CHANGES IN THE PROCESSING OF YOUR PERSONAL DATA REQUIRED BY ROYAL DECREE 958/2020

Detection of Possible Risk Behaviours and Actions Deriving From Them

It involves behavioural profiling, automated decision making, and the need to accept/consent

Version 20201223A-P Aviso

Alert

Relevant information on changes due to regulatory obligation to the processing of your personal data, which entails profiling of your behaviour, automated decision making, the need to accept/consent in order to detect risk behaviours and take action in such case.

From this moment you can only make gaming purchases or make deposits to Lotobolsa by accepting/consenting to the new aspects of the processing of your personal data. Only the data of purchases/deposits made since 15 January will be processed, not the ones made before then. The subscriptions that you may have will be disabled on 15 January unless you accept/consent to the new aspects first, which requires making at least one bet or making one deposit before that date as a way to show your acceptance/consent.

The rest of this page presents general information and Layer I information regarding the new aspects of the processing. When making a gaming purchase or deposit to your lotobolsa we will remind you of this information.

This information, as well as more extensive information (Layer II) can be viewed and downloaded in PDF format from https://www.loteriasyapuestas.es/f/loterias/web_corporativa/DatosPersonales/ClientesyUsuarios/Inscritos/vigente/EstipulacionesDatosPersonales-JuegoResponsable.html.

The general terms and conditions for the processing of personal data are contained in the gaming contract that you can consult at https://juegos.loteriasyapuestas.es/jugar/cas/configuracion/datos-cuenta/politicas.

General information on the new aspects of the processing of your personal data by SELAE for the purposes of Royal Decree 958/2020

The recently approved Royal Decree 958/2020, of 3 November, on commercial communications regarding gambling activities (available in the BOE, at www.boe.es/eli/es/rd/2020/11/03/958/con obliges the entire sector and therefore also SELAE to modify some aspects of its operations, among them, to analyse the purchases of each registered user in order to detect possible risk behaviours and, in the case of detected cases, to take the appropriate action.

This entails new aspects in the processing of your personal data (due to legal obligation), which requires that previously

- you are duly informed: on this page, which is presented (once) to all users after logging in, we inform you extensively, as well as we remind you at the time of each gaming purchase and each lotobolsa deposit, and that

- you accept/consent to the new aspects of the processing that we will carry out from 15 January: proceeding to complete the gaming purchase or deposit to lotobolsa, as indicated in said pages, entails declaring that you understand and agree to have been informed and that continuing with the purchase/deposit, you declare that you accept/consent to the processing by SELAE of your personal data for the detection of risk behaviours as required by Royal Decree 958/2020, in a free, specific, informed and unequivocal manner.

If at any time you do not accept/consent to the processing, it is sufficient that you avoid making any deposits or gaming purchases. Since the processing is a legal requirement, it is not possible to refuse your consent and make a deposit to lotobolsa or participate in any games.

These terms and conditions complement what is indicated in the gaming contract.

The information on your gaming purchases and lotobolsa deposits must be processed to comply with the established regulations, for the following purposes:

- Detection of possible risk behavioursspan>

- The execution, in case of detection, of the legally required measures:

o "sending an email (or equivalent means) informing you that it has been detected that you may have developed a risk behaviour;"

o restriction of issuance of commercial communications;

o other possible measures adopted within SELAE's Responsible Gaming framework contemplated in its action protocol. You can obtain information on other possible measures adopted within SELAE's Responsible Gaming framework here:https://www.selae.es/es/web-corporativa/responsabilidad-social/gestion-responsable-del-juego/juego-responsable

- The execution, in the case of self-prohibition and self-exclusion, of the legally required measures: the suspension of the gaming account and communication of the consequences associated with said suspension

The new aspects of the processing entail the profiling of your behaviour, generating data that may be considered to have special characteristics, and automated decision making.

The detection of possible risk behaviours will come into effect on 15 January, processing for this purpose all gaming purchases or lotobolsa deposits that occur after that date, but none of the ones prior to that date. If your wish is that your data is not processed for the purpose of determining possible risk behaviours, you should not make any purchase or deposit after 14 January.

The rest of this page presents Layer I of information regarding the new aspects of the processing. At the time of making a gaming purchase or a deposit to lotobolsa we will remind you that you are going to accept/consent to the new aspects of personal data processing and that when purchasing or making a deposit to lotobolsa you declare to be informed and accept/consent to the new aspects of the processing.

This information, as well as more extensive information (Layer II) can be viewed and downloaded in PDF format from https://www.loteriasyapuestas.es/f/loterias/web_corporativa/DatosPersonales/ClientesyUsuarios/Inscritos/vigente/EstipulacionesDatosPersonales-JuegoResponsable.html

Processing of personal data - Basic information (layer I)

We inform you of how SELAE processes and protects your data to detect possible risk behaviours and the actions that arise in such case.

Responsable do tratamento Data Controller	SOCIEDAD ESTATAL LOTERÍAS Y APUESTAS DEL ESTADO, S.M.E., S.A. (SELAE) - A86171964
Purposes	Comply with the regulations established for Responsible Gaming: for the detection of risk behaviours; for the execution, in case of detection, of the legally required measures: sending an email (or equivalent means) informing you that it would have been detected that you could have developed risk behaviours, restriction of the issuance of commercial communications, and other possible measures adopted in the Responsible Gaming framework of SELAE contemplated in its action protocol; and the execution, in case of self-prohibition and self-exclusion, of the legally required measures: the suspension of the gaming account and communication of the consequences associated with said suspension. You can obtain information on other possible measures adopted within SELAE's Responsible Gaming framework here: https://www.selae.es/es/web-corporativa/responsabilidad-social/gestion-responsable-del-juego/juego-responsable The foregoing must be understood with the implications that it entails: as in any processing, the data must be processed to satisfy business obligations within the legal framework and management needs - such as the corresponding economic-financial control of transactions and audits as detailed in Layer II - while always respecting due confidentiality and privacy and the principles of data minimisation and being pseudonymised or anonymised when feasible
Legitimation	The legitimising basis of the processing is the legal obligation, within the development of a contractual relationship.
Recipients	SELAE does not carry out any systematic communication to other entities. One-off communications may be produced for reasons of protection of SELAE's interests and legal needs that could arise for the administrative and legal defence of SELAE's interests. The regulations do not consider communications that are made at the request of Authorities within the legal framework, which, if applicable, are mandatory. SELAE does not transfer these data to third countries or international organisations that do not offer sufficient guarantees.
Profiling with data result of special characteristics and automated decision making	A profile is drawn up since the data is processed to detect eventual risk behaviours (behaviour evaluation), the result of the profile being a piece of data that may have special characteristics. For the detection of possible risk behaviours, the existence of activity patterns based on the volume, frequency and variability of product purchases and deposits to the lotobolsa will be evaluated objectively and automatically, without prejudice to other quantitative or qualitative elements that may also be relevant according to the mechanics of the different games or the experience of SELAE. The evaluation will be carried out in an automated manner. In case of detection, the data subject will be informed. You have the right to obtain human intervention from SELAE to express your point of view and challenge the decision.
Consent	Based on the plausible generation of personal data as a result of the profiling based on precaution, consent to the processing will be obtained.
Rights	To access, rectify and delete data as well as other rights, as explained in the Layer II information.
Source of the data	The data originates from the actions of the data subject, but they are derived, not collected from the data subject.
Period of retention	This data is processed for the purposes of compliance with gambling regulations, which require that the data be retained for six years following the termination of the gaming contract.
Additional information	You can consult additional and detailed information on Layer II Data Protection https://www.loteriasyapuestas.es/f/loterias/web_corporativa/DatosPersonales/ClientesyUsuarios/Inscritos/vigente/EstipulacionesDatosPersonales-JuegoResponsable-COMPLETO-20201223A-P.html).

Updating of terms and conditions

The necessity or desirability of updating these terms and conditions may arise. Any modification will be published and warned on SELAE's Digital Gaming Marketing Platform, and the data subject must take into account that the processing of personal data by SELAE will be governed by current terms and conditions. Changes that entail substantial modifications must be communicated to the data subject, without prejudice to the responsibility of the customer to periodically access the terms and conditions published at all times in order to be aware of the latest version in force. The history and modifications are indicated below:

Date	Version	Changes
23 December 2020	20201223A-P	Initial version in production

This information, as well as more extensive information (Layer II) can be viewed and downloaded in PDF format from https://www.loteriasyapuestas.es/f/loterias/web_corporativa/DatosPersonales/ClientesyUsuarios/Inscritos/vigente/EstipulacionesDatosPersonales-JuegoResponsable.html.