This Privacy Policy (hereinafter referred to as the “Policy”) delineates the principles, procedures, and practices governing the collection, processing, use, storage, and protection of personal information obtained from users of the website FANPESA AFFILIATES (hereinafter referred to as the “Website”) operated by Jumbo Jackpot Limited, a corporation duly incorporated under the laws of the Republic of Kenya, bearing registration number C80163, with its principal registered office located at Bandari Plaza, Westlands, Nairobi (hereinafter referred to as “FanPesa,” “we,” “us,” or “our”).

This Policy applies in circumstances where FanPesa acts as a data controller with respect to personal information pertaining to visitors, users, and participants of the Website, including but not limited to Affiliates and Players engaged in the FanPesa Affiliate Program and associated betting or casino services (hereinafter collectively referred to as the “Services”).

We are steadfastly committed to safeguarding your privacy and ensuring the security of your personal information. Any information by which you may be identified during your interaction with the Website (hereinafter referred to as “Personal Information”) shall be processed solely in accordance with the terms and conditions of this Policy and in strict compliance with applicable data protection laws, including the Data Protection Act, 2019 of the Republic of Kenya and, where relevant, international frameworks such as the General Data Protection Regulation (GDPR).

By accessing or using the Website, you expressly acknowledge and consent to the data processing practices articulated in this Policy. Should you disagree with any provision of this Policy or be unwilling to provide the Personal Information required for the operation of the Website or participation in the Services, you are respectfully requested to refrain from accessing or using the Website.

FanPesa reserves the right, at its sole and absolute discretion, to amend, modify, or supplement this Policy periodically by publishing an updated version on the Website. Such amendments may reflect changes in our operational practices, legal obligations, or industry standards. While we shall endeavor to notify users of material changes, it is your responsibility to periodically review this Policy to ensure your continued agreement with its terms. Your ongoing use of the Website following the publication of an updated Policy shall constitute your unequivocal consent to be bound by the Policy as amended.

1. Information We Collect

1.1. Sources of Personal Information:

FanPesa collects Personal Information from users through various methods and sources in connection with the use of the Website and participation in the Services, including but not limited to the FanPesa Affiliate Program and the FanPesa Product (comprising online betting and casino services). The categories of Personal Information collected are as follows:

1.2. Information Voluntarily Provided by You:

Personal Details: When you complete forms or submit data on the Website, we collect personal details such as your full legal name, surname, email address, telephone number, messenger ID (e.g., for communication platforms such as Telegram or WhatsApp), and, where applicable, resume or other professional information provided voluntarily.

Purpose and Processing: Such information is processed to respond to your inquiries, facilitate participation in the Affiliate Program or Services, operate and maintain the Website, ensure the security of our systems, maintain backups of our databases, and communicate with you regarding your account or activities. The legal basis for this processing is the performance of a contract to which you are a party or the taking of steps at your request prior to entering into a contract, as contemplated by the Data Protection Act, 2019.

1.3. Information Collected Based on Website Usage:

Usage Data: We collect data concerning your interactions with the Website, including but not limited to the specific content viewed, products or games explored, dynamic IP address, browser type and version, operating system, referral source (e.g., the website or link directing you to our Website), and details regarding the timing, frequency, and patterns of your Website usage.

Purpose and Processing: This usage data is processed for analytical purposes to enhance the quality of our goods, services, and user experience, including the optimization of Website functionality and content personalization. The legal basis for this processing is our legitimate interest in improving the performance and efficacy of the Website and Services, provided such interests do not override your fundamental rights and freedoms.

1.4. Cookies and Tracking Technologies:

Description: Cookies are small text files transmitted to and stored on your device when you access the Website. These files enable us to track user interactions, facilitate Affiliate referrals, and enhance Website functionality. Additional details regarding cookies are provided in Section 5 (Cookie Policy) below.

Scope: This includes both session cookies, which are automatically deleted upon termination of your browsing session, and persistent cookies, which remain on your device until manually deleted or until their expiration, as well as similar technologies such as web beacons or pixel tags.

2. Data Sharing and Disclosure

2.1. Internal Group Companies:

FanPesa may disclose your Personal Information to any member of our corporate group, including our parent companies, their parent companies, and all subsidiaries thereof, to the extent reasonably necessary to fulfill the purposes outlined in this Policy, such as account management, commission payments, or service delivery.

2.2. Professional Advisers and Business Partners:

We may share your Personal Information with our professional advisers (e.g., legal counsel, auditors, or consultants) and business partners (e.g., payment processors, gaming platform providers) when reasonably necessary to manage operational risks, obtain professional advice, or establish, exercise, or defend legal claims, whether in judicial proceedings or out-of-court processes.

2.3. Confidentiality Obligations:

All employees, contractors, and third-party partners involved in processing your Personal Information are bound by stringent confidentiality agreements, ensuring the confidential nature of your data is respected in accordance with the Data Protection Act, 2019 and other applicable data protection and privacy laws. FanPesa unequivocally prohibits the sale, rental, or unauthorized transfer of your Personal Information to third parties for commercial purposes.

2.4. Legal and Regulatory Compliance:

FanPesa may disclose your Personal Information to governmental or regulatory authorities when necessary to comply with legal obligations to which we are subject, including but not limited to court orders, subpoenas, or investigations related to anti-money laundering (AML), know-your-customer (KYC), tax compliance, or fraud prevention.

3. Data Sharing and Disclosure

3.1. Internal Group Companies:

FanPesa may disclose your Personal Information to any member of our corporate group, including our parent companies, their parent companies, and all subsidiaries thereof, to the extent reasonably necessary to fulfill the purposes outlined in this Policy, such as account management, commission payments, or service delivery.

3.2. Professional Advisers and Business Partners:

We may share your Personal Information with our professional advisers (e.g., legal counsel, auditors, or consultants) and business partners (e.g., payment processors, gaming platform providers) when reasonably necessary to manage operational risks, obtain professional advice, or establish, exercise, or defend legal claims, whether in judicial proceedings or out-of-court processes.

3.3. Retention Periods:

Specific retention periods include:

• Personal Information related to Affiliate accounts shall be retained for the duration of your participation in the Affiliate Program and for a period of six (6) years thereafter to comply with Kenyan legal and regulatory requirements.

• Player data related to the FanPesa Product shall be retained for the duration of their engagement and for a period of six (6) years thereafter, unless extended retention is required by law.

• Usage and cookie data shall be retained for a minimum of thirty (30) days, consistent with the cookie lifetime specified in the CPA Affiliate Offer Terms, and may be retained longer for analytical purposes in anonymized form.

4. Data Sharing and Disclosure

4.1. Security Measures:

FanPesa employs a comprehensive array of technical and organizational security mechanisms to protect your Personal Information from unauthorized access, unlawful processing, accidental loss, destruction, or damage. These measures include:

• SSL Encryption: The Website utilizes Secure Socket Layer (SSL) encryption to secure data transmitted between your device and our servers, identifiable by the “https://” protocol and a lock icon in your browser’s address bar.

• Access Controls: Strict access controls limit data access to authorized personnel with a legitimate need, supported by robust authentication protocols.

• Regular Audits: Periodic security audits, penetration testing, and vulnerability assessments are conducted to identify and mitigate risks.

Incident Response: Established protocols ensure prompt detection, containment, and mitigation of security incidents or data breaches.

4.2. User Responsibilities:

While FanPesa implements rigorous safeguards, you are responsible for personal measures to secure your information, including:

• Maintaining up-to-date anti-virus software and security patches on your devices.

• Regularly updating operating systems, web browsers, and applications.

• Securing your devices with strong, unique passwords and enabling device-level authentication.

• Exercising caution when sharing personal information or accessing the Website on public or unsecured networks.

4.3. Data Breach Notification:

In the event of a personal data breach likely to result in a risk to your rights and freedoms, FanPesa shall notify you and the Office of the Data Protection Commissioner of Kenya within seventy-two (72) hours of becoming aware of the breach, in strict compliance with the Data Protection Act, 2019.

5. Cookie Policy

5.1. Purpose and Functionality:

FanPesa utilizes cookies and similar tracking technologies (e.g., web beacons, pixel tags) to enhance the functionality, usability, and security of the Website, as well as to analyze user behavior and optimize our Services. Cookies are small text files stored on your device by your browser, enabling us to recognize your device, track Affiliate referrals, and improve user experience.

5.2. Types of Cookies:

FanPesa utilizes cookies and similar tracking technologies (e.g., web beacons, pixel tags) to enhance the functionality, usability, and security of the Website, as well as to analyze user behavior and optimize our Services. Cookies are small text files stored on your device by your browser, enabling us to recognize your device, track Affiliate referrals, and improve user experience.

• Session Cookies: Temporary cookies that are automatically deleted upon termination of your browsing session, used to maintain session continuity and facilitate navigation.

• Persistent Cookies: Cookies that remain on your device until manually deleted or until their expiration (e.g., thirty (30) days, as specified in the CPA Affiliate Offer Terms), used to recognize returning users and track referral attributions.

• Last-Click Attribution Cookies: Cookies employing a last-click attribution model, whereby the most recent Affiliate promotional link clicked by a Player determines commission attribution, as stipulated in the CPA Affiliate Offer Terms.

5.3. Cookies Used by Service Providers:

• Google Analytics: Provided by Google, Inc., located at 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, this web analytics service collects data on Website usage (e.g., pages visited, session duration) to inform optimization efforts. Google’s privacy practices are governed by its Privacy Policy, accessible at [https://policies.google.com/privacy].

• Google Ads: An advertising and remarketing service provided by Google, Inc., located at the aforementioned address, used to deliver targeted advertisements and track campaign performance. Google Ads’ privacy practices are governed by its Privacy Policy, accessible at [https://policies.google.com/technologies/ads].

5.4. Consent to Cookies:

By accessing and using the Website without blocking, disabling, or opting out of cookies, you expressly consent to our use of cookies and similar technologies in accordance with this Policy. Consent for non-essential cookies is obtained via a cookie consent banner displayed upon your initial visit to the Website.

5.5. Opting Out of Cookies:

• You may refuse or delete cookies by configuring your browser settings to block cookies or to alert you when cookies are being set, allowing case-by-case decisions.

• Instructions for managing cookies are available in the help or settings sections of modern web browsers (e.g., Google Chrome, Mozilla Firefox, Safari, Microsoft Edge).

• Note that blocking all cookies may adversely impact the usability of the Website and other online services, potentially limiting access to certain features or functionalities, including Affiliate referral tracking.

5.6. Consent to Cookies:

By accessing and using the Website without blocking, disabling, or opting out of cookies, you expressly consent to our use of cookies and similar technologies in accordance with this Policy. Consent for non-essential cookies is obtained via a cookie consent banner displayed upon your initial visit to the Website.

6. Your Rights

6.1. Data Subject Rights:

Pursuant to the Data Protection Act, 2019 of Kenya and, where applicable, the GDPR, you are entitled to the following rights with respect to your Personal Information:

• Right to Access: To request confirmation of whether your Personal Information is being processed and to obtain a copy of such data in a clear, accessible format.

• Right to Rectification: To request the correction or updating of inaccurate, incomplete, or outdated Personal Information.

• Right to Erasure: To request the deletion of your Personal Information, subject to exemptions for legal retention obligations (e.g., tax, AML, or regulatory compliance).

• Right to Restrict Processing: To request the limitation of processing in specific circumstances, such as during the resolution of a dispute regarding data accuracy.

• Right to Data Portability: To receive your Personal Information in a structured, commonly used, and machine-readable format and to transmit it to another data controller, where technically feasible.

• Right to Object: To object to the processing of your Personal Information for certain purposes, including direct marketing or processing based on legitimate interests.

Right to Withdraw Consent: To withdraw consent for processing activities reliant on consent (e.g., non-essential cookies, marketing communications) at any time, without affecting the lawfulness of processing conducted prior to withdrawal.

6.2. Exercising Your Rights:

To exercise any of the aforementioned rights, you shall submit a written request to FanPesa at partners@fanpesaaffiliates.com, including your full name, email address, account number (if applicable), and a detailed description of the request. FanPesa shall respond within thirty (30) days of receipt, with an extension of up to sixty (60) additional days for complex or voluminous requests, in compliance with the Data Protection Act, 2019.

6.3. Lodging a Complaint:

If you believe your data protection rights have been infringed, you may lodge a formal complaint with the Office of the Data Protection Commissioner of Kenya, or, where applicable, a supervisory authority in the Member State of your habitual residence, place of work, or the location of an alleged GDPR infringement, pursuant to Article 77 of the GDPR.

7. Contacting Us

7.1. Data Controller:

Jumbo Jackpot Limited, with its registered office at Bandari Plaza, Westlands, Nairobi, Republic of Kenya, is the designated data controller responsible for the processing of Personal Information pursuant to this Policy.

7.2. Contact Details:

For inquiries, requests, or complaints regarding this Policy, the processing of your Personal Information, or the exercise of your data subject rights, please contact our Data Protection Officer at:

• Email: partners@fanpesaaffiliates.com

• Postal Address: Bandari Plaza, Westlands, Nairobi, Republic of Kenya

• Telephone: +254 713 184 128

7.3. Response Time:

FanPesa shall endeavor to respond to all inquiries within thirty (30) days of receipt, with an extension of up to sixty (60) additional days for complex requests, in strict compliance with the Data Protection Act, 2019.

8. Miscellaneous

8.1. Governing Law and Jurisdiction:

This Policy shall be governed by and construed in accordance with the laws of the Republic of Kenya. Any disputes arising under or in connection with this Policy shall be resolved in accordance with the dispute resolution procedures set forth in Section 4 of the FanPesa Affiliate Terms and Conditions, with final adjudication in a court of competent jurisdiction in the Republic of Kenya.

8.2. Severability:

Should any provision of this Policy be deemed invalid or unenforceable by a court of competent jurisdiction, such provision shall be severed, and the remaining provisions shall remain in full force and effect.

8.3. Entire Agreement::

This Policy, in conjunction with the FanPesa Affiliate Terms and Conditions, CPA Affiliate Offer Terms, and any applicable Cookie Policy, constitutes the entire agreement between you and FanPesa with respect to the processing of Personal Information, superseding all prior or contemporaneous agreements, understandings, or representations.

This Privacy Policy was last updated on May 17, 2025.