Customer Data Retention Policy

Introduction

1. The Rootz Ltd. (hereinafter the ‘Company’) is committed to conducting its business in accordance with all applicable Data Protection laws, regulations and ethical conduct standards.
2. This Policy sets out the expected approach in relation to the retention and deletion of any Personal Data belonging to the Company’s customers (i.e. Data Subjects).
3. The Company, as a Data Controller, is responsible for ensuring compliance with the rules outlined in this Policy.

Scope

1. The purpose of this Policy is to specify the rules for the retention of Personal Data relating to the different types of Processing activities of the Company.
2. This Policy applies to all forms of Processing of Personal Data, whether in electronic form or in manual files that allow access to information about customers.
3. While the need to retain certain information can be mandated by law, such data retention shall nevertheless comply with the General Data Protection Regulation (GDPR).
4. The retention of Personal Data belonging to the Company’s employees is not within the scope of this Policy. It is covered in the Company’s ‘Employee Data Retention Policy’.
5. The as far as no special definitions are outlined in the below definition-section, the definitions stipulated in the Privacy Policy shall also apply to this Data Retention Policy.

Document version

Definitions

1. AML-Monitoring-Data is all data obtained during the AML- and fraud prevention monitoring undertaken according to the German AML-Act (Geldwäschegesetz – “GwG”), especially all early warnings generated by our automated fraud prevention monitoring system on suspicious transactions, internal AML- and fraud prevention investigations, internal Suspicious Activity Reports (“SARs”) or Suspicious Transaction Reports (“STRs”) as well as Suspicious Transaction Reports filed by our Money-Laundering-Reporting-Officer (“MLRO”) to the competent Financial Intelligence Unit (“FIU”) for certain transactions.
2. Anonymous Data - Data which does not relate to an identified or identifiable natural person.
3. Data Controller - A natural or legal person, Public Authority, Agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
4. Data Subject - Identified or identifiable Natural Person to which the data refers.
5. Data Processing on Commission is a data processing by a data processor Processing Personal Data on behalf of a Data Controller within the meaning of Art. 28 GDPR.
6. KYC-Data is all Personal Data obtained during the registration process, the identity-verification process and additional Know-Your-Customer-procedures, especially also enhanced customer due-diligence procedures, including source-of-funds-checks, credit-agencies and other credit-worthiness-checks, social and adverse media checks and documentation obtained thereby (e. g. copies of passports/ID-cards and SCHUFA-ratings and so on).
7. Game Participation Data is all data on your game participations, thus your User-ID, the date and time of your game participations, the name of the games you have participated in, the game-ID, the game provider, the stakes used, the balance before the game participation and the balance thereafter, winnings you have obtained and losses you have suffered.
8. Identifiable Natural Person - Anyone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
9. Personal Data - Any information which relates to an identified or Identifiable Natural Person.
10. Personal Master Data is all Personal Data obtained during the registration process: Full name, as the case may be the maiden name, the full postal address (street, house number, zip-code, city, federal state, country of residence), the email-address, the phone number, the date and place of birth, the nationality and the Gender, as the case may be the ID-card and/or passport-number and the issuing authority as well as the User-Name chosen by the player.
11. Player Exclusion Data is all data collected on player exclusion inserted into OASIS by the Company for a certain player – thus all required data on 24-hours-playing breaks after the use of the panic button and long-term-player-(self- or third party-) exclusions (family name, first name, maiden name, alias names, used fake names, data and place of birth, address, photos, reason of the player exclusion (e. g. use of the panic button, self-exclusion or gambling addiction), date and time of the use of the panic button, in case of a long-term exclusion the duration and the inserting company).
12. Process, Processed, Processing - Any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means. Operations performed may include collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
13. Social Responsibility Data is all data on limits, alterations of limits, attempted exceeding of limits, automated monitoring results, interactions with the social responsibility officer or social responsibility measures undertaken by the Company.
14. Transaction Data are all data on deposits and withdrawals (the user-ID, the dates and times of deposits and withdrawals, the amounts, the currency code, the transaction type (deposit or withdrawal), the status of the transaction (successful/rejected/failed/pending/revoked), the payment methods used, the PSP, the bank/payment-account details or respectively the payment-card-details used, the account/card-owner and the payment-ID).

1. Data Retention

1. The Company adopted this Policy to explain how it implements one of the main principles established under Article 5 of the GDPR, i.e. storage limitations.
2. Pursuant to the ‘storage limitation’ principle, the Company should retain Personal Data for no longer than is necessary to fulfil the purposes, for which the Personal Data is Processed.
3. Accordingly, upon the termination of the business relationship with the customer, the Company shall only retain customer Personal Data in accordance with the below set out rules which are based on applicable German legislation.

2. General Rules

2.1 Legal Obligations

(a) Sec. 6 g par. 1 ISTG 2021 Germany

• Sec. 6 g par. 1 ISTG 2021 demands online-gambling providers to retain all Personal Master Data, all Transaction Data, all Game Participation Data, all Social Responsibility Data and Player Exclusion Data as well as all communication with the players (minutes on phone calls, chats, emails and letters sent via regular post) for a period of five years beginning with the closure of the player account.

(b) Sec. 8 German AML-Act (“GwG”)

• Sec. 8 par. 4 German AML-Act stipulates a retention period of five years. For the KYC-Data, this five-year-period begins with the end of the year, in which the contractual relationship is terminated. For transaction and AML-Monitoring Data this five-year-period begins with the end of the year, in which the data was obtained. However, the records and other supporting documents shall be destroyed at the latest after a period of ten years.

(c) Sec. 257 German Commercial Code (“HGB”)

• Sec. 257of the German Commercial Code demands a retention of six or ten years, depending on the kind of data (relevant for the book keeping).

(d) Sec. 147 German Tax Procedure Code (“AO”)

• Sec. 147 German Tax Procedure Code foresees a retention of six or ten years, depending on the kind of data (relevant for taxes) as well.

2.2 Legitimate Interest

(a) Sec. 195 et seqq. of the German Civil Code (“BGB”)

• According to sec. 195 German Civil Code, the general statutory limitation period is three years. This three-years-limitation period begins to run with the end of the year, in which the claim has arisen and the claimant has obtained knowledge or would have had to gain knowledge without a gross negligence of the circumstances giving rise to the claim and of the person of the debtor.
• An exception applies to damage claims based on tort due to an intentional injury of life, body, health, liberty or sexual self-determination, which become time-barred at the latest after thirty years, commencing with the undertaking of the tort, thus the date, on which the intentional damaging act occurred, see sec. 197 and 199 BGB. Claims for damages due to a negligent injury of life, body, health, liberty or sexual self-determination become statute-barred according to § 199 sec. 3 BGB without consideration of the knowledge or gross negligent unawareness in ten years from the damage occurrence (No. 1) and without consideration of the damage occurrence and the knowledge or gross negligent unawareness in 30 years from the commission of the negligent act, the negligent breach of duty or the other event negligently causing the damage (No. 2). Thus, player claims requesting damages because they became gambling addicted due to the use of the gambling offers of Rootz become time-barred after thirty years at the very latest.
• However, in this case, the players bear the burden of proof that their gambling addiction has causally arisen due to the use of the gambling offers of Rootz and not due to the use of other gambling offers.
• It is possible that the expiry of the limitation period may be suspended or interrupted according to sec. 203 et seqq. BGB. E. g. claims pending at court hamper the expiry of the limitation period.
• The limitation period for the enforcement of claims, which have been decided upon finally and bindingly by a court, (thus for court judgements), expires in thirty years. After the expiry of this thirty-years-limitation period, which commences with the delivery of the decision to the parties, the enforcement of the claims determined in the court decision is time-barred.
• The legitimate interest of the Company covers a retention of all documents and data for the duration of the limitation period for the filing of claims against the Company or for the Company to file claims and/or for the enforcement of judgements against or in favour of the Company.

3. Exceptions to the General Rules

3.1 Extension necessary for the prevention, detection, analysis and investigation of money laundering or funding of terrorism activities

• Under Article 13(2)(d) of Subsidiary Legislation 373.01, the retention period may be further extended up to a maximum of ten (10) years from the date of customer account closure.
• Such extension shall be affected if it would be considered necessary by the Financial Intelligence Analysis Unit, relevant supervisory authorities or law enforcement agencies, for the purposes of the prevention, detection, analysis and investigation of money laundering or funding of terrorism activities.
• Therefore, this extension shall apply to all the Personal Data of any customer who is subject to any ongoing investigations in this respect.

3.2 Ongoing Legal Disputes with Customers

• In case of an ongoing legal dispute with a customer, the Company has a legitimate interest to retain the customer’s Personal Data in order to manage the dispute appropriately.
• Accordingly, the Company shall retain all customer Personal Data until the dispute with the customer has been settled – and, if a judgement is rendered in this case, the retention of all relevant documents and data for the duration of the limitation period for the enforcement of the judgement (see above).

4. Data Deletion

• Data deletion is a critical component of this Policy. Data deletion ensures that the Company shall use data efficiently, thereby making data management and retrieval more cost-effective, while ensuring GDPR compliance.
• Upon the expiry of the retention periods specified in this Policy, the Company shall delete the relevant Personal Data. In this respect, Anonymous Data shall be equivalent to deleted data.
• If a user feels that certain data should not be deleted/Anonymized, he/she should identify the relevant data to his/her supervisor, who should immediately consult the Data Protection Officer so that an exception to this Policy may be considered. Since such decisions have long-term legal implications, exceptions to this Policy shall be approved only by the Data Protection Officer.
• The Company specifically directs users not to delete any Personal Data in violation of this Policy.

Appendix