SUMMARY OF GAME-U'S INCIDENT RESPONSE PLAN AND BREACH NOTIFICATION PROCEDURES

Game-U takes the security of our systems and the protection of Personal Information seriously. While no organization can guarantee that security incidents will never occur, Game-U maintains a comprehensive Incident Response Plan and Breach Notification Procedures designed to enable timely, coordinated, and effective responses in the event of any suspected or confirmed security incidents or data breaches. This summary provides a high-level overview of our approach to incident preparedness, response, and communication.

Preparedness and Monitoring

Game-U maintains strong administrative, technical, and organizational safeguards to help prevent, detect, and respond to security incidents. Our systems are monitored for suspicious activity using appropriate tools and processes, and personnel are trained to recognize and promptly escalate potential security concerns. Game-U has a designated Incident Response Team (including security, IT, and legal personnel) ready to act, and we conduct regular training exercises and simulations to ensure preparedness. We also regularly review and update our security practices to address evolving risks.

Detection and Identification

When unusual activity or a potential security issue is identified, Game-U will promptly evaluate the situation, based on the nature and the circumstances, to determine whether a security incident has occurred. Incidents are assessed based on their nature, scope, and potential impact, including whether any Personal Information may be involved. If Personal Information appears to be at risk, the incident is treated with the highest priority as a potential data breach.

Containment and Mitigation

Upon confirmation of a security incident, Game-U will take immediate steps to contain the incident and prevent further unauthorized access or disclosure. This may include isolating affected systems, disabling compromised user accounts or credentials, and applying technical fixes (such as patches) to address any security vulnerabilities. By quickly containing the issue, we aim to minimize any potential damage or risk to data.

Investigation and Assessment

Game-U will investigate confirmed incidents to understand what happened, what information was affected, and how the incident occurred. This process may involve internal experts and, where appropriate, external cybersecurity or forensic specialists. During the investigation, we will carefully document findings and preserve evidence. We will use this information to determine the incident's root cause and evaluate the potential impact on users and systems.

Notification and Communication

If a security incident involves Personal Information and triggers legal or contractual notification obligations or otherwise warrants notification under applicable circumstances, Game-U will notify affected customers, schools/school districts, or individuals promptly, and in any event in accordance with applicable law and our agreements. Notifications will be written in clear, plain language and include appropriate information about the incident and guidance to support those affected. For example, we may identify the types of data that may have been involved, steps we have taken in response, and measures individuals or schools/school districts can take. We prioritize cooperative communication and, where appropriate, consult with law enforcement to avoid impeding investigations.

Student Personal Information (School Services) – for incidents involving Student Personal Information, Game-U will notify the affected school/school district in accordance with the applicable agreement and law, generally after confirming the incident and within any required contractual timeframe (which may be as short as 24-72 hours). Game-U will assist the school/school district in meeting any further notification obligations to students, parents/guardians, or regulators, as required by law or the applicable agreement.

Individual Personal Information/Website Personal Information – for incidents involving individual Personal information (i.e., Personal Information collected through our Individual Services) or Website Personal Information (i.e., Personal Information collected through our public Websites), Game-U will provide timely notice directly to affected individuals or organizations in compliance with applicable data breach notification laws. Those laws generally require notification without unreasonable delay or within a specific number of days, depending on the jurisdiction. Game-U seeks to comply with these requirements by notifying individuals as soon as practicable after confirming and assessing the incident.

As appropriate, Game-U will coordinate closely with any partner organization (such as schools/school districts) to ensure a transparent and effective communication process. Our goal is to keep affected parties appropriately informed while complying with applicable legal and contractual requirements and consistent with our Privacy Policy.

Remediation and Recovery

Following containment and investigation, Game-U will take steps to remediate the root cause of the incident and restore systems to normal operation. This may include implementing additional security controls, updating procedures, or enhancing monitoring to prevent similar incidents in the future. Our goal is to securely return to normal operations as soon as reasonably practicable while preventing recurrence of the issue.

Review and Continuous Improvement

If an incident occurs, once it is resolved, Game-U will conduct a thorough post-incident review to identify lessons learned and opportunities for improvement. We will document the incident and our response, then update our Incident Response Plan, Breach Notification Procedures, security measures, and training based on these insights. This continuous improvement process will help strengthen our security program and enable us to better protect our community going forward.