Privacy / Cookies Policy

Privacy/Cookies Policy


Effective: Unless you agree to this policy sooner, this policy is effective as of the 23rd May 2018.


This Privacy Policy  regulates the processing of personal data of a user:

A) browsing the website planetwin365.com (please see Section 1);

B) for the purpose of a User gaining access to the services they have freely chosen, unless consent is required (please see Section 2);

C) for the purpose of setting up and using the gaming account (please see Section 3);

D) for the purpose of communication between a User and SKS365 Malta Limited (please see Section 4).

The Privacy Policy describes the manner in which SKS365 Malta Limited collects, uses and processes the personal data of the users, and how SKS365 Malta Limited complies with the provisions stipulated by the law on personal data protection.

- Section 1 -

INFORMATION CONCERNING THE PROCESSING OF PERSONAL DATA WHILE BROWSING THE WEBSITE WWW.PLANETWIN365.COM (hereinafter “the Website”)

SKS365 Malta Limited (hereinafter “SKS365” or “the Data Controller”), in its capacity as data controller, shall collect, use and process the data of users of the Website in compliance with the Data Protection Act (Chapter 440 of the laws of Malta), any future data protection legislation as may be enacted by the Maltese legislator from time to time, and any other European Union data protection legislation, including but not limited to the General Data Protection Regulation (GDPR).

The following provisions make up the privacy policy of the Data Controller regarding the personal data of the users (whether they have a gaming account with SKS365 or not) collected as they browse the Website.

A. Browsing Data

As part of their usual operation, the information systems necessary for the operation of the Website collect certain personal user data, the transmission of which is necessary due to communication protocols of the Internet.

This is information that is not collected for the purpose of being associated with specific individuals, but which due to its nature, could allow for the identification of users through processing and/or association with data held by third parties.

This type of data includes, by way of example, the IP address, browser type, operating system, domain name and the address of the website from where the Website was accessed or to which the Website was exited, the information on the pages of the Website visited by the users, the access schedule, time spent on each page, the analysis of the path used on the Website, and other parameters related to the operating system and to the user's IT infrastructure.

Such technical and IT data is collected and used together and anonymously for the purpose of:

– improving service quality and optimising the performance of the Website;
– understanding user behaviour in order to improve online communication;
– providing statistical information regarding the use of the Website.

B. Data Collected through Cookies

The Website uses the following types of cookies:

– “technical cookies”, which allow for an effective operation of the Website, for which it is not necessary to obtain consent from the interested party, as stipulated by current legislation;
– “session cookies”, namely cookies created temporarily, which are deleted once the window of the browser is closed;
– “profiling cookies” from third parties, used to create user profiles and to send advertisements in line with the preferences displayed by the users.

The Data Controller uses cookies for multiple purposes. The most important ones are used to:

– optimise access to the pages of the Website and access to the games;
– monitor and analyse browsing activities, as well as implement solutions to improve the user experience;
– identify source URLs;
– respond to technical, statistical, and profiling requirements;
– provide advertising and/or marketing services;
– provide advanced functionality in the transmission of identification data of sessions for the purpose of a safe and effective navigation on the website.

SKS365 have several profiling partners:

– Google Analytics (for the privacy policy observed by the service Google Analytics, please see the information published at the following address: https://www.google.com/policies/privacy/)

– Hotjar (for the privacy policy observed by the service Hotjar, please see the information published at the following address: https://www.hotjar.com/privacy);

– Connextra/ Betgenius (for the privacy policy observed by the service Connextra, please see the information published at the following address: http://www.geniussports.com/privacy-policy/);

– Facebook (for the privacy policy observed by the service Facebook, please see the information published at the following address: https://www.facebook.com/policy.php);

The list of profiling partners used by the Data Controller may be updated.

B.1 Technical Cookies

The Website uses technical cookies for the purpose of allowing navigation and providing the services requested by the user. The technical cookies are not used for any other purposes and they are installed directly by SKS365. No operations could be performed without using such cookies, or if they could, they would be more complex and/or less secure.

B.2 Profiling Cookies

The Website uses profiling cookies from third parties with the purpose of tracking the user’s web browsing and creating profiles for their consumption choices and habits. Using these cookies, advertising messages may also be sent to the user's terminal in line with the preferences already expressed by them through their browsing.

The different profiling cookies used by the Website are described below.

B.2.1 Google Analytics Cookies

The Website uses the service called “Google Analytics” provided by Google LLC. This is a service that provides statistics for the measurement and analysis of the Website’s performance through the use of cookies.

The Google Analytics cookies are anonymised by: (a) hiding the IP address (in accordance with the procedure described on the following webpage https://support.google.com/analytics/answer/2763052?hl=it) and (b) disabling (from the control panel) the sharing of the collected data with other services provided by Google (as described at https://support.google.com/analytics/answer/1011397?hl=it); for the purpose of performing such operations, the Google Analytics cookies are equipped with technical cookies, as they are defined above.

The privacy statement belonging to Google Analytics may be found at the following internet address: http://www.google.com/intl/en/analytics/privacyoverview.html. For the privacy standards applied by Google, please go to https://www.google.com/policies/privacy/.

B.2.2 Hotjar Cookies

The Website uses the service called “Hotjar” provided by Hotjar Ltd. This is a service that, through the use of cookies, provides statistics for the measurement and analysis of the user behaviour on the Website.

Hotjar keeps this information in an anonymous user profile. Neither Hotjar, nor the Data Controller is in a position to use such information for identifying a specific user or for combining it with other data retained by the Controller on the specific user. The privacy statement of the service “Hotjar” may be found at the following internet address: https://www.hotjar.com/legal/policies/privacy.

It is possible to decide against the creation of an anonymous user profile on Hotjar, as well as to delete any data attached to the anonymous profile through other websites that may use Hotjar cookies by following the instructions accessible from the following link: https://www.hotjar.com/legal/compliance/opt-out.

B.2.3 Connextra/Betgenius Cookies

The Website uses the service called “Connextra” provided by Genius Sports Group Limited. This is a service that provides statistical information on the outcomes of marketing campaigns carried out by the Data Controller on third party websites.

The privacy statement of the service “Connextra” may be found at the following internet address: http://www.geniussports.com/privacy-policy/.

B.2.4 Facebook Cookies

The Website uses the service called “Facebook Pixel” provided by Facebook Inc. This is a service that provides statistical information on the outcomes of marketing campaigns carried out by the Data Controller on the website https://www.facebook.com/.

The privacy statement of the service “Facebook Pixel” may be found at the following internet address: https://www.facebook.com/about/privacy/update.

B.3 Accepting and Disabling Cookies

The User gives their consent to the use of the cookies described in the paragraphs above by continuing to browse the Website after they have been informed of the use of cookies through a panel found on all the access pages of the Website.

The User is aware of the possibility to set up the browser in such a manner as to accept or refuse the installation of cookies by third parties, however the functionality of the Website could be limited should cookies be disabled from the browser.

Furthermore, the User is free to set the original disabling of the profiling cookies while browsing by selecting the corresponding browser features described on the webpages found at the following links:

A) “Internet Explorer” browser – https://support.microsoft.com/it-it/help/17442/windows-internet-explorer-delete-manage-cookies;

B) “Firefox” browser – https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences;

C) “Safari” browser – https://support.apple.com/kb/PH21411?locale=it_IT&viewlocale=en_US

D) “Google Chrome” browser – https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DDesktop&hl=it.

Users using a browser different from the ones listed above may consult the method for managing cookies, as well as their respective disabling procedure, by checking the support webpage of that particular browser.

B.4 Further Information on Cookies

It is possible to request further information concerning the cookies installed by the Website by sending a request to: privacy@planetwin365.com.

C. Data Processing Methods

The data collected while using the Website is processed by automated means, solely for the duration necessary to pursue the purposes for which the data has been collected.

D. Optionality of Data Transmission

The transmission of browsing data is optional. By deciding to continue using the Website after having viewed the warning message shown in the appropriate panel displayed on the Website page that was accessed first, the user exercises their right to provide their data in accordance with the provisions of this section.

E. Links to Other Websites

From the Website it is possible to connect through dedicated links to other websites owned or managed by third parties that could be part of the same SKS365 Group (this is the corporate group comprising all the companies directly or indirectly owned by SKS365 Malta Holding Limited).

The Data Controller declines any responsibility in connection with any potential collection or processing of personal data performed by the third parties owning said websites.

F. Place Where the Processing is Carried Out and Information About the Server

The processing of the data collected through the navigation of the Website is performed at the offices of the Data Controller and of the Data Processors. The servers where the data is stored are located in Ktiš (the Czech Republic), Ktiš 2, 384 03 and are owned by INTERNET CZ, a.s., with their registered address at Ktiš, č.p. 2, 384 03. The maintenance of the servers is carried out by technicians assigned by this company. This is done in their capacity as Data Processors for SKS365, having received the corresponding assignment in writing and the appropriate instructions in terms of the processing of personal data that fall within the scope of SKS365.

Furthermore, the personal data is only handled by the technical staff, specifically assigned for the processing, with the exception of persons occasionally assigned to maintenance operations.

G. Scope of Data Circulation

The processing associated with the services provided through the Website is handled by staff members of SKS365 and by third party entities on behalf of SKS365, in their capacity as data controllers or processors, both receiving specific operating instructions in writing.

H. Personal Data Retention Period

The data may be used in the assessment of liability in case of cybercrimes against the Website and/or against its users.

In case these situations do not occur, the data collected in accordance with the provisions stipulated in this section is retained for a maximum period of 24 months.

In case of legitimate reasons and within the limits provided for by the law, the user has the right to request the removal of their own data before the term indicated above. Such a request must be submitted as described in paragraph A of Section 5 below.

I. Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

J. Deferment

The provisions in this section are supplemented by the additional information contained in Section 5 below.

- SECTION 2 -

INFORMATION CONCERNING THE PROCESSING OF PERSONAL DATA OBTAINED THROUGH AN ACTIVE USER’S BEHAVIOUR ON THE WEBSITE WWW.PLANETWIN365.COM (hereinafter the “Website”)

SKS365 Malta Limited (hereinafter “SKS365” or “the Data Controller”), in its capacity as data controller, shall collect, use and process the data of users of the Website in compliance with the Data Protection Act (Chapter 440 of the laws of Malta), any future data protection legislation as may be enacted by the Maltese legislator from time to time, and any other European Union data protection legislation, including but not limited to the General Data Protection Regulation (GDPR).

A. Data Provided by Users Through Their Actions

This concerns the cases in which the user, after reading the detailed Privacy Policy , has provided their personal data to the Website in order to access certain services of their choice. This data expressly excludes the data communicated by the user for the purpose of setting up and use of the gaming account, which is processed in accordance with the provisions laid out in Section 3 below.

B. Purpose of the Processing

The data in question is processed for the following purposes:

A) to give users the identification details necessary to access specific sections of the Website;

B) to respond to specific requests from users;

C) to provide information on promotions and offers, to send out communication materials for marketing purposes, and to send advertising and commercial materials by telephone, SMS, MMS, video, web chat, electronic mail, regular mail, fax or any other means of communication possible with the latest technology;

D) to involve users in initiatives aimed at gauging customer satisfaction;

E) to profile users in accordance with the provisions of Section 3 paragraph C.

C. Mandatory or Optional Data Provided

Due to the instrumental connection between SKS365 carrying out the activities requested by the user and the purposes listed in paragraph B above under items A) and B), failure to provide data for the purposes detailed above will render the aforementioned activities impossible.

For the purposes listed in paragraph B above under items C), D), and E), providing the data is therefore optional and the refusal to provide the data does not impact the entering into a relationship, but only precludes the ability to carry out the activities described under items C), D), and E).

D. Method and Tools Used for the Processing

The data is processed with the help of manual and electronic tools (manual and authomated processing) and, in any case, in such a manner as to guarantee the security and confidentiality of the data.

For the purposes detailed in paragraph B) above under items A) and B), the personal data of users may be communicated in order to be subjected to the corresponding processing for the same purposes, and is strictly limited to what concerns the specific relationship between the user and SKS365.

The data will be processed by:

– employees, collaborators, suppliers and consultants of SKS365, who may gain access to the personal data, in their respective qualities - as the case may be - as data controllers or processors;

– companies and/ or third party experts, specifically assigned to the processing, to which the communication of the data is necessary for purposes that are connected, inherent and/ or instrumental to the performance of specific requests from users.

E. Transfer of Data to Countries Outside the EU

The data provided may be transferred to the headquarters of the same Data Controller located in non-EU countries offering a level of data protection which has not been deemed adequate by the European Commission, or to third parties - irrespective of whether they are part of the SKS365 Group or not - established in said countries, that have adhered to the standard contractual clauses approved by the European Commission.

F. Provision of Data Belonging to Third Parties

The user that, in various sections of the Website, provides personal data belonging to third parties for setting up and/or using the gaming account declares and expressly guarantees that they have previously obtained from said third parties the consent for the processing of their personal data under the terms provided in this section.

The user further declares they have informed the third parties on the current legislation, especially with reference to the possibility that the data may be communicated to SKS365 for the purposes indicated above.

G. Transfer of Data to Third Parties

If the user has given their consent, the personal data may be communicated, even with the help of electronic and automated tools of any kind, to third parties established in EU countries or in non-EU countries (offering a level of protection deemed adequate or inadequate, by the European Commission). Third parties may operate in sectors such as finance, banking, insurance, administrative, telecommunication, personal care, and gaming services, as well as in entertainment. The user must give their consent for all third parties to send marketing communications. When the third party is located in a third state, it must adhere to the standard contractual clauses approved by the European Commission, in order to allow them to provide information about promotions and offers, to send out communication materials for marketing purposes, and to send advertising and commercial materials by telephone, SMS, MMS, video, web chat, electronic mail, regular mail, fax or any other means of communication possible with the latest technology on the products and services supplied by the third parties.

The third parties receiving personal data in accordance with this Privacy Policy may otherwise use it for profiling purposes, with the help of methods compliant with those provided for in paragraph C above on the profiling activities carried out by the Licensee.

The third parties to which such data will be transferred and who guarantee, in an autonomous and exclusive manner, the quality of the data controllers to the other interested parties, as well as compliance with any related obligations and responsibilities stipulated by the law regarding the processing of the data detailed above, operate on their behalf and in their own interest.

Furthermore, said third parties may conduct profiling activities in connection to the data transferred in compliance with the provisions of this policy statement.

H. Retention of Personal Data

The data obtained in accordance with this section is retained for the duration necessary to pursue the purpose for which they are processed, however for a period no greater than 24 months, except for the processing under paragraph B) item E), which provides for a period of up to 12 months.

In case of legitimate reasons and within the limits provided for by the law, the user has the right to request the removal of their own data before the term indicated above. Such a request must be submitted as described in paragraph A of Section 5 below.

I. Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

J. Deferment

The provisions in this section are supplemented by the additional information contained in Section 5 below.

- SECTION 3 -

INFORMATION ON DATA PROCESSING IN OPENING AND MANAGING THE GAMING ACCOUNT

SKS365 Malta Limited (hereinafter “the Licensee” or “the Data Controller”), holder of Class 2 remote gaming licence number MGA/B2C/199/2011 (hereinafter “the Authorisation”) granted by the Malta Gaming Authority, in their capacity as data controller, gives notice that the information about users that qualifies as “personal data” collected in accordance with current data protection legislation, during the setting up and use of the gaming account will be processed manually and/or using automated and/or telematic means for the purposes and with the methods mentioned above.

A. Main Purposes for the Processing of Personal Data and Respective Methods

A.1 Purposes connected to the setting up and use of the gaming account.

Processing of the personal data of the user collected by the Licensee through the corresponding features of the website www.planetwin365.com (hereinafter “the Website”) when activating a gaming account is done in order to allow for the setting up of the gaming account of the respective user and to allow for the Data Controller to comply with the requirements deriving therewith.

A.2 Purposes connected to the compliance with the requirements stipulated by the law or by EU regulations and standards.

Personal data will be processed in order to comply with the requirements stipulated under current legislation, as well as to observe the accounting and fiscal requirements and obligations of the Licensee.

To this end, it is highlighted that SKS365 is required to process the data in order to observe the requirements stipulated under the current legislation on remote management and collecting for public gaming, including those that derive from the actions of the Licensee as described below and from the regulations of the industry, under which the agents are, among other things, required to:

– verify the compliance with the prohibition of participation in gaming activities for minors and the obligation to implement appropriate measures to prevent and fight compulsive gambling;

– implement measures to reduce the risk of collusion, money laundering and fraud, which, by way of example, include the monitoring of gaming chats and electronic communications between participants at virtual gaming tables during gaming sessions and/or user operations;

– retain the data from the previous paragraph for the duration stipulated by the provisions which apply from time to time.

It is also highlighted that SKS365 is required to process user data for:

- compliance with the provisions on the prevention of money laundering and terrorist financing pursuant to Legal Notice 372 of 2017;

- the evaluation of profiles at risk of money laundering, the financing of terrorism or committing other fraudulent activity

- network security and the prevention of collusion;

- respect the user’s instructions of self-exclusion and self-limitation.

A.3 Purposes connected to allowing the registration of the user and their participation to public gaming that can be accessed through the Website.

Accessing and browsing the website is free. However, the possibility to enjoy the gaming services sold through the Website is granted only after the conclusion of a gaming account agreement with SKS365, completed after filling out the corresponding form, in the context of which the user is required to include their personal data, also for the purpose of activating the authentication credentials necessary to access the gaming areas and services reserved for users under contract.

More specifically, through this form, the biographical data, residence, contact details of the user (cellular phone number and e-mail address), data of the identification document as well as the login credentials are collected.

The form also includes the confirmation of acceptance of the terms and conditions for the use of the gaming services offered and this privacy policy; this consent is acquired by an opt-in button.

Other primary purposes of the processing are connected to the creation and technical management of the gaming account and of its features.

After the contracting phase is over, the user is granted access to the reserved area connected to their gaming account, which may be used - by way of example - for the completion of gaming operations, for verifying the summary of transactions or the remaining balance, in order to make deposits or withdrawals.

These are the primary purposes of the processing of the data of users holding a gaming account – they are not only contractual, but also technical, as they fulfil the purpose of allowing the user to be recognised when they wish to access their reserved area and its features – these also allow the user to use the services offered on the Website and the contractual and post-contractual assistance (by telephone, SMS, e-mail, web chat or contact form etc.) for the management of any administrative, legal or technical profile with the gaming account. With reference to the latter type of processing, the purpose is also to manage any type of request for assistance - technical, commercial and/or contractual - received from the Licensee and to provide the corresponding answers to users.

Finally, some of the technical processing carried out by means of the so-called "technical cookies" falls within the scope of the main purposes. In these specific cases, the technical processing is aimed solely at sending notices over an electronic communications network to the extent strictly necessary for the Licensee to provide the services explicitly requested by the user.

A.4 Communication and dissemination of the personal data in pursuing the main purposes of the processing

In all the cases detailed above, and in accordance with current regulations, SKS365 may communicate personal data to all the parties whose intervention in the processing is necessary for the services requested by the user and/or by legal provisions.

Furthermore, in pursuing the main purposes the data may be disclosed to any other external entity when such disclosure is made necessary by the legal provisions or in order to allow the Licensee to meet their contractual obligations (i.e. to banks and financial institutions for profiles to carry out collections and payments, to consultancy service providers, to customer service providers, to contact centres and/or chats in order to guarantee support and service levels), both pre-contractual and post-contractual (i.e. technical assistance and request for support or sending complaints submitted by users).

In accordance with the current legislation, below are indicated the categories of entities that may come in contact with the personal data of users as data controllers or processors:

– staff members of SKS365;

– staff employed by other companies in the SKS365 Group (namely the corporate group which comprises all the companies directly or indirectly owned by SKS365 Malta Holding Limited) that provide services to the Data Controller, including IT technicians that manage the websites and the corresponding electronic communication infrastructures, appointed as data processors;

– third parties that perform support services to SKS365, appointed as data controllers or data processors;

– experts and consultants (i.e. with legal or business studies, audit companies etc.), appointed as data controllers.

The personal data shall not make the subject of dissemination, except for cases where contractually and/or by law such data should to be published on the Website.

A.5 The compulsory or optional character of consent in pursuing the main purposes of the processing

When the user does not intend to give their consent to the processing of personal data needed to carry out the activities mentioned above, this has as consequence the inability to proceed to the conclusion of the gaming account agreement and, subsequently, to the activation of the gaming account, at the same time making it impossible to register on the Website and benefit from the gaming services for which registration and/or the provision of personal data is technically and/or contractually necessary. In this case, however, it is still possible to navigate the Website as an unregistered and anonymous user and to view only the contents available to users who are not under contract/are not registered.

A.6 Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the gaming account agreement in effect with the user and the compliance with lawful obligations, as well as, the protection of the vital interests of the user.

B. Secondary Purposes for the Processing of Personal Data and Respective Methods

B.1 Secondary purposes for the processing of personal data, generally with a scope of promotion, advertising, and marketing

The personal data collected may be processed, on paper or with automated/computerised means, in connection with the services/products offered by SKS365, and for the following purposes: commercial promotion, advertising communication, requests of purchase behaviour, market research, surveys, suggestions and remarks to these suggestions (including by telephone, on-line or through forms), statistical reports (in an identifiable format), and generally for marketing activities, including prize events, games and competitions or other reward initiatives (hereinafter "the Processing for Marketing Purposes").

By giving consent to the Processing for Marketing Purposes, the interested party specifically acknowledges that their data will be processed for such purposes, thus expressly authorising this processing:

– where the means used for the Processing for Marketing Purposes are the telephone with an operator or other non-electronic or non-telematic means or supported by automatic means and/or electronic or telematic procedures;

– or where the means used for the Processing for Marketing Purposes are e-mail, web chat, fax, SMS or MMS, or any other means allowed by the latest technology.

In accordance with the current provisions, we would like to draw the attention of users to the following circumstances:

– the consent given for receiving commercial and promotional communications by electronic mail, web chat, fax, SMS, MMS, automatic systems, including electronic platforms and other electronic means, will entail the receipt of such communications not just through such contact methods, but also through traditional methods, such as paper mail or telephone calls made by an operator;

– the user's right to object to the processing of their personal data for the purposes of "direct marketing" through the automatic contact methods described above will in any case extend to the traditional contact methods, without prejudice to the possibility to exercise this right with reference only to certain means of communication or to certain types of processing;

– the user that does not intend to give consent under the terms indicated above still has the possibility to express their willingness to receive communications for the marketing purposes described above exclusively through traditional contact methods, where available. This right may be exercised by sending a communication to this effect to the following e-mail address: privacy@planetwin365.com.

In order to comply with the current regulatory provisions on this matter, SKS365 informs that the consent for the said processing will be granted in a unitary and comprehensive form and will make reference to all the possible means of Processing for Marketing Purposes, without prejudice to the possibility the user has to notify the Licensee (at the e-mail address privacy@planetwin365.com) of a different intention in terms of the use of certain means and the prohibition to use others for the receipt, with the prior consent, of marketing communications.

The Processing for Marketing Purposes will be made exclusively with respect to users that have specifically and expressly given their consent on this matter, at their absolute discretion.

Consequently, in giving their consent the interested party acknowledges that they have been informed and are aware that the purposes of the processing pursued are generally specifically related to, advertising, promotions and marketing.

The processing connected to secondary purposes can be carried out by:

– staff members of SKS365;

– staff employed by other companies in the SKS365 Group (namely the corporate group which comprises all the companies directly or indirectly owned by SKS365 Malta Holding Limited) that provide services to the Data Controller, including IT technicians that manage the websites and the corresponding electronic communication infrastructures, appointed as data processors;

– third-party service providers for SKS365, appointed as data controllers.

B.2 Secondary purposes for the processing of personal data necessary for statistical and customer satisfaction inquiries

In the context of secondary purposes, the Data Controller may use the data collected in order to carry out surveys (also in the form of questionnaires or in-person interviews, by telephone or by other computerised and/or telematic means) in order to verify the degree of user satisfaction and to collect other information useful for adapting their processes to developments noted from the same survey. Prior to conducting any survey, the user shall be asked for their consent.

In turn, the data collected in this manner will be used exclusively for the purpose of improving the services offered and for developing statistical and/or technical analyses.

B.3 Processing data after the conclusion of the gaming account agreement

To the extent necessary, it is specified that the data provided will be used for the purposes indicated in the previous paragraphs not only during the time when the gaming account agreement is in force, but also for a period of 30 (thirty) days  following the termination of this agreement, irrespective of the reason for termination.

B.4 Scope of consent in pursuing the secondary purposes for the processing of personal data, generally with a scope of promotion, advertising, and marketing

The consent given for the Processing for Marketing Purposes is completely discretionary and optional, and may be revoked without any formalities even after the performance of the service; the lack of consent for such purposes will have no other consequences than the inability of the Licensee and of any third party to carry out the aforementioned Marketing activities, excluding any interference and/or consequence to the execution of the gaming account agreement concluded with SKS365.

B.5 Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

C. Processing of the Personal Data of Interested Parties for the Purpose of Commercial Profiling

C.1 Processing of the Personal Data of Interested Parties for the Purpose of Commercial Profiling

For the purposes of marketing and/or improving the services and features of the Website, the Licensee, by means of its employees or by other employees in companies within the SKS365 Group (namely the corporate group which comprises all the companies directly or indirectly owned by SKS365 Malta Holding Limited) that provide services to the Data Controller, may conduct processing of the so-called "profiling" data. In such cases and in accordance with current legislation, the profiling activity may include both "individual" personal data and "aggregate" personal data which derives from individual personal data.

In order to clarify the content of the "profiling" activity, we shall refer to the following circumstances:

– for the purpose of profiling, the data is structured and coordinated on predefined parameters, as identified from time to time, and depending on the company needs (irrespective of whether they are marketing, contractual, administrative etc.);

– in the framework of profiling activities, the starting data that is considered individually, may include personal information that is different in its content, including contractual data and consumption data, but only after profiling (namely its structuring in accordance with pre-established parameters) it is possible to derive further indications in connection with each interested party (namely the "profile", for example, the consumption range, the level of sustained expenditure, the active services, the commercial behaviour etc.), which could not be derived solely from the informative nature of the data considered individually or separately. In other words, profiling can realise the creation of an information data base that goes beyond the information on each interested party individually;

– profiling provides added value to the multiple correlations that can be obtained from the individual data collected in order to obtain additional useful information.

The processing described above will be referred hereinafter as "Processing for the Purpose of Profiling".

In order to carry out the Processing for the Purpose of Profiling, SKS365 will acquire in advance from each specific user their express consent, which is however completely optional.

Among the activities of Processing for the Purpose of Profiling that the Licensee could carry out, we note – by way of example – those connected to:

– the number and type of purchases of gaming titles made over a predetermined time frame;

– the number and type of gaming results over a predetermined time frame;

– the number and type of deposits and/or withdrawals from the gaming account carried out over a predetermined time frame;

– the number and type of payment instruments used over a predetermined time frame;

– the number and type of access to services over a predetermined time frame;

– the number and type of access to the gaming account over a predetermined time frame.

Consequently, when the interested party decides to give their consent, they must have been informed in advance and be aware that the purposes of the processing carried out are generally of a specific commercial, advertising, promotional and marketing nature.

The data collected after consent was specifically granted, may be subjected to Processing for the Purpose of Profiling for the same marketing purposes and dissemination provided for in paragraph B under this section of this Privacy Policy.

Finally, it should be noted that the provision of personal data to SKS365 for purposes secondary to the Processing for Profiling Purposes and the provision of consent to the processing for the same purposes are absolutely discretionary and optional (and in any case it may be revoked without any formalities, even after the provision of the service); the lack of consent for such purposes will have no other consequences than the inability of SKS365 and of any third party to carry out the aforementioned Processing for Profiling Purposes. Therefore, if consent to the Processing for Profiling Purposes is not granted, there will be no interference with and/or consequence on the gaming account (agreement) concluded with the user, as this will continue to be executed on a regular basis.

C.2 Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

 

D. Types of Personal Data Subject to Treatment

SKS365 hereby informs on the fact that no sensitive data will be processed through the Website.

E. Potential Provision of Personal Data Belonging to Third Parties by the Interested Party

Without prejudice to the uniqueness and exclusivity of the gaming account and to the absolute prohibition of its transfer or assignment to third parties, the user that provides data belonging to third parties while observing the provisions of the current legislation in this process, guarantees to SKS365 that any data belonging to third parties that has been provided was obtained by the said user in full compliance with the current provisions, relieving the Data Controller from any claim or request for compensation for damage derived from the processing, which may be raised against SKS365 by any third party as a result of the provision of data indicated by the user in violation of the applicable regulations on the protection of personal data.

To the extent necessary, it should be noted that the data belonging to third parties provided by the user will be processed as if the third party had provided the informed consent to the processing.

F. Retention of Personal Data

The personal data collected in accordance with this section:

- paragraph A of this section will be retained for the periods defined by the relevant legislation (with particular reference to the regulation on the prevention of money laundering and terrorist financing, and the regulation on public gaming) or, if longer, until the lapse of the rights arising from the contractual relationship;

- paragraph B of this section will be retained for 30 days after the termination, for any reason, of the gaming account agreement;

- paragraph C of this section will be retained for a period of maximum 12 months.

G. Transfer of Data to Third Parties

G.1 Transfer of Data to Third Parties

When the necessary consent is granted, the personal data may be communicated, even with the help of electronic and automated tools of any kind, to third parties established in EU countries or in non-EU countries (offering a level of protection deemed adequate or inadequate, by the European Commission). Third parties may operate in sectors such as finance, banking, insurance, administrative, telecommunication, personal care, and gaming services, as well as in entertainment The user must give their consent for all third parties to send marketing communications. When the third party is located in a third state which offers a inadequate level of data protection as determined by the European Commission, it must adhere to the standard contractual clauses approved by the European Commission, in order to allow them to provide information for the same purposes as described in paragraph B about promotions and offers, to send out communication materials for marketing purposes, and to send advertising and commercial materials by telephone, SMS, MMS, video, electronic mail, regular mail, fax or any other means of communication means possible with the latest technology on the products and services supplied by the third parties.

The third parties receiving personal data in accordance with this privacy policy statement and in the cases in which the specific and explicit consent is granted, they may otherwise use it for profiling purposes, with the help of methods compliant with those provided for in paragraph C above on the profiling activities carried out by the Licensee.

The third parties to which such data will be transferred and that guarantee the quality of the Data Controllers to You and to the other interested parties, as well as for the compliance with any related obligations and responsibilities stipulated by the law in an autonomous and exclusive way regarding the processing of the data detailed above, operate on their behalf and in their own interest.

Furthermore, said third parties may conduct profiling activities in connection to the data transferred in compliance with the provisions of this policy statement.

G.2 Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

H. Deferment

The provisions in this section are supplemented by the additional information contained in Section 5 below.

- SECTION 4 -

PRIVACY POLICY ON THE PROCESSING OF DATA FOR THE PURPOSE OF CONTACT BY TELEPHONE, SUBJECT TO RECORDING, BETWEEN THE USERS AND THE COMMERCIAL AND TECHNICAL SUPPORT TEAMS AVAILABLE TO SKS365 MALTA LIMITED

In accordance with the current legislation, SKS365 Malta Limited (hereinafter "the Licensee " or "the Data Controller"), in their capacity as data controller hereby informs that the data on users that qualifies as "personal data" obtained during telephone contacts which are subject to audio recording between the users (irrespective of whether they hold a gaming account with the Licensee or not) and the commercial and technical support teams available to the Data Controller will be handled manually and/or with the support of electronic and/or telematics means, for the purposes of and with the methods indicated below.

A. Purpose of the Processing

The personal data obtained from the user as a result of the recording of telephone calls with the commercial and technical support teams available to the Data Controller will be processed for purposes related to (i) managing the existing contractual relationship or its creation (where the telephone call has the purpose of informing on the procedure for the conclusion of the gaming account agreement), (ii) solving technical or contractual requests made by the user, (iii) staff training, (iv) monitoring and improvement of the services provided.

Any processing secondary to the purpose mentioned above may be conducted manually and/or with the help of electronic and/or telematic means, by:

– staff members of SKS365;

– staff employed by other companies in the SKS365 Group (namely the corporate group which comprises all the companies directly or indirectly owned by SKS365 Malta Holding Limited) that provide services to the Data Controller, including IT technicians that manage the websites and the corresponding electronic communication infrastructures, appointed as data processors;

– third-party service providers for SKS365, appointed as data controllers.

The provision of data is necessary for carrying out the activity described above; if such data is not provided, this will lead to the inability to develop such activities.

B. Provision of Data Belonging to Third Parties

The user that during telephone calls with the commercial and technical support teams available to the Data Controller provides personal data belonging to third parties for the setting up and/or use of the gaming account declares and expressly guarantees that they have previously obtained from said third parties the consent for the processing of their personal data under the terms provided in this section.

The user further declares they have informed the third parties on the current legislation, especially with reference to the possibility that the data may be communicated to SKS365 for the purposes indicated above.

C. Retention of Personal Data

The data obtained in accordance with this section is retained for the duration necessary to pursue the purpose for which they are processed, however for a period no longer than 24 months.

In case of legitimate reasons and within the limits provided for by the law, the user has the right to request the removal of their own data before the term indicated above. Such a request must be submitted as described in paragraph A of Section 5 below.

D. Legal Basis for the processing of personal data

The personal data collected in accordance to this section is being processed on the basis of the consent given by the user.

E. Deferment

The provisions in this section are supplemented by the additional information contained in Section 5 below.

- SECTION 5 -

SUPPLEMENT TO THE PRIVACY POLICY PROVIDED IN THE PRECEDING SECTIONS 1, 2, 3, and 4

In accordance with the current legislative provisions, we make available below some information necessary to supplement the Privacy Policy provided in the preceding sections 1, 2, 3, and 4.

A. Exercise of rights by interested parties (in accordance with the list of rights granted to such parties by the current legislation, please also see Appendix 1 below) The individuals to whom the personal data refers have the right to obtain at any time a confirmation of the existence or absence of the said data and to know its content and origin, to verify its accuracy or request its integration, updating or correction in accordance with the current legislation.

Furthermore, the individuals to whom the personal data refers have the right to request its portability, cancellation, its anonymisation or blocking if it was processed in breach of the law, and in any case to object to its processing for legitimate reasons.

The interested party also has the right to withdraw the consent given by accessing the secure area of the website and deselecting the option related to the specific process the interested party wishes to terminate.

Requests to this effect should be submitted to the Data Protection Officer, Dr Kira Borg at the email address privacy@planetwin365.com or at the following address: SKS365 Malta Limited, Business Centre, St. Augustine Road, Swieqi SWQ 3312, Malta.

The user may also exercise the rights granted by the current legislation by using the appropriate form for such request, which is made available by the Maltese Lead Supervisory Authority for the protection of personal data (the Information and Data Commissioner (“IDPC”) on the website www.idpc.org.mt.

Further details on the rights of the interested party are found in Appendix 1 below.

B. Contact Details of the Data Protection Officer

The contact details of the Data Protection Officer appointed by the Data Controller are: telephone no. +356 20958000, e-mail dpo.mt@sks365.com.

C. Data Controller and Data Processors

The contact details of the Data Controller of the user data are: SKS365 Malta Limited with their registered office in Malta, Business Centre, St. Augustine Road, Swieqi SWQ 3312, VAT number MT20991236.

The updated list of data processors can be consulted at the offices of the Licensee.

D. Transfer of Data to Countries Outside the EU

The data provided may be transferred to the headquarters of the same Data Controller located in non-EU countries offering a level of data protection which has not been deemed adequate by the European Commission, or, based on the adequate documents for mandating (external) data processors, to third parties - irrespective of whether they are part of the SKS365 Group or not - established in non-EU countries that have adhered to the standard terms approved by the Authority for the protection of personal data.

E. Complaints

The interested party has the right to submit a complaint to the IDPC at any time, , using the described method and in accordance with the instructions provided on their website (http:// www.idpc.org.mt).

F. Changes to the Policy Statement

In case new regulations enter into force on this matter, as well as in light of the continuous analysis and updating of the services provided to users, there could be a need to change the methods and/or purposes of the processing of data provided by users.

It is therefore possible that this policy statement be subject to changes over time. As a consequence, the user is invited to periodically consult this web page, where the date of the last update is always mentioned.

Any substantial changes to this policy statement shall be communicated by e-mail to the users that have set up a gaming account and by publishing a notice on the Website for the users that do not hold such accounts.

APPENDIX 1 – RIGHTS OF THE INTERESTED PARTY

In accordance with the current legislation, the interested party has the right to obtain:

a) a confirmation of the existence or lack thereof of personal data concerning them, even if they are not registered yet, and its communication in an intelligible form;

b) an indication of:

1) the source of the personal data;
2) the purposes of and methods for the processing;
3) the rationale behind the processing with the electronic instruments;
4) the identification details of the data controller and the data processors;
5) the individuals or categories of individuals to whom the personal data may be communicated or which may learn about it in their capacity as national representative, processors or agents;

c) information about the use of the data for decisions based solely on automated processing, including profiling;

d) the updating, correction or, as necessary, integration of the data;

e) the cancellation, anonymisation or blocking of any data processed in breach of the law, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed;

f) the confirmation that the operations referred to in items c) and d) have been brought to the attention, also in terms of their content, of those to whom the data has been communicated or disseminated, except for the case where such confirmation is impossible or involves the use of disproportionate means in relation to the protected right.

The interested party also has the right to object, in whole or in part:

a) for legitimate reasons, to the processing of their personal data, even though this is relevant to the purpose of the collection;

b) to the processing of their personal data for the purpose of sending direct advertising or sales materials or for carrying out a market research or any commercial communication.

Therefore, to summarise the interested party has the following fundamental rights:

a) Right to be informed – the right to clear, concise, intelligible and easily accessible information notices;

b) Right of access – the right to be aware of the personal data being processed and to be able to verify the lawfulness of that processing;

c) Right to rectification – the right to have inaccurate data be corrected or deleted;

d) Right to data portability – the right to request and be furnished with personal data already provided to the data controller in a structured, commonly used and machine-readable format, as well as, to request the transmission of that data to another data controller, where it is technically feasible to do so;

e) Right to object – the right to refuse (i) processing based on legitimate interests or the performance of a task in the public interest or in the exercise of official authority, (ii) using personal data for direct marketing, including profiling to the extent that it is related to such marketing activities, and (iii) processing for scientific or historical research purposes or for the purpose of statistics.

APPENDIX 2 - REFERENCES TO LEGISLATION

Below are summarised the references to the main regulations on the protection of personal data:

- European Regulation 2016/679

- Data Protection Act, Chapter 440 of the Laws of Malta