Privacy Notice – Players Play

Date: 17/12/2025

Introduction

Our Company, under the name “OPAP S.A.” and having its registered office at 112 Athinon Avenue, Athens (hereinafter referred to as “the Company”), is, under applicable law, the Data Controller for the processing of your personal data in the context of providing games of chance services conducted through Video Lottery Terminals (VLTs), as well as under the Accession Agreement you conclude with the Company.

The Company has implemented all appropriate technical and organizational security measures to protect your personal data against unauthorized access, misuse, loss, or destruction. We make every effort to keep your personal information secure at all times by applying the latest technologies and continuous controls.

This notice aims to inform you about the types of personal data collected, the manner and purposes for which they are processed, the third parties to whom such data may be disclosed, and the rights you have, in compliance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), Law 4624/2019, and the applicable data protection legislation.

If you also use the allwyn Play App, please refer to the specific terms and the privacy notice applicable to the app, as published in the relevant section of the application.

Categories of personal data that we process

Τhe collection and processing of your personal data is carried out by the responsible, authorized employees/associates of the Company and relates to the information you voluntarily disclose to us when submitting the application for issuing the Individual Player Card or subsequently, always in accordance with applicable laws and regulations. Specifically:

• Identification and demographic data, such as full name, father’s name, date and place of birth, ID/passport number, issuance and expiry date, issuing authority, personal citizen number (optional), gender, nationality, permanent address, city, postal code, and data derived from verification documents requested for proof of the above (e.g., ID/passport).


• Contact details and communication preferences, such as landline (optional) and mobile phone number, email address (optional), preferred communication channels (SMS, email, phone call), as well as records of consent/withdrawal for marketing communications


• Gaming activity and playing behavior data, such as the stores you visit, the VLT machines you choose, the games you participate in, the amounts you wager, the time and duration of your sessions, and significant changes in your gaming behavior (e.g., average daily loss, exceeding set limits), in accordance with the Regulation.


• Data from your optional participation in loyalty programs and other special activities, such as points collected, rewards, and data required for participation in activities subject to terms and conditions (e.g., draws, tournaments, missions, events etc), including third-party details you voluntarily provide, AMKA (e.g., for ticket issuance), delivery address for prizes, and audiovisual material from prize acceptance or participation in activities and related events.


• Data arising from service evaluations (e.g., participation in surveys) or data arising when you communicate directly with the Company (e.g., submitting complaints or comments regarding services or other requests), such as data from recorded calls with our call center and/or electronic written communication (email, chat sessions), as well as identity verification details (e.g., ID, mobile provider certificate, or other documents that may be requested when submitting requests to the Company and sent via mail or email). When you contact us by phone, the Company may, in accordance with Article 4(3) of Law 3471/2006, record and archive all telephone conversations and other electronic communications with the Customer Service Department, and you will be informed of such recording at the start of the call.


• Data related to Individual Player Card management requests, such as details required for card replacement (loss/damage), card linking, updating personal details, as well as IBAN and/or payment means identifiers where required for transaction processing.


• Compliance and audit data, such as tax details, electronic account identifiers, transaction details (e.g., timestamp, amount, store code), winnings certificates, and documents required for AML/fraud prevention.


• Responsible Gaming data, such as self-exclusion details (type/duration), account reactivation requests, and application of cooling-off mechanisms based on gaming activity parameters.


• CCTV image data, i.e., your image captured by closed-circuit television (CCTV) systems operating in PLAY stores for security purposes and compliance with regulatory requirements.

Why we collect personal data

The above information and the personal data collected by the Company will be stored in Company’s databases and servers, always in accordance with the provisions of the applicable legislation and in particular those provisions on the protection of the confidentiality of communications and the protection of the individual with regard to the processing of personal data. The legal basis, as well as the purposes of processing are the following:

1. Contract
   Processing necessary for the performance of the terms of our contractual relationship and for the provision of the Company’s games of chance services to you. Within this context, we process your data for the following purposes:
   
   
   1. To create, operate and manage each Player’s Account, in accordance with the terms of the Agreement of Accession.
   
   
   2. To process transactions, including payments.
   
   
   3. To manage all types of requests and/or requests related to the Individual Player Card, such as card replacement (loss/damage), card linking, and updating personal details.
   
   
   4. To enable participation in loyalty programs and activities associated with the Player Card, in accordance with the specific terms and conditions of the loyalty program (if you participate) and the specific terms of individual activities (e.g., draws, competitions, tournaments, prize acceptance), and to process data required for organizing and executing such activities
   
   
   5. To process transactions, including payments.
   
   
   
   
2. Legal Obligation
   Necessary processing for compliance with our legal obligations. Within this context, we process your data for the following purposes:


1. To comply with applicable legal and regulatory frameworks governing the VLT gaming market.


2. To conduct the necessary security controls, both by capturing images from the CCTV circuits installed in PLAY stores and by identity verification and age confirmation of the Customers, through the control of their identification documents and through the use of their contact details, so as to ascertain that they indeed belong to you. It is clarified that for the operation of CCTV circuits in allwyn stores other than PLAY stores, the data controller is exclusively the Agent, who determines the purpose and means of processing.
   To comply with anti-money laundering (AML) and fraud prevention obligations, including processing identification data, contact details, tax information, electronic account identifiers, payment instrument identifiers (e.g., IBAN), winnings certificates, and transaction details (e.g., timestamp, amount, store code), applying appropriate monitoring mechanisms to detect unusual or suspicious activities and take immediate action.


3. To ensure Responsible Gaming obligations, which have been established in the context of protecting society from addiction and of public interest, including, using all available evidence, preventing participation by minors and individuals under 21, and protecting against excessive gaming through analysis of gaming activity and player notifications.
   With regard to compliance with the obligation to protect players from excessive participation in the games, and in particular to timely intervene and inform them of the risks of participating in the games, we process your playing behavior and the information you provide when you communicate with us, using automated means and artificial intelligence applications, in order to create a player profile. Based on each player's profile, appropriate communication and measures (i.e. communication by telephone, automated notifications, other communications) to protect players from excessive participation in the games are determined. For the avoidance of doubt the abovementioned communications, for the above purpose of protecting players from excessive participation in games, do not fall into the category of commercial communications of par. D, which are carried out based on your consent.
   Furthermore, the Company has activated a cooling-off mechanism for the protection of the players, which is automatically triggered after considering parameters such as the uninterrupted participation time of the player, the total amount of participation in games over a period, and the pattern of gaming activity associated with increased risk of player participation in the game, contrary to Responsible Gaming rules and practices.


4. to manage self-exclusion requests (temporary/permanent) and account reactivation requests, in accordance with the regulatory framework.


3. Legitimate Interest:
   Necessary processing for the purposes of the legitimate interests pursued by the Company, in particular:
   
   
   1. To improve services, particularly by recognizing you when you call the customer service center, so you receive priority and the representative has immediate access to your account details.
   
   
   2. For the provision of evidence as to the transactions effected, by processing recorded oral or written (in soft or hard copy) communication. Specifically, the mobile telephone number provided by the Player will be also used for his/her immediate information in case of detection of transactions of his/her Individual Player Card that raise reasonable suspicions of non-authorized use or of fraud, without this meaning that the Company undertakes the obligation to detect any eventual non-authorized use or suspicious transaction.
   
   
   3. To conduct research with the aim of improving the range of products and services offered based on Players' preferences.
   
   
   4. For statistical analysis of data in order to identify player trends and preferences so that we can optimize the services, products, and experiences we offer to Players and develop our commercial strategy
   
   
   5. To manage incidents within stores/agencies for security and risk prevention purposes, in addition to legal compliance obligations.
   
   


4. Consent
   If you wish, by selecting the relevant fields at the end of the Declaration, you may give your consent to the Company to process your personal data for the following purposes:
   
   
   1. To implement loyalty programs in accordance with Ministerial Decision No. 79292 EX 2020/23.7.2020 on “Establishing the Gaming Regulation on Commercial Communication of Games of Chance” (Government Gazette B’ 3260/5.8.2020), as amended, allowing the Company to process your personal data recorded in the Central Information System, mainly data related to your gaming activity, to send you exclusive offers based on your gaming behavior within loyalty programs.
   
   
   2. To carry out marketing communications, the Company may process your personal data obtained outside the Central Information System, such as your contact details
   
   

You have the right to withdraw your consent for these purposes at any time. In such case, the Company will cease any processing based on your consent, without affecting the lawfulness of processing carried out before withdrawal or other processing described under sections A– C.

Recipients

The processing of your personal data within the context of providing games of chance services is carried out by the responsible, duly authorized employees of the Company. In addition, recipients of your data may include:

1. Partners acting on our behalf (Processors), to the extent necessary for better service and the provision of our services:
   1. IT and gaming system service providers as well as technology providers for security operations support and document verification,
   
   
   2. Customer service/call center providers,
   
   
   3. Advertising and communication delivery service providers, Partners for the implementation of reward programs and actions under terms and conditions (e.g., courier service providers for prize delivery, event organization, etc.), to the extent necessary for the provision of our services and fulfillment of related purposes,
   
   
   4. PLAY store agents, to the extent necessary for better service and the provision of our services (e.g., submission of requests for issuance of Individual Player Card, exclusion or reactivation requests, etc.).
   
   
2. Third-party providers acting as Independent Controllers
   1. Financial institutions or payment service providers for transaction completion or payment method identification,
   
   
   2. Partners for actions related to prizes (e.g., travel agencies, transportation companies, hotels, sponsors, event organizers),
   
   
   3. Other Group companies for fraud control or anti-money laundering purposes, in accordance with the applicable regulatory framework,
   
   
   4. Store agents when acting for their own purposes (e.g., reporting an incident for security or staff protection reasons).
   
   
3. Joint Controllers:
   1. The Company and PLAY store agents for the operation of CCTV systems, in accordance with the applicable regulatory framework and security obligations. It is clarified that for CCTV operation in allwyn agencies other than allwyn PLAY stores), the Controller is exclusively the Agent, who determines the purpose and means of processing.

The Company ensures that its partners acting as Processors are under its control and act only on its instructions and are bound by confidentiality obligations and compliance with applicable law. We may disclose your data to competent judicial, prosecutorial, or administrative authorities or to the Hellenic Gaming Commission (HGC) to the extent required by applicable legislative and regulatory framework, upon relevant request or when obliged to submit a report with such data without prior specific notice.

Where possible, we seek to ensure that the processing of personal data takes place within the European Economic Area (EEA). However, your data may be transferred outside the EEA by the above providers, particularly to the USA and the United Kingdom. In cases where data transfer outside the EEA is required, the Company or its processors acting on its behalf will ensure that such transfers are made either to countries for which there is an adequacy decision by the European Commission or by applying appropriate safeguards, in accordance with the applicable data protection legislation. It is noted that the USA and the United Kingdom are considered by the European Commission as adequately safe countries for the transfer of your data

Retention Period

Your personal data is retained only for as long as necessary to fulfill the purposes of processing and in accordance with applicable legal and regulatory obligations. Specifically, your personal data will be retained for ten (10) years from the time of collection and, in any case, for five (5) years from the termination of our customer relationship. Specific retention periods may be defined in notices accompanying particular actions (e.g., reward programs, draws, prize delivery), according to the applicable terms and conditions. After the above periods, your data will either be securely deleted or anonymized for statistical analysis purposes.

Your Rights

In accordance with applicable legislation, you have and you can exercise the following rights:

• right to access your personal data, as well as the information related to their processing;
• right to correct inaccurate or incomplete personal data of yours;
• right to erasure, subject to cases where data retention is necessary to comply with our legal obligations;
• right to restrict the processing of your personal data, when explicitly provisioned by the legislation;
• right to data portability in a structured, commonly used and machine-readable format (e.g. USB)
• right to have your data (directly) transmitted to a different controller;
• right to object to the processing of your personal data, which is founded on our legitimate interest; as well as
• the right to withdraw any consent you may have given at any time and at no cost.

If you exercise the rights of rectification, erasure, and restriction of processing of your data, these requests will also be communicated to third-party recipients to whom the data was disclosed in the context of providing games of chance services.

You can exercise any of the abovementioned rights by submitting a written request to the Company in writing or by electronic means. Your request must include supporting documents verifying your identity.

You can expect a reply to such a request within one (1) month following its receipt by the Company and in any case, within three (3) months, if the complexity of your request or in general the number of requests received, so requires.

Finally, you shall promptly notify the Company of any eventual change to the information that you provided upon registering and opening your account.

Disclaimer

Company’s services are not addressed to persons below twenty one (21) years of age. Any person who provides his/her details to us through any of our services warrants that he/she is above twenty one (21) years of age. We do not take on any obligation or liability for the practices, actions or policies that are beyond our control.
The present Privacy Notice may be amended. We will make sure to inform you on any amendment but, in any case, we invite you to visit our Website regularly, where the updated Privacy Notice will be posted. The latest version of this notice will also be available in printed form at PLAY stores, so you can consult it at any time.
Finally, this notice was originally drafted in Greek and subsequently translated into English. In case of any discrepancy between the Greek and the English version, the Greek text shall prevail.

Our Commitments

To ensure the minimization, accuracy, and completeness of the personal data it collects, the Company undertakes to review the data at regular intervals to correct or securely delete data that is no longer necessary for the purposes for which it was originally collected. The Company has taken all appropriate technical and organizational measures, in accordance with current technological standards and applicable laws and regulations, to ensure that the processing of your personal data is lawful, appropriate, and secure against any unauthorized or accidental access, disclosure, processing, deletion, modification, or other use

Contact Information

For any request relevant to the processing of your data, as well as in case you ascertain that we have not observed the principles stipulated in the present Privacy Notice, we kindly ask you to address, the soonest possible, OPAP Group's Data Protection Officer, using the following contact details: Website: www.allwyn.gr/gdpr | Address: 112 Athinon Ave., 10442, Athens | Telephone: +30 210 5798888 | E-mail: dpo@allwyn.gr

In case you deem we did not sufficiently address your request and the protection of your personal data is affected in any way, you may submit a complaint via the special online portal to the Hellenic Data Protection Authority (Athens, 1-3, Kifissias Ave., P.C. 115 23, tel: +30 210 6475600).| Detailed instructions on the submission of complaints are provided on the Authority's webpage.