Privacy Policy

Introduction

Nolimit City Ltd (“NLC”), NLC’s direct subsidiaries, and Nolimit City Services Ltd (“NLCSL”) (hereinafter collectively referred to as “NLC Group” or “we”), form part of the wider Evolution Group.

This privacy policy (hereinafter “Policy”) applies to NLC Group and any NLC Group websites and applications.

This Policy explains how we collect, share, and use personal data, and how you can exercise your privacy rights. We recommend that you read this Policy in full to ensure you are fully informed.

Who is the Data Controller?

Nolimit City Limited
Level 6, Tower Sixty3, 63,
Tower Road,
Sliema, SLM1609,
Malta.

How do we collect your personal data?

When you are using NLC Group websites and social media accounts, NLC Group collects personal data from you either actively or passively.

Personal data is actively collected from you when you voluntarily provide us with your personal data. For example, when you are applying for an open job position, building business relationships with us, communicating with us, etc.

Depending on your preferences and/or choices we might collect data from cookies and similar technologies. Said data might contain certain information about you, for example, IP address or online activity, some of which will constitute your personal data. You can find more information about use how we use cookies in our Cookie Policy.

What personal data do we collect and for what purpose?

The personal data that we collect, and process might differ from the choices you make in the privacy settings while visiting our websites. It also depends upon what services, functionalities, or experiences you use, your location and applicable law.

We will only process your personal data when we have a lawful basis for doing so. The lawful basis might be;

a) you have agreed to data processing by giving your consent;

b) it is necessary to provide services to you under the performance of the contract we have with you;

c) we are required to do so in accordance with legal or regulatory obligations; or

d) it is in our legitimate interests to process your personal data, if none of these interests prejudice your own rights, freedoms, and interests.

In the table below we indicate the business purposes where we may use your personal data:

Purpose	Personal data	Legal basis
To communicate with you and handle your inquiries, requests, comments, and feedback etc.	First name, Last name, E-mail address, Feedback and comments made by you	Legitimate interests to handle, adequately and in a timely manner, your' inquiries, complaints, and suggestions regarding the services we provide in our sites.
To provide you with information such as Investor information, Newsletters, Press Releases etc.	First name, Email address, Phone number, Company name, Language settings	Your freely given consent.
To inform you about our newly released products, events, or other promotional purposes.	First name, Last name, Email address.	Your freely given consent.
To establish, exercise and defend legal claims.	First name, Last name, E-mail address, Telephone number, Other information as necessary for the purpose.	Legitimate interests to defend ourselves in legal claims.
To permit you to participate in social sharing, including live social media feeds	Social networks including your profile information, User ID associated with your social media account, and any other information you allow the social network to share with third parties	Legitimate interests to provide you better services and permit you to participate in social sharing.
To allow participate in polls, lotteries, promotions, contests and to administer these activities	First name, Last name, Email address, Telephone number, Other information as necessary for the purpose.	Your freely given consent.
To manage your work applications	First name, Last name, E-mail address, Telephone, Information in your CV and other information related, with purpose.	Your freely given consent and Legitimate interests depending on application case.
To organize brand promotional campaigns, including job fairs	First name, Last name, E-mail address, Telephone, Photography, and other information related with purpose	Legitimate interests to promote Nolimit City as a brand.
To detect, prevent, or investigate potential security incidents or fraud.	IP address, Log data, Other data that is necessary for the purpose	Legitimate interests to ensure security for our systems and services provided.
To perform analytics, quality control, market research, and determine the effectiveness of our websites, promotional campaigns, and develop new products and services	IP address, Location, Device information, User activity	Legitimate interests to perform marketing and research activities in order to develop our products and provide you better service
To perform due diligence checks to fulfil regulatory obligations	First name, Last name, Company name, Company registration number, Other information as necessary for the purpose.	Necessary to comply with a legal or regulatory obligations or, in the absence of a legal obligation, legitimate interests to protect our business, brands and their reputation and also having regard to the fact that the prevention of money laundering is in the public interest.
To comply with our obligations under applicable laws (including gambling legislation, and regulatory and licensing requirements related to our gambling licenses)	First name, Last name, Company name, Other information as necessary for the purpose.	Necessary to comply with a legal or regulatory obligations
To identify and disclose any suspected unlawful, fraudulent, or other improper activity connected with our websites, and services (including money laundering)	First name, Last name, Company name, Other information as necessary for the purpose.	Necessary to comply with a legal or regulatory obligations or, in the absence of a legal obligation, legitimate interests to protect our business, brands and their reputation
To share your personal data with other members of Evolution Group entities who assist in providing the services to customers	First name, Last name, E-mail address, Telephone number, Company name, Other information as necessary for the purpose.	Legitimate interests to allow us to provide services and perform our contractual obligations.
To share your personal data with gambling regulators or other legally required regulators in order to assist and comply with legal requirements and any investigation if applicable	First name, Last name, Address, Telephone number, Other information as necessary for the purpose.	Necessary for a legal or regulatory obligation

Please note that the processes and lawful basis set above are those that primarily apply and are not intended to be exhaustive. They may also change and/or be supplemented over time due to business needs, and in order to comply with current legal requirements.

Where may we disclose and/or transfer your personal data?

Since NLC Group operates worldwide your personal data might be shared within Evolution Group, and/or contracted third parties for various business purposes.

The personal data might be transferred based on legal grounds such as legitimate interests to fulfil the services agreed or based on mutually concluded contractual obligations.

Additionally, there might be situations where NLC Group might transfer personal data to Evolution Group entities or external parties located outside the EU/EEA. In such a case NLC Group will ensure that the Standard Contractual Clauses or other legally required documentation is concluded, to ensure an adequate level of protection before transferring personal data outside EU/EEA.

For all personal data transfers, an adequate security level is ensured, and all legal requirements are met.

Evolution Group Entities:
In order to fulfil data processing purposes NLC Group may disclose your personal data to other Evolution Group entities. The data transfers between group entities are governed by an Intra-Group data processing agreement which includes the Standard Contractual Clauses. Additional legal safeguards for data transfer may apply in certain cases. Data transfer purposes may be relevant in order to:

• provide accurate information regarding our provided services (based on necessary to comply with a legal/regulatory requirements);

• better understand our business practices, services, and products across the Evolution Group entities (based on legitimate interests);

• provide Evolution Group entities with marketing and promotional materials (based on your provided consent);

• identify fraud and other criminal activities including anti money-laundering (based on necessary to comply with a legal/regulatory requirement);

• provide you with the customer support including the obligation to ensure that information is up-to-date and accurate (based on necessary to comply with a legal/regulatory obligation);

• comply with legal requirements towards identification of responsible gaming measures across the Evolution Group entities (based on necessary to comply with a legal/regulatory requirement)and/or ;

• provide you services agreed, ensuring the implementation of security measures (based on necessary to comply with a legal/regulatory requirement).

Data Processors Acting on Behalf of NLC Group:
NLC Group may disclose personal data to external parties, such as vendors and service providers. Third parties might process personal data on behalf of and under the instructions of NLC Group. The personal data may be transferred only if an adequate security level is ensured, and all legal requirements are met.

NLC Group engages with data processors (incl. sub-processors) in order to deliver you the agreed services and to comply with legal and regulatory requirements. The data processors might vary from cloud services for data storage purposes, marketing companies in preparing and delivering marketing related materials, and external advisors and auditors. In the case of engagement of processors, we inform you as far as it is required by legal and regulatory requirements.

What security measures are implemented?

We ensure that all necessary appropriate security measures are in place to keep and process your personal data securely. In support of this commitment, we have implemented appropriate technical, physical, and organizational measures to protect your personal data against unauthorized or accidental destruction, alteration or disclosure, misuse, damage, theft or accidental loss, or unauthorized access.

What is the data retention period?

Personal data is kept for a period that is either required by law and regulatory requirements or for as long as necessary to fulfil the personal data collection purpose. The storage period might differ from the location and services that you are receiving.

What rights do you have?

You have several rights towards your personal data. You have the right to request access, rectify, erase, object, restrict personal data processing, withdraw consent if given and transfer your personal data. In addition, you have the right to contact the Data Protection Supervisory authority in the country where you are located.

We will respond to all individual requests wishing to exercise data protection rights. We may request to verify your identity and/or ask for additional information in order to help us respond efficiently to your request, and to protect personal data from unauthorized disclosure. If you wish to exercise your data protection rights, please contact our Data Protection Team at dataprivacy@evolution.com

In the case that you would like to exercise your rights related to our developed games, we kindly ask you to contact the Casino you played with, as we do not process information belonging to players by which the individual can be identified directly. This action is done by online casinos/operators as they are Data Controllers of player personal data..

Please be informed that certain rights might not be fulfilled entirely due to legal or regulatory reasons or requirements.

Right to access your personal data
You have the right to confirmation as to whether or not we process your Personal Data and, where we do, access to the Personal Data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of Personal Data concerned and the recipients of the Personal Data. Providing the rights and freedoms of others are not affected, we will supply you with a copy of your personal data.

Right to rectify your personal data
You have the right at any time request to correct your personal data that is inaccurate, as well as supplement your personal data that is incomplete. For example: if you are a NLC Group business partner and your contact information such as telephone number or email address have been changed, you can request to edit this data.

Right to erase your personal data
You may request to erase your personal data under certain circumstances such as when your personal data is no longer needed for the purposes for which it was collected. For example: if you were a NLC Group employee and you have provided your contact information for employment related communication purposes. When terminating employment relations, you can ask to delete your contact information unless it is requested to be stored otherwise by law.

It is important to note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. These may include instances where the retention of your personal data is necessary to;

• Comply with a legal or regulatory obligation to which we are subject; or
• stablish, exercise, or defend a legal claim.

Right to object to certain personal data processing
You may object to the processing of your personal data if you have a particular situation, your data are being used for direct marketing purposes and the legal grounds of data processing are legitimate interests. For example: If you receive any marketing-related materials that you have not agreed to, you can object and request to stop receiving them.

Right to restrict the processing of personal data
You may ask us to restrict the processing of your personal data under certain circumstances, such as when the processing is unlawful, but you do not wish your personal data erased. Additionally, in case if you have concerns about your data accuracy, you can ask us to restrict data usage until we verify the accuracy of your data. For example: In you are a NLC Group employee and you have concerns that your provided bank account data are not accurate, we will stop using this data until we will verify the accuracy of it.

Right to withdraw your consent
If you have agreed on data processing based on your consent, you have the right at any time withdraw your consent. The consent withdrawal will not affect the legality of the previous processing. For example: In case you have agreed to receive newsletters from NLC Group, and you would not like to receive them anymore. You can withdraw your consent at any time, and you won't receive newsletters in future.

Right to transfer your personal data
You may ask NLC Group to provide you with a copy of your personal data and if technically possible you can request to transfer this data to another Data Controller (Company or Institution, where possible). This is only applicable if personal data are processed on the legal basis of your consent or on necessity to comply with agreement concluded with you, and only for the data that is provided by you. For example: if you are a NLC Group employee you could ask to transfer your provided data to Public Revenue Service or any other Public Institution.

Right to complain to the data protection supervisory authority
You have the right to lodge complaints regarding your personal data processing to the relevant data protection supervisory authority. The list of national supervisory authorities can be found here: https://edpb.europa.eu/about-edpb/board/members_en

Need more information?

If you have any additional questions or concerns regarding the processing of your personal data regarding of websites or applications, please contact our Data Protection Team by emailing dataprivacy@evolution.com.

Policy Version 2.0 - published on 24/11/2023