Personal Data Processing Policy

LLC “X2”

Version dated 19 January 2026

1. General Provisions

1.1.

This Personal Data Processing Policy (hereinaAer referred to as the “Policy”) defines the main principles,

purposes, condiHons and methods of personal data processing, the categories of personal data subjects,

the scope of processed personal data, the acHons (operaHons) performed with personal data, as well as

the measures taken to ensure their security within X2 Limited Liability Company (LLC “X2”) (hereinaAer

referred to as the “Operator”).

1.2.

This Policy has been developed in accordance with the legislaHon of the Kyrgyz Republic, including but

not limited to:

— the Law of the Kyrgyz Republic “On Personal Data InformaMon” dated 14 April 2008 No. 58;

— the Law of the Kyrgyz Republic “On LoReries” dated 21 December 2023 No. 214;

— the Law of the Kyrgyz Republic “On CounteracMng the LegalizaMon (Laundering) of Criminal Proceeds

and the Financing of Terrorist AcMviMes” dated 31 July 2018 No. 87;

— other regulatory legal acts of the Kyrgyz Republic.

1.3.

This Policy shall be published in open access on the Operator’s official website:

hUps://x2.kg

2. Principles, Purposes and Legal Grounds for Personal Data Processing

2.1 Principles of Personal Data Processing

The Operator processes personal data on a lawful and fair basis, exclusively for the achievement of

specific, predetermined and legiHmate purposes.

Only personal data that corresponds to the purposes of processing is processed. Such data must not be

excessive and must be maintained in an accurate and up-to-date condiMon.

Personal data shall be stored no longer than required for the purposes of processing, unless another

storage period is established by the legislaHon of the Kyrgyz Republic.

Upon achieving the purposes of processing or if such purposes are no longer necessary, personal data

shall be destroyed or anonymized, unless otherwise provided by law.

2.2 Purposes of Personal Data Processing

Personal data is processed by the Operator for the following purposes:

— registraHon and idenHficaHon of Website users;

— provision of Website services and performance of contracts with personal data subjects;

— accounHng for parHcipaHon in loUery games, bets and winnings;

— payment of winnings;

— informaHonal communicaHon with users;

— compliance with the requirements of the legislaHon of the Kyrgyz Republic;

— exercising the Operator’s rights and legiHmate interests, provided that the rights and freedoms of

personal data subjects are not violated;

— prevenHon of unlawful acHons and ensuring the security of services.

2.3 Legal Grounds for Personal Data Processing

Personal data processing is carried out on the basis of:

— the consent of the personal data subject;

— the necessity to perform a contract to which the personal data subject is a party;

— the necessity to fulfill obligaHons imposed on the Operator by the legislaHon of the Kyrgyz Republic;

— the necessity to protect the legiHmate interests of the Operator, provided that the rights of personal

data subjects are respected.

3. Categories of Personal Data Subjects, Scope of Data and Processing AcMons

3.1 Categories of Personal Data Subjects

The Operator processes personal data of the following categories of persons:

— Website users and parHcipants of loUery games;

— individuals who have contacted the Operator with requests or inquiries;

— counterparHes who are individuals or individual entrepreneurs;

— representaHves of counterparHes that are legal enHHes;

— employees of the Operator and candidates applying for employment;

— other persons interacHng with the Operator within the framework of lawful processing purposes.

3.2 Scope of Processed Personal Data

The scope of personal data depends on the purposes of processing and may include:

— surname, name and patronymic;

— date of birth;

— telephone number;

— email address;

— user account idenHfiers;

— informaHon about parHcipaHon in loUery games and operaHons performed on the Website;

— other data voluntarily provided by the personal data subject.

The Operator does not process special categories of personal data, unless such processing is directly

required by the legislaHon of the Kyrgyz Republic.

3.3 AcMons with Personal Data and Use of Cookies

Personal data processing may be carried out with or without the use of automated means, including

the following acHons:

— collecHon;

— recording;

— systemaHzaHon;

— accumulaHon;

— storage;

— clarificaHon (updaHng, modificaHon);

— use;

— transfer;

— anonymizaHon;

— blocking;

— destrucHon of personal data.

The Website uses cookies in order to:

— ensure proper funcHoning of the Website;

— improve the quality of user services;

— perform analyHcs;

— ensure the security of services.

4. Rights of Personal Data Subjects

A personal data subject has the right to:

— obtain informaHon regarding the processing of their personal data;

— request clarificaHon, blocking or destrucHon of personal data;

— withdraw consent for personal data processing;

— appeal against acHons or inacHon of the Operator to authorized authoriHes or courts;

— exercise other rights provided by the legislaHon of the Kyrgyz Republic.

5. Ensuring Personal Data Security

The Operator takes the necessary legal, organizaMonal and technical measures to protect personal data

against unlawful or accidental access, destrucHon, modificaHon, blocking, copying, distribuHon, or other

unlawful acHons.

Such measures include, but are not limited to:

— appointment of responsible persons;

— internal monitoring and compliance control;

— restricHon of access to personal data;

— use of informaHon security tools;

— employee training and awareness.

6. Final Provisions

This Policy shall remain valid indefinitely unMl replaced by a new version.

The Operator has the right to amend this Policy.

A new version shall enter into force from the moment it is published on the Website.