English

Privacy Policy

1. Executive Summary and Data Controller Information

1.1. NexaCore Entertainment N.V. (the “Company”) is committed to the professional stewardship of the personal data entrusted to us by our Users. This Privacy Policy outlines the institutional protocols for the collection, processing, storage, and protection of “Personally Identifiable Information” (PII). 1.2. Data Controller: NexaCore Entertainment N.V., Abraham de Veerstraat 9, Willemstad, Curaçao. 1.3. Data Processor (EU Representative): NexaCore Payments Ltd, Arch. Makariou III, 155, Proteas House, 5th Floor, 3026, Limassol, Cyprus. 1.4. Data Protection Officer (DPO): The Company has appointed a dedicated DPO to oversee compliance. Inquiries may be directed to [email protected].

2. Categories of Data Collected

To maintain regulatory compliance and operational excellence, the Company processes the following data categories:

2.1. Individual Identification Data:

Legal name, date of birth, gender, and residential address.
Government-issued identification numbers (Passport, National ID).

2.2. Digital Connectivity and Technical Data:

IP addresses, browser fingerprints, device specifications, and operating system data.
Geolocation data derived from GPS or IP triangulation (to ensure jurisdictional compliance).

2.3. Financial and Transactional Records:

Source of wealth declarations, payment method identifiers, and comprehensive transaction histories.
Creditworthiness data obtained through authorized third-party verification agencies.

2.4. Behavioral and Gaming Analytics:

Real-time betting patterns, session durations, and interaction logs with the Platform’s user interface.
Responsible Gaming indicators used for risk-profile modeling.

3. Legal Basis for Processing

The Company processes data under the following legal frameworks stipulated by Art. 6(1) of the GDPR:

Contractual Necessity (Art. 6(1)(b)): Processing is mandatory to fulfill the Agreement between the User and the Company.
Statutory Obligation (Art. 6(1)(c)): Processing is required to comply with Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) legislation.
Legitimate Interests (Art. 6(1)(f)): Processing is necessary for fraud prevention, network security, and internal service optimization.
Explicit Consent (Art. 6(1)(a)): Applicable specifically to direct marketing communications and advanced behavioral tracking.

4. Processing Objectives

Data is processed for the following institutional objectives: 4.1. Platform Integrity: Facilitating account registration, financial settlements, and game participation. 4.2. Regulatory Compliance: Executing mandatory “Know Your Customer” (KYC) protocols and AML screenings. 4.3. Security Architecture: Deploying intrusion detection systems and preventing “multi-accounting” or “bot” exploitation. 4.4. Social Responsibility: Monitoring for problem gambling indicators and enforcing self-exclusion directives. 4.5. Service Optimization: Using anonymized datasets to refine game mathematical models and UX/UI design.

5. Data Disclosure and Third-Party Interaction

The Company does not commoditize personal data. Disclosure is restricted to the following authorized entities: 5.1. Financial Institutions: Banks and payment gateways for the execution of fund transfers. 5.2. Content Providers: Licensed game developers for the technical rendering of gaming software. 5.3. Regulatory Bodies: The Curaçao Gaming Control Board and Financial Intelligence Units (FIU) upon statutory request. 5.4. External Auditors: Third-party firms responsible for verifying the Company’s fair-gaming and financial standards.

6. Transborder Data Transfers

6.1. The Company operates a global technical infrastructure. Data may be transferred to jurisdictions outside the European Economic Area (EEA). 6.2. In such instances, the Company ensures a “Standard of Adequacy” via Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring the User’s data rights remain uncompromised.

7. Cryptographic Security and Technical Safeguards

7.1. All data at rest and in transit is secured via AES-256 bit encryption and TLS 1.3 protocols. 7.2. The Company’s server environment is protected by hardware-based firewalls and multi-layered access control lists (ACLs). 7.3. Employees with access to PII are subject to strict non-disclosure agreements (NDAs) and undergo regular data-integrity training.

8. Data Retention and Erasure Protocols

8.1. Data is retained only for the duration necessary to satisfy the purposes outlined in Section 4. 8.2. Statutory Retention: Pursuant to AML/CTF regulations, the Company is legally mandated to archive identification data and financial records for five (5) years following the termination of the business relationship. 8.3. Anonymization: Data not subject to statutory retention will be permanently erased or cryptographically anonymized.

9. User Rights (GDPR Alignment)

The User possesses the following statutory rights regarding their data:

Right of Access: To request a comprehensive “Subject Access Request” (SAR) detailing all stored data.
Right of Rectification: To demand the correction of inaccurate or outdated information.
Right to Erasure: To request the deletion of data (subject to statutory retention exceptions).
Right to Restriction: To limit the processing of data during a pending dispute.
Right to Portability: To receive data in a machine-readable format for transfer to another controller.
Right to Object: To halt processing for the purposes of direct marketing or profiling.

10. Cookies and Telemetry

10.1. The Platform utilizes cookies to enhance functionality and analyze traffic. 10.2. Cookie Categories:

Mandatory: Essential for account persistence and security.
Performance: Used for load balancing and speed optimization.
Analytics: Used for understanding User behavior. 10.3. Users may manage cookie preferences through their browser settings, though this may impede Platform functionality.

11. Policy Modifications

The Company reserves the right to revise this Privacy Policy to reflect evolving regulatory standards. The current version will always be accessible on the Platform, and significant changes will be communicated via direct notification.