Privacy Policy

At Rootz, transparency is essential, and we take your privacy extremely seriously. We appreciate that you trust us with your personal information and want to be transparent about how we use it.

Rootz LTD, acting as data controller, is committed to protecting your personal data and processing it in compliance with applicable laws – notably The Maltese Data Protection Act (Chapter 586 of the Laws of Malta) as well as the various subsidiary legislation issued under the same – the 'DPA'; The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of Personal Data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – the 'GDPR'.

This Privacy Policy describes the privacy practices for our applications, software, websites, APIs, products, and services (the "Services"). You will learn about the data we collect, how we use it, the controls we give you over your information and the measures we take to keep it safe.

If you have any questions, please email us at support@tuplaus.com.

Specifically, in this Privacy Policy, we will cover:

1. Who we are and How to contact us
2. Why we collect information
3. Where we get your information from
4. Information we collect
5. How we use information
6. How we communicate with you
7. How information is shared
8. Your rights to access and control your personal data
9. Data Retention
10. Promoting Safety and Security
11. International Operations and Data Transfers
12. Privacy Compliance

1. Who We Are and How to Contact Us

If you live in the European Economic Area or Switzerland, then Rootz LTD, a Maltese company, controls your data and provides you with the Services. If you seek to exercise your statutory rights, please get in touch with our Data Protection Officer at dpo@tuplaus.com. You may also contact us at:

Rootz LTD
Ewropa Business Centre
Level 3 - 701, Dun Karm Street
Birkirkara BKR 9034
Malta

Email: support@tuplaus.com

If you seek to exercise your statutory rights, please get in touch with our Data Protection Officer at dpo@tuplaus.com.

As Rootz is based in Malta, we are subject to the General Data Protection Regulation (GDPR). This means that whenever we process personal data, we always follow the GDPR principles:

• Lawfulness, fairness and transparency;
• Purpose limitation;
• Data minimisation;
• Accuracy;
• Storage limitation;
• Integrity and confidentiality; and
• Accountability.

If you have questions, suggestions, or concerns about this policy or our use of your information, please email us at support@tuplaus.com.

2. Why we collect personal information

We need to process your personal information to provide you with our services. We will only ask you for the minimum amount of information and use it only for lawful purposes.

When you register for an account with Tuplaus, you enter into a contract with us, as set out in our Terms and Conditions. For us to be able to keep up our end of the contract and provide you with access to our services, we need to process some personal information about you. We will always clarify which information is mandatory and which information you can decide not to give us if you don't want to. If there are mandatory pieces of information and you wish to refrain from providing them, you cannot hold an account with us and use our services. We use your information to:

• Help you create, operate and manage your personal profile, allowing you to access our games and services;
• Manage loyalty points and reward schemes;
• Protection of your personal profile and account;
• Process your bets and transactions, including your use of credit/debit cards and online payment systems;
• Provide customer support and service updates;
• Analyse user trends and improve the services we provide; and
• Monitor the registration of multiple accounts.

Some of the information we process about you is also necessary for us to comply with our legal and regulatory obligations as a gaming company, such as licensing requirements, responsible gaming and Anti Money Laundering (AML) Regulations. This information is processed to:

1. Carry out age and identity verification checks;
2. Verify the source of wealth;
3. Carry out due diligence checks;
4. Monitor and investigate transactions and gameplay to prevent and detect fraud, money laundering, problem gambling and other irregular gaming activities;
5. Consult self-exclusion registers and manage problem gambling and
6. Manage registration of duplicate accounts and individuals from jurisdictions where gambling is prohibited.

Tuplaus processes a small amount of information about anyone who visits our website. We do this to better understand the individuals who visit our websites and to help us identify where there are problems, security issues or things going wrong for visitors to the site. We do this by using technical programmes and functionality cookies. When we process information in this way, the legitimate interests of Tuplaus must ensure that we provide an enjoyable, secure and smooth customer journey and protect the product from abuse that could compromise other users' ability to use the service. Read more about our Cookie Policy.

Tuplaus will contact you about news, promotions, and bonuses when we have your consent. We will only contact you for these reasons if we have your consent. You have complete control over whether and how we contact you through the settings in your account. You can access and change these settings at any time.

Tuplaus will never ask you to provide sensitive personal information, such as information about your health, race, or ethnic origin. You may disclose information like this to us, such as when speaking with us. Any chats or emails are assigned to your account with us. Where you disclose a health condition that may impact your ability to make rational decisions around your gameplay, we may block you from our services for your safety.

3. Where we get your information from

Most of the information we have about you is what you provide us. However, sometimes, we also get information about you from other sources.

Under our AML obligations, we are required to carry out due diligence checks that confirm information about you. In some circumstances, we may also need to verify your source of wealth. We work with reputable external companies in the gaming industry to carry out these checks, and they provide a report that contains information about you and your background.

In some circumstances, payment service providers may supply us with a small amount of personal information when they carry out a transaction for you so that we can connect transactions to you as a player.

4. Information We Collect

When you use our Services, we collect the following types of information:

Information you provide us

Account Information
Some information is required to create an account on our Services, such as your name, address, email address, password, date of birth, gender, telephone number and country of residency. This is essential data for the 'Know Your Customer' process as imposed by the anti-money laundering regulations applicable both in Malta and in the EU. This is the only information you must provide to create an account with us.

Given the strict legal obligations imposed upon us, we also ask for occupation and source of income. There might be situations where you are also asked to provide documentary evidence to prove that you only use legitimate funds.

Additional Information
We might request that you provide us with additional information, such as your game preferences and payment transaction history, to help improve your experience or enable certain features of the Services.

If you contact us or participate in a survey, contest, or promotion, we collect the information you submit, such as your name, contact information, and message.

Information from Third-Party Services
If you choose to connect your account on our Services to your account on another service, we may receive information from the other service.

Payment and Card Information
To receive payments, you must provide certain information for identification and verification, such as your name, credit, debit, or other card number, card expiration date, and CVV code. This information is encrypted and sent to your card network, which, upon approval, sends back a token, a set of random digits for engaging in transactions without exposing your card number. For convenience, we store the last four digits of your card number and your issuer's name and contact information.

Location Information
We may also derive your approximate location from your IP address.

Usage Information
When you access or use our Services, we receive usage data. This includes information about your interaction with the Services, such as when you view or search content, create or log into your account, play a game, or collect or use a bonus or loyalty point.

We also collect data about the devices and computers you use to access the Services, including IP addresses, browser type, language, operating system, the referring web page, pages visited, location, and cookie information.

Cookie Information
Our Websites use "cookies". A "cookie" is a piece of software which may be sent to your computer. Cookies enable us to collect information about how our Websites and services are being used and to manage them more efficiently.

Our up-to-date Cookie Policy.

5. How we use Information

We use the information we collect for the following purposes:

Provide and Maintain the Services
Using the information we collect, we can deliver the Services to you and honour our Terms of Service contract. For example, we need to use your information to provide you with your player dashboard, game suggestions, and any other relevant marketing promotions.

Improve, Personalise and Develop the Services
We use the collected information to improve and personalise the services and develop new ones. For example, we use the information to troubleshoot and protect against errors, perform data analysis and testing, conduct research and surveys, and develop new features. We also use segmentation to split our players into groups based on their gaming behaviour. We do this to help us understand how people use the product and to help us develop our marketing approach, including bonuses and promotions.

When you allow us to collect location information, we will use that information to provide and improve the features of the Services. For example, we may present your favourite games or games you might be interested in at the top of our game content based on your preferences, country of residence and gameplay data.

We must take several steps to comply with the rules regarding Anti-Money Laundering (AML), Counterterrorism Financing, and fraud. To do this, we employ programmes that monitor player behaviour and alert us to suspicious or fraudulent transactions. Where suspicious transactions are flagged, we escalate them to the necessary regulators and enforcement bodies.

As part of our license, we also have obligations around responsible gaming. To do this, we employ a system that flags any gambling patterns or behaviours a player exhibits that could indicate problem gambling. When the system flags a player, one of our responsible gaming team members reviews the account and, where necessary, will contact the player to discuss their gameplay and provide information and advice.

Third Party Websites
Our Websites may, from time to time, contain links to both local and/or international third-party Websites after obtaining permission from them. Any such links are not an endorsement by us of any information in such Websites or products and/or services offered through the same. We shall not accept any responsibility whatsoever for the content, use, availability, privacy practices or the content of any such Websites. Please note that upon entering such other Websites, you become subject to the Privacy Policy of these other sites.

Third parties are only permitted to link any other Website to our website without obtaining our prior written consent.

6. How we Communicate with you

We use your information, when needed, to send you Service notifications and respond to you when you contact us. We also use your information to promote new features or products that you would be interested in. You can control marketing communications and most Service notifications by using your notification preferences in your account settings or via the "Unsubscribe" link in an email.

Use of Email for Communications
All email messages are routinely scanned for viruses. In the case of emails, we may reject, delay or remove content from emails due to their nature, content or attachments, which may disrupt our systems or because they may pose security issues such as viruses. We may also filter out emails containing certain content because the content is offensive or the email is unwanted or spam. Unfortunately, this may result in "innocent" emails being affected in certain circumstances, but we try to reduce such occurrences.

Please be aware. However, that data sent through the Internet may technically be transmitted across international borders even where the sender and receiver of information are located in the same country. Consequently, personal information relating to you may be transmitted via a country with a lower level of data protection than in your country of residence.

7. How Information is Shared

For External Processing
In some circumstances, we need to share your information with recipients outside of Tuplaus to provide our Services. When we share with third parties, we always ensure that there is an appropriate contract in place, that the information being shared is transferred securely, and that we only share the minimal amount of your information that we need to. Tuplaus will never sell your information to any other third parties.

Third parties we work with include payment service and game providers, analytics services, identity verification and AML-related services, social media platforms, website performance and security systems affiliates, and other partners who process data for us based on our instructions and in compliance with this policy and any other appropriate confidentiality and security measures. These partners provide global services, including customer support, information technology, payments, marketing, data analysis, research, and surveys.

When you Agree or Direct us to Share
You may direct us to disclose your information to others, such as when you use our community features like the "Races". For specific information, we provide you with privacy preferences in account settings and other tools to control how your data is visible to other service users. Remember that if you choose to participate in a "Race", information like your first name will be visible to all other participants.

Analytics and Advertising Services Provided by Others
We work with partners who provide us with analytics and advertising services. These services include helping us understand how users interact with the Services, serving advertisements on our behalf across the Internet, and measuring the performance of those advertisements. These companies may use cookies, pixels, and similar technologies to collect information about your interactions with the Services and other websites and applications.

We may share non-personal information that is aggregated or de-identified so that it cannot reasonably be used to identify an individual. We may prepare such information for research or statistical purposes.

We do not transfer your personal information to third parties for marketing purposes or any purposes other than those listed above.

For Legal Reasons or To Prevent Harm
Without prejudice to anything contained in this Privacy Policy, we are obliged to disclose personal data relating to you to any third party if such disclosures are necessary among other things for the following purposes:

• to prevent, detect or suppress fraud or any other criminal offence;
• where it is necessary as a matter of national or public security;
• in the interest of national budgetary, monetary or taxation matters that can arise;
• to protect and defend our rights and property or that of users;
  -to protect against abuse, misuse or unauthorised use of our Services;
• to protect the personal safety or property of users of our Services (e.g. if you provide false or deceptive information about yourself or attempt to pose as someone else, we shall disclose any information we may have about you in our possession to assist any investigation into your actions); and
• for any purpose necessary for the performance of any agreement you may have entered into with us, as may be required under any law.

Our policy is to notify you of a legal process seeking access to your information, such as search warrants, court orders, or subpoenas, unless we are prohibited by law. In cases where a court order specifies a non-disclosure period, we provide delayed notice after the expiration of the non-disclosure period.

8. Your Rights to Access and Control your Personal Data

We provide you with account settings and tools to access and control your personal data, as described below, regardless of where you live.

Accessing and Exporting Data
You have several rights that you can exercise when it comes to your information. These rights include:

• Having access to the information that we hold about you
• Being able to rectify the information we have about you that is incorrect
• In minimal circumstances, having your information deleted
• In some circumstances, your information is restricted or "paused."
• Have your information provided to you in a digital format and, where possible, transferred to another organisation

You can access your personal information, including your dashboard, by logging into your account.

If you would like to exercise any of these rights, you should email our Support at support@tuplaus.com from your registered email address and provide:

• Your name
• Contact details
• Your registered email
• Full details of your request

In some circumstances, we may request that you provide us with identity documents so that we can verify your identity. We will fulfil your request to the best of our ability.

Editing and Deleting Data
Your account settings let you change your personal information. For instance, you can edit the profile data you provide or delete your account by contacting us at support@tuplaus.com.

If you choose to delete your account, please note it may take up to 30 days to delete your transactional data, like the data recorded during your games. This is due to the size and complexity of the systems in which we store data.

We recognise your right to be forgotten; however, we have a legal obligation due to Anti-Money Laundering (AML) regulations to retain all personal account data obtained for customer due diligence purposes, such as your name and address and all documentation gathered during registration and payment processes for 5 years after you close your account. You may also wish to note that this period may be extended by a further 5 years where such extension would be considered necessary for the prevention, detection, analysis and investigation of money laundering or funding of terrorism activities by the Financial Intelligence Analysis Unit, relevant supervisory authorities or law enforcement agencies.

Customising or Restricting your Data Use
We provide you with account settings and tools to control your data use. For example, through your privacy settings, you can limit how your information is visible to other Service users; using your notification settings, you can limit the notifications you receive from us.

You have a right to object to using your information for direct marketing purposes. Please see your notification settings to control our marketing communications about new games and products. Please also review our Cookie Policy for your options to control how we and our partners use cookies and similar technologies for advertising.

If you need further assistance regarding your rights, please contact our Data Protection Officer at dpo@tuplaus.com, and we will consider your request per applicable laws. You also have the right to lodge a complaint with your local data protection authority or with the Malta Data Protection Commissioner, our lead supervisory authority.

9. Data Retention

We keep your account information, like your name, email address, and password, for as long as your account exists because we need it to operate it. For more information on the retention period, please contact us at dpo@tuplaus.com.

10. Promoting Safety and Security

We use the information we collect to promote the safety and security of the Services, our users, and other parties. For example, we may use the information to authenticate users, facilitate secure payments, protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and policies.

For personal data, we rely on several legal bases to process the data. These include when you have given your consent, which you may withdraw at any time using your account settings and other tools; when the processing is necessary to perform a contract with you, like the Terms & Conditions; and our legitimate business interests, such as in improving, personalising, and developing the Services, marketing new features or products that may be of interest, and promoting safety and security as described above.

Information Security
We work hard to keep your data safe and make all reasonable efforts to safeguard the confidentiality of the personal information we process. We regularly review and enhance our technical, physical, and managerial procedures to ensure that your personal data is protected. These procedures cover areas such as access control, authentication, audit, monitoring, alarms, data storage, and backup and transmission standards. This ensures no unauthorised access or modifications to data, improper use or disclosure, or unlawful destruction or accidental loss.

Our security policies, rules, and technical measures are dedicated to protecting the personal information we control. All our employees and third-party data processors who have access to and are associated with the processing of personal information are further obliged to respect the confidentiality of this personal data and are subject to a code of conduct that requires them to adhere to privacy principles.

By its very nature, however, the Internet is not a secure medium, and data sent via this medium can potentially be subject to unauthorised acts by third parties. No method of transmitting or storing data is completely safe; however, if you have a security-related concern, please get in touch with Customer Support.

11. International Operations and Data Transfers

Tuplaus keeps your information within the European Economic Area (EEA) wherever possible. However, your information may have to leave the EEA in some circumstances, such as when we work with third parties. Tuplaus always ensures that any transfers outside of Europe are carried out in line with the law and made securely.

We rely on multiple legal bases to lawfully transfer personal data worldwide. These include your consent, the EU-US and Swiss-US Privacy Shield, and EU Commission-approved model contractual clauses requiring certain privacy and security protections. You may obtain copies of the model contractual clauses by contacting us.

12. Privacy Compliance

Our Privacy Policy is compliant with the Data Protection Act (Chapter 586 of the Laws of Malta) and any future data protection legislation that may be enacted from time to time, including but not limited to the General Data Protection Regulation (GDPR) and any other applicable privacy law.

Making a complaint
If you are unhappy with how Tuplaus has handled your information, you can first raise this with our Support team at support@tuplaus.com to try to resolve it.

If you cannot resolve your complaint with the Support team, the next step is to file a complaint with our Data Protection Officer (DPO). You can do this by sending an email to dpo@tuplaus.com and detailing:

• Your name
• Your contact details
• Your registered email
• Full details of the complaint that you have

The DPO will then investigate your complaint and determine whether your information has been handled appropriately and in accordance with this privacy notice, our legal obligations, and our internal policies and procedures. The DPO will then contact you regarding the outcome of the investigation and any steps taken as a result.

If, after raising your complaint with the DPO, you are unhappy with the resolution to your complaint, you can make a complaint to our lead supervisory authority, the Maltese Data Protection Commissioner:

Office of the Information and Data Protection Commissioner
Level 2, Airways House, High Street
Sliema, SLM 1549, Malta
Phone: (+356) 2328 7100
Email: idpc.info@idpc.org.mt

Translations of this privacy notice
We have translated our privacy notice from English into the official languages of the countries to which we provide our services. This ensures that all of our customers are clear about how Tuplaus uses personal information.

If there are any conflicts or inconsistencies between the translated versions of this privacy notice, the English version will prevail.

Changes to this Policy
This Privacy Policy may be modified at any time, particularly where statutory obligations or the interest of our users' security require it. Any such changes will be posted here so you are always informed of how and why we process your personal information.

We will notify you before we make material changes to this policy and allow you to review the revised policy before deciding if you would like to continue using the Services.