Privacy Policy

This Privacy Policy explains how NetGame Entertainment N.V. (“the Company”, “we”, “us”, “our”) collects, uses, stores, discloses, and protects personal data in connection with our business activities as a Business-to-Business (B2B) gaming technology and software provider, licensed by the Curaçao Gaming Authority (CGA) under the National Ordinance on Games of Chance (Landsverordening op de Kansspelen, “LOK”).

The Company supplies gaming platform software, game content, and related technology services exclusively to licensed online gaming operators (“Operators”). We do not operate end-player-facing gaming services and do not, as a general rule, knowingly collect personal data directly from end players. This Policy is intended to:

• explain what categories of personal data we process and why;

• set out the legal bases on which we rely under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Curaçao data protection requirements;

• describe how personal data is shared, transferred, and protected;

• inform data subjects of their rights and how to exercise them;

• set out our approach to retention, security, and accountability.

This Policy applies to personal data processed by the Company in the following contexts:

• Operator personal data: personal data of directors, UBOs, key personnel, and authorised representatives of our B2B Operator clients, collected during onboarding, due diligence, and the ongoing commercial relationship;

• Limited end-player data: aggregated or pseudonymised gameplay data received from Operators for the purposes of game delivery, RNG/RTP integrity, fraud detection, and reporting. Where any directly identifying end-player data is incidentally processed through our platform on behalf of an Operator, the Company acts as a data processor and the relevant Operator remains the data controller;

• Website and corporate contact data: personal data of visitors to our corporate website, prospective partners, job applicants, and corporate correspondents;

• Employee data: personal data of our own employees, contractors, and job applicants, which is addressed in further detail in our internal Employee Privacy Policy.

This Policy does not govern end-player due diligence or end-player data protection compliance generally. That obligation rests with the licensed Operators to whom the Company supplies its technology, who act as data controllers in respect of their players.

Regulatory Framework

This Policy is adopted with reference to:

• the General Data Protection Regulation (EU) 2016/679 (GDPR), applied as a benchmark of best practice given our Operator base includes EU/EEA-facing licensees;

• applicable Curaçao data protection and confidentiality requirements under the LOK and related CGA regulations;

• the Curaçao AML/CFT regulatory framework, insofar as it imposes record-keeping and data-sharing obligations that interact with personal data processing;

• internationally recognised data protection principles, including those reflected in the OECD Privacy Guidelines.

Where local law and GDPR principles differ, the Company applies the higher applicable standard of protection as a matter of policy, unless prevented from doing so by a binding legal or regulatory obligation.

Personal Data We Process

This section defines the categories of personal data processed by the Company, the purposes of processing, and the applicable legal basis. Applies to all personal data processing activities carried out by or on behalf of the Company.

Where the Company processes any directly identifying end-player data incidentally transmitted through the platform (for example, in technical logs or support escalations from an Operator), the Company acts strictly as a data processor on the instructions of the relevant Operator, who remains the data controller and is responsible for end-player privacy notices and consents

Disclosure and International Transfers

This section sets out the circumstances in which personal data may be disclosed to third parties and transferred outside the jurisdiction in which it was collected. Applies to all sharing and cross-border transfer of personal data by the Company.

• Personal data may be disclosed within the NetGame Entertainment group of companies and to third-party service providers (including hosting providers, KYC/AML screening providers, professional advisers, and auditors) for purposes consistent with this Policy.

• Personal data may be disclosed to the Curaçao Gaming Authority (CGA), the Financial Intelligence Unit (FIU), and other competent regulatory or law enforcement authorities where required by law, licence condition, or formal request.

• Recipients may be established outside the European Economic Area (EEA), including in jurisdictions that may not have data protection laws equivalent to the GDPR. Where this occurs, the Company applies appropriate safeguards, such as Standard Contractual Clauses, data processing agreements, or equivalent contractual protections, before any such transfer takes place.

• The Company does not sell personal data to third parties.

• Where the Company engages a sub-processor (for example, a cloud hosting or analytics provider), that sub-processor is contractually bound to data protection obligations no less protective than those set out in this Policy.

Security of Personal Data

This section defines the technical and organisational measures applied to protect personal data, in alignment with the Company's Corporate Information Security Policy.Applies to all systems, networks, and personnel handling personal data on behalf of the Company.

• The Company applies industry-standard technical, physical, and administrative security measures, including encryption, firewalls, access controls, and secure storage, to protect personal data against unauthorised access, disclosure, alteration, or loss.

• Access to personal data is restricted on a least-privilege, need-to-know basis in accordance with the Company's Access Control Policy.

• All communication with backend systems handling sensitive data is conducted over HTTPS; plaintext transmission of credentials or sensitive personal data is prohibited.

• In the event of a personal data breach, the Company will assess the risk to affected individuals and, where required by applicable law, notify the relevant supervisory authority without undue delay and, in any event, within the timeframe required by applicable law (72 hours under GDPR where applicable), and will notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

• All security incidents involving personal data are logged, investigated, and documented in accordance with the Company's Incident Management process.

Data Retention

This section defines how long personal data is retained by the Company. Applies to all categories of personal data described in Section “Personal Data We Process”

• Operator due diligence and AML/CFT records are retained for a minimum of five (5) years from the end of the business relationship or the date of the relevant transaction, in accordance with CGA and AML/CFT requirements, or for a longer period where required by applicable law.

• Commercial and contractual records are retained for the duration of the relationship and for such additional period as is necessary to comply with legal, tax, or regulatory obligations.

• Website and marketing contact data is retained only for as long as necessary for the purpose for which it was collected, or until consent is withdrawn, whichever occurs first.

• Recruitment data is retained for the duration of the recruitment process and for a limited period thereafter in case of a related dispute, or longer if the applicant consents to being considered for future opportunities.

• Upon expiry of the applicable retention period, personal data is securely deleted or anonymised, save where retention is required by law.

Data Subject Rights

This section sets out the rights available to individuals whose personal data is processed by the Company and how those rights may be exercised. Applies to all individuals whose personal data is processed by the Company, subject to applicable law and any exemptions provided therein.

Subject to applicable law, including the GDPR where relevant, individuals have the following principal rights. This list is illustrative; individuals should refer to applicable law for a definitive statement of their rights.

• Right to access: to request a copy of the personal data the Company holds about them.

• Right to rectification: to request correction of inaccurate or incomplete personal data.

• Right to erasure: to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to the Company's legal retention obligations.

• Right to restrict or object to processing: to request that processing be limited, or to object to processing carried out on the basis of legitimate interest.

• Right to data portability: to request that personal data provided to the Company be transferred in a structured, machine-readable format.

• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

• Right to lodge a complaint: with the competent data protection supervisory authority.

Requests to exercise these rights should be directed to the Company's Data Protection Officer using the contact details in Section 8. The Company will respond within the timeframe required by applicable law (generally one month under GDPR, extendable by a further two months for complex requests).

Cookies and Website Tracking

This section explains the Company's use of cookies and similar tracking technologies on its corporate website.Applies to visitors of the Company's corporate website.

• The Company's website uses strictly necessary cookies required for the website to function, and, where consented to, analytics and performance cookies to understand website usage.

• Non-essential cookies are only set following the visitor's affirmative consent, obtained through the website's cookie consent mechanism.

• Visitors may withdraw or amend cookie consent at any time through their browser settings or the website's cookie preference centre, where available. Non-essential cookies (including analytics, performance, and any marketing cookies) are set only on the basis of the visitor's prior affirmative consent, consistent with the EU ePrivacy Directive and GDPR as a benchmark of best practice; strictly necessary cookies do not require consent but are disclosed for transparency. Where the Company uses any non-essential cookies, a separate Cookie Policy is published on the website setting out each cookie in use, its purpose, duration, any third-party recipient, and how consent may be given or withdrawn.

Questions, requests, or complaints regarding this Policy or the processing of personal data may be directed to the Company's Data Protection Officer at: dpo@netgamenv.com.

This Policy takes effect on the date of approval recorded in the Acceptance section and, unless revised earlier, has a next scheduled review date twelve (12) months thereafter. This Policy is reviewed by the DPO and approved by Senior Management on an annual basis, or earlier where there is a material change in applicable law, the Company's business model, or its processing activities.

Exceptions to any provision of this Policy may only be authorised by the DPO with the approval of Senior Management, and must be documented including the rationale, compensating controls applied, and the approving individual.