This Privacy Notice describes how OTCPLAY collects and processes your personal information through the OTCPLAY websites and applications that reference this Privacy Notice. By using the services provided by OTCPLAY (“OTCPLAY Services”), you are consenting to the collection, storage, processing and transfer of your personal information as described in this Privacy Notice.

OTCPLAY, is the Data Controller for personal information collected and processed in connection with the provision of OTCPLAY Services.

OTCPLAY collects your personal information in order to provide and continually improve our products and services, and to comply with legal and regulatory obligations as more fully explained in sections 3 and 5.

• email address
• name
• gender
• date of birth
• home address
• phone number
• nationality
• device ID
• credit card number

Additionally, we collect and process Sensitive Personal Data to comply with our Know Your Client (“KYC”) obligations under applicable laws and regulations. The sensitive personal data includes:

• Identification documents
• Facial image for processing using facial recognition software
• Video recording of you

Automatically Collected information: we automatically collect and store certain types of information about your use of OTCPLAY Services including your interaction with content and services available through OTCPLAY. Like many websites, we use cookies and other unique identifiers and we obtain certain types of information when your web browser or device accesses OTCPLAY Services. Examples of the information we collect and analyse include:

• the Internet protocol (IP) address used to connect your computer to the Internet,
• login, e-mail address, password and location of your device or computer;
• OTCPLAY Services metrics (e.g., the occurrences of technical errors, your interactions with service features and content, and your settings preferences);
• version and time zone settings;
• transaction history.

Information from other sources: we may receive information about you from other sources such as credit history information from credit bureaus, which we use to help prevent and detect fraud.

OTCPLAY does not allow anyone under the age of 18 to use OTCPLAY Services.

We process your personal information to operate, provide, and improve the OTCPLAY Services that we offer our users. These purposes include:

• Transaction services. We use your personal information to process fiat payments, and to communicate with you about orders and services.
• Provide, troubleshoot, and improve OTCPLAY Services. We use your personal information to provide functionality, analyse performance, fix errors, and improve the usability and effectiveness of OTCPLAY Services.
• Recommendations and personalisation. We use your personal information to recommend features and services that might be of interest to you, identify your preferences, and personalise your experience with OTCPLAY Services.
• Comply with legal obligations. In certain cases, we collect and use your personal information to comply with laws and regulations. For instance, we collect and process identity information and Sensitive Personal Data (as detailed in section 1) to comply with KYC and Anti-Money Laundering laws and regulations.
• Communicate with you. We use your personal information to communicate with you in relation to OTCPLAY Services.
• Fraud prevention and credit risks. We process personal information to prevent and detect fraud and abuse in order to protect the security of our users, OTCPLAY Services and others. We may also use scoring methods to assess and manage credit risks.
• Purposes for which we seek your consent. We may also ask for your consent to process your personal information for a specific purpose that we communicate to you. When you consent to our processing your personal information for a specified purpose, you may withdraw your consent at any time and we will stop processing your data for that purpose.

We use cookies and similar tools to enhance your user experience, provide our services, and understand how customers use our services so we can make improvements. To enable our systems to recognise your browser or device and to provide OTCPLAY Services to you, we use cookies

We use operational cookies and similar tools (collectively, "cookies") to provide our services, for example:

• Recognising you when you sign-in to use our services.
• Providing customised features and services.
• Displaying features and services which might be of interest to you, including ads on our services.
• Preventing fraudulent activity.
• Improving security.
• Keeping track of your preferences such as currency and language.
• We also use cookies to understand how users use our services so we can make improvements.

The settings on your browser will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, how to disable and remove cookies, and when cookies will expire.

Operational cookies allow you to take advantage of some of OTCPLAY's essential features. If you block or otherwise reject operational cookies through your browser settings some features and services may not work.

Information about our users is an important part of our business and we are not in the business of selling our users' personal information to others. OTCPLAY shares users' personal information and Sensitive Personal Data only as described below and with the subsidiaries or affiliates of OTCPLAY that are either subject to this Privacy Notice or follow practices at least as protective as those described in this Privacy Notice.

Third party service providers: We employ other companies and individuals to perform functions on our behalf. Examples include analysing data, providing marketing assistance, processing payments, transmitting content, assessing and managing credit risk, and performing identity recognition and other KYC functions. These third-party service providers have access to personal information and Sensitive Personal Data needed to perform their functions, but may not use it for other purposes. Further, they must process the personal information in accordance with this Privacy Notice and as only permitted by applicable data protection laws.

Business transfers: As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, user information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice. Also, in the unlikely event that OTCPLAY or substantially all of its assets are acquired, user information will be one of the transferred assets.

Protection of OTCPLAY and others: We release accounts and other personal information when we believe releasing is appropriate to comply with the law or with our regulatory obligations; enforce or apply our Terms of Use and other agreements; or protect the rights, property or safety of OTCPLAY, our users or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction, and with regulatory agencies and law enforcement to comply with lawful requests.

OTCPLAY may transfer your data outside of the European Economic Area (“EEA”). OTCPLAY puts in place suitable safeguards to ensure that such transfers are carried out in compliance with applicable data protection rules, except where the country to which the data is transferred has already been determined by the European Commission to provide an adequate level of protection.

Where OTCPLAY transfers personal data to affiliates or service providers, OTCPLAY relies on the standard contractual clauses approved by the European Commission.

We design our systems with your security and privacy in mind. We work to protect the security of your personal information during transmission by using encryption protocols and software.

We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of your personal information. Our security procedures mean that we may ask you to verify your identity before we disclose personal information to you.

It is important for you to protect against unauthorised access to your account password. We recommend using a unique password for your OTCPLAY account that is not utilized for other online accounts. Be sure to sign off when you finish using a shared computer.

We may share your personal information with our marketing partners for the purposes of targeting, modeling, and/or analytics as well as marketing and advertising. You may opt out of receiving such marketing by contacting infoservice@otc-play.com.

You can access your information, including your name, address, payment options, profile information, and transaction history in the "Your Account" section of the website.

If you have any questions or objections as to how we collect and process your personal information, please contact infoservice@otc-play.com.

When you consent to our processing your personal information for a specified purpose, you may withdraw your consent at any time and we will stop any further processing of your data for that purpose.

When you consent to our processing your personal information for a specified purpose, you may withdraw your consent at any time and we will stop any further processing of your data for that purpose.

We keep your personal information to enable your continued use of OTCPLAY Services, for as long as it is required in order to fulfil the relevant purposes described in this Privacy Notice, as may be required by law such as for tax and accounting purposes, or as otherwise communicated to you. Additionally, identity information and Sensitive Personal Data may be retained for eight years to comply with Anti-Money Laundering laws.

The EU GDPR and UK data protection laws require a legal basis for our use of personal information. Our basis varies depending on the specific purpose for which we use personal information. We rely on:

• Performance of a contract when we provide you with products or services, or communicate with you about them. This includes when we use your personal information to take and handle orders, and process payments.
• Our legitimate interests and the interests of our users when, for example, we detect and prevent fraud and abuse in order to protect the security of our users, ourselves, or others.
• Your consent when we ask for your consent to process your personal information for a specific purpose that we communicate to you. When you consent to our processing your personal information for a specified purpose, you may withdraw your consent at any time and we will stop the processing of your data for that purpose.
• Compliance with a legal obligation when we use your personal information to comply with laws. For instance, we collect bank account information for identity verification purposes, and identity information and Sensitive Personal Data to comply with Anti-Money Laundering laws.

Our data protection officer can be contacted at infoservice@otc-play.com, and will work to address any questions or issues that you have with respect to the collection and processing of your personal information.

If you choose to use OTCPLAY Services, your use and any dispute over privacy is subject to this Privacy Notice and our Terms of Use. If you have any concerns about privacy at OTCPLAY, please contact us with a thorough description, and we will try to resolve it. You also have the right to contact your local Data Protection Authority.

Our business changes constantly, and our Privacy Notice will change also. You should check our websites frequently to see recent changes. If you do not agree with the revised content, you shall stop accessing OTCPLAY Services immediately. When an updated version of the Privacy Notice is released, your continued access to OTCPLAY Services means that you agree to the updated content and agree to abide by the updated Privacy Notice. Unless stated otherwise, our current Privacy Notice applies to all information that we have about you and your account.