Privacy Policy

This Privacy Policy explains how the online casino service operated under the name Boho Casino through the website bohobet-au.com ("Boho Casino", "we", "us" or "our") collects, uses, discloses and protects personal information when you visit the website, create an account, place bets, make payments, or otherwise interact with us. It applies to all website visitors and registered players, with particular focus on individuals located in Australia.

By using bohobet-au.com, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you should not use our services or should discontinue use immediately.

Effective date: 1 February 2026

Who We Are

Boho Casino is an online gaming service currently made available to Australian-facing users via the domain bohobet-au.com, referred to in this Policy as "Boho Casino". The service is operated and controlled by the following entities:

• Data controller / casino operator: Hollycorn N.V., a company incorporated under the laws of Curaçao, with company registration number 144359, registered address at Scharlooweg 39, Willemstad, Curaçao. Hollycorn N.V. operates Boho Casino under gambling license no. 8048/JAZ2019-015, issued by Antillephone N.V., Curaçao.
• Payment processing partner: Libergos Limited, a private limited company incorporated in Cyprus, registration number ΗΕ 371971. Libergos Limited assists with payment processing and related services, primarily within the EU banking system.

For the purposes of privacy and data protection, Hollycorn N.V. is generally the "data controller" and Libergos Limited acts as a "data processor" or, in some limited cases, as a joint controller in relation to payment information.

Data protection contact: We have appointed a dedicated privacy/data protection function responsible for overseeing compliance with this Privacy Policy and applicable data protection laws.

• Postal contact: Data Protection Officer, Hollycorn N.V., Scharlooweg 39, Willemstad, Curaçao.
• Online contact: via the "Contact Us" or customer support section on bohobet-au.com, selecting a subject line related to "Privacy" or "Data Protection". Up-to-date contact channels for privacy matters are maintained on the website.

What Personal Data We Collect

We collect only the information necessary to provide, secure and improve Boho Casino on bohobet-au.com, and to meet our legal and regulatory obligations. The categories of data we may collect include:

Identification and contact data

• Full name, date of birth, and proof of age (e.g. copy of ID, passport or driver's licence) for account creation, age and identity verification.
• Residential address, nationality, and (where required) proof of address (e.g. utility bill, bank statement).
• Contact details such as email address and, where provided, telephone number or messaging handle.
• Documents or information submitted during Know Your Customer (KYC) checks, anti-money laundering (AML) screening, and source-of-funds/source-of-wealth assessments.

Account and behavioural data

• Username, account ID, preferred language and time zone.
• Game play and betting history, including stakes, wins/losses, game sessions, tournament participation, bonuses claimed and wagering progress.
• Interaction logs such as customer support chats, email exchanges, and responsible gambling interactions (e.g. self-exclusion requests, limits set).
• Behavioural data related to use of the website, including pages viewed, clicks, navigation paths and time spent on different sections.

Technical and device data

• IP address, approximate geographic location derived from IP, device identifiers, device type, operating system, browser type and version.
• Log data such as access dates and times, login attempts, session duration, crash reports and performance diagnostics.
• Security-related identifiers used for fraud detection and account protection.

Payment and financial data

• Deposits, withdrawals and transaction history, including amounts, currencies, timestamps and payment channels (e.g. bank transfers, cards, vouchers such as Neosurf, cryptocurrencies processed via third-party providers such as CoinsPaid or similar).
• Limited payment card or account details as provided to us or our payment processors (e.g. masked card numbers, issuer, expiry month/year), in accordance with applicable security standards.
• Information related to chargebacks, refunds, disputed transactions and AML/CTF monitoring.

Cookies and similar technologies

• Cookies: small text files stored on your device to recognise your browser and remember your preferences.
• Web beacons, pixels and tags: used for analytics, performance monitoring and, where permitted, marketing attribution.
• Local storage and similar tools: used to keep you logged in, remember game preferences, and maintain session integrity.

You may choose not to provide certain information; however, this may limit your ability to register, verify your account, access particular games or payment methods, or comply with regulatory requirements.

Legal Basis for Processing

Because Boho Casino via bohobet-au.com serves players in multiple jurisdictions, we apply a legal basis framework consistent with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), and comparable global standards. Depending on the context, we rely on one or more of the following legal grounds:

• Performance of a contract or steps prior to entering a contract
  We process your data to create and manage your player account, enable deposits and withdrawals, conduct gameplay, award bonuses, calculate wagering, provide customer support, and otherwise perform the terms and conditions between you and Boho Casino.
• Compliance with legal and regulatory obligations
  We are legally required to collect, verify and retain certain information for purposes such as:
  • Age and identity verification (e.g. preventing underage gambling).
  • Anti-money laundering (AML), counter-terrorism financing (CTF), sanctions screening and fraud prevention.
  • Record-keeping, accounting and reporting obligations under Curaçao law and other applicable regimes.
  • Responding to lawful requests from regulators (such as Antillephone N.V. or the Curaçao Gaming Control Board), tax authorities, courts or law enforcement bodies, including authorities in Australia such as the Australian Communications and Media Authority (ACMA) for enforcement purposes.
• Legitimate interests
  We process data to pursue our legitimate interests, provided these are not overridden by your rights and interests, including:
  • Maintaining the security and integrity of bohobet-au.com and preventing fraudulent or abusive use.
  • Monitoring gameplay to ensure fair use and detect bonus abuse, collusion, or other violations of our rules.
  • Improving our website, games, payment options and customer service through aggregated analytics and performance data.
  • Defending our legal rights and managing disputes with players or third parties.
• Consent
  Where required by law, we rely on your explicit consent, for example:
  • Sending you electronic marketing communications (emails, SMS, push notifications) about promotions, bonuses or partner offers.
  • Using certain non-essential cookies and tracking technologies for analytics and advertising.
  • Processing special categories of personal data (if any) that may arise in specific contexts, subject to strict controls.
  You may withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.

Purpose of Processing

We use personal data strictly for defined, lawful and proportionate purposes. These include:

• Providing and operating Boho Casino on bohobet-au.com
  To register your account, verify your identity and age, process deposits and withdrawals, run games, calculate winnings and losses, manage bonuses, and provide customer support.
• Compliance with legal and regulatory duties
  To conduct KYC and AML/CTF checks, monitor transactions, maintain statutory records, apply responsible gambling tools (such as self-exclusion and limits) and comply with obligations under Curaçao law and any other applicable regulatory frameworks.
• Improving our services and user experience
  To analyse aggregated usage patterns, test new features, optimise site performance, tailor content and game recommendations, and enhance reliability of payments and support.
• Marketing and promotions (where permitted)
  To send you newsletters, bonus offers and promotions, subject to applicable consent and opt-out rules. We may customise marketing based on your previous activity, provided this is lawful and in line with your preferences.
• Fraud detection, security and risk management
  To monitor for suspicious activities, prevent account takeovers, detect bots or multiple-account abuse, enforce our terms and conditions, and protect our rights, our players and third parties.
• Dispute resolution and legal claims
  To investigate complaints, handle chargebacks and payment disputes, respond to regulatory inquiries and defend against legal claims or enforcement actions.

Disclosure & Sharing

We do not sell your personal data. We may, however, share it with carefully selected third parties strictly as necessary for the purposes described above and subject to appropriate safeguards:

Group companies and core service partners

• Hollycorn N.V. and Libergos Limited: Internal sharing between the operator and its payment processing subsidiary for account administration, payments, fraud prevention and compliance.
• Payment processors and banks: To process deposits, withdrawals and refunds via card schemes, bank transfers, vouchers (e.g. Neosurf) and cryptocurrency gateways (e.g. via third-party crypto payment processors), and to handle chargebacks or disputes.
• Technical and hosting providers: To host the website, provide game servers, security services, content delivery networks (CDNs), email and messaging services, and IT support.

Regulators, authorities and dispute bodies

• Gaming regulators and auditors: Antillephone N.V., Curaçao Gaming Control Board and other competent regulatory or certification bodies that audit our operations, RNG/fairness systems or compliance obligations.
• Government agencies and law enforcement: Courts, law enforcement authorities, tax authorities and similar bodies in Curaçao, Australia and other jurisdictions, where required by law or where we reasonably believe disclosure is necessary to protect our rights, other players or the public interest.

Professional advisers and other third parties

• Lawyers, auditors and consultants: For legal advice, audits, risk management, or corporate governance.
• Analytics and anti-fraud providers: To support fraud detection, transaction monitoring, device fingerprinting, sanctions screening and customer risk profiling, in accordance with applicable laws.
• Marketing and affiliate partners: Where you have given the required consent, we may share limited data (often pseudonymised or aggregated) with marketing platforms, affiliate networks or advertising providers for campaign measurement and attribution.

If we are involved in a merger, acquisition, restructuring or sale of assets, your data may be transferred as part of that transaction, subject to confidentiality and continued protection consistent with this Policy.

International Transfers

Because Boho Casino is operated globally and hosted outside Australia, your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including:

• Curaçao: Where Hollycorn N.V. is established and where key operational and regulatory functions are based.
• Cyprus and other EU/EEA states: Where Libergos Limited and certain hosting, payment or analytics providers are located.
• Other jurisdictions (including, potentially, the United States or other third countries): Where cloud infrastructure, content delivery networks, or specialist service providers are situated.

These countries may have different data protection standards than those in Australia, the European Union or Mexico. Where required, we implement safeguards designed to ensure an equivalent level of protection, including:

• Contractual protections such as the European Commission's Standard Contractual Clauses (SCCs) or comparable contractual mechanisms for non-EU transfers.
• Robust technical and organisational security measures, including encryption, access controls and minimisation of data disclosed.
• Where applicable, reliance on adequacy decisions or comparable data-transfer frameworks recognised by relevant authorities.

By using bohobet-au.com, you acknowledge that your information may be processed in these locations. Where local law requires your explicit consent to such transfers, we will request it separately.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes. Retention periods may vary depending on the type of data and the applicable laws in Curaçao, Australia, the EU and other relevant jurisdictions. As a general guide:

• Player account data (identification and contact details): Usually kept for the duration of your active account and typically for up to 5 - 7 years after account closure, to meet AML/CTF, fraud and record-keeping obligations and to handle potential disputes.
• KYC/AML documentation and transaction records: May be retained for at least 5 - 10 years after your last transaction or account closure, as required by applicable AML/CTF and financial laws.
• Gameplay and behavioural data: Retained while your account remains active and for a reasonable period (normally up to 5 years) thereafter for security, dispute resolution and compliance purposes, after which it may be aggregated or anonymised.
• Marketing data: Kept until you withdraw your consent or opt out of marketing, or until it is otherwise no longer necessary, after which it may be kept in a suppression list to ensure that you are not contacted again.
• Cookie and tracking data: Retained in accordance with cookie type and purpose (see "Cookies & Tracking Technologies" below), typically ranging from the end of your browsing session up to 2 years, unless a longer period is legally permitted and justified.

When data is no longer needed, we will securely delete, anonymise or de-identify it, unless we are legally required to keep it longer. Aggregated or anonymised data, which does not identify you, may be retained for analytics and business purposes without time limit.

Your Rights

We aim to handle personal data in line with leading international standards, including the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), and, where applicable, the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). Regardless of where you are located, we seek to respect the following rights, subject to legal limitations:

• Right of access: To obtain confirmation as to whether we process your personal data and to receive a copy of that data together with certain information about how it is used.
• Right to rectification (correction): To request correction of inaccurate or incomplete personal data. This includes keeping your contact details and KYC information up to date.
• Right to erasure ("right to be forgotten" / cancellation): To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (if consent was the sole basis), or where processing is unlawful. We may be unable to delete data we must retain under AML/CTF, gambling and financial laws.
• Right to restriction of processing: To request that we suspend processing of some data (for example, while we verify its accuracy or assess an objection).
• Right to object: To object at any time to processing based on our legitimate interests, including profiling related to such interests, and to object to the use of your data for direct marketing.
• Right to data portability: Where technically feasible and legally required (for example, under GDPR), to receive certain personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
• Rights under Mexican law (ARCO): For users whose data is subject to Mexican LFPDPPP, this includes rights of Acceso (access), Rectificación (rectification), Cancelación (cancellation/erasure) and Oposición (objection), which we seek to honour in line with that framework.
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time (for example, by unsubscribing from marketing communications or adjusting cookie settings).

How to exercise your rights

1. Submit a request: Contact us through the privacy/contact channels described in the "Who We Are" and "Complaints & Contacts" sections, clearly stating your identity and the rights you wish to exercise.
2. Verification: We may request additional information or documentation to verify your identity and protect your account and privacy.
3. Response timeframe: We aim to respond within 30 days of receiving a valid request. If the request is particularly complex or we receive multiple concurrent requests, this period may be extended as permitted by law; we will inform you of any extension and the reasons for it.
4. Fees: Requests are generally handled free of charge. We may charge a reasonable fee or refuse to act on requests that are manifestly unfounded, excessive or repetitive, in line with applicable law.

Some rights may be restricted where we must retain certain data for legal or regulatory reasons (for example, AML/CTF and gambling law requirements), or where disclosure would adversely impact the rights and freedoms of others.

Cookies & Tracking Technologies

Boho Casino uses cookies and similar technologies on bohobet-au.com to ensure technical functionality, enhance user experience, and, where permitted, perform analytics and marketing. Cookies may be set by us ("first-party cookies") or by third parties ("third-party cookies").

Types of cookies we use

• Strictly necessary (session) cookies: These are essential for the operation of the website and your account (e.g. maintaining your session, processing bets, ensuring security). They are usually deleted when you close your browser.
• Functional/persistent cookies: These remember your preferences (such as language, region, game settings) and help provide a more personalised experience. They may remain on your device for a defined period or until you delete them.
• Analytics/performance cookies: These help us understand how visitors use bohobet-au.com, which pages are most popular and how the site performs, allowing us to improve stability and usability. Data from these cookies is often aggregated.
• Advertising/targeting cookies: Where permitted by law and with your consent, these cookies may be used to deliver more relevant ads on our site or on third-party sites, and to measure the effectiveness of campaigns run in cooperation with affiliate or advertising partners.

Managing cookies

• You can manage or disable cookies through your browser settings. Methods vary by browser, but typically you can block all cookies, accept only certain types, or delete existing cookies.
• Some non-essential cookies may also be controlled via on-site tools or preferences panels (where provided), allowing you to opt in or out of categories such as analytics or marketing cookies.
• If you block or delete certain cookies, some features of bohobet-au.com may not function correctly, and your ability to access games or maintain a logged-in session may be affected.

Data Security

We take the security of your personal data seriously and implement technical and organisational measures designed to protect it against unauthorised access, loss, misuse, alteration or disclosure. These measures reflect the nature of the data and the risks associated with online gambling services.

Technical safeguards

• Encryption in transit: Data transmitted between your browser and bohobet-au.com is protected using Transport Layer Security (TLS 1.2+) or equivalent protocols.
• Encryption at rest: Sensitive data is stored in encrypted or otherwise protected form, with access restricted to authorised systems and personnel.
• Access controls and authentication: Strict access rights are enforced based on role and business need. Administrative access is protected by strong authentication measures, and we encourage (and may offer) multi-factor authentication for player accounts.
• Segregated environments: Production systems are logically or physically separated from testing and development environments to reduce risks of unauthorised access or data leakage.

Organisational and procedural measures

• Security policies and training: Staff with access to personal data receive training on data protection, confidentiality, responsible gambling procedures and security best practices.
• Vendor due diligence: Third-party service providers that process personal data on our behalf are subject to contractual obligations regarding security and confidentiality and are assessed for appropriate safeguards.
• Monitoring and audits: We monitor systems for suspicious activity and may conduct periodic internal audits or assessments aligned with recognised security practices (such as ISO 27001 or SOC 2-aligned controls, where practicable).
• Incident response and breach notification: We maintain procedures to identify, assess and respond to security incidents. Where a data breach is likely to result in serious harm, we will notify affected individuals and relevant authorities (for example, under Australia's Notifiable Data Breaches scheme and comparable regimes) in accordance with applicable law.

While we strive to apply high security standards, no system can be guaranteed 100% secure. You are responsible for keeping your login credentials confidential, using strong passwords, enabling any additional security features we provide, and notifying us promptly if you suspect unauthorised access to your account.

Complaints & Contacts

If you have questions, concerns or complaints about how Boho Casino handles your personal data on bohobet-au.com, you have several avenues to contact us and, if necessary, escalate your complaint.

How to contact us

• Customer support: In the first instance, please contact our customer support team using the channels listed on bohobet-au.com (e.g. live chat or support form). Many issues can be resolved quickly at this level.
• Data protection contact / DPO: If your issue specifically relates to privacy or data protection, you may address your request to our Data Protection Officer or privacy team via the contact options provided in the "Contact Us" section of bohobet-au.com or by writing to: Data Protection Officer, Hollycorn N.V., Scharlooweg 39, Willemstad, Curaçao.

Internal complaint handling procedure

1. Submission: Provide a clear description of your concern or complaint, including relevant dates, account details and any supporting evidence.
2. Acknowledgement: We will aim to acknowledge receipt of your complaint within 7 days.
3. Investigation: We will investigate the matter, which may involve requesting additional information from you.
4. Response: We will endeavour to provide a substantive response within 30 days of receiving a complete complaint. If extra time is required due to complexity, we will inform you of the delay and the expected timeframe.

Escalation to supervisory authorities

If you are not satisfied with our response or believe that we are processing your personal data in a way that breaches applicable law, you may have the right to lodge a complaint with a data protection authority or privacy regulator, such as:

• Australia: Office of the Australian Information Commissioner (OAIC)
  Website: https://www.oaic.gov.au
• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
  Website: https://home.inai.org.mx
• European Union / EEA: Your local data protection authority in the EU/EEA if GDPR applies to you. A list of supervisory authorities is available via the European Data Protection Board website:
  https://edpb.europa.eu/about-edpb/about-edpb/members_en

We encourage you to contact us first so we can attempt to resolve your concerns directly, but you are not obliged to do so before contacting a relevant authority where applicable law provides otherwise.

Updates

We may update this Privacy Policy from time to time to reflect changes in our services, technologies, legal or regulatory requirements, or our internal practices. The most current version will always be available on bohobet-au.com and will govern our use of your information.

Last updated: February 2026

Notification of changes

• Minor changes: For non-material updates (e.g. clarifications or organisational detail), we will post the revised Policy on bohobet-au.com with an updated "Last updated" date.
• Material changes: Where we make significant changes to how we handle your personal data (such as new processing purposes or categories of recipients), we will provide additional notice, which may include:
  • Email notifications to the address associated with your player account.
  • Prominent notices or banners on bohobet-au.com.
  • Notifications in your account dashboard.
• Advance notice: Where feasible and required by law, we will give you at least 30 days' notice before material changes become effective, so you can review the updated Policy.

Your options

• If you do not agree with the updated Policy, you may discontinue using bohobet-au.com and, where applicable, request account closure and/or exercise your rights (such as withdrawing consent for marketing).
• Your continued use of Boho Casino via bohobet-au.com after the effective date of any changes will constitute your acknowledgement and acceptance of the updated Privacy Policy.