Privacy statement of Betting Compliance Advisory B.V.

Betting Compliance Advisory B.V. ("Betting Compliance Advisory", "we", "us" or "our") attaches great importance to the protection of personal data.

This privacy statement explains which personal data we process when you visit our website, contact us or use our services. We process personal data in accordance with the General Data Protection Regulation ("GDPR") and applicable Dutch legislation.

1. Who are we?

Betting Compliance Advisory B.V. is the controller for the processing of personal data as described in this privacy statement.

Betting Compliance Advisory B.V. provides compliance, risk management and governance consultancy and interim management services to financial institutions.

For questions about this privacy statement, our processing of personal data or the exercise of your privacy rights, you can contact us at:

E-mail: info@bettingcomplianceadvisory.com

2. Which personal data do we process?

We only process personal data that is necessary for the purposes described below.

When you contact us via the contact form on our website, we may process, among other things, the following data:

• your name;
• your e-mail address;
• your telephone number, if you provide it;
• the content of your message;
• any other personal data you voluntarily provide in your message.

We ask you not to provide special categories of personal data or other sensitive information in a contact form or e-mail.

In addition, when you visit our website, technical data may be processed, such as an IP address and country, information about the device and browser used, date and time of the visit and technical data necessary for the functioning and security of the website.

3. What do we use your personal data for?

We process personal data for the following purposes:

1. to answer questions, requests and other communication received via our website or by e-mail;
2. to contact you, when you request this, about our consultancy, advisory or interim management services;
3. to ensure the security, availability and proper functioning of our website;
4. to comply with legal obligations;
5. to protect our rights and interests, for example when necessary to establish, exercise or substantiate a legal claim.

We do not use the personal data you provide via the contact form for newsletters or unsolicited marketing communications.

4. Legal basis for the processing

We only process personal data when a valid legal basis exists.

Depending on the situation, we may process personal data on the basis of:

• your request (consent) to take steps prior to entering into an agreement, for example when you contact us about our services;
• the performance of an agreement, when this is necessary for performing an agreement with you;
• a legal obligation, when we are legally required to process or retain certain personal data; or
• our legitimate interest, for example for answering business correspondence, securing our systems and website and protecting our legal position.

When we rely on a legitimate interest, we carry out a balancing test and ensure that your privacy interests are not unnecessarily harmed.

5. Contact form and e-mail

When you contact us via the contact form, we use the data you provide solely to handle and answer your message and, where relevant, for further business communication following your request.

We do not retain this data for longer than necessary for the purpose for which it was collected, unless a statutory retention obligation or a legitimate interest requires a longer retention period.

6. Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small files that can be stored on your device when you visit a website. Some cookies are necessary for the functioning, security or technical operation of the website.

We aim to use only cookies that are necessary for the functioning and security of our website, unless we inform you in advance and (where legally required) obtain your consent for other cookies.

We do not use tracking cookies for advertising purposes and do not use cookies to profile visitors for marketing purposes.

If analytical or other non-essential cookies are used on our website, we will state in our cookie information:

• which cookies are used;
• by whom these cookies are placed;
• what the cookies are used for;
• how long the cookies are retained; and
• whether consent is required for placing or reading them.

For cookies that require consent, we ask for this consent before the relevant cookies are placed or read.

7. With whom do we share personal data?

We do not provide your personal data to third parties for their own marketing purposes.

For offering and maintaining our website, personal data may be processed technically by service providers acting on our behalf, for example a hosting provider or supplier of technical website infrastructure. Such parties may only process personal data in accordance with our instructions and insofar as necessary for the service.

In addition, we may provide personal data to third parties when necessary to comply with a legal obligation, a court order or a competent request from a government authority, or when necessary to establish, exercise or substantiate our legal position.

8. Transfers outside the European Economic Area

We aim to have personal data processed within the European Economic Area ("EEA").

If personal data is processed or accessible from a country outside the EEA, we ensure that a valid legal basis and appropriate safeguards exist, such as an adequacy decision of the European Commission or appropriate contractual safeguards such as the standard contractual clauses adopted by the European Commission.

9. How long do we retain personal data?

We do not retain personal data for longer than necessary for the purposes for which it was collected.

The specific retention period depends on the nature of the data and the purpose for which it is processed. Where a statutory retention obligation applies, we retain the relevant data for the legally prescribed period.

After the applicable retention period has expired, personal data is deleted or anonymised, unless further retention is necessary because of a legitimate interest or a legal obligation.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unauthorised alteration, disclosure and other forms of unlawful processing.

These measures are tailored to the nature of the personal data and the risks of the processing.

11. Your privacy rights

Under the GDPR, depending on the circumstances, you have the following rights:

• the right to request access to your personal data;
• the right to have inaccurate or incomplete personal data corrected;
• the right to have your personal data erased;
• the right to have the processing of your personal data restricted;
• the right to object to certain processing;
• the right to data portability where legally applicable; and
• the right to withdraw consent where the processing is based on consent.

Withdrawing consent does not affect the lawfulness of the processing that took place before the withdrawal.

If you wish to exercise one or more of these rights, or have a question about the processing of your personal data, you can contact us at:

info@bettingcomplianceadvisory.com

We may ask you to provide sufficient information to verify your identity before we handle your request. We only do this when necessary and proportionate.

We will in principle respond to your request within one month. If your request is complex or we receive a large number of requests, this period may, in accordance with the GDPR, be extended by up to two months. In that case we will inform you within one month of receiving your request.

12. Complaints

Do you have a complaint about the way we handle your personal data? Please contact us first at:

info@bettingcomplianceadvisory.com

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

The Autoriteit Persoonsgegevens supervises compliance with privacy legislation in the Netherlands.

13. Changes to this privacy statement

We may amend this privacy statement from time to time, for example when our website, services or applicable laws and regulations change.

The most recent version is published on this page. We therefore recommend that you consult this privacy statement regularly.