2 Advertising and Conversion Measurement

• Meta Pixel — Meta Platforms, Inc. and Meta Platforms Ireland Limited. Pixel identifier 562425432958052. Processes IP address, device and browser identifiers, cookie identifiers, pages viewed, and standard events (including page-view events) for the purpose of measuring advertising performance, attributing conversions, and enabling audience segmentation and interest-based advertising across Meta technologies. The Pixel is not loaded unless the advertising category is in force for you (Section 5.2). Privacy policy: facebook.com/privacy/policy.

6.3 Error Monitoring, Performance, and Session Replay

• Sentry — Functional Software, Inc. d/b/a Sentry. Processes error reports, exception data, stack traces, application logs, request metadata, URL and route information, and browser and device characteristics, for the purpose of diagnosing and remedying faults. This baseline error reporting operates at all times on the basis of legitimate interests in maintaining the security and stability of the Site. Where, and only where, you have yourself granted the analytics category — these three features are never enabled by the default operation described in Section 5.2, and require your affirmative choice wherever you are located — Sentry additionally performs performance tracing, transmits default personally identifiable information as that term is defined by Sentry (which may include IP address and user-agent data), and enables Session Replay, which records a sampled reconstruction of user interaction with the Site comprising document structure, navigation, input events, and console activity; sampling is applied to a proportion of ordinary sessions and to sessions in which an error is detected, and replay data may incidentally include information entered into or displayed within the Site. In the absence of that consent, none of these three features is enabled. Privacy policy: sentry.io/privacy.

6.4 Forms, Registration, and Communications

• PixelVerse Forms — PERSPECTIVE GLOBAL PTY LTD (PIXELVERSE DIGITAL). Receives and stores contact form submissions, comprising name, electronic mail address, message content, submission metadata, and anti-spam signals, for the purpose of delivering and administering inquiries. Privacy policy: forms.pixelverse.tech/privacy.
• Laylo — Laylo, Inc. Provides the registration and subscription module embedded on the Site. Collects name, electronic mail address, mobile telephone number, and engagement data directly from individuals who interact with the module, and may set its own cookies. The module is not loaded unless the functional category is in force for you (Section 5.2). Privacy policy: Laylo Privacy & GDPR Policy.

6.5 Security and Anti-Abuse

• Google reCAPTCHA — Google LLC and Google Ireland Limited. Deployed on the Site’s contact form. Collects IP address, device and browser characteristics, cookie data, mouse and touch interaction signals, and other behavioural telemetry, and transmits such data to Google for the purpose of distinguishing human users from automated agents. Use of reCAPTCHA is subject to the Google Privacy Policy at policies.google.com/privacy and the Google Terms of Service at policies.google.com/terms.

6.6 Embedded Media and Content Delivery

• YouTube — Google LLC. Video players are embedded on the Site, served from the youtube-nocookie.com domain. Upon loading, YouTube receives your IP address and may set cookies and read device identifiers in accordance with Google’s privacy policy, irrespective of whether the video is played. Accordingly, no player is loaded unless the functional category is in force for you (Section 5.2); until then a placeholder is displayed in its stead. Privacy policy: policies.google.com/privacy.
• TikTok — TikTok Pte. Ltd. and affiliated entities. Video players are embedded on the Site. Upon loading, TikTok receives your IP address and may set cookies and read device identifiers. No player is loaded unless the functional category is in force for you (Section 5.2). Privacy policy: tiktok.com/legal/privacy-policy.
• Google Fonts — Google LLC. Typeface resources are requested from Google’s content delivery network. In consequence, your IP address and user-agent string are transmitted to Google when a page of the Site is rendered. Privacy policy: policies.google.com/privacy.
• Shopify — Shopify Inc. Merchandise imagery displayed on the Site is served from the Shopify content delivery network, which receives your IP address and user-agent string upon such requests. The Trueblood online store is hosted by Shopify and is governed by its own policies. Privacy policy: shopify.com/legal/privacy.
• Spotify — Spotify AB. Release artwork displayed on the Site is served from the Spotify content delivery network, which receives your IP address and user-agent string upon such requests. Privacy policy: spotify.com/legal/privacy-policy.

6.7 Hosting and Infrastructure

• Vercel — Vercel Inc. Provides hosting, edge delivery, and serverless execution for the Site. Processes request metadata in the ordinary course of delivering the Site, including IP address, user-agent string, requested resource, response status, and timestamp, and retains such data in access logs for operational, security, and diagnostic purposes. Privacy policy: vercel.com/legal/privacy-policy.

6.8 Outbound Links and Third-Party Destinations

The Site contains hyperlinks to third-party destinations that are not operated by us. Activation of such a hyperlink transfers you to the third party, which may collect personal information in accordance with its own policies. Such destinations include, without limitation:

• Linkfire smart links served from the domain trueblood.lnk.to, which perform redirection and may record click, device, and referral data for release-marketing measurement (linkfire.com/privacy);
• the Trueblood online store at shop.truebloodtheband.com, hosted by Shopify;
• the ticketing platform at ticketing.pixelverse.tech, operated by PERSPECTIVE GLOBAL PTY LTD (PIXELVERSE DIGITAL);
• digital service providers and social platforms, including Spotify, Apple Music, YouTube, YouTube Music, Instagram, TikTok, and Discord.

We do not control, and assume no responsibility for, the content, security practices, or privacy practices of any third-party destination.

7. Consent and Withdrawal of Consent

Where applicable law requires consent as a condition of the deployment of non-essential Tracking Technologies or of the processing of personal information for analytics or advertising purposes, such consent is sought through the notice described in Section 5.2 and, where relevant, through the consent mechanisms of the applicable third-party provider. Consent is sought separately in respect of each of the following categories, and each may be granted or refused independently of the others:

• Functional and embedded content — embedded video players and the registration module (YouTube, TikTok, Laylo);
• Analytics and performance — Google Analytics, together with Sentry session replay, performance tracing, and the transmission of IP address to Sentry;
• Advertising and measurement — the Meta Pixel.

Where you switch a category off, it ceases to be in force for you: the Google tag is then not loaded and Google Consent Mode is maintained in the denied state, the Meta Pixel is not loaded, and no embedded third-party content is requested. As described in Section 5.2, each optional category is in force by default until you switch it off.

Two matters are treated more strictly than that. Sentry Session Replay, performance tracing, and the transmission of personally identifiable information to Sentry are enabled only where you have yourself granted the analytics category, and are never enabled by the default described in Section 5.2. And a Global Privacy Control signal operates as a standing refusal of the analytics and advertising categories. Basic error reporting to Sentry, which employs neither session replay nor personally identifiable information in the absence of consent, is undertaken on the basis of legitimate interests in maintaining the security and stability of the Site.

Consent may be withdrawn at any time and without detriment, by selecting Your Privacy Choices in the footer of any page, by deleting the Site’s cookies through your browser settings, by employing the provider-specific opt-out mechanisms identified in Section 11.4, or by submitting a request to management@pixelverse.tech. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

8. Disclosure of Personal Information

Personal information may be disclosed to the following categories of recipient:

• Service providers and processors engaged to perform functions on our behalf, as enumerated in Section 6, each of which is permitted to process personal information only for the purposes specified by us and in accordance with applicable contractual and legal obligations;
• The Artist and its management, label, and professional advisers, including for the purpose of responding to inquiries and administering business matters;
• Advertising and analytics platforms, to the extent described in Sections 4 and 6;
• Legal and regulatory recipients, where disclosure is necessary to comply with applicable law, legal process, or an enforceable governmental request, or to establish, exercise, or defend legal claims;
• Successors in interest, in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to the continued application of protections materially consistent with this Policy.

We do not sell personal information in exchange for monetary consideration. However, the operation of the Meta Pixel and of analytics Tracking Technologies may constitute a “sale” or “sharing” of personal information for cross-context behavioural advertising, or “targeted advertising,” as those terms are defined under certain United States state privacy statutes. Section 11.4 sets out the means by which such activity may be opted out of.

9. International Transfers of Personal Information

The Site is operated from Australia, and personal information processed in connection with the Site is stored and processed in Australia, the United States, and other jurisdictions in which our service providers maintain facilities. Such jurisdictions may not afford a level of data protection equivalent to that of your jurisdiction of residence.

Where personal information originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a jurisdiction that has not been the subject of an adequacy decision, such transfers are effected in reliance upon appropriate safeguards, which may include the Standard Contractual Clauses approved by the European Commission (and, as applicable, the UK International Data Transfer Addendum), participation in the EU–US Data Privacy Framework and its UK Extension and Swiss–US Extension by the relevant provider, or a derogation permitted under Article 49 of the GDPR. Further information concerning the safeguards applied may be obtained by contacting management@pixelverse.tech.

In respect of disclosures of personal information to overseas recipients for the purposes of Australian Privacy Principle 8, the countries in which such recipients are likely to be located, and the steps taken before disclosure, are described in Section 11.3.

10. Retention of Personal Information

Personal information is retained only for so long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, and thereafter is deleted or irreversibly anonymised. The criteria applied in determining retention periods include the nature and sensitivity of the information, the purposes of processing, the availability of alternative means of achieving those purposes, and applicable limitation periods.

• Contact form submissions: retained for the duration necessary to respond to and administer the inquiry, and thereafter for a reasonable period for record-keeping and dispute-resolution purposes.
• Analytics data: retained in accordance with the retention settings configured within Google Analytics, subject to Google’s applicable default and maximum retention periods.
• Advertising and pixel data: retained by Meta Platforms in accordance with its own retention practices.
• Error, performance, and session replay data: retained in accordance with the retention periods applicable to our Sentry subscription plan.
• Server access logs: retained by our hosting provider for a limited operational period.
• Cookies and storage values: retained for the durations specified in Section 5 or until deleted by you.

11. Your Rights and Choices

11.1 Rights Under the GDPR and UK GDPR

Where the GDPR or UK GDPR applies to the processing of your personal information, you are entitled, subject to the conditions and exceptions provided by law, to exercise the following rights:

• Right of access (Article 15) — to obtain confirmation as to whether personal information concerning you is processed and, where that is the case, access to that information and to the prescribed supplementary particulars;
• Right to rectification (Article 16) — to obtain the correction of inaccurate personal information and the completion of incomplete personal information;
• Right to erasure (Article 17) — to obtain the deletion of personal information in the circumstances specified by law;
• Right to restriction of processing (Article 18);
• Right to data portability (Article 20) — to receive personal information provided by you in a structured, commonly used, and machine-readable format and to transmit it to another controller;
• Right to object (Article 21) — to object, on grounds relating to your particular situation, to processing carried out on the basis of legitimate interests, and to object at any time and without qualification to processing for direct-marketing purposes;
• Right to withdraw consent (Article 7(3)), as described in Section 7;
• Right to lodge a complaint (Article 77) with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, the competent authority is the Information Commissioner’s Office (ico.org.uk).

11.2 Rights Under United States State Privacy Laws

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states having comprehensive consumer privacy legislation are entitled, subject to the conditions and exceptions provided by the applicable statute, to exercise the following rights:

• The right to know or access the categories and specific pieces of personal information collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom personal information is disclosed;
• The right to delete personal information collected from you;
• The right to correct inaccurate personal information;
• The right to obtain a copy of personal information in a portable format;
• The right to opt out of the sale or sharing of personal information and of targeted advertising, as described in Section 11.4;
• The right to limit the use and disclosure of sensitive personal information (we do not collect sensitive personal information for the purpose of inferring characteristics);
• The right not to be subjected to unlawful discrimination for the exercise of any of the foregoing rights, including through the denial of goods or services, differential pricing, or the provision of a different level or quality of service;
• The right, in those jurisdictions that so provide, to appeal a decision declining to act upon a rights request.

11.3 Rights Under Australian Privacy Law

Individuals in Australia, and individuals whose personal information is handled by us in Australia, may exercise the following rights and protections under the Privacy Act 1988 (Cth) and the Australian Privacy Principles:

• Access (APP 12) — to request access to the personal information we hold about you. We will respond within a reasonable period, and in any event within thirty (30) days of the request, and will provide access in the manner requested where it is reasonable and practicable to do so. Where access is refused on a ground permitted by the Act, we will provide written reasons and information concerning the complaint mechanisms available to you;
• Correction (APP 13) — to request the correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Where we refuse to correct information, you may request that a statement to that effect be associated with the information;
• Anonymity and pseudonymity (APP 2) — to deal with us anonymously or by pseudonym where it is lawful and practicable to do so. The Site may be browsed without providing your name, and the consent controls described in Section 5.2 may be exercised without identifying yourself;
• Direct marketing (APP 7) — to request that we cease using or disclosing your personal information for the purpose of direct marketing, and to request the source of that information. Every electronic marketing message sent in connection with the Site contains a functional unsubscribe facility, as required by the Spam Act 2003 (Cth);
• Cross-border disclosure (APP 8) — to be informed of the countries in which recipients of your personal information are likely to be located, which are identified in Sections 6 and 9;
• Government-related identifiers (APP 9) — we do not adopt, use, or disclose government-related identifiers, and we do not collect them through the Site;
• Sensitive information (APP 3) — we do not solicit sensitive information within the meaning of section 6 of the Privacy Act through the Site, and do not collect it for the purpose of inferring characteristics about you;
• Complaint — to complain about a breach of the APPs. Complaints should be directed in the first instance to management@pixelverse.tech, and we will acknowledge your complaint and respond within thirty (30) days. Should you be dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner (“OAIC”), GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au/privacy/privacy-complaints.

Where personal information is disclosed to an overseas recipient, we take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the APPs in relation to that information, in accordance with APP 8.1, save where an exception under APP 8.2 applies. The recipients identified in Section 6 are located principally in the United States, Ireland, and Singapore, and further recipients may be located in any jurisdiction in which those providers maintain facilities.

11.4 Opt-Out Mechanisms

• Google Analytics: the Google Analytics Opt-out Browser Add-on is available at tools.google.com/dlpage/gaoptout.
• Meta advertising: advertising preferences may be managed within your Meta account settings at facebook.com/adpreferences, and off-Facebook activity may be managed at facebook.com/off_facebook_activity.
• Industry opt-out programmes: the Digital Advertising Alliance (optout.aboutads.info), the Network Advertising Initiative (optout.networkadvertising.org), and, for European users, youronlinechoices.eu.
• Global Privacy Control: where your browser or extension transmits a Global Privacy Control (GPC) signal, we will treat that signal as a valid request to opt out of the sale and sharing of personal information and of targeted advertising with respect to that browser.
• Browser controls: cookies and storage may be blocked or deleted through your browser settings, as described in Section 5.2.

11.5 Exercise of Rights and Verification

Requests to exercise any of the foregoing rights may be submitted to management@pixelverse.tech with the subject line “Privacy Rights Request.” In order to protect against unauthorised disclosure, we will take reasonable steps to verify your identity, which may require you to provide information sufficient to match your request to information already in our possession. We will not use information provided for verification purposes for any other purpose.

We will respond to verifiable requests within the period prescribed by applicable law, generally within thirty (30) days under United States state privacy legislation (extendable by a further forty-five (45) days where reasonably necessary) and within one (1) month under the GDPR and UK GDPR (extendable by a further two (2) months where reasonably necessary, with notice). Requests are ordinarily processed without charge, save where permitted by law in respect of manifestly unfounded or excessive requests. An authorised agent may submit a request on your behalf upon provision of evidence of authority satisfactory to us. Where a request pertains to personal information held by a third-party provider in its own capacity, we will direct you to that provider.

12. Children’s Privacy

The Site is directed to a general audience and is not intended for children under the age of thirteen (13) years, or under such higher age as may be prescribed by the law of your jurisdiction. We do not knowingly collect personal information from children under the age of thirteen (13). Where we become aware that personal information has been collected from a child under that age without verifiable parental consent, we will take reasonable steps to delete such information. A parent or legal guardian who believes that a child has provided personal information through the Site is requested to contact management@pixelverse.tech. Individuals under the age of sixteen (16) resident in the European Economic Area or the United Kingdom should not consent to non-essential Tracking Technologies without the authorisation of a parent or guardian.

13. Automated Decision-Making and Profiling

We do not engage in automated decision-making that produces legal effects concerning you or that similarly significantly affects you within the meaning of Article 22 of the GDPR. Automated scoring is applied by reCAPTCHA for the sole purpose of distinguishing human users from automated agents, and profiling for advertising-measurement purposes is undertaken by the platforms identified in Section 6.2 in accordance with their respective policies.

For the purposes of Australian Privacy Principles 1.7 to 1.9, which commence on 10 December 2026, we do not arrange for a computer program to make, or to do a thing that is substantially and directly related to making, any decision that could reasonably be expected to significantly affect the rights or interests of an individual. Should that position change, this Policy will be amended to identify the kinds of personal information used in such decisions and the kinds of decisions so made, before the arrangement takes effect.

14. Information Security

We implement technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. Such measures include the encryption of data in transit by means of Transport Layer Security, restriction of administrative access on a need-to-know basis, segregation of secrets and credentials from application source code, anti-abuse controls on form submissions, and the engagement of service providers that maintain recognised security programmes. Notwithstanding the foregoing, no method of transmission over the internet and no method of electronic storage is entirely secure, and accordingly absolute security cannot be guaranteed.

Data breach notification. Where a data breach occurs that is likely to result in serious harm to any individual whose personal information is involved, and we are unable to prevent that likelihood of serious harm through remedial action, we will assess the breach and notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of a personal data breach where required by Article 33, and will notify affected individuals where required by Article 34. Notification obligations arising under United States state law will be discharged within the periods those statutes prescribe.

15. Do Not Track Signals

No uniform industry or legal standard presently governs the interpretation of “Do Not Track” browser signals. Accordingly, the Site does not respond to Do Not Track signals. As stated in Section 11.4, the Site does honour Global Privacy Control signals where transmitted.

16. Disclaimers and Limitation of Liability

This Section applies to the fullest extent permitted by applicable law. Nothing in it excludes, restricts, or modifies any right, guarantee, or remedy that cannot lawfully be excluded, restricted, or modified, including under the Australian Consumer Law, the Privacy Act 1988 (Cth), the GDPR, the UK GDPR, and United States state privacy legislation; and nothing in it prevents you from complaining to the Office of the Australian Information Commissioner, a supervisory authority, an attorney general, or any other regulator with jurisdiction.

This Policy is a notice, not a promise. It describes our information-handling practices for your information. It is not legal advice, and it is not given as a warranty, guarantee, condition, or contractual undertaking as to any particular level of privacy, confidentiality, security, or performance. Descriptions of third-party services reflect our understanding of them at the date shown at the head of this Policy, and those third parties may change their practices without notice to us.

The Site is provided “as is.” The Site and its content are made available on an “as is” and “as available” basis, without representation or warranty of any kind, whether express, implied, or statutory. We do not warrant that the Site will be accurate, complete, current, available, uninterrupted, secure, or free from error or harmful code.

Third parties are responsible for themselves. The providers identified in Section 6, the destinations identified in Section 6.8, and every other third party linked to or embedded within the Site act in their own capacity and under their own terms and privacy policies. We do not control them and are not responsible for anything they do or fail to do, including any collection, use, disclosure, loss of, or unauthorised access to personal information within their systems, and any failure of their consent or opt-out controls. Your dealings with any third party are between you and that third party alone.

No liability. To the maximum extent permitted by law, none of us, the Artist, or our respective related entities, personnel, and representatives is liable to you or to any other person for any loss, damage, cost, or expense of any kind, whether direct or indirect, arising out of or in connection with this Policy, the Site, your use of or inability to use the Site, or the handling of personal information described in this Policy, however that liability arises, whether in contract, in tort (including negligence), under statute, or otherwise. This applies in particular to loss arising from unauthorised access to, interception of, or interference with information, and to any event beyond our reasonable control. Each person referred to in this paragraph may rely on it.

Governing law and severance. This Policy is governed by the law of South Australia, Australia. That choice does not deprive you of the protection of any mandatory law of your place of residence. If any part of this Section is held to be unenforceable, it is to be read down to the extent necessary, or severed, and the remainder continues to apply.

17. Amendments to this Policy

This Policy may be amended from time to time in order to reflect changes to our practices, to the services deployed on the Site, or to applicable legal requirements. The effective date and last-updated date appearing at the head of this Policy indicate when this Policy was most recently revised. Where an amendment is material, we will provide such additional notice as applicable law may require, which may include a prominent notice on the Site or, where consent is required, a renewed request for consent. Continued use of the Site following the effective date of an amended Policy constitutes acknowledgement of the amended Policy.

18. Contact Information

Inquiries, requests, and complaints concerning this Policy or the processing of personal information should be addressed as follows:

• Privacy and data protection matters: management@pixelverse.tech
• Merchandise and order support: info@trueblood.shop
• General and business inquiries: the contact form available at /contact

Should you consider that our processing of your personal information infringes applicable data protection law, you are entitled to lodge a complaint with the competent supervisory authority or attorney general in your jurisdiction, without prejudice to any other administrative or judicial remedy. In Australia, that authority is the Office of the Australian Information Commissioner (oaic.gov.au); in the United Kingdom, the Information Commissioner’s Office; and in the European Economic Area, the supervisory authority of your Member State. We would, however, appreciate the opportunity to address your concerns directly in the first instance.