PRIVACY STATEMENT

1. GENERAL

BETTING SERVICE BV, having its registered offices at Stapkens 4, 2200 Herentals, Belgium, and registered with company number BE0407.826.701 (also referred to as "We" or "Our") greatly values the protection of your personal data.

BETTING SERVICE is the holder of an F+ permit in accordance with the laws of Belgium (operation of the organisation of bets using the instruments of the information society), number FA+ 120.148.

By making use of our website, apps, and other products and services, you accept the applicability of this Privacy Statement to the personal data processed by us.

We respect your privacy and therefore treat your personal data with due care and confidentiality. In this respect, we comply with the current privacy laws and requirements pursuant to the General Data Protection Regulation, also referred to as the "GDPR"

We do not collect any more data than strictly necessary, do not retain this data for any longer than necessary and permitted by law, restrict access to this data, do not provide any information to third parties unless we are obliged to do so by operation of law, and aim to facilitate the overall privacy-friendliness of our settings and features to the greatest extent possible.

This Privacy Statement aims to inform you of the manner in which we process your personal data and your rights in this respect.

In the context of this policy, the following terms are defined as follows:

• "GDPR": refers to Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, which entered into effect on 25 May 2018.
• "Data Subject(s)": refers to every identified or identifiable natural person to which the processed Personal Data relates. In the framework of this Policy, the Data Subjects are the parties described in Article 2 of this Privacy Statement.
• "Data Protection Authority": refers to each Supervisory Authority for the Processing of Personal Data by a Member State of the European Union, pursuant to Article 51 of the General Data Protection Regulation. In Belgium, this is the Data Protection Authority established by the Act of 3 December 2017 on the establishment of a Data Protection Authority, the successor to the Commission for the Protection of Personal Privacy.
• "Personal Data": refers to all information relating to an identified or identifiable natural person (the "Data Subject"); an identifiable natural person is a person who can be identified, directly or indirectly, specifically by means of reference to an identifying factor such as a name, an identification number, location data, an online identificator, or one or more factors specific to this natural person's physical, physiological, genetic, mental, economic, cultural, or social identity.
• "Privacy Statement": refers to this statement.

2. General principles of Data Processing

Personal Data must be:

• processed in a manner that is lawful, fair, and transparent ('lawfulness, fairness, and transparency');
• collected for clearly defined, expressly described, and lawful objectives, and may not be subsequently processed in any manner that is not compatible with these objectives ('purpose limitation');
• adequate, serve the intended purpose, and limited to what is necessary for the objectives for which they are processed ('data minimisation');
• correct and updated where necessary ('accuracy');
• stored – in a form that makes it possible to identify the Data Subject – for no longer than necessary to meet the objectives for which the Personal Data are processed ('storage limitation');
• processed in such a manner that a suitable level of security is guaranteed and that they are protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, for example, by taking suitable technical or organisational measures ('integrity and confidentiality').

3. Which Personal Data do we process?

Your Personal Data can (a) be provided to us by you, (b) received by us automatically, or (c) provided by a third party. In principle, you will provide us with your Personal Data on a voluntary basis. However, we may need specific Personal Data in order to provide our services, or we may have a legal obligation to have this data.

3.1. Personal data provided to us by you

You may provide us with the following Personal Data:

• Identification data: surname, first name, residential address, email address, telephone number, username, identity document, IP address, national registration number, and other contact details, if you make use of our online services or contact us by telephone;
• Financial details: bank account number;
• Personal characteristics: civil status (married, cohabitation agreement), date of birth, sex, nationality;
• Information regarding the communication session, content of the messages and emails;
• Information concerning technical support, services, complaints or feedback through our support channels in relation to your experiences with us, comments, suggestions, and all other feedback;
• Financial and payment information;
• Preferences and interests with regard to online betting;
• Inclusion in the EPIS list;
• Profiling: information about the products and services you are interested in, the times when you visit us, and visitor behaviour on our website;
• Communication preferences;
• All other personal data voluntarily provided to us (e.g. in your correspondence with BETTING SERVICE).

3.2. Personal Data provided by you through your use of our website

If you make use of our website, the following information can be processed: pages visited, websites, the web browser you are using to browse the Internet, and queries by means of cookies (Cookie Policy), details that you enter on the website yourself. You cannot be identified directly on the basis of this information, but it does allow us to collect statistics.

Personally identifiable data collected through the website may include, but are not limited to, your name, address, email address, date of birth, telephone number, country, gender, national registry number, date of birth, etc. Other personal data such as log file data and device data (e.g. IP address, pages opened, mouse clicks, the date and time of your visit, the brand, type, and operating system of your device, your browser) may also be collected through your use of the website.

You, as a visitor, hereby grant your unambiguous and irrevocable consent to BETTING SERVICE to use your personal data subject to the conditions set out in this Privacy Statement.

It is possible to visit the website without providing this information. BETTING SERVICE does not retain the data it has collected any longer than permitted by law and, in any case, not any longer than necessary for the objectives set out below.

3.3. Personal Data provided by third parties

We may receive Personal Data of which you are the subject from third parties, including public databases, social media platforms (e.g. Facebook, Instagram), Google Analytics, or marketing companies. We may also receive Personal Data that is publicly available

In addition, BETTING SERVICE may receive personal information from other sources if you have given permission to share this information. This may include information from commercially available sources, such as public databases and third-party information. The types of personal information that may be collected from such sources include your name, address, age, and public information, such as user-generated content, blogs, and messages, to the extent that this is permitted by law.

In order to comply with our regulatory obligations, we will perform self-audits or use thirdparty vendors to help us perform background, identity, or financial checks, or we may obtain information from our regulators (or third parties operating in our industry) with regard to excluded (or self-excluded) customer lists.

4. For which objectives do we process Personal data and what are the legal grounds for this?

We process your Personal Data for the following purposes:

4.1. To provide our services and/or if required to execute a contract:

• To respond to your requests and provide you with our services;
• To communicate with you about our services, purchases, requests, questions, and comments;
• To create a player account.

4.2 To improve our services and for the following legitimate commercial interests:

It is in our interest to collect your Personal Data as this provides us with information that we need in order to improve our services. We must therefore seek a workable balance between our interest in processing your Personal Data and your interests as a citizen and rights under the GDPR:

• To gather information with a view to improve our services, develop new products and services, conduct research into our consumers' behaviour to determine the effectiveness of our sales and marketing campaigns;
• To provide a relevant service, tailored to individual needs, in order to personalise your experience;
• Profiling. Your Personal Data may be used to create user patterns and statistics and, on the basis of your personal information (e.g. gender and age group), to categorise you in a particular consumer group ("profiling"), with the aim of developing and improving products and services;
• To contact you and communicate with you, to invite you to participate in customer research or surveys;
• This enables us to send you targeted and personalised news items and promotional campaigns or special offers, tailored to your specific needs, and to enhance your experience with added value. The use of this technology will not have any legal consequences for you, nor will it have any other far-reaching consequences.

4.3 Consent:

We may inform you about our products and services, special offers, promotional campaigns and/or newsletters by email, telephone, post, and targeted advertisements on social media. We can communicate with you if you have placed a bet or purchased other products and/or services from us.

If you are not a customer and you register with us, you declare that you consent to receiving marketing communications from both Magic Betting and Magic Betting Casino. You have the right to change your preferences and withdraw your consent in this respect at any time. To do so, please send an email to [email protected].

4.4 To comply with applicable laws and regulation and the following legitimate interests:

• The requirements imposed by applicable legislation in the field of lotteries, betting, or gambling. We are obliged to keep a record of the personal identification data of our players and to forward this to the Belgian Gambling Commission;
• The anti-money laundering legislation. We are obliged to report any suspicious transactions to the Financial Intelligence Processing Unit;
• To combat fraud. Personal identifying data and transactional data may be used for the purposes of fraud prevention, detection, and investigation. Personal data may be disclosed to third parties that assist us in combating fraud;
• The guidelines of the competent regulating bodies;
• To protect you against identity fraud. Specifically, we need to process your Personal Data in order to verify your identity, determine your age, and verify the origin of your funds for the purposes of combating money laundering, fraud, corruption, terrorism, tax evasion, and the provision of financial or other services to persons that may be subject to economic or financial sanctions, including excluded customers;
• To conduct appropriate and required investigations and to comply with our regulatory obligations in the field of responsible gaming with respect to self-excluded or vulnerable customers;
• Enforcement of legal claims;
• Physical, IT, and network security;
• To monitor and report on compliance issues.

5. Special category of Personal Data

We may collect data concerning your health (in relation to responsible gambling). We need to retain this personal data to ensure compliance with gambling legislation and its implementing decrees.

We have taken all necessary measures to protect these sensitive personal data and ensure that they are kept confidential.

6. Who are the processors and recipients of your Personal Data?

People from our own organisation and third parties may be involved in the processing of your Personal Data

We do not sell Personal Data and only share Personal Data as described below.

We may share your Personal Data with the service providers whose services we call on for the purposes of fulfilling orders, providing IT services, managing promotional campaigns, organising competitions and marketing campaigns, conducting research and analyses, and personalising individual customer experiences with us.

We may also disclose your Personal Data to other operators of games of chance, banks, credit card companies, and agencies for the purpose of conducting investigations and protecting us from activities carried out by minors and from fraudulent, criminal, or suspicious acts and activities.

We may decide to sell or transfer all or part of our business for strategic or other reasons related to our business operations. As part of that sale or transfer, we may disclose information we have collected and stored, including Personal Data, to anyone involved in the sale or transfer.

Additionally, we always have the right to disclose your Personal Data to third parties if this is needed to satisfy our legal obligations or for the execution of the agreement we have concluded with you.

7. How are your Personal Data secured?

We take appropriate technical and organisational measures to protect your Personal Data from destruction, loss, accidental alteration, damage, or disclosure.

All information you provide to us is stored on secure servers. Once we have received your data, we will implement strict procedures and security features to prevent all forms of unauthorised access.

We may occasionally use the services of service providers and organisations that are located outside the EEA. However, we will always make all reasonable efforts to ensure that adequate protective measures are taken to protect your personal data. We will also ensure that our service providers enter into compliant processing agreements with us to ensure that your Personal Data are processed in accordance with the GDPR.

If, despite these security measures, there is a security incident that could potentially compromise your privacy, we will inform you immediately of this incident and the measures we have taken to mitigate the consequences and prevent any recurrence of the incident.

If you nevertheless have the impression that your Personal Data are not properly secured or there are indications of misuse, please contact us immediately at the following email address: [email protected]

8. How long do we retain your Personal Data?

We do not retain your Personal Data any longer than is necessary for the fulfilment of the purposes for which they were collected and processed or as long as is required by law.

9. Which rights do you have and how can these be exercised?

Based on the GDPR, you have the following rights:

• The right to consult your personal data, including the right to request a copy of your Personal Data; You can consult some of these data when you log in to your player account. Please send us an email if you require a more detailed overview;
• The right to correct and update your Personal Data, including the completion of incomplete data if these details are not accurate; Specific data can be edited when you log in to your player account;
• The right to have your Personal Data deleted should the legal grounds for processing these data no longer apply; We are, however, required to retain some data for the sake of compliance with statutory and/or contractual obligations;
• The right to restrict the processing of your Personal Data;
• The right to have your Personal Data transferred;
• The right to lodge an objection against the processing of your Personal Data.

To exercise any of these rights, please send a written request to: [email protected].

In order to ensure that the person issuing the request is genuinely the person he or she professes to be, we request that you send a copy of your identity document along with your request.

Upon receipt of a request, the various interests will be examined and an assessment will be made to determine whether or not we can or may accede to the request. We will then, in principle, respond to your request within no more than thirty (30) days.

If requests are unfounded or excessive, particularly on account of their repetitive nature, we may charge a reasonable fee or refuse the request.

If you have not received a response to your request in time or if your request has been refused, you can lodge an objection to [email protected]. Additionally, you have the right to lodge a complaint with the Data Protection Authority at the following email address: https://www.dataprotectionauthority.be/citizen

10. Is automated decision-making used?

Automated decision-making is defined as decisions about individuals that are based solely on the automated processing of data and to which legal consequences apply or that significantly affect the individuals involved.

Since we use profiling, we make use of automated decision-making.

11. Amendments to and acceptance of the Privacy Statement

We have the right to amend this Privacy Statement at any time with immediate effect in order to remain in compliance with applicable regulations or changed practices within the limits of the applicable regulations. The most recent version of the Privacy Statement will always be posted on our website. It is therefore recommended to regularly consult this Privacy Statement on the website.

12. Contact and questions

Do not hesitate to contact us if you have any questions about this Privacy Statement:

This privacy statement was most recently amended on 26 April 2022.