PRIVACY POLICY

The company “Bet Winner” d.o.o. from Belgrade is a controller of personal data of natural persons and is committed to protecting the personal data of all employees, clients, partners and other persons, in accordance with the Law on Personal Data Protection (“Official Gazette of the Republic of Serbia”, No. 87/2018) and applicable European Union regulations.

This policy aims to explain in a clear, understandable and easily accessible manner what personal data we collect, for what purpose, how we protect it and how you can exercise your rights. In order to be fully aware of the rights you have and how you can exercise them, you need to know that certain terms in this document have the following meaning:

The processing of personal data means any action that is performed automatically or not with personal data or their sets, such as collection, use, recording, classification, grouping, or structuring, storage, adaptation, alteration, disclosure, transmission, delivery, provision for inspection, copying or duplication, comparison, restriction, deletion or destruction, which “Bet Winner” d.o.o. performs directly or through its partners and affiliated entities.

Personal data is any information that relates to a natural person whose identity is determined or can be determined, directly or indirectly.

Respondent – The person to whom the data relate is any natural person whose personal data are processed by “Bet Winner” d.o.o.

A special type of personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data on health or data on the sex life or sexual orientation of a natural person.

Scope of application

The Policy applies to all services and products of “Bet Winner” d.o.o. that include the processing of personal data.

The last expression of will of the person to whom the data relate, by which that person gives consent to the processing of personal data, applies to all services and products of “Bet Winner” d.o.o. that that person uses.

The Policy is primarily intended for natural persons who submit a request or use the services and products of “Bet Winner” d.o.o. (hereinafter: Users) and/or are interested in using the services and products (hereinafter: Interested parties), but in an appropriate manner also to other natural persons whose data “Bet Winner” d.o.o. has access to. occurs in the course of its business in accordance with applicable legal regulations.

The policy does not apply to anonymized data, i.e. data on the basis of which the identity of a person is not directly or indirectly identifiable. Anonymized data is data that has been modified in such a way that it cannot be linked to a specific natural person or cannot be linked

without disproportionate effort and is therefore, in accordance with applicable regulations, not considered personal data.

“Bet Winner” d.o.o. processes personal data for various purposes, and the means of collection, legal basis for processing, use, disclosure and retention periods may differ depending on the purpose.

What personal data do we process

“Bet Winner” d.o.o. collects and processes the following categories of personal data:

2.1. Information contained in contracts with Users and request forms of Interested Parties. Personal data contained in contracts/request forms from the pre-contractual phase, which are necessary for the provision of services, fulfillment of contractual obligations or conclusion of contracts. This includes the processing of the following data: name and surname, unique citizen identification number, postal address, delivery address, contact details, data on the method and history of payment for services (amounts owed, existence of a standing order, current account number, etc.), data from the account specification.

2.2. Information contained in records of communications and correspondence in situations of establishing contact by Users, Interested Parties and other natural persons. This data includes written or electronic communication.

2.3. Information collected in order to fulfill legal obligations.

This includes personal data that “Bet Winner” d.o.o. is obliged to collect, store and process in accordance with the applicable laws of the Republic of Serbia and submit to the competent state bodies (courts, investigative bodies, etc.).

2.4. Other information collected in order to realize a certain legitimate interest of “Bet Winner” d.o.o. When personal data are processed on the basis of legitimate interest, “Bet Winner” d.o.o., with particular care takes into account the impact of the processing on the rights and freedoms of the data subject.

The legitimate interests of “Bet Winner” d.o.o. are not overridden by the interests of the data subject. In the event that the legitimate interests of “Bet Winner” d.o.o. are overridden by the interests or fundamental rights and freedoms of the data subject that require data protection

and about the person, and especially if the person to whom the data relate is a minor, “Bet Winner” d.o.o. will not process it, unless it obtains the express consent of the person to whom the data relate, or the consent of the parent exercising parental rights or another legal representative of the minor in accordance with the relevant regulations.

“Bet Winner” d.o.o. does not process special types of personal data. Exceptionally, “Bet Winner” d.o.o. may process these types of data only in the following cases:

if the person to whom the data relate has given his or her express consent in accordance with the Law, if such processing is necessary for the performance of legal obligations of “Bet Winner” d.o.o.

if it is in the capacity of protecting the vital interests of the person to whom the data relate,

if the data are obviously publicly available, if the processing is carried out for the purpose of fulfilling a legal request, and in order to achieve the public interest defined by law.

Methods of collecting personal data

“Bet Winner” d.o.o. collects personal data in the following ways:

3.1. Directly from the User or Interested Parties, by direct submission by the User and/or Interested Party (such as during the communication of the User/Interested Party with “Bet Winner” d.o.o. when submitting a complaint, etc.).

3.2. Automatically when using “Bet Winner” d.o.o. products and services.

3.3. From publicly available sources such as, for example, data from publicly available records.

3.4. From other controllers, based on an appropriate contractual relationship. In situations where another controller entrusts a certain processing activity of personal data to “Bet Winner” d.o.o. and based on a previously concluded contract, “Bet Winner” d.o.o. as a processor may process all personal data that “Bet Winner” d.o.o. entrusted to another controller for processing.

A prerequisite for any collection of personal data is the existence of an appropriate legal basis in accordance with the Law.

Principles of personal data processing

“Bet Winner” d.o.o. processes personal data in a lawful, transparent and fair manner by carrying out the following activities:

• In a clear, simple and understandable manner, it informs the persons to whom the data relate about the purpose of the processing and the legal basis for the processing;

• Only those processing operations that are necessary are carried out, namely, for the purpose of implementing the contract concluded with the person to whom the data relate (e.g. Users, Interested Parties, engaged associates and the like), then processing operations that are required by relevant legal regulations and represent a legal obligation of “Bet Winner” d.o.o. as the controller, processing operations that are necessary for the purpose of achieving the legitimate interest of “Bet Winner” d.o.o. but only in cases where this interest outweighs the interest of the data subject, as well as processing carried out on the basis of the explicit and freely given consent of the data subject.

“Bet Winner” d.o.o. processes personal data for purposes that are specifically specified, explicit, justified and lawful.

Personal data may not be further processed in a manner that is incompatible with those purposes.

“Bet Winner” d.o.o. adheres to the principle of minimum data collection when collecting personal data, so only those personal data that are necessary to fulfill the purpose for which they are processed are collected from the data subject. Additional personal data are collected with the consent of the data subject.

“Bet Winner” d.o.o. ensures the accuracy of personal data by applying technical and organizational measures and periodically updating the data.

“Bet Winner” d.o.o. respects the principle of integrity and confidentiality of personal data. “Bet Winner” d.o.o. has implemented technical and organizational measures for the protection of personal data, while following legal provisions, good business practice and internationally recognized standards.

“Bet Winner” d.o.o. may engage a processor for the processing of personal data, based on a contract that, among other things, regulates the processor’s duties with regard to the protection of personal data.

Personal data retention periods

Personal data are retained only for as long as necessary to achieve the purpose of the processing, unless applicable regulations provide for a longer or shorter retention period for a particular purpose or in other cases expressly prescribed by law. After that, the data are permanently deleted or anonymized. In the case of processing personal data after the expiration of the retention period (for example, creating a historical data base for the purposes of statistical analysis), “Bet Winner” d.o.o. (permanently) anonymizes the personal data in a way that makes it impossible to identify the natural person to whom the personal data relate.

Purposes of processing personal data

“Bet Winner” d.o.o. shall process the personal data of the data subject only when such processing is lawful. Processing is lawful in the following cases:

6.1. Processing is necessary for the performance of a contract concluded with l

to whom the data relates or in order to take action at the request of the person to whom the data relates before concluding a contract.

In order to provide services to Users, the minimum set of data necessary for the provision of a particular service, i.e. the sale of a product, is processed. Otherwise, i.e. if the person to whom the data relates refuses to provide the requested set of data, “Bet Winner” d.o.o. will not be able to conclude a contract with the User and enable the use of the product or service. The minimum set of data includes the use of data to verify the identity of the User and/or the Interested Party, as well as the use of contact and financial data of the person for the purposes of submitting invoices, assessing solvency, calculating and collecting costs, delivering ordered products, contacting in connection with the provision of the service, checking and creating technical capabilities for the implementation of the service, installing devices, repairing, eliminating interference and other actions related to the conclusion and execution of the contract.

6.2. Processing is necessary to comply with the legal obligations of “Bet Winner” d.o.o. (applicable legal regulations to which “Bet Winner” d.o.o. is obliged to act).

Based on a written request based on applicable legal regulations, “Bet Winner” d.o.o. is obliged to provide or provide access to certain personal data of the User to the competent state bodies (e.g. courts, police, etc.) in certain situations.

6.3. Processing is necessary for the purpose of achieving the legitimate interests of “Bet Winner” d.o.o. or a third party, except when these interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, especially if the data subject is a minor.

The legitimate interest of “Bet Winner” d.o.o. means processing that serves to improve the process, product development and business improvement, modernize services, offer products and services that are expected to improve business with Users. This may, for example, include the use of User data to prevent, detect and prosecute abuses to the detriment of the User or “Bet Winner” d.o.o… protection of “Bet Winner” d.o.o. property creation of services and offers that meet the needs and wishes of the User, market research and analysis, etc.

6.4. The data subject has given consent to the processing of his/her personal data for one or more specifically specified purposes, where such consent must be demonstrable and voluntary, written in an easily understandable language and the data subject has the right to withdraw his/her consent at any time.

6.5. Processing is necessary for the purposes of the vital interests of the data subject or another natural person.

6.6. Processing is necessary for the purposes of performing tasks in the public interest or exercising the statutory

authorizations of “Bet Winner” d.o.o.

Automated decision-making

Decision-making based on automated data processing, including profiling, is an integral part of business operations, and is carried out in accordance with:

a) applicable laws;

b) the performance of contractual obligations;

c) the explicit consent of the data subject;

d) the legitimate interests of “Bet Winner” d.o.o.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, if that decision produces legal consequences for that person or significantly affects his or her position, unless the decision:

1) is necessary for the conclusion or performance of a contract between the data subject and the

controller;

2) is based on law, if that law lays down appropriate measures to protect the rights,

freedoms and legitimate interests of the data subject;

3) is based on the explicit consent of the data subject.

“Bet Winner” d.o.o. does not make decisions based on automated data processing if it is based on automated processing of special categories of personal data unless the person has given his/her explicit consent or if such data are obviously publicly available. In the event that the person has given his/her explicit consent, “Bet Winner” d.o.o. applies enhanced measures to protect this type of data.

In accordance with the Law, “Bet Winner” d.o.o. enables the persons to whom the data relates to exercise the right to object to automated processing, including profiling. The objection may be submitted either in relation to the initial or further processing, at any time and the submission of the objection is free of charge.

Access to personal data and transfer of personal data

Only employees of “Bet Winner” d.o.o. and engaged associates have access to personal data in accordance with the tasks they perform based on the appropriate authorizations determined by “Bet Winner” d.o.o. and only to the extent that it is minimally necessary, with the obligation to act in accordance with the normative acts of “Bet Winner” d.o.o. which regulate the area of ​​personal data protection.

Personal data is available to third parties

to persons outside “Bet Winner” d.o.o. only in the following cases:

• if there is a legal obligation or explicit authorization based on the law (e.g. a court request);

• if a third party or subcontractor (processor) is engaged to perform certain tasks, whereby that processor acts exclusively in accordance with and on the instructions of “Bet Winner” d.o.o., and “Bet Winner” d.o.o. ensures all data protection measures as if it were performing these tasks independently;

• to affiliated companies of “Bet Winner” d.o.o. provided that there is a legal basis for such transfer or access (consent of the person or legitimate interest);

• if the data needs to be forwarded for the performance of the contract;

• to other persons outside “Bet Winner” d.o.o. for whom there is the explicit consent of the person to whom the data relates.

“Bet Winner” d.o.o. generally processes the User’s personal data in the Republic of Serbia. Exceptionally, “Bet Winner” d.o.o. may process personal data in other countries or international organizations that provide an adequate level of protection of personal data (e.g. when a subcontractor from another country is engaged to provide a certain service or part of a service that includes the processing of personal data).

An adequate level of protection is considered to be provided in countries and international organizations that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, or in countries, parts of their territories or in one or more sectors of certain activities in those countries that have been determined by the European Union to provide an adequate level of protection, or in cases where the Republic of Serbia has concluded an international agreement on the transfer of personal data with another country or international organization.

Security and protection of personal data

Personal data is treated as a business secret of “Bet Winner” d.o.o. and is accordingly classified as confidential or strictly confidential data. In accordance with their classification, adequate protection measures are applied to them to protect this data from infringement, unauthorized access, accidental loss, destruction, damage, and any other security threat. For these purposes, technical and organizational measures are applied such as control of access rights, establishment and implementation of information security policies and other related internal acts, establishment of a system of segregation of duties, establishment and ensuring compliance with the obligation of confidentiality and compliance with the law of all

third parties who have the right to access personal data in the information system of “Bet Winner” d.o.o., application of methods for monitoring access and activities in information systems, as well as application of software solutions for the protection of information resources.

“Bet Winner” d.o.o. has implemented an information security management system and within it adequate measures have been established to protect the confidentiality, integrity and/or availability of personal data. In the event of a personal data breach that results in or may result in the accidental or intentional destruction, loss, alteration or unauthorized disclosure of personal data during their processing, which may result in a high risk to the rights and freedoms of natural persons to whom the data relate, “Bet Winner” d.o.o. will immediately upon becoming aware of such a breach, without undue delay, notify the Commissioner and the data subject in a clear and comprehensible manner, including the contact details of the person authorised to protect personal data, a description of the possible consequences and a description of the measures taken. “Bet Winner” d.o.o. will, in the event of a personal data breach, immediately take appropriate measures to prevent further damage to the rights and freedoms of data subjects and to mitigate the consequences of the breach.

Rights of data subjects

Users, Interested Parties and other persons to whom the personal data relate may exercise the following rights:

10.1. Right to access personal data – the applicant for the exercise of this right has the right to obtain information on the existence of the processing of personal data relating to him, on the purpose of the processing, on the type of personal data being processed, the recipients or categories of recipients to whom the personal data are disclosed or may be disclosed, on the retention periods, on the existence of the right to request the correction or deletion of personal data, or the right to restrict the processing of such data, on the existence of the right to file a complaint with the Commissioner.

10.2. Right to correction of personal data – the right to request the correction of inaccurate personal data, as well as the right to supplement incomplete data.

10.3. Right to restriction of processing of personal data in the following cases:

– when the accuracy of personal data is contested, “Bet Winner” d.o.o. will temporarily restrict the processing for a period sufficient to verify the accuracy of the personal data;

– when there is no legal basis for the processing of personal data, and the person to whom the

the data subject

opposes the deletion of the data for the purpose of filing an exercise or defense of legal claims;

– “Bet Winner” d.o.o. no longer needs the personal data for the purpose of the processing, but the data subject has requested them for the purpose of filing, exercising or defending a legal claim;

– when an objection is lodged to the processing, and an assessment is underway as to whether the legal basis for the processing by

“Bet Winner” d.o.o. outweighs the interests of that person.

10.4. The right to object refers to the right of the person to object at any time to the lawfulness of the processing of his or her personal data established on the basis of the relevant legal grounds for processing:

– “Bet Winner” d.o.o. will, upon receipt of the objection, restrict the processing in accordance with point 10.3. and after the assessment of the grounds for the objection has been completed, cease processing the data of the person who has submitted the objection, unless he demonstrates that there are legitimate grounds for processing which override the interests, rights or freedoms of the data subject or are related to the submission, exercise or defense of a legal claim.

– The data subject has the right to object at any time to the processing of his or her personal data processed for the purposes of direct advertising, including profiling, to the extent that it is related to direct advertising.

– If the data subject objects to the processing for the purposes of direct advertising, the personal data may no longer be processed for such purposes.

10.5. The right to erasure (“right to be forgotten”) of personal data relating to the person who submitted the request may be exercised in the following cases:

– the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

– the data subject withdraws the consent on the basis of which the processing was carried out, and there is no other legal basis for the processing;

– the data subject has objected to the processing in accordance with the Law, and there is no other legal basis for the processing that overrides the legitimate interest, right or freedom of the data subject.

10.6. The right of a person to data portability means the right of a person (and the obligation of “Bet Winner” d.o.o.) to receive from “Bet Winner” d.o.o. the personal data previously provided by the person to “Bet Winner” d.o.o. in a structured, commonly used and electronically readable format, as well as the right to have such personal data of the person to whom they relate transferred from “Bet Winner” d.o.o. to another controller.

Manner of exercising the rights of the data subject

The data subject may exercise their rights under Section 10 of this Policy by submitting a request to “Bet Winner” d.o.o. The request submitted must be legible and duly completed and signed. “Bet Winner” d.o.o. will respond to the request without delay, and no later than 30 days from the date of receipt of a complete and correct request. This deadline may be extended for another 60 days if necessary, taking into account the complexity and number of requests. “Bet Winner” d.o.o. will inform the data subject of the extension of the deadline and the reasons for such extension within 30 days from the date of receipt of the request.

Contact details of the controller

Contact details of “Bet Winner” d.o.o. Belgrade are:

Address: “Bet Winner” d.o.o. Belgrade, Alekse Nenadpvića br. 19

11000 Belgrade

Contact phone: 38164/645-94-59

e-mail: [email protected]

Submitting a complaint to the Commissioner for Information of Public Importance and Personal Data Protection

The supervisory body for personal data protection in the Republic of Serbia is the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade (hereinafter: the Commissioner).

The person to whom the personal data relates has the right to submit a complaint to the Commissioner if he or she believes that the processing of his or her personal data by “Bet Winner” d.o.o. is in violation of the provisions of the Law.

Personal Data Protection Officer

You can exercise your rights regarding the personal data that “Bet Winner” d.o.o. processes about you at the business premises of “Bet Winner” d.o.o. All additional questions related to the processing of your personal data, as well as questions regarding the exercise of your rights, can be addressed to the Data Protection Officer at [email protected].

The “Bet Winner” d.o.o. User Privacy Policy comes into force on the day of its adoption and applies throughout the territory of the Republic of Serbia.

Data processing in the online gaming platform

15.1. User accounts and verification (KYC)

“Bet Winner” d.o.o. collects personal data about users for the purpose of registration and account verification, in accordance with legal obligations. This data may include:

name and surname, date of birth, unique identification number, address, contact details, photo/scanned identity document, IP address and technical data about the device.
Access to this data is exclusively granted to authorized employees

and processors, and the data are used only for identity verification and fraud prevention.

15.2. Financial transactions

Financial data processing includes:

data on payments and withdrawals,

bank account and card numbers,

transaction history.

This data is used only for the purpose of payment processing, collection, contract execution and fraud prevention.

15.3. Fraud and abuse prevention

“Bet Winner” d.o.o. uses data on user activities (logs, IP addresses, gaming history) to detect and prevent abuse or violations of the game rules. Any suspicious activity is recorded and processed in accordance with the Law.

15.4. Automated decisions and profiling

The Company may use automated data processing for risk assessment, personalization of services and fraud prevention, with the possibility for the user to file a complaint or request human intervention.

15.5. System logs and monitoring

All activities of employees and users on the platform are recorded in system logs for security, data protection and auditing purposes. Employees may not change or delete logs without authorization from the IT department.

15.6. Cookies and site analytics

The platform uses technical and analytical cookies for the purpose of functioning, security and improving services. Data collected through cookies is used in accordance with this Policy and the Company’s cookie policy.

In Belgrade, on 16.02.2026.