PRIVACY POLICY

This Privacy Policy (hereinafter referred to as the "policy") explains how Casoola and its direct and indirect subsidiaries (collectively, "Casoola", "we", "our") handle your personal data.

This Privacy Policy applies to the personal data collected from registered users ("Player/s") who hold an account on our website and from visitors to our website.

The operator of this website is the Controller of your personal data. We are the Controller of your personal data because, in the context of our business relationship with you, we decide how and why it is processed in the ways explained in this policy. Together with our joint controller, we maintain the ownership and the security of the personal data you provide to us.

If you have any questions about this policy, including any request concerning the exercise of your privacy and data protection rights, you can contact our Data Protection Officer by sending an email to [email protected] .

Data you provide to us directly

We may collect the following personal data from you depending on how you interact with our services;

Registration data: to create an account on our website, you have to provide us with your personal data, including email address, date of birth, country, phone number, gender, full name, social security number, postal code, username. When you register, we automatically receive your IP address and location data.

Due diligence data: we collect your ID card/driving licence/passport number, proof of address, social security number, source of income/funds, bank ID and financial statement/details in order to meet our due diligence and Know Your Customer (KYC) obligations, for age and identity verification purposes, for anti-money laundering purposes and/or to comply with our licence or other legal requirements.

Financial information: we may collect your financial information, including bank ID, CPR number, CPF number, IBAN and payment system details, in order to facilitate withdrawals and deposits on your account. This information may also be used for Know Your Customer (KYC) and Anti-Money Laundering (AML) compliance purposes.

Personal data we collect automatically

Device information: we receive information about the device and the software you use to access our services, including IP (Internet protocol) address, operating system version and device identifiers.

Logs and usage information: to help us understand how you use our services and to help us improve them, we automatically receive information about your interactions with our services. Our servers automatically log usage data when you interact with our website. This information includes records of your activity such as viewing content, clicking on ads, running searches and sharing our services on social media from our website, the date and time of your sessions, the pages you view, links to and from any page, and the time spent in a session. We collect some of this data through cookies and similar technologies.

Location information: we may collect or infer your general location information when you use our Services.

Personal data we receive from others

We may collect your personal data from other sources in order to provide and personalise our services for you and/or to comply with legal obligations. We may collect data from:

• Publicly available sources such as public and government databases, the Internet, social media platforms, online and printed media and so on.
• Commercially available databases and third-party entities, including financial and credit institutions, fraud prevention agencies and public authorities. These sources help us verify your information and investigate suspicious activity, in particular for fraud prevention and anti-money laundering purposes.
• Inference. We may infer additional personal data on the basis of the personal data described above. For example, we may infer your interests and gaming preferences from the web pages you view and the games you play.

Personal data you have made public, such as information available on social media platforms, linked accounts (for example, Facebook or Google) and other publicly accessible digital platforms.

We use the personal data we collect to:

• Provide you with our services
• Answer your questions or requests
• Test, research, troubleshoot and analyse data in order to develop and improve our products and services
• Prevent, detect and manage risks against harmful behaviour, fraud and illegal activity
• Send you marketing content and newsletters and personalise our marketing for you
• Resolve disputes that may arise, including investigations by law enforcement or regulatory bodies
• Meet regulatory and legal obligations

Maintain the security and the functionality of the service, including ensuring the technical availability of the website and protecting our systems and intellectual property from security threats and unauthorised access

In accordance with the GDPR and other applicable data protection laws, we process your personal data when we have a legal basis to do so. For some processing, more than one legal basis may be relevant. Here are some of the legal bases we rely on;

Conclusion and performance of a contract

We process personal data in order to perform or to enter into a contract with you. For example, to create and support your account with us, to communicate with you in order to meet our obligations under the Terms and Conditions and so on.

Legal obligation

Processing your personal data may be necessary in order to meet legal obligations. Some of the processing activities we may undertake to meet legal obligations include:

• Verifying your age and identity as part of our KYC and AML obligations
• Determining your location and the applicable legal requirements using your IP data
• Managing risks, including the prevention of problem gambling and the promotion of responsible gaming
• Ensuring network and information security
• Complying with legal procedures such as search warrants, subpoenas or court orders
• Preventing offences related to money laundering, terrorist financing, fraud or cybercrime claims
• Regular reporting activities to satisfy economic, financial, technical and legal requirements
• Handling your requests to exercise your rights under data protection laws

Legitimate interest

Where necessary, we may process your personal data to safeguard our legitimate interest, that of a third party or a business reason, provided that your rights, freedoms or interests do not override those interests. Examples of such processing activities include:

• Bringing legal action and preparing our defence in litigation or administrative proceedings
• Undertaking IT and system security procedures to prevent potential crime, secure our assets, protect intellectual property and ensure the technical availability and the proper functioning of our website and our applications
• Managing our business relationships and improving our products and services
• Engaging in analytics, data aggregation and research for service development or improvement and/or marketing purposes
• Segmenting customers in order to manage risk, identify potentially harmful behaviour and ensure responsible gaming
• Analysing your gaming behaviour using machine learning algorithms in order to recommend games and features you may like
• Detecting and preventing activity that undermines the integrity of our services, such as fraud, the use of unauthorised software or tools, anomalous patterns or scams

Consent

With your consent, we may carry out the following activities:

• Send direct marketing messages by email, SMS, phone call, website or app notification
• Personalise offers and promotions based on your gaming history and your preferences
• Use data about your online behaviour to display targeted advertising that may interest you
• Personalise and measure the effectiveness of our marketing in order to align it better with your interests and preferences
• Manage your participation in contests, tournaments, prizes, loyalty programmes and promotional events

We may share your personal data with the following categories of recipient:

• Internally with authorised employees, brands within the same entity or operator, contractors, agents, joint controllers, affiliates and subsidiary companies within our corporate group or connected to our parent company.
• Payment service providers and financial institutions. For the use of our services, withdrawals and deposits, we offer a variety of trusted third-party payment service providers. We may share the following personal data with them: first name, last name, date of birth, email, address, postcode, city, country, phone number, alias. We may also share your KYC documents with payment service providers so that they can meet their legal and AML obligations.
• Third-party service providers, where necessary in order to provide, manage and improve our services, including but not limited to customer support providers, email delivery, SMS and voice call providers, technology providers and cloud hosting providers.
• Marketing partners.
• Fraud prevention agencies.
• Third parties in the event of or in connection with a business transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, transfer, assignment or sale of all or part of our business or our assets.
• Game providers.
• Data aggregators or analytics providers for the purpose of conducting market research and data analysis and improving our service offering.
• Law enforcement, regulatory and licensing authorities.

If you choose to send a complaint, a review or a request relating to our services to a third-party platform (for example, a casino review site, a gambling forum or a dispute resolution body), we may have to respond directly to those platforms in order to clarify, look into or resolve the matter you have raised. In that context, we may share personal data strictly limited to what is necessary to identify your account and provide an adequate response. Such communications take place on the basis of our legitimate interest in protecting our business reputation and in handling any external dispute transparently and responsibly. We will not proceed with such disclosures except where a public report or allegation has been made by you or on your behalf. In every circumstance, the data shared will be limited to the minimum necessary and proportionate to the purpose of providing the right context and objective clarification.

We will keep your personal data only for as long as you maintain an account with us and in order to fulfil the purposes described in this privacy policy.

In addition, we may keep your data for a longer period where required by applicable legal obligations, such as anti-money laundering (AML) regulations or other regulatory requirements.

Once your account is closed and there is no longer any legal or business need to keep your data, your personal data will be deleted or anonymised so that it can no longer be associated with you.

The table below summarises the retention periods we apply to the main categories of data.

Data category	Purpose	Retention period
Account and registration data	Account management	Duration of the account plus 5 years
Due diligence and KYC documents	Legal anti-money laundering obligation	5 years after account closure
Transaction records	Financial reporting	5 years
Marketing preferences	Consent management	Until consent is withdrawn
Website and cookie data	Analytics	Up to 13 months

You have certain rights regarding the personal data we hold about you. These include:

• The right to request access to the personal data we hold about you and to obtain information about how we process it.
• The right to rectify or correct any inaccurate or incomplete personal data about you.
• The right to erase, delete or remove your personal data where there is no compelling legal or business reason for its continued processing.
• The right to restrict the processing of your personal data in certain circumstances.
• The right to request the transfer of your personal data to another party in a structured, commonly used and machine-readable format.
• The right to object to the processing of your personal data, in particular if we are processing it on the grounds of legitimate interests or for direct marketing purposes.
• The right to withdraw your consent at any time, without affecting the lawfulness of the earlier processing based on your consent.
• The right to lodge a complaint with a supervisory authority. You can do so in your EU member state of residence, place of work or the place where the alleged infringement occurred. To exercise your rights, contact our customer service at [email protected] or our data protection officer at [email protected] .

We use cookies, tags, pixels, web beacons and other similar technologies in order to improve your experience on our website and our applications. On your first visit to our website or our applications, we will ask for your consent to use non-essential cookies. Strictly necessary cookies, which are required for the website to work, do not require your consent. For more information about the specific cookies we use, their purposes and how to manage your preferences, please see our Cookie Policy.

We give priority to the security of your personal data and put robust measures in place to protect it from unauthorised access, loss, theft and misuse. Our security strategy combines administrative, technical and physical security measures designed to protect your data from unauthorised disclosure, alteration and destruction. Even though we use advanced security measures to protect your data, no system is completely safe from security breaches. The Internet, by its very nature, cannot guarantee complete security in the transmission or the storage of data. While we work hard to protect your personal information, we cannot guarantee its absolute security. We will, however, constantly assess and improve our security practices in order to strengthen the protection of your data.

We may process your personal data in countries outside the EU/EEA. When we transfer your personal data to our affiliates or to third parties, we make sure that appropriate safeguards are in place before that transfer, so that your personal data is granted a high standard of protection. This includes transferring personal data only to countries recognised by the European Commission as providing adequate protection, which use standard contractual clauses approved by the European Commission or put other legally recognised safeguards in place.

In the event of a sale, merger or any other change of ownership or control of our company, your personal data may be disclosed as part of the transaction or while preparing for such an event. The new owner or controlling entity will be entitled to use your personal data, but only in accordance with the terms set out in this Privacy Policy, unless you give explicit consent to a different use.

If you have any questions about this privacy policy or about our data collection practices, please contact us by sending an email to [email protected] or [email protected] .

We may have to update, change or amend our Privacy Policy as our technology evolves and as required by law. It is your responsibility to review the amended Privacy Policy from time to time. The Privacy Policy will apply from the effective date stated on our website.