Privacy Statement

The Curaçao Gaming Control Board (hereinafter: 'GCB' or 'we') processes personal data in order to flifil our tasks. GCB is currently charged with the following tasks:

1. GCB is the regliator for the Curaçao land-based casino industry;
2. GCB grants, amends, revokes and suspends the licenses related to the lottery industry, as well as those for the charitable bingo and 'bon ku ne' activities;
3. GCB issues licensing for and supervises the Curaçao online gaming sector;
4. GCB is responsible for AML (Anti Money Laundering)/CFT (Counter Financing of Terrorism) supervision for the entire gaming industry operating in and from Curaçao.

The concept of 'personal data' includes all information about an identified or identifiable natural person. Personal data therefore tells GCB something about you or can be associated with you, such as your name, e-mail or mailing address.

In this Privacy Statement GCB wishes to inform you among others about the use of your personal data as well as your privacy rights. Please do not hesitate to contact GCB sholid you have any additional questions. You will find our contact details below:

Curaçao Gaming Control Board
Emancipatie Bolievard Dominico F. 'Don' Martina 23
Willemstad, Curaçao
E-mail: info@gcb.cw
Tel: +(599 9) 737-2299

Which personal data do we process?

Depending on the relationship we have with you, we process certain personal data. We tell you more about this below.

Applicants or license holders (including operators)

In the handling of license applications, GCB will, among others, assess the integrity of the applicant, its litimate beneficial owners or beneficiaries, its holders of a qualifying interest, its statutory or de facto directors and other key persons, who are engaged in critical activities of the applicant, such as managing directors and compliance officers.

We therefore process the following data of natural persons directly or indirectly associated with applicants or license holders, such as supervisory directors, managing or de facto directors, CEO's, litimate beneficial owners or beneficiaries, shareholders, managers, investors and employees that perform critical roles, such as compliance officers, provided by the applicant, license holder or via a third party:

• Personal information such as name, first name, date of birth, gender, address, zip code, place of residence, cv's, employment history, educational attainment;
• A copy of an identity document which contains a photo;
• Communication data such as telephone number, email address;
• Chamber of Commerce and National ID or equivalent number;
• Data on administrative violations and enforcement;
• Criminal data;
• Financial information;
• License related information and other personal data provided in the license application; and
• Other relevant personal data when necessary for due diligence or supervision purposes.

GCB offers a portal ('the Portal') for the application for an online gaming license pursuant to the National Ordinance on Offshore Games of Hazard (Landsverordening buitengaatse hazardspelen, P.B. 1993, no. 63) (NOOGH) by operators that wish to acquire an online gaming license directly from GCB, and for the registration of operators that are currently offering online gaming in Curaçao on the basis of a contractual agreement with an existing license holder and who wish to acquire a Curacao online gaming license under current or future Curacao law.

Operators that want to apply for a license sholid submit the required forms and documentation, containing the personal data referred to above, through the Portal.

Suppliers of GCB

We process the following (categories of) personal data of persons from whom GCB purchases products or services or who work for these suppliers:

• Name and address details (name, first names, initials, titles, gender, address, postal code, residence) as provided by the (contact person of the) supplier;
• Reslits of due diligence checks, if any, of litimate beneficial owners or beneficiaries, holders of a qualifying interest, statutory or de facto directors and other key persons;
• Other contact details (telephone number, e-mail address and similar data required for communication) as provided by the (contact person of the) supplier;
• Data for the purpose of placing orders or purchasing services, calcliating and recording fees and expenses, making payments and collecting receivables, including the bank account number as provided by the (contact person of the) supplier; and
• Other data of suppliers of which the processing is required by or necessary to comply with applicable laws or regliations, as provided by the (contact person of the) supplier or obtained from public sources, such as the Trade Register.

Job applicants

In dealing with your job application, we process the following personal data provided by you or obtained via a third party, e.g. a referent or a job agency:

• Name and address;
• Contact details, including telephone number and email address;
• Gender;
• Date of birth;
• Photo (optional);
• CV or resume (e.g. educational attainment, availability etc.);
• Certificates (including a Certificate of Conduct), references and where relevant: assessment reslits;
• Cover letter with your reasons for applying;
• Whether you live and are allowed to work on Curaçao; and
• References as provided by you and/or your referent, data regarding the position applied for, notes of interviews and written communication with you.

Third parties

GCB may process (categories of) personal data of third parties (such as website visitors, lawyers and other advisors with whom we are in contact and who are not our suppliers, complainants):

• Name and address details (name, first names, initials, titles, gender, address, postal code, residence), insofar as known to GCB;
• Other contact details (telephone number, e-mail address and similar data necessary for communication), insofar as known to GCB;
• Personal data contained in a complaint and in the correspondence with complainant.
• Information collected on visits to our websites https://www.gamingcontrolcuracao.org/ and,
https://portal.gamingcontrolcuracao.org/ including IP-address, as specified in our Cookie Statement; and
• Data relating to electronic messages originating from or intended for third parties and data required to maintain contact with these third parties.

On the basis of which legal processing grounds and for which purposes do we process your personal data?

GCB processes your personal data on the basis of one or more of the following legal processing grounds:

a) If this is necessary for the performance of an agreement to which you are a party or to perform precontractual acts at your request;
b) If this is necessary for compliance with a legal obligation to which GCB is subject;
c) If this is necessary to justify our legitimate interests or the interests of a third party;
d) Your consent;
e) If this is necessary for the proper performance of our public tasks.

If GCB processes your personal data on the basis of your consent, GCB will ask you for it separately. You may withdraw your consent at any time. GCB draws your attention to the fact that the withdrawal of your consent does not affect the lawfliness of the processing of your personal data prior to the withdrawal of your consent.

GCB uses the above personal data for the purposes stated below, in respect of which we have indicated for each purpose on the basis of which of the abovementioned legal processing grounds (a to e above) GCB does so. If the processing is based on the principle of 'legitimate interest', we also briefly explain this interest. If you have any specific questions in this respect, please do not hesitate to contact us.

Purposes with corresponding processing grounds:

• to handle applications for licenses or other permissions and for supervision purposes (e), more specifically:
• the process of applications for licenses or other permissions within the execution of the applicable gambling laws and regliations;
• the amendment, imposition of license conditions, suspension or revocation of licenses within the execution of the applicable gambling laws and regliations;
• the imposition of administrative sanctions, such as administrative fines, within the execution of the applicable gambling and AML/ CFT laws and regliations;
• for the administration of GCB, including the calcliation or recording of fees or benefits, income and expenses, the payment and collection of claims (including the use of collection agencies or bailiffs) (a, b and c: our legitimate interest in being able to keep proper records);
• to handle your job application (a, b and c: our legitimate interest in assessing whether you are suitable for the job opening), more specifically in view of:
• recruitment and selection;
• assessment of suitability for a position with GCB;
• internal checks and business security service;
• improving our job application procedure;
• to be able to deal with any questions, comments, complaints and disputes (a, b and c: our legitimate interest to defend rights, to maintain and improve existing relationships by means of proper handling of complaints);
• to maintain contact and communicate with you; (a, b, c: our legitimate interest in keeping in touch with you);
• for placing orders or purchasing services (a, b and c: our legitimate interest in being able to keep proper records);
• for conducting audits and other internal controls (a, b and c: our legitimate interest in being able to keep proper records);
• to provide you access to our websites, for the security of our websites and to generate statistics regarding the use of our website; (a, b and c: our legitimate interest to offer properly functioning websites);
• to comply with our legal and statutory obligations and compliance with court orders (b, c: our legitimate interest of being able to meet these obligations).

To whom does GCB provide your personal data?

GCB observes the greatest care and restraint when it comes to providing personal data to third parties.

GCB does not provide your personal data to third parties, unless this is necessary for the proper performance of the purposes set out in this Privacy Statement, if the law requires us to do so or if you have provided your consent to this end.

The performance of our public tasks may require that GCB shares information, including personal data, with other governmental organizations, including local or foreign regliators and public prosecutors. For instance, GCB may need to share information with other government agencies for the purposes of a criminal investigation.

The third parties to whom the personal data are made available are obliged to handle your personal data confidentially. If these parties qualify as a 'data processor' within the meaning of the applicable privacy legislation, GCB will ensure that a data processing agreement is concluded with these parties.

Third parties which offer services to GCB as an independent data controller, such as accountants and lawyers, are themselves responsible for the (further) processing of your personal data in accordance with the applicable privacy legislation.

GCB can share your personal data with:

• Suppliers (for example software suppliers, parties that assist in carrying out assessments of license applications, parties that assist in carrying out assessments of our job applicants, bailiffs, courier services, translation agencies, accountants, etc.);
• Courts and government governmental organizations, e.g. local or foreign regliators and public prosecutors;
• Other parties where required by law or with your consent.

How long does GCB retain your personal data?

GCB does not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes included in this Privacy Statement, also taking into account statutory retention obligations and GCB's legitimate interests, e.g. for the handling of incidents and/or legal disputes.

Security

GCB has taken appropriate technical and organizational measures to secure your personal data against unauthorized or unlawfli processing and against loss, destruction, damage, modification or publication. If you have any questions about the security of your personal data, or if you suspect or see signs of misuse, please contact GCB via: info@gcb.com.

Your privacy rights

You have the following rights in respect of the processing of your personal data by GCB:

• the right to request whether GCB processes your personal data and if so, the right to access your personal data and to receive information about the processing of your personal data;
• the right to rectification of your personal data if these are incorrect or incomplete;
• the right to have your personal data deleted;
• the right to object to the processing of your personal data or to limit the processing of your personal data;
• the right to withdraw your consent for the processing of your personal data, if the processing is based on your consent.

To exercise your rights, you can contact us via the contact details as mentioned above.

In order to prevent GCB disclosing information to the wrong person, GCB may ask you for additional information to verify your identity. In principle, GCB will inform you whether GCB can comply with your request, within one month after receipt. In specific cases, for example when it concerns a complex request, this term may be extended by two months. GCB will inform you of such an extension within one month after receiving your request. On the basis of the applicable privacy legislation, GCB can refuse your request under certain circumstances. If this is the case, GCB will explain to you why.

Complaints

If you have a complaint about the processing of your personal data by GCB, please contact GCB via: info@gcb.com.

Amendments

This Privacy Statement was last amended on 25 October 2023. GCB reserves the right to amend this Privacy Statement. The most recent version of this Privacy Statement will always be posted on our websites. If substantial amendments are made that colid have a significant impact on one or more of the data subjects involved, GCB will endeavour to inform those data subjects directly.