Stadiobet (hereinafter referred to as "Stadiobet") needs to collect personal information to effectively carry out its daily business functions and activities, as well as to provide services to customers. This data is collected from employees, prospects, and customers and includes (but is not limited to) name, address, email address, IP address, and telephone numbers. We operate under a "Privacy by Design" approach and seek to be proactive rather than reactive, assessing changes and their impacts early and designing systems and processes to protect personal information at the heart of the business.

The purpose of this policy is to ensure that Stadiobet complies with its legal, statutory, and regulatory requirements to ensure that all personal information is secure and fully processed while in use, stored, and shared by us. The purpose of these measures is to ultimately minimize the risk of breaches and maintain the protection of personal data.

This policy applies to all staff (i.e., permanent, temporary, and contingent staff, third-party or subcontractor representatives, seasonal workers, volunteers, interns, and agents involved with Stadiobet) within the organization and is designed to ensure that staff conduct business in accordance with legal, regulatory, contractual, and commercial expectations and requirements.

We are committed to ensuring that all personal data obtained and processed by Stadiobet is done so in accordance with its principles, along with any associated regulations and/or codes of conduct established by the Supervisory Authority and local legislation. We are dedicated to ensuring the safe, ethical, and transparent use of all personal data and maintaining the highest standards of data processing.

Stadiobet ensures this:

● We protect the rights of individuals with respect to the personal information known and maintained about them by Stadiobet in the course of our business.

● We develop, implement, and maintain a data protection policy, procedure, audit plan, and compliance training program.

● All practices, tasks, and business processes carried out by Stadiobet are monitored for regulatory compliance.

● Data is only obtained, processed, or stored when we comply with legal processing requirements.

● We record consent at the time it is obtained and demonstrate such consent to the Supervisory Authority upon request.

● All employees (including new hires and contractors) are competent and aware of their obligations under the APPLICABLE POLICY and receive detailed training on the principles, regulations, and how they apply to our business and services.

● Customers feel secure providing us with personal information and know that it will be treated in accordance with their rights under the APPLICABLE POLICY.

● We maintain an ongoing monitoring, review, and improvement program regarding compliance with the APPLICABLE POLICY and to identify gaps and non-compliances before they become a risk.

● We have robust, recorded controls and procedures for handling breach incidents and complaints, to identify, investigate, review, and report any data protection breach or complaint.

● We have designated a single point of contact (the Privacy Office - dataofficer@Stadiobet) who is responsible for the general oversight and implementation of the APPLICABLE POLICY and its principles and who remains informed about regulations and how they relate to Impulsivity.

● We have an internal audit program to conduct regular checks and evaluations of how the personal data we process is obtained, used, stored, and shared. The audit program utilizes this policy and procedure and the APPLICABLE POLICY itself to ensure ongoing compliance.

● We provide clear reporting and oversight lines regarding data protection compliance.

● We store and destroy all personal information in accordance with the timeframes and requirements of the APPLICABLE POLICY.

● Any information provided to an individual regarding the personal data we hold or use about them must be provided in a concise, transparent, understandable, and easily accessible manner, using clear and concise language.

Due to the nature, scope, context, and purposes of the processing carried out by Stadiobet, we conduct frequent risk assessments and information audits to identify, evaluate, measure, and monitor the impact of such processing. We also implement appropriate technical and organizational measures to ensure the protection of personal data and compliance with the APPLICABLE POLICY and any code of conduct under which we have obligations.

We can demonstrate that all processing activities are carried out in accordance with the APPLICABLE POLICY and that we have robust data protection policies, procedures, measures, and controls in place. We operate in a transparent work environment and work diligently to ensure and promote a comprehensive and proportionate governance program.

Our main governance objectives are:

● Educate senior management and employees on the requirements of the APPLICABLE POLICY and the potential impact of non-compliance

● Provide a dedicated and effective data protection training program for all staff

● Identify key senior stakeholders to support the data protection compliance program

● Assign responsibility for data protection compliance and ensure the designated individual has sufficient access, support, and budget to perform the role

● Identify, create, and disclose reporting lines within the data protection governance structure Lawfulness of Processing

At the heart of all personal information processing activities carried out by Stadiobet is ensuring and verifying that we comply with Article 6 of the APPLICABLE POLICY and our lawfulness of processing obligations. Before carrying out any personal information processing activity, we always identify and establish the legal basis for doing so and verify it against the regulations.

This legal basis is documented in our data map and, where applicable, provided to the data subject and the Supervisory Authority as part of our information disclosure obligations. Data is only collected, processed, or stored when we comply with legal processing requirements, where:

● The data subject has given consent to the processing of their personal data for one or more specific purposes.

● The processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

● The processing is necessary for compliance with a legal obligation to which we are subject.

● The processing is necessary to protect the vital interests of the data subject or another natural person.

● The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

● Processing is necessary for the purposes of the legitimate interests pursued by Stadiobet or a third party (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child).

Stadiobet maintains records of all processing activities when:

● The processing of personal data may jeopardize the rights and freedoms of the individual.

● The processing is not occasional.

● We process special categories of data or criminal convictions and offenses.

● These records are kept in writing, provided in a clear and easy-to-read format, and are readily available to the Supervisory Authority upon request.

Acting as a processor (or representative), our internal records of the categories of processing activities carried out on behalf of a controller contain the following information:

● The full name and contact details of the processor(s) and of each controller on whose behalf the processor is acting and, where applicable, the controller's or processor's representative and the data protection officer.

● The categories of processing carried out on behalf of each controller.

● Where applicable, transfers of personal data to a third country or international organization (including identification of such third country or international organization and, where applicable, documentation of appropriate safeguards).

Code of Conduct: Impetus adheres to data protection codes of conduct to demonstrate that we comply with the rules and principles of the APPLICABLE POLICY. These codes and certification mechanisms are approved by the Privacy Office and have been disseminated throughout the company to ensure competency and compliance among all personnel. The codes of conduct to which we adhere help us:

● Improve transparency and accountability.

● Demonstrate to the public and supervisory authorities that we comply with the requirements of data protection law and that they can trust us with personal data.

● Mitigate enforcement actions.

● Improve standards by establishing good practices.

● Conduct fair and transparent processing.

● Ensure adequate safeguards when transferring personal data to third countries or international organizations.

We undergo frequent and unexpected monitoring and audits by trade association/body codes of conduct and the data protection certification scheme. We understand that if we are found to be non-compliant in any area related to the APPLICABLE POLICY, we may lose our certification/seal of approval and/or will be reported to the Supervisory Authority.

Third-Party Processors and/or Subprocessors: Impetus uses third-party processors for certain processing activities. We use information audits to identify, classify, and record all personal data processed outside the company so that the information, processing activity, processor, and legal basis are recorded, reviewed, and easily accessible. Such third-party processing includes (but is not limited to):

● IT systems and services, including cloud services.

● Payment services, including payment gateways.

● Marketing services.

● Customer support systems/tools.

We perform due diligence and know-your-customer procedures, reviewing, evaluating, and verifying all subprocessors before establishing a business relationship. We obtain company documents, certifications, and references, ensuring that the processor is suitable, appropriate, and effective for the task we are entrusting them with.

We audit their processes and activities before and during the contract period to ensure compliance with data protection regulations and review any codes of conduct under which they are required to confirm compliance. The ongoing protection of data subject rights is our priority when choosing a processor, and we understand the importance of outsourcing processing activities, as well as our ongoing obligations under the APPLICABLE POLICY, even when a process is handled by a third party.

This contract or other legal document must stipulate, in particular, that the processor:

● Processes personal data only in accordance with our documented instructions.

● Seek our authorization to transfer personal data to a third country or international organization (unless required by law to which the processor is subject).

● You must inform us of any legal data transfer requirements prior to processing.

● Ensure that those authorized to process personal data have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality.

● Take all measures to protect personal data at all times.

● Respect, support, and comply with our obligation to respond to requests to exercise the data subject's rights.

● Help comply with our data security obligations by mitigating risks, breach notification, and privacy impact assessments.

● Upon request, delete or return all personal data to Impetus after completing the provision of processing-related services, and delete existing copies where possible.

● Provide Impetus with all information necessary to demonstrate compliance with the obligations set out here and in the contract.

● Facilitates and supports audits, monitoring, inspections, and reports as established in the contract.

● Immediately informs Impetus of any violation, noncompliance, or inability to fulfill its obligations, as detailed in the contract.

Data Retention and Deletion: Impetus has established procedures to comply with the retention periods established by relevant laws, contracts, and business requirements, as well as to comply with the requirement of the APPLICABLE POLICY to retain and process personal information only for as long as necessary. All personal data is disposed of in a manner that protects the rights and privacy of data subjects (e.g., destruction by shredding, disposal as confidential waste, secure electronic disposal) and prioritizes the protection of personal data at all times.

Please see our Data Retention Policy for full details on our retention, storage, and destruction processes.

Data Protection Impact Assessments (DPIAs) Individuals have the expectation that their privacy and confidentiality will be maintained and respected at all times while their data is being stored and processed by Impetus. Therefore, we use various measures and tools to reduce risks and breaches for processing in general; however, when processing is likely to be high-risk or cause a significant impact on an individual, we use proportionate methods to map and assess the impact in advance. Impetus will conduct Data Protection Impact Assessments (DPIAs) from time to time (sometimes called Privacy Impact Assessments).

In accordance with Article 35(3) and Recitals 84, 89-96, we consider processing likely to result in a high risk to include:

● Systematic and extensive assessment of personal aspects relating to natural persons, based on automated processing, including profiling, and resulting in decisions which produce legal effects concerning the natural person, or which significantly affect that natural person(s). Large-scale processing of special categories of data.

● Large-scale processing of personal data relating to criminal convictions and offenses.

● Systematic monitoring of a publicly accessible area on a large scale (i.e., CCTV).

● When a processing operation is likely to result in a high risk to the rights and freedoms of an individual.

● Those involving the use of new technologies.

● New processing activities not previously used.

● Processing of considerably large amounts of personal data at the regional, national, or supranational level, which could affect many people.

● Processing activities that make it difficult for the party(ies) involved to exercise their rights.

Conducting DPIAs allows us to identify the most effective way to comply with our data protection obligations and ensure the highest level of data privacy during processing. It is part of our Privacy by Design approach and allows us to assess impact and risk before processing, identify and correct problems at source, reducing costs, breaches, and risks.

The DPIA allows us to identify potential privacy solutions and mitigation actions to address risks and protect privacy and impact. The solutions and suggestions are set out in the DPIA, and all risks are ranked to assess their likelihood and impact. The objective of the solutions and mitigation actions for all risks is to ensure that the risk is: ● Eliminated; ● Reduced; ● Accepted.

The collection of personal data is a fundamental part of the products/services offered by Impetus, and therefore, we have specific measures and controls in place to ensure compliance with the consent conditions set forth in the APPLICABLE POLICY.

THE APPLICABLE POLICY defines consent as: "Any freely given, specific, informed, and unambiguous indication of the data subject's wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to him or her."

Where processing is based on consent, Impetus has reviewed and revised all consent mechanisms to ensure that:

● Consent requests are transparent, using clear language and free from illegible terms, jargon, or extensive legalese.

● It is freely given, specific, and informed, and is an unambiguous indication of the individual's wishes.

● Consent is always given through a statement or a clear affirmative action (opt-in) that signifies agreement to the processing of personal data.

● Consent mechanisms are clean, clear, detailed (in fine detail), and easy to use and understand.

● Pre-ticked boxes or default checkboxes are never used.

● When consent is given as part of other matters (i.e., terms and conditions, agreements, contracts), we ensure that consent is independent of the other matters and is not a precondition for any service (unless required for that service).

● Along with our company name, we also provide details of any other third parties that use or rely on consent.

● Consent is always verifiable, and we have controls in place to ensure we can demonstrate consent in all cases.

● We maintain detailed records of consent and can at least demonstrate the following:

• That the individual has given their consent to the use and processing of their personal data.

• That the individual has been informed of the name of our company and any third party that will use the data.

• What was said to the individual at the time of consent.

• How and when consent was obtained.

● We ensure that withdrawing consent is as easy, clear, and straightforward as giving it and is available through multiple options, including:

• Unsubscribe links in correspondence or electronic communications.

• Explanation of the unsubscribe process and steps on the website and in all written communications.

• Ability to unsubscribe verbally, in writing, or by email.

● Requests to withdraw consent are processed promptly and without prejudice.

● For special category data, the consent obtained is explicit (stated clearly and in detail, leaving no room for confusion or doubt), and the purposes of the processing are always specified.

Consent Controls: Impetus maintains strict records of the data subject's consent to the processing of personal data and can always demonstrate that the data subject has consented to the processing of their personal data, where applicable.

We also ensure that withdrawing consent is as clear, simple, and transparent as granting consent.

Where the data subject's consent is given in the context of a written declaration that also concerns other matters, the request for consent is presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear language.

All such written declarations are reviewed and authorized by the Data Protection Officer before being distributed. THE APPLICABLE POLICY establishes that when processing is based on consent and personal data relates to a child under the age of 16, such processing will only be carried out by Impetus if consent has been obtained from the child's parent.

Consent to collect, process, store, and share (where applicable) is obtained by:

● Email.

● Electronically (i.e., via forms on the website).

Privacy Notices are used in all consent forms to ensure we comply with the disclosure of information required in the APPLICABLE POLICY in an easy-to-read and accessible manner.

Alternatives to Consent: Impetus recognizes that there are six legal bases for processing and that consent is not always the most appropriate option. We review all processing activities and only use consent as an option when the individual has a choice.

When reviewing processing activities to comply with consent requirements, we ensure that none of the following are a factor:

● When we request consent but would still process the data even if it were not given (or withdrawn). If we would continue to process the data under an alternative legal basis regardless of consent, we recognize that it is not the correct legal basis to use.

● When we request consent to process personal data as a precondition for a service we are offering and it is not offered as an option, consent is not appropriate.

● When there is an imbalance in the relationship, i.e., with employees.

Provision of Information When personal data is obtained directly from the individual (i.e., through consent, by employees, written materials, and/or electronic formats (i.e., website forms, signatures, email, etc.), we provide the following information in all cases, in the form of consent/privacy:

● The identity and contact details of the controller and, where applicable, the controller's representative.

● The contact details of our Data Protection Officer.

● The processing purpose(s) for which the personal data is intended.

● The legal basis for the processing.

● Where processing is based on point (f) of Article 6(1) "processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party," details of those legitimate interests.

● The recipients or categories of recipients of the personal data (if applicable).

● If applicable, the fact that Impetus intends to transfer the personal data to a third party. country or international organization and the existence/absence of an adequacy decision by the Commission.

• When Impetus intends to transfer personal data to a third country or international organization without an adequacy decision from the Commission, reference to the appropriate safeguards that Impetus has implemented and the means to obtain a copy of them or where they have been made available.

• The period for which the personal data will be stored, or if this is not possible, the criteria used to determine that period.

• The existence of the right to request access to and rectification or erasure of personal data, or restriction of processing of data relating to the data subject, or to object to processing, as well as the right to data portability.

• When processing is based on consent pursuant to Article 6(1)(a) or Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• The right to lodge a complaint with the Supervisory Authority.

● Whether the provision of personal data is a legal or contractual requirement, or a requirement necessary for entering into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of not providing that data.

● The existence of any automated decision-making, including profiling, as provided for in Article 22, paragraphs 1 and 4, and explanatory information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

The above information is provided to the data subject at the time of collecting the information, and records related to the consent obtained are kept and stored for 6 years from the date of consent, unless there is a legal requirement to retain the information for a longer period

Privacy Notices When Impetus obtains personal data from a third party or third party, we use Privacy Notices to provide the information in accordance with Articles 13 and 14 of the APPLICABLE POLICY. Our privacy notice is easily accessible, legible, jargon-free, and inclusive of all information, and is available on our website. When we rely on consent to collect and process personal information, we ensure that:

● It is clearly and prominently displayed.

● It asks individuals to opt in.

● It provides sufficient information to make an informed decision.

● It explains the different ways we will use their information.

● It provides a clear and simple way for them to indicate their consent to different types of processing.

● It includes a separate, unchecked checkbox for direct marketing.

Personal Data Not Obtained from the Data Subject When Impetus obtains and/or processes personal data not obtained directly from the data subject, we ensure that the information is provided to the data subject within 30 days of obtaining the personal data (except to inform them if the personal data is a legal or contractual requirement). In addition to the information provided to the data subject, we also provide information about the following:

● Categories of personal data.

● The origin of the personal data and whether it comes from publicly available sources. When personal data is used to communicate with the data subject, or if disclosure to another recipient is planned, the information will be provided no later than the time of the first communication or disclosure. When Impetus intends to continue processing any personal data for a purpose other than that for which it was originally obtained, we communicate this intention to the data subject before doing so and, where applicable, process it only with their consent. Although we follow best practices when providing information, we reserve the right not to provide the information to the data subject if:

● They already have it and we can demonstrate prior receipt of the information.

● Providing such information is impossible and/or would involve a disproportionate effort.

● Obtaining or disclosing it is expressly required by Union or Member State law to which Impetus is subject and which provides appropriate measures to protect the legitimate interest of the data subject.

● When personal data must remain confidential pursuant to an obligation of professional secrecy governed by Union or Member State law, including a statutory obligation of secrecy.

The Right of Access: We ensure that appropriate measures have been taken to provide the information referred to in Articles 13 and 14, and any communications pursuant to Articles 15 to 22 and 34 (collectively, the Rights of Data Subjects) related to the processing of data to the data subject in a concise, transparent, intelligible, and easily accessible manner, using clear and concise language.

Such information is provided free of charge and in writing, or by other means when authorized by the person involved and with prior verification of the data subject's identity (i.e., verbally, electronically).

The information is provided to the data subject as soon as possible, but no later than 30 days from the date of receipt of the request. When the retrieval or provision of information is particularly complex or subject to a valid delay, the period may be extended by another two months if necessary. However, this is done only in exceptional circumstances, and the data subject is kept informed in writing throughout the retrieval process of any delays or reasons for the delay.

When we refuse to comply with a request to provide data, the individual concerned is informed within 30 days of the reason(s) for the refusal and of their right to lodge a complaint with the Supervisory Authority.

Data Subject Access Request When a data subject asks us to confirm whether we process personal data concerning them and requests access to such data, we provide one or more of the following pieces of information, as requested:

● The purposes of the processing.

● The categories of personal data concerned.

● The recipients or categories of recipients to whom the personal data have been or will be disclosed.

● Whether the data have been or will be disclosed to a third country or international organization and the appropriate safeguards in place in accordance with the transfer.

● Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.

● The existence of the right to request rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing.

● The right to lodge a complaint with a Supervisory Authority. ● When the personal data has not been collected by Impetus from the data subject, any available information about the source and provider.

Subject Access Requests (SARs) are forwarded to the Privacy Office (dataofficer@Stadiobet) as soon as they are received, and the request is logged. The type of personal data held about the individual in our information assets (such as Salesforce, Human Resources Management System, accounting system, etc.) is checked to see

1. what PII is stored,

2. with whom it has been shared the most, and

3. any specific retention rules for that PII (related to statutory or contractual purposes). SARs must always be completed within 30 days and must be provided free of charge. Individuals can submit SARs electronically, and we respond by email after completing the Subject Access Request.

Data Portability: Impetus provides all personal information relating to the data subject upon request and in a format that is easy to disseminate and read. We ensure compliance with individuals' data portability rights by ensuring that all personal data is readily available and in a structured, commonly used, and machine-readable format, allowing data subjects to retrieve and reuse their personal data for their own purposes across different services.

To ensure compliance with Article 20 of the APPLICABLE POLICY regarding data portability, we maintain a commonly used, machine-readable format for the personal information on which processing is based:

● Consent pursuant to Article 6(1)(a).

● Consent pursuant to Article 9(2)(a).

● A contract pursuant to Article 6(1)(b).

When a data subject requests it and if the criteria meet the above conditions, we will transmit personal data directly from Impetus to a designated controller, where technically feasible.

We use the following format for machine-readable data: CSV, XLS, or any other popular machine-readable format.

All requests for information to be provided to the data subject or a designated controller are made free of charge and within 30 days of receiving the request. If, for any reason, we do not act on a request, we will provide the data subject with a full written explanation within 30 days regarding the reasons for the refusal and their right to lodge a complaint with a Supervisory Authority and a judicial remedy.

All requests for transfers under the right to data portability are assessed to ensure that no other party is affected by the data. When personal data affects more individuals than the individual requesting the data/transfer to another controller, this is always without prejudice to the rights and freedoms of other individuals.

Correction of Inaccurate or Incomplete Data In accordance with Article 5(d), all data maintained and processed by Impetus is reviewed and verified as accurate whenever possible and is always kept up-to-date. Where inconsistencies are identified and/or where the data subject or controller informs us that the data we hold is inaccurate, we take all reasonable steps to ensure that such inaccuracies are corrected promptly.

Controllers are notified of requests to update personal data and are responsible for validating the information and correcting errors when notified. Information is changed in accordance with the data subject's instructions, and the information is audited to ensure that all data relating to the data subject is updated when incomplete or inaccurate. Once updated, we add an annex or supplementary statement where applicable.

When we are notified of inaccurate data by the data subject, we will correct the error within 30 days and inform any third party of the rectification if we have disclosed the personal data in question to them. The data subject is informed in writing of the correction and, where applicable, is provided with the details of any third party to whom the information has been disclosed.

If, for any reason, we are unable to act on a request for rectification and/or completeness, we always provide the individual with a full written explanation and inform them of their right to lodge a complaint with the Supervisory Authority and a legal remedy.

The Right to Erasure: Furthermore, known as the "Right to be Forgotten," Impetus fully complies with Article 5(e) and ensures that personal data that identifies the data subject is not retained longer than necessary for the purposes for which the personal data is processed. All personal data obtained and processed by Impetus is categorized upon assessment by the information audit and assigned a deletion date or monitored so that it can be destroyed when no longer needed.

These measures allow us to comply with the right to erasure of the individual whose data is being deleted, allowing an individual to request the deletion or removal of personal data when there is no compelling reason for its continued processing. While our standard procedures already delete data that is no longer needed, we follow a dedicated process for deletion requests to ensure all rights are respected and that no data is retained longer than necessary.

When we receive a request to delete and/or remove a data subject's personal information, we follow the following process:

1. The request is assigned to the Privacy Office and recorded in the "Subject Access Request" log.

2. The privacy office locates all personal information relating to the data subject and reviews it to see if it is still being processed and if it is still necessary for the legal basis and purpose for which it was originally intended.

3. The request is reviewed to ensure that it meets one or more of the grounds for deletion: a) The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed. b) The data subject has withdrawn the consent on which the processing is based, and there is no other legal basis for the processing. c) The data subject objects to the processing, and there are no overriding legitimate grounds justifying the processing. d) The personal data must be erased to comply with a legal obligation. e) The personal data was collected in connection with the provision of services to a child.

4. If the deletion request meets at least one of the above grounds, it is deleted within 30 days of receiving the request. 5. The Privacy Office will write to the data subject and notify them in writing that the right to be forgotten has been fulfilled, providing details of the deleted information and the deletion date.

6. When Impetus has made public and granted the erasure of personal data, we will take all reasonable steps to remove public references, links, and copies of the data and will contact the relevant controllers and/or processors to inform them of the data subject's request to erase such personal data.

If, for any reason, we are unable to act on a deletion request, we always provide a written explanation to the individual and inform them of their right to lodge a complaint with a Supervisory Authority and to seek legal recourse. Such deletion refusals include:

● Exercising the right to freedom of expression and information.

● Compliance with a legal obligation to perform a task in the public interest.

● For archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, to the extent that the right to be forgotten could seriously hinder or impair the achievement of the purposes of such processing.

● Establishing, exercising, or defending legal claims.

The Right to Restrict Processing There are certain circumstances in which Impetus restricts the processing of personal information to validate, verify, or comply with a legal requirement for an individual's data request. Restricted data is removed from the normal flow of information and recorded as restricted in the information audit. Any account and/or system related to the restricted data subject is updated to notify users of the category and reason for the restriction. When data is restricted, it is only stored and not processed in any way.

Impetus will apply restrictions to data processing in the following circumstances:

● When an individual disputes the accuracy of the personal data, and we are in the process of verifying the accuracy of the personal data and/or making corrections.

● When an individual objects to processing (where it was necessary for the performance of a task carried out in the public interest or a purpose of legitimate interest), and we are considering whether we have compelling legitimate grounds to object to the individual.

● When the processing is considered unlawful, but the data subject requests restriction as opposed to erasure.

● When we no longer need the personal data, but the data subject requires the data to establish, exercise, or defend a legal claim.

The Data Protection Officer reviews and authorizes all restriction requests and actions and retains copies of notifications to and from data subjects and relevant third parties. When data is restricted and we disclose that data to third parties, we will inform the third party about the restriction and the reason, and will inform them again if any restriction is lifted.

Individuals who have requested data restriction are informed within 30 days of the restriction request, and they are also notified of any third parties to whom the information has been disclosed. We also provide the data subject with written notice of any decision to lift a restriction on data processing. If, for any reason, we are unable to act on a restriction request, we always provide the individual with a written explanation and inform them of their right to lodge a complaint with the Supervisory Authority and to a legal remedy.

Objections and Automated Decision-Making: Data subjects are informed of their right to object to processing in our Privacy Policy and at the time of initial communication, in a clear and legible manner, and separately from other information. We provide opt-out options in all direct marketing materials.

Individuals have the right to object to:

● Processing of their personal information based on legitimate interests or the performance of a task carried out in the public interest/exercise of official authority (including profiling).

● Direct marketing (including profiling).

● Processing for scientific/historical research and statistical purposes.

When Impetus processes personal data for the performance of a legal task, in relation to our legitimate interests, or for research purposes, an objection from data subjects will only be considered when it is based on "reasons relating to their particular situation." We reserve the right to continue processing such personal data when:

● We can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the individual.

● The processing is for the establishment, exercise, or defense of legal claims.

When we are processing personal information for direct marketing purposes based on previously obtained consent, we will cease processing such personal data immediately upon receiving an objection from the data subject. This measure is absolute, free of charge, and always complies.

When a data subject objects to data processing for valid reasons, Impetus will cease processing for this purpose and notify the data subject in writing within 30 days of receiving the objection.

We conduct a system audit to identify automated decision-making processes that do not involve human intervention. We also evaluate new systems and technologies for this same component before implementation. Impetus understands that decisions without human interaction can be biased toward individuals, and in accordance with Sections 9 and 22 of the APPLICABLE POLICY, we seek to establish measures to protect individuals where appropriate. Through our privacy policy, in our initial communications with an individual, and on our website, we inform individuals of their right not to be subject to a decision when:

● It is based on automated processing.

● It produces a legal effect or a similar significant effect on the individual.

In limited circumstances, Impetus will use automated decision-making processes within regulatory guidelines. Such cases include:

● When necessary for the conclusion or performance of a contract between us and the individual.

● When authorized by law (e.g., prevention of fraud or tax evasion).

● When it is based on explicit consent to do so.

● When the decision does not have a significant legal or similar effect on someone.

When Impetus uses automated decision-making processes, we always inform the individual and inform them of their rights. We also ensure that individuals can obtain human intervention, express their point of view, obtain an explanation of the decision, and challenge it.

Security and Breach Management Along with our "Privacy by Design" approach to data protection, we ensure the utmost security for the data we process, including, as a priority, when it is shared, disclosed, and transferred.

We conduct information audits to ensure that all personal data we hold and process is accounted for and recorded, along with risk assessments of the scope and impact a data breach could have on data subjects. We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Although every effort is made to reduce the risk of a data breach, Impetus has dedicated controls and procedures for such situations, along with notifications to the Supervisory Authority and data subjects (where applicable).

Please refer to our Data Breach Policy and Procedures for specific protocols.

Passwords Passwords are a fundamental part of Impetus's data protection strategy and are used throughout the company to protect information and restrict access to systems. We use a multi-channel approach that includes passwords at the user, administrative, device, system, and network levels to ensure a complete and comprehensive approach.

Although passwords are also directly related to Information Security and Access Control, Impetus recognizes that strong, effective, and robust controls and measures are imperative for the protection and security of personal information. Passwords provide a high level of protection for resources and data and are mandatory for all employees and/or third parties responsible for one or more accounts that need access to any resource requiring a password.

Acceptable Use Policy and Desk Clearance. Occasionally, and at Impetus' discretion, all or part of your files may be placed on a secure computer network with restricted access to all or part of your personal data. When implemented, access to personal information will only be granted to the individual/department with a specific and legitimate purpose for accessing and using it.

Impetus operates a zero-tolerance "Clear Desk" policy and does not allow personal data to be left unattended on desks or meeting rooms, or in visible formats such as unlocked computer screens or on fax machines, printers, etc. Access to areas where personal information is stored (both electronic and physical) is restricted with controlled and secure access features throughout the building.

Only personnel authorized to access data or secure areas are permitted to do so. All personal and confidential information in hard copy format is stored securely.

Audits and Monitoring This policy and procedure document details the extensive controls, measures, and methods used by Impetus to protect personal data, uphold the rights of data subjects, mitigate risks, minimize breaches, and comply with the APPLICABLE POLICY and associated laws and codes of conduct. In addition to these, we also conduct regular audits and compliance monitoring processes with the goal of ensuring that the measures and controls implemented to protect data subjects and their information are adequate, effective, and compliant at all times.

The Data Protection Officer has overall responsibility for evaluating, testing, reviewing, and improving the processes, measures, and controls implemented, and submitting improvement action plans to senior management, where applicable. Data minimization methods are frequently reviewed, and new technologies are evaluated to ensure we are protecting data and individuals to the best of our ability.

All reviews, audits, and ongoing monitoring processes are recorded by the Data Protection Officer, and copies provided to senior management are available to the Supervisory Authority upon request.

The purpose of internal data protection audits is:

● To ensure that appropriate policies and procedures are in place.

● To verify that these policies and procedures are being followed.

● To test the adequacy and effectiveness of the measures and controls implemented.

● To detect violations or potential violations of compliance.

● To identify risks and evaluate mitigating actions implemented to minimize such risks.

● To recommend solutions and action plans to senior management to improve the protection of data subjects and safeguard their personal data.

● To monitor compliance with the APPLICABLE POLICY and demonstrate good practices.

Training Through our strong commitment and robust controls, we ensure that all personnel understand, have access to, and can easily interpret the requirements of the APPLICABLE POLICY and its Principles, and that they receive ongoing training, support, and assessments to ensure and demonstrate their knowledge, competence, and suitability for the task. New and existing employees receive training, assessment, and support, including:

● Training and awareness sessions on the APPLICABLE POLICY for all employees.

● Privacy by design workshops/training for product and engineering teams designing software solutions that process personal data.

● Easy access to policies, procedures, checklists, and supporting documents (including this document).

Employees receive ongoing support and training on the requirements of the APPLICABLE POLICY and their own objectives and obligations around data protection.

Sanctions: Impetus understands our obligations and responsibilities under the APPLICABLE POLICY and the Supervisory Authority, and understands the seriousness of any violations under the Regulation. We respect the Supervisory Authority's authorization under the legislation to impose fines and sanctions when we fail to comply with regulations, fail to mitigate risks where possible, and operate in a deliberately non-compliant manner. Employees have been informed of the severity of such sanctions and their proportional nature depending on the violation. We acknowledge that:

● Violations of the obligations of the controller, processor, certification body, and supervisory body are subject to administrative fines of up to €10,000,000 or 2% of the total worldwide annual turnover of the preceding financial year, whichever is greater.

● Violations of the basic principles of processing, conditions of consent, rights of data subjects, transfers of personal data to a recipient in a third country or international organization, specific processing situations (Chapter IX), or failure to comply with an order of the Supervisory Authority are subject to administrative fines of up to €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year, whichever is greater.

Responsibilities: Impetus has appointed an employee to lead the Privacy Office (dataofficer@Stadiobet), whose role is to identify and mitigate any risks to the protection of personal data, act in an advisory capacity to the company, its employees, and senior management, and remain actively informed and up-to-date with all legislation and changes related to data protection. The resource will work closely with the IT Manager to ensure that all processes, systems, and personnel operate effectively and within the requirements of the APPLICABLE POLICY and its principles.

The resource also has overall responsibility for due diligence, privacy impact assessments, risk analysis, and data transfers when personal information is involved. The resource will also maintain appropriate and effective management records and reports in accordance with the APPLICABLE POLICY and our own internal objectives and obligations. Staff who handle and process personal information or special category information will receive data protection training and ongoing support and guidance to ensure they are competent and knowledgeable in their roles.

The Privacy Office is also responsible for internally disseminating this policy to all stakeholders (employees, freelancers, contractors, interns) and obtaining their acknowledgement of their understanding and acceptance of the terms set forth in this policy (see the form in Appendix A). The resource is available at dataofficer@Stadiobet.