PRIVACY & DATA PROTECTION POLICY

Issued by SUVYD B.V.
Applicable to: orobet.com and affiliated services

At SUVYD B.V., we are committed to protecting your privacy and ensuring that your personal data is handled in a lawful, fair, and transparent manner. This Privacy & Data Protection Policy ("Policy") explains what information we collect, how we use it, and the rights you have in relation to your data.

This Policy applies to all users of the website orobet.com, its mobile versions, applications, and other related services (the "Platform"). It reflects our obligations under applicable laws of Curaçao, including regulatory requirements of the Curaçao Gaming Control Board (License No. OGL/2024/846/0501), and is aligned with international data protection best practices, such as the EU General Data Protection Regulation (GDPR) where applicable.

In this document:

• "SUVYD B.V.", "we", "us", or "our" refers to SUVYD B.V., a company registered under the laws of Curaçao with registration number 164492 and registered address at Abraham Mendez Chumaceiro Boulevard 03, P.O. Box 4750, Curaçao.
• "Client", "User", or "you" refers to any individual accessing or using our services, products, websites, or interacting with us directly or indirectly.

By registering an account, accessing orobet.com, or using any of our services, you confirm that you have read, understood, and agree to the terms of this Privacy & Data Protection Policy.

If you do not agree with any part of this Policy, please discontinue the use of our services immediately.

1. Information We Collect

In the course of providing services via the orobet.com platform, SUVYD B.V. collects and processes various categories of personal and non-personal information to meet legal obligations, ensure secure gameplay, prevent fraud, and enhance user experience.

We collect the following types of data:

1.1 Personal Data (Personally Identifiable Information – PII)

This includes any information that can directly or indirectly identify you:

• Account Registration Data:

• Full legal name

• Email address

• Date of birth

• Gender

• Physical residential address

• Telephone number

• National ID, passport, or other government-issued identification

• Country of residence

• Preferred currency (e.g., USD)

• Occupation

• Know Your Customer (KYC) & Anti-Money Laundering (AML) Data:

• Source of funds and source of wealth

• Banking details or proof of income

• Payment instrument details (IBAN, credit card masking, e-wallet identifiers)

• Verification Documents:

• Photo or scan of government-issued ID

• Proof of address (e.g., utility bill, bank statement)

• Selfie photo or biometric data for identity confirmation

• Video verification (if required)

• Transactional Data:

• Deposit, withdrawal, bonus, and wagering history

• Account balance and payment method usage

• Sensitive Categories (under strict controls):

• Politically Exposed Person (PEP) status

• Self-exclusion or responsible gaming limits

• Communication records in case of complaints or disputes

• Social Media Integrations (if enabled):

• Basic public profile data from connected accounts (e.g., Facebook, Google)

• Profile photo, name, contact email, friend list (where applicable)

1.2 Technical and Non-Personal Data

Collected automatically via cookies, server logs, and analytics tools:

• Device Information:

• Device type, operating system, screen resolution, language settings

• Browser type and version

• IP address and approximate geolocation

• Unique device identifiers and session ID

• Usage and Gameplay Data:

• Page views and navigation patterns

• Clickstream and session duration

• Login timestamps and failed login attempts

• Game history, bet amounts, win/loss results, bonus usage

• Security and Anti-Fraud Data:

• Detection of suspicious behavior (e.g., automated access, multi-accounting)

• VPN or proxy use

• Behavioral profiling for risk scoring

Note: When non-personal data is combined with personal data, it is treated as personal data under this Policy.

1.3 Information from Third Parties

We may also collect or validate data about you through:

• External KYC/AML Providers:
  Sanction list screening, identity verification checks, adverse media screening.

• Payment Processors & Banks:
  Confirmation of successful deposits or withdrawals, fraud flags, chargeback history.

• Affiliates or Referrers:
  Campaign identifiers, promotional data, or bonus eligibility.

1.4 Data Retention Periods

Different types of personal data are retained for different periods depending on regulatory obligations and operational needs. For example:

• KYC and AML-related documents: retained for at least five (5) years from account closure or last transaction, whichever is later.

• Technical logs and activity data: typically retained for no longer than twelve (12) months unless required for security audits.

• Marketing consent records: retained until consent is withdrawn and no longer than 24 months from last interaction.

All retention timelines are periodically reviewed and revised as necessary.

2. Use of Information

We collect and process your personal data for lawful, fair, and transparent purposes, as permitted under applicable legislation including but not limited to the General Data Protection Regulation (GDPR) and Curaçao AML regulations. Your data is used for the following clearly defined purposes:

2.1. Contractual Obligations

To fulfil our obligations under the Terms of Service and to provide you with access to the orobet.com platform, including:

• Creating, verifying, and managing your gaming account

• Processing deposits, withdrawals, and bonuses in USD or other supported currencies

• Enabling gameplay, tracking bets, wins/losses, and bonus participation

• Communicating important service-related updates

2.2. Legal and Regulatory Compliance

To comply with anti-money laundering (AML), counter-terrorist financing (CTF), tax, fraud prevention, and responsible gaming requirements, including:

• Performing KYC (Know Your Customer) checks during registration and ongoing account activity

• Monitoring gameplay and transaction activity for suspicious patterns

• Reporting suspicious activity to competent authorities (e.g., FIU/MOT)

• Enforcing self-exclusion or cooling-off periods as requested by the Client or required by law

2.3. Legitimate Business Interests

To improve and maintain our services, and ensure platform security and reliability:

• Detecting, investigating, and preventing fraud, abuse, or cheating

• Conducting system audits, service analytics, and internal performance reviews

• Enhancing product usability, optimizing gameplay experience, and improving support services

• Monitoring system performance and platform availability

Note: We conduct a legitimate interest balancing test to ensure your rights and freedoms are not overridden when relying on this legal basis.

2.4. Marketing and Promotions

To send you offers and promotions that may interest you, provided you have opted in:

• Email or SMS communication regarding bonuses, tournaments, and exclusive offers

• Personalized content based on your preferences or playing behavior

• Use of cookies and analytical tools to tailor promotions

You may opt out of receiving marketing communications at any time via your account settings or by following the unsubscribe link in emails.

2.5. Consent-Based Processing

In some cases, we may rely on your explicit consent:

• Social media logins or data access (e.g., Facebook, Google)

• Participation in surveys, competitions, or affiliate campaigns

• Using optional services that require additional personal information

You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal.

2.6. Security and Risk Management

To ensure a secure, fair, and compliant environment for all users:

• Identifying IP anomalies, VPN usage, or device fingerprinting

• Enforcing responsible gaming limits and compliance flags

• Maintaining audit trails for internal investigations and dispute resolution

2.7 Data Minimization and Purpose Limitation

We collect and process only the minimum necessary personal data required to achieve the specific purposes outlined in this Policy. Data is not used for unrelated purposes unless legally required or with your explicit consent.

3. Disclosure of Your Personal Information

We treat your personal data with strict confidentiality and only share it when necessary for legal, contractual, or operational purposes. We do not sell, lease, or trade your personal information.

Your data may be disclosed to the following categories of recipients:

3.1. Service Providers and Processors

We may share your data with third parties that process information on our behalf for the purpose of providing our services. These include:

• Identity and document verification partners

• Payment processors and banking institutions

• IT infrastructure and hosting providers

• Customer support platforms and communication services

• Data analytics and fraud detection software providers

• KYC/AML screening service providers (e.g., sanctions/PEP databases)

All such third parties are contractually bound to handle your data securely and in compliance with data protection legislation, including the GDPR.

3.2. Regulatory and Legal Authorities

We may disclose your personal data where required by law, regulation, or upon formal request from competent authorities, such as:

• The Curaçao Gaming Control Board (GCB)

• Financial Intelligence Unit (FIU/MOT)

• Tax authorities

• Courts or law enforcement agencies

• Other licensed gaming regulators, when applicable

Disclosure may also occur if we have a reasonable suspicion of fraud, money laundering, terrorist financing, or criminal activity involving your account. International Transfers where your personal data is transferred outside the European Economic Area (EEA) or other jurisdictions deemed adequate by GDPR standards, we ensure appropriate safeguards are in place. These may include Standard Contractual Clauses (SCCs), data processing agreements, or other legally approved mechanisms.

3.3. Partnered Gaming Operators and Financial Institutions

If your actions raise compliance concerns (e.g., bonus abuse, collusion, fraudulent activity), your personal data and transactional records may be shared with:

• Other regulated gaming operators

• Affiliated platforms within our corporate group

• Banks or financial institutions involved in disputed or suspicious transactions

This is done strictly on a need-to-know basis and in line with AML/CTF cooperation frameworks.

3.4. Corporate Restructuring and Business Transfers

In the event of a merger, acquisition, asset sale, reorganization, or bankruptcy, your data may be shared with third parties involved in the transaction, under strict confidentiality obligations and only if necessary for the continued operation of services or compliance with legal duties.

3.5. With Your Consent

Where required by law or for optional services (e.g., marketing by third parties, integration with external accounts), we may disclose your information with your explicit consent. You will be fully informed prior to any such disclosure and may withdraw your consent at any time.

4. Protection of Information

At SUVYD B.V., we implement robust technical and organizational measures to ensure the confidentiality, integrity, and availability of your personal data in accordance with applicable laws, including the General Data Protection Regulation (GDPR) and the Curaçao Gaming Control Board (GCB) standards.

4.1. Data Security Measures

We protect your personal information through:

• 256-bit SSL encryption for all data in transit

• AES encryption for sensitive data at rest

• Firewall and intrusion detection systems (IDS)

• Access control policies restricting access to authorized personnel only

• Regular penetration testing and vulnerability assessments

• Multi-factor authentication (MFA) for internal administrative access

• Encrypted backups to protect against data loss or corruption

4.2. Data Storage

Your personal data is stored on secure servers located within the European Economic Area (EEA) or other jurisdictions that provide an adequate level of data protection under GDPR. We do not store unnecessary or outdated data. 

We also implement strict policies for data retention and destruction. Backups are retained securely for up to 90 days, after which they are purged using secure deletion protocols to prevent data recovery.

4.3. Internal Access and Confidentiality

Access to your personal data is granted only to employees or authorized third parties who require the information to perform their duties (e.g., compliance officers, support staff, finance team). All personnel are subject to:

• Confidentiality obligations

• AML and GDPR training

• Periodic access reviews

4.4. User Responsibilities

While we take all reasonable measures to protect your data, you are also responsible for safeguarding your login credentials and ensuring that your account is not accessed by unauthorized parties. Always:

• Use strong, unique passwords

• Avoid public or unsecured Wi-Fi for logging into your account

• Enable multi-factor authentication (if supported)

4.5. Data Integrity and Accuracy

We rely on you to provide accurate and up-to-date information. You can request a review or update of your personal data at any time via ayuda@orobet.com. If we detect inconsistencies, we may temporarily suspend access to your account until the data is verified.

4.6. Breach Notification

In the unlikely event of a data breach involving your personal information:

• We will notify the relevant data protection authority (if required by law)

• We will notify affected users without undue delay

• We will take immediate action to mitigate the risk and prevent recurrence

5. Your Rights

As a data subject, you have specific rights under the General Data Protection Regulation (GDPR) and relevant data protection laws. At SUVYD B.V., we fully respect and uphold these rights in our processing of your personal data.

You may exercise the following rights at any time by contacting us at ayuda@orobet.com.

5.1. Right to Be Informed

You have the right to receive clear and transparent information about how we collect, use, and share your personal data. This Privacy Policy serves as the primary source of that information.

5.2. Right of Access

You have the right to request access to your personal data held by SUVYD B.V., including:

• The categories of data we process

• The purpose of the processing

• The recipients or categories of recipients with whom the data is shared

• The retention period or criteria used to determine it

We will provide this information within 30 days of your verified request, unless an extension is required due to complexity.

5.3. Right to Rectification

If you believe that any personal data we hold about you is incorrect or incomplete, you may request that we correct or update it. You may also update certain details directly through your account profile.

5.4. Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data if:

• It is no longer necessary for the purposes for which it was collected

• You withdraw consent (where applicable)

• You object to the processing and there are no overriding legitimate grounds

• The data has been unlawfully processed

• The data must be erased to comply with a legal obligation

Please note: Some data may be retained to comply with AML (Anti-Money Laundering) obligations, regulatory audits, or dispute resolution policies. You may also contact the Curaçao Gaming Control Board (GCB), our primary supervisory authority, via their official website: https://www.gamingcontrolcuracao.org or email info@gamingcontrolcuracao.org.

5.5. Right to Restrict Processing

You may request that we restrict processing of your personal data if:

• You contest the accuracy of the data

• The processing is unlawful but you oppose deletion

• You have objected to processing and we are verifying the legitimacy of our grounds

• We no longer need the data, but you require it for a legal claim

5.6. Right to Data Portability

Where technically feasible, you may request that your personal data be transferred directly to another service provider or receive a copy in a structured, commonly used, machine-readable format.

5.7. Right to Object

You may object to the processing of your personal data when:

• The processing is based on our legitimate interests

• The data is used for direct marketing purposes

In such cases, we will stop processing your data unless we demonstrate compelling legitimate grounds or are required to do so by law.

5.8. Rights Related to Automated Decision-Making and Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you, unless:

• It is necessary for entering into or performance of a contract

• You have given your explicit consent

• It is authorized by law

SUVYD B.V. does not currently carry out any fully automated decision-making that falls within this category.

5.9. Right to Withdraw Consent

If the processing of your personal data is based on your consent, you may withdraw this consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to your withdrawal.

5.10. Right to Lodge a Complaint

You have the right to file a complaint with your local data protection authority or the Curaçao Gaming Control Board (GCB) if you believe that we have failed to comply with our obligations under data protection law.

6. Account Closure

You may request the closure of your account at any time by contacting our support team at ayuda@orobet.com. Upon receiving your request, we will take all reasonable steps to confirm your identity before proceeding with the closure.

6.1. Immediate Effects of Account Closure

Once your account is closed:

• You will no longer be able to access or use our services

• All marketing and promotional communications will be discontinued

• Any remaining bonus balance or promotional benefits will be forfeited

• The account cannot be reopened unless a specific review and verification process is completed

6.2. Withdrawal of Remaining Funds

Prior to account closure, you must request the withdrawal of any available real money balance (excluding bonuses). If your balance is below the minimum payout threshold, please contact support to arrange a manual refund, subject to verification.

In certain cases, we may retain funds for a limited time to:

• Complete open verification or fraud checks

• Finalize active bets or disputed transactions

• Comply with regulatory reporting obligations

6.3. Data Retention After Closure

In accordance with the applicable Anti-Money Laundering (AML) regulations and the Curaçao Gaming Control Board (GCB) licensing requirements:

• Your personal data and transaction records will be retained for a minimum of five (5) years from the date of account closure or last transaction, whichever is later
  Data required for legal, compliance, or dispute resolution purposes may be retained beyond this period

• After the retention period, your data will be securely deleted or pseudonymized (anonymized beyond restoration)

6.3.1 Financial Recordkeeping

Certain financial transaction records may be retained beyond the standard retention period to comply with national accounting, auditing, and tax reporting laws.

6.4. Exceptions

We reserve the right to deny account closure in the following circumstances:

• You are under active investigation for fraudulent, criminal, or suspicious activity

• Your account is subject to a regulatory or legal hold

• There are unresolved disputes or chargebacks

6.5. Right to Reopen an Account

Reactivation of a closed account is not guaranteed and may only occur after a full identity and risk reassessment, including KYC verification and approval from our Compliance Department. Accounts closed due to self-exclusion, responsible gambling concerns, or breach of terms may be permanently disabled.

7. Mitigating Risks

SUVYD B.V. takes your data security seriously and is committed to providing a secure environment for all Users. We encourage you to follow the best practices outlined below to further safeguard your account and personal information.

7.1. Use Strong Passwords

• Create a unique password for your orobet.com account.

• The password must contain at least 10 characters, including uppercase and lowercase letters, numbers, and special characters.

• Do not reuse passwords from other websites or platforms.

• Change your password periodically and avoid sharing it with others.

7.2. Protect Your Devices

• Keep your operating system, browser, and antivirus software up to date.

• Install anti-malware and firewall software to detect and block threats.

• Lock your device with a passcode, fingerprint, or biometric authentication when not in use.

7.3. Avoid Using Public or Shared Devices

• Avoid accessing your account from public Wi-Fi or shared computers, such as internet cafés, libraries, or hotels.

• Always log out from your orobet.com account after each session, especially when using a shared device.

• Do not save your login credentials in public browsers or password managers without encryption.

7.4. Be Aware of Phishing Attempts

• Do not click on suspicious links in emails, SMS, or messages claiming to be from orobet.com unless you are certain of their authenticity.

• SUVYD B.V. will never ask for your password or payment details via email, phone, or messaging services.

• If you suspect you’ve received a phishing message or fraudulent contact, report it immediately to ayuda@orobet.com.

7.5. Limit Personal Data Exposure Online

• Be cautious when sharing personal details on social media or public forums.

• Do not disclose sensitive account information (e.g., login details, KYC documents) outside official communication channels.

7.6. Enable Additional Account Protection

• Where supported, enable two-factor authentication (2FA) for added security.

• Use biometric login (e.g., fingerprint, Face ID) on mobile devices when available.

7.7. Monitor Account Activity

• Review your transaction history, login records, and account changes regularly in your Personal Profile section.

• Immediately report unauthorized activity or anomalies to our Support Team.

8. Marketing

SUVYD B.V. may contact you via email, SMS, push notifications, or other electronic communication channels to provide you with:

• Promotional offers

• Bonus announcements

• Personalized content and campaigns

• Product or service updates

• Surveys to improve user experience

These communications are sent only if you have provided explicit consent (opt-in) during registration or via your profile settings. You may withdraw this consent at any time.

8.1. Marketing Preferences

You may manage your marketing preferences via your Personal Profile settings on orobet.com. There you can:

• Enable or disable email marketing

• Enable or disable SMS marketing

• Manage push notification preferences

• Choose specific types of promotional content you are interested in

8.2. Opt-Out / Unsubscribe

All promotional emails and SMS will contain a clear and simple unsubscribe or opt-out link. Once you unsubscribe:

• You will be removed from the relevant marketing list within 72 hours

• You will no longer receive marketing communications through the opted-out channel

• Transactional or legally required messages (e.g., KYC updates, deposit confirmations) will still be sent where necessary

8.3. Personalization and Analytics

To improve marketing relevance, SUVYD B.V. may use your activity (such as games played, deposit history, or promotion participation) to personalize content and offers. This is done using automated decision-making tools, in line with applicable data protection laws.

You may contact us at ayuda@orobet.com to:

• Request more information about profiling or automated decisions

• Object to certain types of marketing or profiling

• Withdraw your consent at any time without affecting the lawfulness of prior processing

Please note that SUVYD B.V. does not use automated decision-making or profiling that produces legal or similarly significant effects on you without your explicit consent.

9. How to Contact Us

If you have any questions regarding this Privacy Policy, or if you would like to exercise your data protection rights (such as accessing, correcting, deleting, or objecting to the use of your personal data), please contact us via any of the following channels:

Email:
ayuda@orobet.com
We aim to respond to all inquiries within 72 hours.

Postal Address:
SUVYD B.V.
Abraham Mendez Chumaceiro Boulevard 03
P.O. Box 4750
Curaçao

Data Protection Officer (DPO):
If your inquiry is privacy-related or you wish to escalate a concern regarding your personal data, you may request direct communication with our appointed Data Protection Officer (DPO). Please include the subject line “Attention: DPO” in your email.

Supervisory Authority:
If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority. If you are located in the European Union, you may contact the relevant Data Protection Authority (DPA) in your country.