Marketing Communications Policy

Version 2.0 · effective 1 September 2026 · KebApp s.r.o.

Courtesy translation. The Slovak version (zasady-marketingovej-komunikacie-2.0.md) is the binding one.

This document forms part of the Privacy Policy and explains exactly what you receive when you subscribe to our news, what we process while doing so, and how to unsubscribe at any time. The controller is KebApp s.r.o., Timonova 13, 040 01 Košice, Slovakia, Company ID 54 866 596, contact kontakt@bellybutton.sk.

---

1. One consent for all our services

You give marketing consent once and it covers our whole offering — the BellyButton Shop online store, the loyalty app, the Belly Button café and our events. You do not have to subscribe separately in each app and we will not ask you for consent again in every place.

The same works in reverse: one unsubscribe ends marketing communications from all our services at once. You will never unsubscribe in the app and keep receiving news from the online store.

All these services are operated by one company, so this is one consent given to one controller, not several consents to several entities.

2. What we send you

On the basis of your consent we send e-mails containing:

• news from the online store's range (new games, accessories, merchandise),
• promotions, discounts and discount codes,
• news from the café and the menu,
• invitations to events and game nights,
• game tips and recommendations from our range.

Frequency: as a rule a few messages a month. We do not send daily e-mails.

We use no other channels. We do not send marketing SMS messages or push notifications in the app. If we introduce either in the future, we would ask for separate consent and update this document.

What is not marketing. Messages about your orders, reservations, sign-ups and complaints are always sent, even without marketing consent — they form part of performing the contract and cannot be unsubscribed from separately. Examples are an order confirmation, notice of dispatch, a reservation confirmation or the outcome of a complaint.

3. How you give consent

Consent is always voluntary and active — the checkbox is never pre-ticked.

You can subscribe:

• using the newsletter form on the online-store website,
• using the checkbox when registering a customer account, when making a reservation, or when signing up for an event.

Subscribing through the form is a two-step process (double opt-in): after you enter your address we send a confirmation e-mail and add you to the list only once you click the confirmation link. Until you confirm, we send you no marketing messages. This protects people whose address someone entered by mistake or deliberately.

Consent is never a condition of anything else. Buying, creating an account, reserving or signing up for an event do not depend on it, and not giving it has no effect on them. We do not combine marketing consent with acceptance of the terms and conditions — they are two separate boxes.

Legal basis: your consent under Article 6(1)(a) GDPR.

4. What data we process

This is the part where the previous wording was incomplete. The actual scope is:

Contact details

• e-mail address,
• first name and surname, if we already have them (for example from an order or your account) — so we can address you by name,
• telephone number, if you gave it when making a reservation; we do not use it for marketing, but it is part of the same contact record.

Record of consent

• date and time consent was given, its source and the identifier of the document version,
• date and time of withdrawal, if it happens.

Campaign measurement

Our marketing e-mails contain a measurement pixel and tracked links. Through them we record:

• whether you opened the message,
• which link in it you clicked.

We use this data solely to evaluate how well campaigns perform and to keep the subscriber list up to date (for example to remove addresses that have long stopped working).

Segmentation

We divide the subscriber list into groups so that we do not send everything to everyone — for example by whether you have bought from us, or what kind of events interested you. For this we use labels (tags) and the date you last interacted with us.

This is segmentation of a marketing list, not automated decision-making with legal effect. Prices and purchase conditions do not change because of it — see article 22 of the Privacy Policy.

What we do not do

• We do not link your behaviour on the site to a marketing profile without your consent to analytics cookies.
• We do not use third-party advertising tools and do not give your e-mail to advertising platforms.
• We do not sell or exchange the subscriber database.

5. Who has access

We send marketing e-mails with our own system running on our own infrastructure. These suppliers are involved:

• Websupport, s.r.o. (SK) — Technical delivery of e-mails
• Amazon Web Services (EU, Frankfurt) — Servers and storage running the marketing system

We do not provide the subscriber database to any advertising or marketing platform and do not transfer it outside the European Union.

6. How to unsubscribe

You can unsubscribe at any time, free of charge, in three ways:

1. The "Unsubscribe" link in the footer of any marketing e-mail — works immediately, no sign-in needed.
2. In your account settings, if you are signed in.
3. By writing to kontakt@bellybutton.sk or info@bellybutton.sk.

We process unsubscribes without delay. You may still receive a message that had already been sent at the moment you unsubscribed.

Withdrawing consent does not affect the lawfulness of processing before it and has no effect on messages about your orders and reservations (article 2).

7. How long we keep the data

• E-mail address on the subscriber list — Until you withdraw consent
• Record of consent given and withdrawn — 3 years from withdrawal
• Open and click data — 13 months

We keep the record of consent given and withdrawn after you unsubscribe on the basis of our legitimate interest under Article 6(1)(f) GDPR — we must be able to demonstrate that the messages were sent lawfully, and to make sure nobody adds you back by mistake.

8. Your rights

You have the right of access, rectification and erasure, restriction of processing, portability, the right to object and the right to withdraw consent at any time. The details and the procedure are in article 20 of the Privacy Policy.

You may also lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.

9. Changes to this document

We may update this document. The current wording, with its version number and effective date, is always published on bellybutton.sk and in the terms section of the online store.

If a change were to widen the purpose you consented to — for example by adding a new communication channel — we would ask for fresh consent; the new wording would not apply to you automatically.

This document is issued as version 2.0 and takes effect on 1 September 2026.

---

This English version is a courtesy translation provided for convenience only. The Slovak version is the legally binding one; in the event of any discrepancy between the English and the Slovak version, the Slovak version prevails.