This Privacy Policy explains how LUSTRIA LTD, a private limited company registered in England and Wales under company number 17382144, with its registered office at 20 Wenlock Road, London, England, N1 7GU (“Lustria“, “we“, “us” or “our“), collects, uses, shares and protects personal data in connection with our business-to-business gaming platform, including our casino, sportsbook, player management, provider and payment integration, reporting and white-label services (the “Platform“). This policy is effective from 29 September 2026 and was last updated on that date.

This policy is intended to comply with the UK General Data Protection Regulation, the Data Protection Act 2018, and, where relevant to personal data of individuals in the European Economic Area, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (together, the “Data Protection Laws“). Where Lustria processes personal data on behalf of a business customer as a processor, that processing is governed by our Data Processing Agreement, and this policy applies to Lustria’s own processing as a controller as described below.

1. Who This Policy Applies To

This policy applies to personal data we collect from: (a) representatives, employees and contacts of our business customers (“Customer Contacts“) who engage with us in connection with the supply of the Platform; (b) prospective customers, partners and suppliers who contact us or attend our events; (c) visitors to our corporate website; and (d) job applicants. Where Lustria processes personal data of end players on behalf of a customer operating a white-label or player account management deployment, Lustria acts as a processor for that data under the applicable Data Processing Agreement, and the customer’s own player-facing privacy policy, not this document, governs Lustria’s processing of that player data as against the player.

2. Data Controller and Contact Details

Lustria Ltd is the data controller for the personal data described in this policy. You can contact us by post at 20 Wenlock Road, London, England, N1 7GU, or by email at privacy@lustria-gaming.com. Where we are required to appoint a data protection officer or an EU representative, details will be published in this section and updated accordingly.

3. Personal Data We Collect

• Identity and contact data: name, job title, employer, business email address, phone number, and business address of Customer Contacts and prospective partners.

• Account and platform usage data: login credentials, access logs, IP address, device and browser information, and activity logs generated when Customer Contacts use our back-office, reporting and administrative tools.

• Commercial and contractual data: billing details, contract terms, correspondence, and due diligence or compliance documentation (such as licence numbers or know-your-business information) provided in connection with onboarding a business customer.

• Website and marketing data: cookies and similar technologies, IP address, browser type, pages visited, and marketing preferences collected via our corporate website and newsletter sign-ups.

• Recruitment data: CVs, cover letters, references and interview notes submitted by job applicants.

4. How We Use Personal Data and Our Legal Basis

• Providing and administering the Platform to our business customers, including account provisioning, technical support, and reporting — legal basis: performance of a contract with the business customer, or our legitimate interest in delivering the Services where the individual is a Customer Contact rather than the contracting party.

• Onboarding and compliance checks, including verifying a business customer’s gambling or gaming software licences, conducting know-your-business and anti-money laundering checks, and sanctions screening — legal basis: legal obligation and legitimate interest in preventing financial crime and regulatory breach.

• Billing and account administration, including invoicing and payment reconciliation — legal basis: performance of a contract and legal obligation (accounting and tax record-keeping).

• Communicating with prospective and existing customers, including responding to enquiries and sending service updates — legal basis: legitimate interest, or consent where required for direct marketing.

• Operating and securing our website, including essential cookies — legal basis: legitimate interest in maintaining a secure and functioning website.

• Analytics and marketing cookies, including measuring website usage and, where applicable, personalised content — legal basis: consent, obtained through our cookie banner.

• Recruitment, including assessing applications and conducting interviews — legal basis: steps necessary prior to entering into a contract, and legitimate interest in recruitment administration.

• Complying with legal and regulatory obligations, including responding to requests from the Gambling Commission, other gaming regulators, tax authorities or law enforcement — legal basis: legal obligation.

We do not use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect Customer Contacts or website visitors.

5. Cookies and Similar Technologies

1. Our corporate website and back-office portals use cookies and similar technologies to operate securely, remember preferences, and measure usage. Essential cookies are set on the basis of our legitimate interest in providing a functioning, secure service and cannot be disabled without affecting core functionality.
2. Non-essential cookies, including analytics and marketing cookies, are only set with your consent, given through our cookie banner on first visit. You may withdraw or change your consent at any time through the cookie settings link in the website footer or your browser settings.
3. Details of the specific cookies used, their purpose and duration are set out in our cookie table, available on request or via the cookie banner’s “manage preferences” option.

6. Sharing Personal Data

1. We share personal data with: (a) group Affiliates involved in providing the Platform; (b) sub-processors and technology vendors, including cloud hosting, customer relationship management, and payment processing providers, engaged under written contracts requiring an equivalent standard of protection; (c) Content Providers and payment service providers with whom a business customer has instructed integration, to the extent necessary for that integration; (d) professional advisers, including auditors, lawyers and insurers; and (e) regulators, law enforcement and government authorities, where required by law or to protect our legal rights.
2. We do not sell personal data to third parties.
3. Where a business customer instructs us to integrate with a specific Content Provider or PSP, that provider may act as an independent controller of any data it receives, and the business customer should review that provider’s own privacy notice.

7. International Data Transfers

Some of our sub-processors and group Affiliates are located outside the United Kingdom and the European Economic Area. Where we transfer personal data internationally, we rely on adequacy regulations, the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under the Data Protection Laws, and we carry out transfer risk assessments where required. Details of specific transfer mechanisms are available on request to privacy@lustria-gaming.com.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to satisfy legal, accounting, tax, and gambling regulatory record-keeping obligations, which commonly require retention of business records and compliance documentation for a minimum of five years following the end of the business relationship. Recruitment data is retained for no longer than twelve months after the relevant recruitment process concludes, unless the applicant consents to longer retention for future opportunities. Cookie-derived data is retained in accordance with the retention periods set out in our cookie table.

9. Security

We implement appropriate technical and organisational measures, including access controls, encryption in transit, network monitoring and staff training, to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. We require our sub-processors to maintain equivalent safeguards.

10. Your Rights

1. Subject to applicable law, you have the right to: request access to your personal data; request correction of inaccurate data; request erasure of your data; request restriction of processing; object to processing based on legitimate interest or for direct marketing; request data portability; and withdraw consent at any time where processing is based on consent.
2. To exercise any of these rights, contact us at privacy@lustria-gaming.com. We will respond within the statutory timeframe, generally one month, and may request identity verification before processing a request.
3. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), or, if you are located in the European Economic Area, with your local data protection supervisory authority.

11. Children’s Data

Our services are directed at business customers and their authorised personnel, not children. We do not knowingly collect personal data from individuals under the age of 18 through our corporate website. Lustria does not process end-player data directly except as a processor for a business customer’s platform, and player age verification is the responsibility of that customer as controller.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. We will post the updated policy on our website with a revised effective date, and where changes are material, we will provide additional notice to affected Customer Contacts.

13. Contact Us

For any questions about this Privacy Policy or our data protection practices, please contact us at privacy@lustria-gaming.com or by post at 20 Wenlock Road, London, England, N1 7GU.