Privacy Policy

2. Information We Collect

2.1. Information You Provide Directly

We collect personal data that you voluntarily provide to us, including but not limited to the following categories:

• Identity and Contact Data: Full legal name, date of birth, nationality, country of residence, email address, and phone number, collected during account registration or KYC/AML verification processes.
• KYC and Verification Documents: Government-issued identification documents (passport, national identity card, or equivalent), proof of address documentation, and biometric data (such as a facial photograph or selfie) collected as part of applicable Know Your Customer and Anti-Money Laundering compliance procedures.
• Wallet and Transaction Data: Blockchain wallet addresses, wallet identifiers, and any additional identifiers you provide in connection with token purchases, wagering activities, or staking participation. Note that associated on-chain transaction data is publicly recorded and falls outside the scope of this Policy.
• Financial Information: Information relating to your token purchase interests, investment intentions, and participation in the Private Sale or ICO, to the extent you provide such information voluntarily.
• Communications Data: Records of your correspondence with us, including support requests, feedback submissions, and responses to surveys or questionnaires.

2.2. Information Collected Automatically

When you access the Platform, we and our service providers may automatically collect the following categories of technical and usage data:

• Device and Browser Data: Information about the device and browser you use to access the Platform, including device type, operating system, browser version, screen resolution, and language settings.
• Network and Location Data: IP address, approximate geolocation data derived from your IP address, and, where applicable, GPS or network-based location data where you have consented to such collection.
• Usage and Analytics Data: Information about how you interact with the Platform, including pages visited, features used, time spent on the Platform, navigation paths, and referral sources.
• Cookie and Tracking Data: Data collected through cookies, web beacons, pixels, and similar tracking technologies as described in Section 5 below.
• VPN and Proxy Use: If you access the Platform using a virtual private network, proxy service, or similar technology, your apparent location may differ from your actual location. You are solely responsible for ensuring that your access to the Platform is lawful in your actual jurisdiction of residence. BetsWave is not responsible for any consequences arising from your use of technologies designed to misrepresent your location.

2.3. Information Received from Third Parties

We may receive personal data about you from third-party sources, including:

• KYC and AML Verification Providers: Third-party providers engaged by BetsWave to conduct identity verification, document authentication, and AML screening.
• Blockchain Analytics Providers: Third-party blockchain analytics services used to monitor wallet addresses and transaction patterns for compliance, fraud prevention, and security purposes.
• Partner Platforms and DApps: Personal data or identifiers shared by third-party decentralized applications, partner platforms, or referral services where you have consented to such data sharing.
• Publicly Available Sources: Publicly available on-chain data, sanctions list, politically exposed persons (PEP) databases, and other publicly accessible compliance databases.

3. How We Use Your Personal Data

3.1. Purposes of Processing

BetsWave processes personal data for the following purposes:

• a. To provide, maintain, and improve the Platform and its services, including processing wagering transactions, managing token holdings, and administering ORCA NFT memberships.
• b. To conduct KYC/AML verification procedures and to comply with applicable anti-money laundering, counter-terrorist financing, and sanctions screening obligations.
• c. To verify user eligibility, including age verification and jurisdictional access checks in accordance with our Platform access policy.
• d. To communicate with users about their accounts, transactions, platform updates, security alerts, and service-related notifications.
• e. To process token sale participation, including the Private Sale and ICO, and to administer associated vesting schedules and distribution records.
• f. To detect, investigate, and prevent fraud, security incidents, technical vulnerabilities, and unauthorized access.
• g. To comply with applicable legal obligations, regulatory requirements, court orders, and governmental or regulatory authority requests.
• h. To enforce the Terms and Conditions, Disclaimer, and other platform agreements, including the investigation and resolution of disputes.
• i. To analyze platform usage, conduct research, and improve the user experience and platform functionality.

3.2. Legal Bases for Processing (GDPR-Aligned)

Where the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') or equivalent data protection legislation applies to users in the European Economic Area or the United Kingdom, BetsWave relies on the following legal bases for processing personal data:

• Contract Performance: Processing necessary for the performance of the Terms and Conditions to which the user is a party, or to take steps at the user's request prior to entering into that agreement.
• Legal Obligation: Processing necessary to comply with applicable legal obligations, including AML/KYC regulatory requirements, sanctions compliance, and regulatory reporting obligations.
• Legitimate Interests: Processing necessary for the legitimate interests pursued by BetsWave or third parties, including fraud prevention, platform security, network monitoring, and platform improvement, where such interests are not overridden by users' fundamental rights and freedoms.
• Consent: Where processing is based on consent, you will be asked to provide explicit consent before such processing commences. You may withdraw consent at any time, subject to the limitations described in Section 8.

4. Cookies and Tracking Technologies

4.1. Types of Cookies Used

The Platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Cookies essential to the operation of the Platform, including session management, security, and load balancing. These cannot be disabled without significantly impairing platform functionality.
• Analytics and Performance Cookies: Cookies that allow us to measure and analyze how users interact with the Platform, including third-party analytics tools such as Google Analytics or equivalent services. These cookies help us identify areas for improvement.
• Functional Cookies: Cookies that enable enhanced platform functionality and personalization, including remembering user preferences and settings.
• Marketing and Targeting Cookies: Cookies used to deliver relevant communications based on user interests and browsing behavior. These are only placed where you have provided explicit consent.

4.2. Cookie Management

You may manage your cookie preferences through your browser settings, which allow you to block, delete, or receive notifications about cookies. Note that disabling certain categories of cookies may impair platform functionality. For users in the EEA or UK, a cookie consent interface is provided on first access to the Platform and can be revisited through the Platform's privacy settings.

5. Data Sharing and Disclosure

5.1. Third-Party Service Providers

BetsWave engages third-party service providers who process personal data on our behalf as data processors. These providers are bound by data processing agreements requiring them to process data only on our instructions and to implement appropriate security measures. Categories of third-party processors include: KYC and AML verification providers; blockchain analytics and compliance screening services; cloud infrastructure and hosting providers; email communication and notification service providers; analytics platform providers; and customer support software providers.

5.2. Regulatory and Legal Disclosure

BetsWave may disclose personal data to governmental authorities, regulatory bodies, law enforcement agencies, courts, or other public authorities where: (a) required to do so by applicable law or a legally binding court order; (b) necessary to comply with our AML, KYC, or sanctions compliance obligations; (c) necessary to protect the legal rights, property, or safety of BetsWave, its users, or third parties; or (d) necessary to investigate, prevent, or take action regarding suspected fraud, illegal activity, or violations of our Terms and Conditions.

5.3. Business Transfers

In the event of a merger, acquisition, reorganization, asset sale, or analogous corporate transaction involving BetsWave or its assets, personal data held by BetsWave may be transferred to the acquiring entity as part of such transaction. We will notify affected users of any such transfer and any resulting material changes to this Policy.

5.4. No Sale of Personal Data

BetsWave does not sell, rent, trade, or otherwise commercially exploit personal data to or with third parties for their own independent marketing or commercial purposes.

6. International Data Transfers

BetsWave is operated from Costa Rica. Personal data may be transferred to, stored in, and processed in jurisdictions outside of your country of residence, including Costa Rica and any jurisdiction in which our service providers operate. Some of these jurisdictions may not provide data protection standards equivalent to those in your home jurisdiction.

Where such transfers involve personal data of individuals in the European Economic Area or United Kingdom, BetsWave implements appropriate safeguards in accordance with applicable data protection law, including Standard Contractual Clauses approved by the European Commission or equivalent transfer mechanisms recognized under applicable law.

By using the Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside your country of residence as described in this Policy.

7. On-Chain Data - Important Distinction

Blockchain Immutability Notice: Transactions executed on the Hedera Hashgraph distributed ledger - including wager placements, token transfers, smart contract interactions, wallet address associations, and settlement events - are permanently and publicly recorded on the blockchain. This data constitutes public on-chain data. BetsWave has no ability to delete, modify, anonymize, or restrict access to on-chain data after it has been confirmed on the ledger, and cannot comply with data subject requests (including right to erasure requests) in respect of on-chain data. Users must be aware of this fundamental characteristic of blockchain technology before engaging with the Platform. The immutability of on-chain data is inherent to the Hedera Hashgraph protocol and is outside BetsWave's control.

Off-chain personal data held by BetsWave in its own systems remains subject to this Policy and applicable data protection law. The two categories of data are distinct and are governed by different frameworks.

8. Data Retention

8.1. Retention Periods

BetsWave retains personal data only for as long as necessary to fulfill the purposes described in Section 3, and as required by applicable legal, regulatory, or compliance obligations. Applicable retention periods include the following:

• KYC and AML Records: Identity verification documents, AML screening records, and related compliance data are retained for a minimum of five (5) years from the date of the relevant transaction or the end of the business relationship, in accordance with FATF guidance and applicable AML regulations. Extended retention may apply in jurisdictions with longer statutory requirements.
• Account and Transaction Records: Account registration data and transaction records are retained for a minimum of five (5) years following account closure or the last transaction, as required for regulatory and audit purposes.
• Communications Data: Support correspondence and communications records are retained for a maximum of three (3) years unless a longer period is required for legal proceedings or dispute resolution.
• Analytics and Technical Data: Aggregated or anonymized analytics data may be retained indefinitely for platform improvement purposes, provided it can no longer be linked to an identifiable individual.

8.2. Legal Hold

Notwithstanding the above retention periods, BetsWave may retain personal data for longer periods where: (a) required by a court order, regulatory directive, or governmental authority; (b) necessary for the establishment, exercise, or defence of legal claims; or (c) required to comply with an applicable legal obligation that mandates extended retention.

9. Your Data Subject Rights

9.1. Rights Available to EEA and UK Users

Subject to applicable law and the limitations described below, individuals in the European Economic Area and United Kingdom have the following rights with respect to their personal data:

• Right of Access: The right to obtain confirmation of whether we process your personal data and to receive a copy of the personal data we hold about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data in certain circumstances. This right does not apply where processing is required for legal compliance, the exercise of legal claims, or other overriding legitimate purposes. It does not apply to on-chain data for the reasons described in Section 7.
• Right to Restriction: The right to request restriction of processing in certain circumstances.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract performance.
• Right to Object: The right to object to processing based on legitimate interests, including profiling. BetsWave will cease such processing unless compelling legitimate grounds exist that override your interests.
• Right to Withdraw Consent: The right to withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal.

9.2. Rights Available to California Residents (CCPA)

California residents have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know: The right to know what personal information is collected, used, shared, or sold.
• Right to Delete: The right to request deletion of personal information, subject to applicable exceptions.
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale: BetsWave does not sell personal information. If our practices change, we will update this Policy and provide an appropriate opt-out mechanism.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA rights.

9.3. Limitations on Rights

Data subject rights are subject to important limitations. In particular: (a) the right to erasure does not apply to data we are required to retain for AML/KYC compliance, legal proceedings, or regulatory obligations; (b) rights cannot be exercised in respect of on-chain blockchain data, which is beyond our control; and (c) the exercise of rights may be restricted where necessary to protect the rights and freedoms of others or to enable the establishment, exercise, or defence of legal claims.

9.4. How to Exercise Your Rights

To exercise any of your data subject rights, please submit a written request to contact@betswave.io, clearly identifying yourself and the right you wish to exercise. We will respond to verified requests within thirty (30) days, with a possible extension of a further sixty (60) days in complex cases. We may require verification of your identity before processing your request.

10. Children's Privacy

The Platform is intended exclusively for adults. BetsWave does not knowingly collect personal data from individuals under the age of eighteen (18). If we become aware that we have inadvertently collected personal data from a minor, we will take prompt steps to delete such data. If you believe that a minor has submitted personal data to us, please contact us at contact@betswave.io.

11. Data Security

BetsWave implements commercially reasonable technical and organizational security measures designed to protect personal data against unauthorized access, alteration, disclosure, destruction, or loss. These measures include encryption of data in transit and at rest, access controls and authentication requirements, regular security assessments and audits, employee data protection training, and incident response procedures.

Security Limitation: No method of data transmission or storage over the internet is completely secure. BetsWave cannot guarantee absolute security of your personal data. Users are reminded that the security of blockchain wallet private keys and credentials is solely the user's responsibility. BetsWave cannot recover lost private keys or reverse unauthorized on-chain transactions. In the event of a data security incident affecting your personal data, we will notify you as required by applicable law.

12. Third-Party Websites and Services

The Platform may contain links to third-party websites, decentralized applications, wallets, exchanges, and services that are not operated by BetsWave. These third-party services are governed by their own privacy policies and terms, for which BetsWave accepts no responsibility. We encourage you to review the privacy policies of any third-party service you access through the Platform.

13. Changes to This Policy

BetsWave reserves the right to update or modify this Policy at any time. Material changes will be notified to registered users via email or through a prominent notice on the Platform, with at least fourteen (14) days' notice before the changes take effect. The current version of this Policy is always available at www.betswave.io/privacy. The 'Effective Date' at the top of this document indicates when the latest version was published. Continued use of the Platform following the effective date of any update constitutes acceptance of the updated Policy.

14. Contact Information

For all privacy-related inquiries, requests, or complaints, please contact BetsWave's Data Privacy team at:

Email: contact@betswave.io
Website: www.betswave.io

If you are an EEA or UK resident and are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your country of residence or establishment.