Data Processing Agreement

(DPA)

Last updated: 17 July 2026

This Data Processing Agreement (the “DPA”) forms an integral part of the Playerly Terms of Use (the “Terms”) and applies where Kupaline OÜ, a company registered in Estonia under registration number 14283378, with its registered address at Kivila tn 21-101, Tallinn, 13918, Estonia (the “Company” or the “Processor”), processes Personal Data on behalf of the Client (the “Controller”) in connection with the provision of the Playerly service (the “Service”).

By accepting the Terms, the Client also accepts this DPA. Capitalized terms not defined in this DPA have the meanings given to them in the Terms. The terms “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Personal Data Breach” have the meanings given to them in Regulation (EU) 2016/679 (the “GDPR”).

1. Subject Matter and Allocation of Roles

1.1. With respect to the data of the Client’s representatives and information about the Client’s organization, including registration and account data, data relating to the acceptance of legal documents, and technical access logs, the Company acts as an independent Controller and processes such data in accordance with the Playerly Data Privacy Policy.

1.2. With respect to Client Data transferred through an integration, including pseudonymized player identifiers, information about gaming sessions and events, betting amounts, winnings, gross gaming revenue, and technical information about devices and referrals, the Company acts as a Processor and processes such data solely on the documented instructions of the Client. This DPA applies to the Processing described in this Clause.

1.3. The Client acts as the Controller of Client Data and independently determines the purposes and means of its Processing. A detailed description of the subject matter, nature and purposes of the Processing, the categories of Data Subjects, and the categories of Personal Data is set out in Appendix 1.

2. Controller’s Instructions

2.1. The Company processes Client Data only on the Client’s documented instructions, including instructions set out in the Terms, this DPA, the Service settings, and the agreed technical requirements, unless Processing is required by European Union or Member State law applicable to the Company. In such a case, the Company shall inform the Client of the applicable legal requirement before the Processing begins, unless such notification is prohibited by law.

2.2. The Company shall immediately inform the Client if, in its opinion, an instruction infringes the GDPR or other applicable data protection laws.

3. Confidentiality

3.1. The Company shall ensure that persons authorized to process Client Data are subject to contractual confidentiality obligations or an appropriate statutory duty of confidentiality.

3.2. Access to Client Data shall be granted only to those employees, contractors, and Sub-processors of the Company who require such access to perform the Company’s obligations under the Terms and this DPA.

4. Security of Processing

4.1. The Company shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account Article 32 of the GDPR. The applicable measures are set out in Appendix 3.

4.2. The Company shall regularly review the applicable measures, taking into account the state of the art, the nature of the data processed, and the likely risks.

5. Engagement of Sub-processors

5.1. The Client grants the Company general written authorization to engage Sub-processors to process Client Data. The current list of Sub-processors is set out in Appendix 2.

5.2. The Company shall notify the Client of any intended engagement of a new Sub-processor or replacement of an existing Sub-processor at least 30 days before the relevant Processing begins. The Client may submit a reasonable objection to such change within that period. If the Parties are unable to reach a reasonable resolution, the Client may discontinue its use of the affected part of the Service.

5.3. The Company shall enter into a written agreement with each Sub-processor that imposes data protection obligations substantially no less protective than those set out in this DPA. The Company shall remain liable to the Client for the performance of the obligations of its Sub-processors.

6. Assistance to the Controller

6.1. Taking into account the nature of the Processing, the Company shall provide the Client with reasonable assistance through appropriate technical and organizational measures in fulfilling the Client’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR.

6.2. If the Company receives a request directly from a Data Subject relating to Client Data, the Company shall forward the request to the Client without undue delay and shall not respond to the substance of the request without the Client’s instructions, unless required to do so by law.

6.3. Taking into account the nature of the Processing and the information available to the Company, the Company shall provide the Client with reasonable assistance in ensuring compliance with the obligations under Articles 32–36 of the GDPR, including security of Processing, Personal Data Breach notifications, data protection impact assessments, and prior consultations.

7. Personal Data Breach Notification

7.1. The Company shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Data.

7.2. To the extent possible at the time of notification, the notification shall include:

• a description of the nature of the Personal Data Breach;
• the categories and approximate number of affected Data Subjects and Personal Data records;
• the likely consequences of the Personal Data Breach;
• the measures taken or proposed to address the Personal Data Breach and mitigate its possible adverse effects.

Information may be provided in phases as it becomes available.

7.3. The Company shall document Personal Data Breaches and the measures taken and shall provide the Client with reasonable assistance in fulfilling its obligations to notify the relevant supervisory authority and affected Data Subjects.

8. International Data Transfers

8.1. The Company and its Sub-processors may process Client Data outside the European Economic Area only where appropriate safeguards under Chapter V of the GDPR are in place, including an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission (the “SCCs”), or another lawful transfer mechanism.

8.2. Where the SCCs apply to a transfer, the relevant modules shall be deemed incorporated into this DPA by reference, with the Client acting as the data exporter and the Company or the relevant Sub-processor acting as the data importer.

9. Audits

9.1. The Company shall provide the Client with information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including any available independent audit reports and certifications.

9.2. Where the information provided is reasonably insufficient, the Client may conduct an audit no more than once in any twelve-month period, including through an independent auditor bound by confidentiality obligations, by providing at least 30 days’ prior written notice.

The audit shall:

• be conducted during normal business hours;
• not unreasonably interfere with the operation of the Service;
• not interfere with the Company’s obligations to other clients;
• be conducted at the Client’s expense unless the audit identifies a material breach by the Company.

10. Return and Deletion of Data

10.1. Upon termination of the Service, the Company shall, at the Client’s choice, delete or return Client Data to the Client and delete existing copies, unless the retention of such data is required by European Union or Member State law.

10.2. If the Client does not provide instructions within 30 days after termination of the Service, the Company shall delete or irreversibly anonymize Client Data in accordance with its data retention policy.

Deletion from backup copies shall take place in accordance with the applicable backup retention and replacement cycle. Until final deletion, such data shall remain protected in accordance with this DPA.

11. Liability

11.1. The liability of the Parties under this DPA shall be governed by the limitation of liability provisions set out in the Terms, unless otherwise required by mandatory provisions of applicable law, including Article 82 of the GDPR.

12. Term and Final Provisions

12.1. This DPA shall remain in effect for as long as the Company processes Client Data and shall terminate after the return or deletion of such data in accordance with Section 10.

12.2. In the event of a conflict between this DPA and the Terms regarding the Processing of Personal Data, this DPA shall prevail.

12.3. This DPA shall be governed by the laws of the Republic of Estonia. Any disputes shall be resolved in accordance with the procedure set out in the Terms.

Appendix 1. Description of Processing

Subject matter of the Processing: provision of the Playerly analytics service, including the collection, matching, and analysis of data relating to traffic sources, referrals, gaming events, and commercial performance.

Duration: the term during which the Service is provided to the Client and the applicable data deletion period under Section 10 of this DPA.

Nature and purposes of the Processing: collection, recording, storage, structuring, matching, analysis, report generation, provision of access to authorized recipients at the Client’s direction, and deletion.

Categories of Data Subjects: end users and players of the Client’s products and services, and users acquired by the Client’s partners.

Categories of Personal Data: pseudonymized and other identifiers; information about referrals and traffic sources; technical and gaming events; information about gaming sessions; betting amounts, winnings, and gross gaming revenue; country; IP address; device and browser information; and other technical and analytical information determined by the Client’s settings.

Special categories of Personal Data: such data is not processed and must not be provided by the Client.

Appendix 2. List of Sub-processors

Appendix 3. Technical and Organizational Measures

• encryption of data in transit using TLS and, where applicable, encryption of data at rest;
• access control based on the principle of least privilege, individual user accounts, and multi-factor authentication for administrative access;
• logging of access and activities within systems used to process Client Data;
• regular backups and recovery procedures;
• security incident response procedures;
• regular software updates and vulnerability remediation;
• confidentiality obligations applicable to employees and contractors;
• periodic review of security measures and risk assessments.