36. PERSONAL DATA

36.1 Collection of Personal Data. The collection and processing of personal data carried out is subject to the provisions of Regulation (EU) 2016/679. All Personal Data of Individuals, collected for any purpose, are protected by the respective legislation on Personal Data of the Republic of Cyprus and/or the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of such Data Law of 2018 (Law 125(I)/2018), as amended to date.

36.2 We may only process "Customer" Personal Data:

1. If this is necessary for the fulfillment of any contract we have with the member.
2. If required by a legal obligation.
3. If "the Customer" has consented to the processing.
4. If this is required for reasons relating to our legitimate interests.
5. If necessary for reasons of public interest.

36.3 The procedures followed by our Company regarding the collection and processing of "Customer" Personal Data are described in detail in our Company's Privacy Policy, which is posted on our official website at https://bookieco.com.cy address in the "Privacy Policy" section.

36.4 It is our policy to retain "Customer" Personal Data only for as long as this is necessary for the purpose for which it was collected, in accordance with the principles of data minimization and storage limitation. For all the above reasons, the Personal Data of our "Customers" will be retained for at least five (5) years from the date of collection. It is noted, however, that the Company may not delete any of the Personal Data of the "Customers", unless the five-year period has elapsed and the prior approval of the National Betting Authority has been obtained. In addition, in some cases, certain "Customer" Personal Data may be retained for longer than this period of five (5) years due to possible legal obligations, legitimate interests, etc. Such cases could concern:

• Money laundering
• Taxation
• Player Protection
• Civil law
• Criminal law
• Any other legal issues

36.5 Disclosure of Personal Data. We will not assign and/or disclose Personal Data of our "Customers" to any third party/entity. However, we reserve the right to disclose the Personal Data of our "Customers" to third parties:

1. If we are required to disclose or share the Personal Data of our "Customers" in order to comply with any legal or regulatory obligations, to enforce our terms and conditions and/or regulations, or to protect our rights, property and safety as well as the safety of our "Customers" or third parties.
2. If we need to cooperate with law enforcement agencies and other competent agencies where, in our estimation, disclosure of Personal Data is necessary or related to any investigation of fraud or other illegal activity.

36.6 The player's right of access to data concerning him may be waived in part or in whole in accordance with the provisions of Regulation (EU) 2016/679, the Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of such Data Law - (a) for the purpose of proper fulfillment of the duties of the recipient and the supervisory authorities, as they derive from the Law, or (b) not to impede the conduct of official or legal investigations, analyses or procedures for the purposes of this Law and to ensure that the prevention, investigation and detection of money laundering and terrorist financing are not compromised. (See relevant NBA Directive - 15.2023 v.3. paragraph 7.4.4.)

36.7 In particular, these principles may be:

• The National Betting Authority
• Sports governing bodies (e.g. FIFA, IOC, TIU)
• Anti-money laundering (AML) organizations.
• Counter-Terrorism Financing Organizations (CTF)
• Law enforcement agencies (Police, Courts) of any country may request such data from us.
• It is understood that for all the above cases the National Betting Authority will be informed. (V 6.00 14/12/2022)