PRIVACY POLICY

Vamos Poker Tour

Version 2.0 — Effective from 1 May 2026

1. Introduction

This Privacy Policy governs the processing of personal data of users of the official Vamos Poker Tour website (hereinafter, the “Website”) and the official Vamos Poker Tour mobile application (hereinafter, the “App”), jointly referred to as the “Platform”.

Kikuxo Events LTD (hereinafter, the “Controller”, “VPT” or “we”) is committed to protecting the privacy and personal data of its users, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, “GDPR”), the Cypriot Law on the Protection of Natural Persons with Regard to the Processing of Personal Data (Law 125(I)/2018), and other applicable regulations.

By using the Platform, the User declares that they have read, understood and accepted the contents of this Privacy Policy.

2. Data Controller

Identity: Kikuxo Events LTD Registration number: HE 470466 Registered office: Archiepiskopou Makariou III, 84, Office 1, 6017, Larnaca, Cyprus Contact email: info@vamospokertour.com Website :https://www.vamospokertour.com/

3. Personal data we process

Depending on the User’s interaction with the Platform, we may process the following categories of data:

3.1. Identification and contact data: name, surname, date of birth, nationality, ID or passport number, postal address, email address, telephone number, profile picture.

3.2. Account and credentials data: username, encrypted password, account preferences, language, notification settings.

3.3. Sports and participation data: tournaments played, results, finishing positions, prizes won, achievements, badges, accumulated VPT points, status, level, history of participation in VPT and Kikuxo Poker Events (KPE) Group events.

3.4. Financial and transaction data: information on purchases made at the VPT Store, hotel packages purchased, point redemptions and, where applicable, billing data. Payment data (card numbers, etc.) are processed directly by external PCI-DSS certified payment providers, and VPT does not store such information.

3.5. Platform usage data: activity logs, sessions, frequency and duration of use, sections visited, interactions with notifications, event check-ins, QR code scans, navigation events, technical errors and performance data.

3.6. Device technical data: IP address, device type, model, operating system, app version, unique device identifiers (IDFA on iOS, AAID on Android, Firebase Installation ID), browser type, language, time zone, carrier and connection type.

3.7. Geolocation data: approximate location (based on IP) or precise location (based on GPS) when the User expressly authorises it from their device.

3.8. Data derived from cookies and similar technologies: as detailed in the Cookie Policy available at https://www.vamospokertour.com/cookies-policy/ and in clause 11 of this Policy.

3.9. Image and voice: photographs, videos and recordings taken during VPT or KPE Group events, as well as audiovisual content related to the User’s participation in the Programme.

3.10. Communications: emails, messages and queries sent to user support.

4. Purposes of processing and legal bases

We process personal data for the following purposes, based on the following legal grounds set out in Article 6 of the GDPR:

4.1. Registration and account management. To create, maintain and administer the User’s account on the Platform. Legal basis: performance of a contract (Art. 6.1.b GDPR).

4.2. Provision of Platform services. To enable use of the Website and App functionalities, including tournament registration, consultation of results, calendar and operational communications. Legal basis: performance of a contract (Art. 6.1.b GDPR).

4.3. Management of the VIP Loyalty Programme. To credit points, validate achievements and badges, manage the User’s status, and issue rewards and redemptions. Legal basis: performance of a contract (Art. 6.1.b GDPR).

4.4. Operational communications. To send essential notifications related to the account, tournaments, contracted services, changes to terms or any information necessary for the provision of the service. Legal basis: performance of a contract (Art. 6.1.b GDPR).

4.5. Commercial and promotional communications. To send information about events, news, promotions and services of VPT and other brands within the Kikuxo Poker Events Group (Vamos Poker Tour, Gladiator Poker Series, European Poker Masters and others). Legal basis: User’s consent (Art. 6.1.a GDPR) and, in the case of existing customers, legitimate interest (Art. 6.1.f GDPR) under Article 13(2) of Directive 2002/58/EC for similar products or services.

4.6. Analysis of Platform usage. To study User behaviour, improve functionalities, detect errors and optimise the experience. Legal basis: consent (Art. 6.1.a GDPR) or legitimate interest (Art. 6.1.f GDPR), depending on the type of processing.

4.7. Personalisation of content and recommendations. To tailor the User experience on the Platform. Legal basis: consent (Art. 6.1.a GDPR).

4.8. Publication of results, rankings, name and image. To publish the User’s name, nationality, sports results and, where applicable, image and voice captured during events, on official VPT and KPE Group channels. Legal basis: performance of a contract and express consent given at the time of registration (Arts. 6.1.a and 6.1.b GDPR).

4.9. Fraud prevention and security. To detect and prevent fraudulent use, manipulation, anti-sporting practices and security breaches. Legal basis: legitimate interest (Art. 6.1.f GDPR).

4.10. Compliance with legal obligations. To comply with applicable accounting, tax, regulatory and legal obligations. Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR).

4.11. User support. To handle queries, complaints and support requests. Legal basis: performance of a contract (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR).

5. Recipients and data sharing

5.1. Kikuxo Poker Events (KPE) Group. The User expressly authorises the sharing and use of their personal and contact data with other brands and companies within the KPE Group (including, but not limited to, Vamos Poker Tour, Gladiator Poker Series and European Poker Masters), for the purposes set out in clause 4 of this Policy. The aim of this transfer is to provide the User with an integrated experience across all brands of the Group.

5.2. Data processors (service providers). Certain third-party providers may have access to the User’s personal data as data processors, exclusively to provide their services to the Controller. These providers include, but are not limited to:

1. a) Hosting and cloud service providers (e.g. AWS, Google Cloud, Microsoft Azure). b) Analytics and measurement service providers (e.g. Google Analytics, Firebase Analytics). c) Push notification and messaging providers (e.g. Firebase Cloud Messaging, OneSignal). d) Error monitoring providers (e.g. Crashlytics, Sentry). e) Email marketing and CRM providers (e.g. Mailchimp, HubSpot, Brevo). f) Payment processing providers (e.g. Stripe, Adyen). g) Customer support providers (e.g. Zendesk, Intercom). h) Audiovisual production and streaming providers.

All data processors are contractually bound to the Controller through the corresponding agreement under Article 28 of the GDPR.

5.3. Public and judicial authorities. Where there is a legal obligation or judicial requirement, data may be disclosed to competent tax, police, judicial or regulatory authorities.

5.4. Media and broadcasting. Pursuant to clause 4.8, data corresponding to name, nationality, results and image may be publicly disseminated through official channels, social media, specialised press, broadcasting platforms and other media.

6. International data transfers

Some of the providers mentioned in clause 5.2 may be established outside the European Economic Area (EEA). In such cases, the Controller ensures that international data transfers are carried out with the appropriate safeguards provided for in Articles 44 and following of the GDPR, through one or more of the following mechanisms:

1. a) Adequacy decisions of the European Commission. b) Standard Contractual Clauses (SCCs) approved by the European Commission. c) Other appropriate safeguards provided for under the GDPR.

The User may obtain detailed information on these transfers and their safeguards by requesting it at info@vamospokertour.com.

7. Retention periods

Personal data will be kept for the following periods:

7.1. Account and Programme data: as long as the User keeps their account active on the Platform. In the event of inactivity for more than 24 consecutive months, the Controller may cancel the account in accordance with the Terms and Conditions.

7.2. Financial and tax data: for the periods legally established by Cypriot accounting and tax regulations (minimum 6 years).

7.3. Commercial communications data: until the User withdraws their consent or objects to the processing.

7.4. Images and audiovisual content: for the maximum period permitted by law, given the promotional and historical archive nature of the content.

7.5. Data derived from legal obligations: for the periods required by applicable regulations.

Once the relevant periods have elapsed, data will be securely deleted or anonymised.

8. User rights

In accordance with Articles 15 to 22 of the GDPR, the User has the following rights:

8.1. Right of access. To know which personal data we process about them.

8.2. Right to rectification. To request the correction of inaccurate or incomplete data.

8.3. Right to erasure (“right to be forgotten”). To request the deletion of their data when it is no longer necessary or when consent is withdrawn.

8.4. Right to object. To object to the processing of their data on grounds relating to their particular situation, as well as to the sending of commercial communications.

8.5. Right to restriction of processing. To request the limitation of the use of their data in certain cases.

8.6. Right to data portability. To receive their data in a structured and commonly used format in order to transmit it to another controller.

8.7. Right not to be subject to automated decisions. Not to be subject to decisions based solely on automated processing that produce significant legal effects.

8.8. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out previously.

How to exercise your rights: the User may exercise their rights by sending a request to info@vamospokertour.com, attaching a copy of an identification document for identity verification. The request will be addressed within a maximum period of one (1) month, extendable by a further two (2) months in complex cases.

Right to lodge a complaint with the supervisory authority: if the User considers that the processing of their data does not comply with applicable regulations, they have the right to lodge a complaint with the competent supervisory authority:

Office of the Commissioner for Personal Data Protection (Cyprus) Address: 1 Iasonos Str., 1082 Nicosia, Cyprus P.O. Box: 23378, 1682 Nicosia Telephone: +357 22 818 456 Email: commissioner@dataprotection.gov.cy Website: www.dataprotection.gov.cy

9. Data security

The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, among others: encryption of data in transit (HTTPS/TLS) and at rest where applicable; role-based access control; regular backups; pseudonymisation where applicable; periodic security audits; staff training in data protection; incident response protocols; and breach notification in accordance with Articles 33 and 34 of the GDPR.

Despite these measures, no transmission over the internet or storage system is completely secure. The User is also responsible for protecting their access credentials.

10. Minors

The Platform is intended exclusively for persons of legal age (18 years or older). The Controller does not knowingly collect personal data from minors. If the processing of a minor’s data without valid authorisation is detected, such data will be deleted immediately. Anyone who becomes aware of such a situation may report it to info@vamospokertour.com.

11. Cookies and tracking technologies

11.1. On the Website. The use of cookies on the Website is governed by the Cookie Policy available at https://www.vamospokertour.com/cookies-policy/.

11.2. On the App. The App does not use cookies in the strict sense, but it does use equivalent technologies such as advertising device identifiers (IDFA, AAID), unique installation identifiers, local storage, third-party SDKs (Firebase, Google Analytics, Crashlytics, etc.) and attribution and measurement tools. The User may manage their preferences from the App’s privacy panel or from their device’s settings, including Apple’s App Tracking Transparency framework (iOS) and equivalent controls on Android.

12. Changes to the Privacy Policy

The Controller may amend this Privacy Policy to adapt it to regulatory, technical or operational changes. Amendments will be published on the Platform indicating the date of the update. If the changes substantially affect the processing of data, the User will be notified through appropriate means.

13. Contact

For any questions relating to this Privacy Policy or the processing of your personal data:

Email: info@vamospokertour.com

Web:https://www.vamospokertour.com/

Acceptance: by using the Platform, registering and/or accepting the Terms and Conditions, the User acknowledges having read and understood this Privacy Policy.