Privacy Policy – Your Data Protection

1. Introduction

This Privacy Policy provides information on the processing of Personal Data in relation to the website operated at letsbet.de by Starlet Entertainment Limited (hereinafter “Starlet”), as Data Controller in terms of the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter the “GDPR”). This Privacy Policy is provided in accordance with the provisions of Articles 12, 13 and 14 of the GDPR.

Starlet seeks to ensure that your Personal Data is Processed in a secure manner whilst respecting the principles of lawfulness, fairness and transparency as provided for in the GDPR. Starlet only processes Personal Data that is strictly necessary for the provision of its services

This Privacy Policy applies equally whether you are accessing the website via a computer, a mobile phone, or any other device.

Within this Policy when referring to Personal Data, one refers to any information that can directly or indirectly identify a natural person. Whilst the Processing of Personal Data means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In the context of this Policy, Data Subject means anyone who can be identified, directly or indirectly by Personal Data (“you”); Data Controller means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; and Data Processor refers to a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of a Data Controller.

GlüStV 2021 refers to the German Interstate Treaty on Gambling of 2021.

2. The identity and the contact details of the Data Controller

The Data Controller is Starlet Entertainment Limited (C 105787).

The Data Controller may be contacted at:

• Junction Business Centre 1st Floor, Sqaq Lourdes, San Giljan SWQ 3334, Malta

• [email protected]

3. The contact details of the Data Protection Officer

If you have questions about Starlet’s data protection framework or wish to receive further information on how your Personal Data is processed, please reach out to [email protected] or [email protected]

4. Processing of your Personal Data

4(a). Lawful basis for Processing

Your Personal Data will only be processed by Starlet if there is a lawful basis for processing as allowed under the GDPR. The GDPR provides for the following lawful bases:

(i) you have given consent to the processing of your Personal Data for one or more specific purposes (GDPR Section 6(1)(a));

(ii) processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (GDPR Section 6(1)(b));

(iii) processing is necessary for compliance with a legal obligation to which the controller is subject (GDPR Section 6(1)(c));

(iv) processing is necessary in order to protect the vital interests of the data subject or of another natural person (GDPR Section 6(1)(d));

(v) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Section 6 (1)(e));

(vi) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (GDPR Section 6(1)(f)).

4(b). Categories of data processed and purpose for processing

The following outlines the categories of data processed, the purposes for their use and the lawful bases that justify the processing:

(i) Identity Verification and Legal Compliance

To comply with legal obligations when providing our services and to ensure secure account creation, we process Personal Data necessary to verify your identity and age, perform PEP, sanction and background checks, prevent identity theft, and meet anti-money laundering (AML) and counter-terrorism financing (CTF) requirements. This includes compliance with the German State Treaty on Gambling (GlüStV 2021) and Know Your Customer (KYC) obligations.

Data Categories	Purpose	Legal Basis
Personal information, including name, maiden names, salutation, title, gender, nationality, date and place of birth; Identity documentation such as: ID card/passport details, selfie/document photographs; Address data, including residential address, postal code, city, country; Compliance-related data such as: Information for OASIS and LUGAS checks; Creditworthiness data such as: Financial indicators, SCHUFA/credit checks, rental agreements, and source-of-funds documentation.	To verify identity and age; To fulfil legal obligations related to AML, CTF, and KYC requirements; To prevent identity theft, fraud, and unauthorized account use.	Compliance with legal obligations (Article 6(1)(c) GDPR); Legitimate interest in fraud prevention and ensuring secure transactions (Article 6(1)(f) GDPR).

(ii) Account Registration and Management

To facilitate account creation, manage your preferences, and provide secure access to our services, we process data related to your registration and account management.

Data Categories	Purpose	Legal Basis
Account details such as: Username, password (encrypted), IP address, OTP code, account ID, and account status (e.g., active, locked, closed); Contact information such as: Email address, phone number,; Other registration data such as: Language preferences or IP address.	To enable account creation, multi-factor authentication, and management; To ensure secure access and support account functionality, including password recovery.	Performance of a contract to provide our services (Article 6(1)(b) GDPR); Legitimate interest in maintaining the functionality and security of user accounts (Article 6(1)(f) GDPR).

(iii) Responsible Gaming and Player Protection

To promote responsible gambling and allow early detection of problem gambling , Starlet monitors gameplay and behavioural patterns, implements deposit and session limits, and processes data related to self-exclusion and other protective measures as required.

Data Categories	Purpose	Legal Basis
Gameplay data such as bets placed, winnings/losses, games played, and session durations; Behavioural monitoring data such as frequency and intensity of gameplay, risky behaviour patterns; Responsible gaming data such as self-exclusion requests, panic button activations, cross-operator and/or site related deposit, other financial and/or session limits, and OASIS/LUGAS exclusion/limit information.	To monitor gambling activity for signs of problem behaviour; To implement tools for managing gaming habits, including self-imposed limits and session reminders; To comply with responsible gambling obligations under GlüStV 2021.	Compliance with legal obligations (Article 6(1)(c) GDPR); Legitimate interest in ensuring player protection and maintaining regulatory compliance (Article 6(1)(f) GDPR).

(iv) Financial Transactions and Payment Processing

To facilitate deposits, withdrawals, and other financial transactions securely, Starlet processes your payment information in accordance with applicable financial regulations.

Data Categories	Purpose	Legal Basis
Payment details such as: Bank account information, IBAN/BIC, card details (excluding CVN); Transaction data, including on deposits, withdrawals, stakes, winnings, bonuses, and timestamps; Verification data such as card verification data, source-of-funds documentation, financial capacity assessments (e.g., SCHUFA checks).	To process payments and validate financial transactions; To prevent fraud and money laundering in line with AML/CTF requirements; To comply with financial regulatory obligations and ensure payment accuracy.	Performance of a contract to process your payments (Article 6(1)(b) GDPR); Compliance with legal obligations under financial regulations (Article 6(1)(c) GDPR); Legitimate interest in fraud prevention and secure payment processing (Article 6(1)(f) GDPR).

(v) Communication/Customer Service

To respond to queries received via calls, customer support live chat and through topic selection, email or similar communication methods, as well as to resolve customer support requests, or to contact you regarding system information/updates or for compliance reasons (including player protection and anti-money laundering and fraud reasons), Starlet processes your Personal Data.

Data Categories	Purpose	Legal Basis
Contact information such as full name, email and phone number; Information such as your user name, date of birth	General communication with customers; To respond to queries received via calls, customer support live chat and through topic selection, email or similar communication methods; To resolve customer support requests; To contact you regarding system information/updates or for compliance reasons (including player protection and anti-money laundering and fraud reasons).	Compliance with legal obligations (Article 6(1)(c) GDPR); Legitimate interest in meeting licence obligations and providing reliable customer service (Article 6(1)(f) GDPR).

(vi) Marketing and Promotions

To define campaigns, send promotional material and provide you with tailored promotions, special offers and updates, Starlet processes Personal Data. Marketing is conducted based on your consent or legitimate interest, depending on the circumstances.

Data Categories	Purpose	Legal Basis
Contact information and preferred channel of communication: Email address, phone number, residential address; Information such as your full name, date and place of birth; Marketing preferences information such as your subscription status and whether or not you have given consent and are free to receive marketing communication; Interaction data such as responses to marketing communication/campaigns, engagement with offers.	To send personalized marketing communications, including about offers, bonuses, and updates; To ensure compliance with opt-out and unsubscribe requests as well as OASIS clearances (only persons who are not excluded from gambling may receive marketing communication); To meet licence conditions, namely to report about the effect of advertising and related problem gambling risks to the Gemeinsame Glücksspielbehörde der Länder (GGL).	Your consent for promotional communications (Article 6(1)(a) GDPR); Legitimate interest in improving customer retention and experience (Article 6(1)(f) GDPR).

(vii) Regulatory Monitoring

Starlet processes data required by regulatory authorities to monitor gambling behaviour and ensure compliance with state and national laws. This includes carrying out checks against the OASIS player blocking system (a central database of excluded players) as well as transmitting information to the cross-state gambling evaluation system (LUGAS) and our Safe Server as required including to perform checks against the central databases contained in LUGAS for monitoring the cross-provider deposit limit (limit file) and for preventing parallel gambling with several gambling providers (activity file).

Data Categories	Purpose	Legal Basis
Data such as full name, date and place of birth, residential address, nationality, username; Player activity data such as deposits, withdrawals, transaction logs, games played, gameplay sessions but also suspicious behaviour data, dates and times of registration, timeouts logins and logouts; Financial data such as deposits, withdrawals, and bonuses, payment methods and service providers saved and used, account balances and transactions; Cross-provider deposit limit information, including the amount set by the player, date the limit was set, amount and date of deposits made, total value of deposits made; Regulatory data such as exclusions imposed, interactions with the exclusion database, information about provider-related limits, the standard cross-provider deposit limit regulated by the GlüStV 2021, messages about parallel play from the central database; Pseudonymized identifiers: Linking activity across platforms e.g. for Safe Server reporting; Technical and communication data such as messages sent and their acknowledgment by the player, interactions with the central database, panic button usage data, including the fact that the panic button was used as well as the date and time of activation.	To monitor compliance with deposit limits and responsible gaming requirements; To facilitate oversight by regulatory authorities (e.g., the Gemeinsame Glücksspielbehörde der Länder ( GGL)); To properly report suspicious behaviour to relevant authorities/bodies including to maintain the integrity of sports by collaborating with sports bodies and associations.	Compliance with legal obligations under GlüStV 2021 and other regulations (Article 6(1)(c) GDPR); Legitimate interest (Article 6(1)(f) GDPR)).

(viii) Security and Fraud Prevention

To protect user accounts, maintain system stability and ensure the proper functioning of the website and player account, Starlet processes data related to device usage, login behaviour, and unusual activity.

Data Categories	Purpose	Legal Basis
Security data such as IP addresses, device details, login timestamps, session tokens; Fraud indicators: Reports of suspicious activity and behaviour patterns.	To detect and prevent unauthorized account access; To respond to security incidents and ensure system stability; To ensure the proper functioning of the website and player account.	Legitimate interest in ensuring system security and preventing fraud (Article 6(1)(f) GDPR).

(ix) Analytics and Research

To prepare statistics and analysis to improve services, content or customer experience or to produce reports as required for the Gemeinsame Glücksspielbehörde der Länder (GGL), Starlet processes data related to usage and engagement, survey responses and demographic information.

Data Categories	Purpose	Legal Basis
Usage and engagement data (e.g., session durations, interaction logs). Survey responses demographic information	To prepare statistics and analysis to improve services and content; To collect feedback for improving services and customer experience; To produce reports as required for the Gemeinsame Glücksspielbehörde der Länder ( GGL),	Legitimate interest (Article 6(1)(f) GDPR). Compliance with legal obligations under GlüStV 2021 (Article 6(1)(c) GDPR).

(x) Features

To offer you features like Popular Combis, LetsTrack, LetsRank and LetsShare Starlet may anonymise your data or ask for your consent to process your data.

Data Categories	Purpose	Legal Basis
Player ID/avatar/user name Bet slip information	To offer special features allowing you to share your or see others’ betting history; To create overviews of the most popular bets or most popular combination bets based on anonymised data for information and experience improvement purposes.	Your consent for participating in LetsRank and LetsShare (Article 6(1)(a) GDPR; Legitimate interest for understanding betting activity across player base and popularity of certain bets (Article 6(1)(f) GDPR).

5. Transfer and receipt of Personal Data

From time to time, Starlet may need to share Personal Data with third parties or will indirectly receive Personal Data from third parties to provide its services to you, fulfil its obligations as a licensee and comply with applicable legislation. The following may be recipients/sources of your Personal Data when it is transferred:

(i) technical service providers, call centre service providers in order to receive and address member requests, maintenance service providers who maintain Starlet's hardware and software, affiliated companies;

(ii) payment service providers and banks for the processing of payment transactions (deposits and withdrawals);

(iii) courts or other authorities as well as legal and/or other advisors and consultants in connection with the enforcement of claims for the performance of contract, in connection with the defence against claims or to obtain advice related to ensuring compliance with German laws, the GDPR and our licence obligations;

(iv) professional consultants engaged by Starlet in order to assist with any necessary investigations and preparations of legal claims;

(v) business partners who carry out identity or economic capacity verification checks, as well as credit agencies, in particular in connection with the establishment, execution and/or termination of contracts and/or the enforcement of contract performance claims, to determine residence, detect identity misuse, establish identity, Identity, age, PEP and sanction and other checks and verification, credit assessment and checks, compliance with statutory identification and verification obligations;

(vi) OASIS and LUGAS databases, regulatory/supervisory authorities and sports integrity bodies/associations;

(vii) Other entities associated with or part of the same group as Starlet.

If of interest, you may contact our Data Protection Officer for further details about the third parties we work with and about how they handle your data. We further wish to refer you to the privacy policies of some selected partners:

SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, Germany. Starlet transfers personal data, namely the data categories mentioned above as required to register and manage your account to SCHUFA Holding AG based on its legal obligations and legitimate interest. The data exchange with SCHUFA Holding AG serves in particular to fulfil legal obligations to protect players and to check economic performance in gambling, for example in the context of an intended limit increase. SCHUFA Holding AG processes data in order to provide its contractual partners in the European Economic Area and Switzerland and, where applicable, other third countries (provided that an adequacy decision has been made by the European Commission or standard contractual clauses have been agreed, which can be viewed at www.schufa.de) with information, including for assessing the creditworthiness of natural persons. Further information on SCHUFA Holding AG's activities can be found at www.schufa.de/datenschutz

GB Group Plc, The Foundation, Herons Way, Chester Business Park, Chester CH4 9GB, Great Britain. Starlet transfers personal data, namely the address location and verification related data categories mentioned above as required to register and manage your account to GB Group Plc. This serves Starlet meeting its legal obligations and legitimate interest. Further information GBG Group Plc’s activities can be found at https://www.gbgplc.com/productsservices-privacy-policy

Sportradar AG, with registered seat of business at Feldlistrasse 2, 9000 St. Gallen, Switzerland. Starlet transfers personal data, which may include IP addresses, geographical coordinates, client ID, user agent strings of end users, log files and client facing APIs whcih may contain personal data of end users of Starlet. Further information on Sportradar’s activities can be found at: https://sportradar.com/privacy-notice

IDnow GmbH, Auenstr. 100, 80469 Munich, Germany. Starlet transfers personal data, namely the user's name, surname, date of birth and address information to IDnow GmbH for identity verification purposes. In addition, during the verification process, users may upload and provide, identification documents (such as identity cards, passports or residence permits) and proof of address documents (such as utility bills, tax documents, bank statements or insurance documents), which are processed by IDnow on Starlet's behalf to verify the user's identity and address. This processing serves Starlet's compliance with its legal obligations, including anti-money laundering and customer due diligence requirements. Further information regarding IDnow GmbH's privacy practices can be found at https://www.idnow.io/privacy-policy/.

6. Transfer of Personal Data to third-countries

In the event that Starlet transfers any of your Personal Data to third-countries, it shall ensure that such transfers are subject to appropriate safeguards in terms of Sections 45 and 46 of the GDPR, including by ensuring the transfer is covered by an appropriate adequacy decision or EU Standard Commission Clauses.

7. Use of Cookies

Starlet makes use of Cookies in some areas of the website. Cookies are short alphanumeric text files that are placed on your computer or mobile device when you visit a website. Cookies are used in order to make websites function as well as to provide reporting information. Further details on the Cookies used may be found in our Cookie Policy.

8. Retention Period

Personal Data will be processed as long as is necessary for the purpose for which it was obtained. Once the purpose is fully achieved, the data will be deleted in accordance with Starlet’s Data Retention Policy. The retention period may however be extended in the event that there is any legal obligation to retain the Personal Data for a longer period in the event that there is any ongoing investigation or procedure before any competent court.

9. Your Rights as a Data Subject

You have the following rights with respect to the processing of your Personal Data:

(i) Right of access – you have the right to access the Personal Data that Starlet holds about you;

(ii) Right of rectification – you have the right to request the correction of any inaccurate or incomplete data that Starlet holds about you;

(iii) Right to erasure – you may request for the data held about you to be erased from Starlet’s records. This will be acceded to in certain circumstances in accordance with the GDPR;

(iv) Right to restriction of Processing – you have the right to request the restriction of Processing of your Personal Data. This will be acceded to in certain circumstances in accordance with the GDPR;

(v) Right to data portability – you have the right request that the Personal Data Starlet holds about you be transferred to another entity;

(vi) Right to object – in certain circumstances you have the right to object to particular processing activities; and

(vii) Right to withdraw consent – where Processing of your Personal Data is based on consent, you have the right to withdraw your consent at any time. Such a withdrawal will not affect the lawfulness of any Processing carried out prior to such withdrawal, and neither will it affect any Processing of your Personal Data carried out on any other lawful basis for Processing in terms of the GDPR.

In addition to the above, you also have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

Office of the Information and Data Protection Commissioner,

Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta

+356 2328 7100

[email protected]

10. The existence of automated decision-making

By processing your data, an automated decision may be made in specific cases, as outlined in Article 22 of the GDPR, including profiling. This could occur when determining your eligibility to play, assessing your continued eligibility based on legal and regulatory requirements for player protection, and/or efforts to combat money laundering and terrorism. Depending on certain criteria, this automated decision may result in restrictions on services, the partial or complete blocking of your account, the rejection of a gaming contract offer, or the refusal to open an account. Since such automated decisions may have legal consequences or significantly affect you, you have the right to challenge the decision, request a manual review, and present your own viewpoint.

11. External Links

If third-party links are provided on letsbet.de, please note that once you click on such a link, and this results in Starlet no longer being the Controller of your Personal Data, we no longer have any control over the data collected or how it is used and shared by the respective third-party provider. We therefore cannot accept any responsibility for their activities. For detailed information on how the third-party collects and uses your data, please refer to the privacy policy of the respective third-party provider.

12. Changes

If this Privacy Policy is updated, we will replace the current version on this page with the revised version. Each version will include a modification date for reference. It is the customer’s responsibility to review all versions regularly to stay informed of any changes or updates.

Version 1.0 – 24 June 2026