WPA Policy

Definitions

The terms used in this policy carry the following meaning:

Act – The Act on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches, promulgated in the State Gazette No. 11 of 2 February 2023.

Policy – This document, adopted by “Big Bet Gaming” Ltd., which regulates the procedures, conditions and guarantees for internal submission, examination and protection with respect to reports of breaches under the Act.

Report – Oral or written information concerning a specific breach or a real risk of such a breach, submitted under the Act by a natural person in the context of employment, service or other professional relations with the Company.

Reporting Person – A natural person who submits a report or publicly discloses information on a breach that became known to him/her in the course of work or service activity within the meaning of Art. 5 of the Act.

Breach – Any act or omission that constitutes a violation of Bulgarian or EU legislation, as well as of the rules on ethics and good governance listed in Art. 3 of the Act and in this Policy.

Internal Reporting Channel – A mechanism administered by the Company for receiving, registering and examining information on breaches in accordance with the Act.

Retaliatory Action – Any act or omission taken in connection with a submitted report that leads, or could lead, to adverse consequences for the reporting person, including dismissal, demotion, discrimination, threats, etc.

Person Concerned by a Report – Any person against whom allegations of an actual or imminent breach are made in a report.

Commission – The Commission for Personal Data Protection (CPDP), which is the competent authority for examining externally submitted reports under Art. 15 et seq. of the Act.

Personal Data – Any information relating to an identified or identifiable natural person, including that provided in the context of a report.

1. Purpose of the Policy

This Policy on the procedure for submission and examination of breach reports (“Policy”) aims to provide clear, accessible and comprehensive information on the conditions, procedures and guarantees relating to whistle-blowing under the Act on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches (“Act”), including through the internal reporting channel maintained by “Big Bet Gaming” Ltd., UIC 207008293, registered office and address: Sofia 1404, Triaditsa District (“Company”).

Pursuant to Art. 12(4) of the Act, this Policy is publicly available and explains how any person may file a report learned in the course of professional or service relations with the Company, as well as the measures for protecting the whistle-blower.

2. Scope of the Policy

The right to file a report under this Policy is granted to natural persons who learned of the breach in the context of their employment, service or other professional relations with the Company, including but not limited to:

• current or former employees, including when the employment or service relationship has already ended;
• self-employed persons, sole practitioners or craftsmen;
• job applicants who acquired the information during recruitment or other pre-contractual relations;
• volunteers and interns, paid or unpaid;
• partners, shareholders, sole proprietors, as well as members of management, supervisory or audit bodies;
• persons working for external contractors, subcontractors or suppliers of the Company.

Protection also covers:

• persons who assist the whistle-blower, provided their help is bona fide and confidential;
• persons in employment or other professional relations with, or relatives of, the whistle-blower who could suffer retaliation;
• legal entities in which the whistle-blower has an interest, works for, or is otherwise professionally connected.

Protection arises from the moment of submission or public disclosure, provided the information is bona fide and credible.

3. Review and Update of the Policy

This Policy is reviewed annually and whenever legislative changes or practical application require.

The review is performed by the Compliance Manager and approved by the Managing Director.

4. Responsible Person

The Company designates the Compliance Manager as the person responsible for receiving, registering, examining and processing breach reports under this Policy and Art. 14 of the Act.

Another employee or external service provider may be entrusted with these functions, provided confidentiality, impartiality and absence of conflict of interest are ensured.

The Responsible Person acts independently, in good faith and with due professional care.

5. Conditions for Protection

Whistle-blowers enjoy protection under the Act if all of the following are met:

• They had reasonable grounds to believe the reported information was true at the time of submission and falls within the Act’s material scope; and
• The report was made in good faith and in the form and content required by the Act.

Anonymous reports do not trigger protection unless the whistle-blower’s identity is later established. Reports concerning breaches committed more than two years before submission are inadmissible unless a law provides otherwise.

6. Confidentiality of Reports

The Company guarantees the confidentiality of the information contained in submitted reports, including the identity of the reporting person, the persons concerned and any other data from which their identity may be directly or indirectly established.

Access to such information is granted only to employees and other persons to whom this information is necessary for the performance of their official or contractual duties, in compliance with the “need‑to‑know” principle. A person against whom a report is submitted has no access to the information, except where expressly provided by law to ensure his or her right of defence.

Persons who have access to the reports are obliged to maintain their confidentiality and not to disseminate information about them, unless necessary for the purposes of the investigation, the taking of follow‑up actions or the protection of affected rights and legitimate interests.

Disclosure of the identity of the reporting person and/or other information from which it can be established is permissible only:

• with the explicit consent of the person who submitted the report; or
• where it is necessary and constitutes a proportionate obligation arising from applicable Bulgarian or European legislation, including within criminal or administrative proceedings, or to guarantee the right of defence of the person concerned.

The Company shall take all necessary technical and organisational measures to protect the information contained in submitted reports.

7. Liability in the Event of Bad Faith

Pursuant to Article 34 of the Law, where prohibited retaliatory measures are taken against a person who has submitted a report under the conditions of the Law, such person is entitled to compensation for all pecuniary and non‑pecuniary damages suffered.

Under Article 39 of the Law, a person who knowingly submitted false information or acted in bad faith is liable for damages caused to other persons, including those mentioned in the report. In such case, the affected persons are entitled to compensation for pecuniary and non‑pecuniary damages.

Additionally, pursuant to Article 45 of the Law, the submission of a report or public disclosure of information known by the reporter to be false entails administrative‑penal liability. The culpable person may be fined up to EUR 3,500.

Where a report contains manifestly false or misleading allegations of fact, the Company reserves the right to return the report with a reasoned instruction for correction, and to warn the reporter of the potential liability arising from the provision of false information.

8. Breaches That Are the Subject of a Report

Under the procedure set out in this Policy, reports may be submitted regarding breaches of Bulgarian legislation or of European Union acts listed in the Annex to Article 3, paragraphs 1 and 3 of the Law, where such breaches have become known to the reporter in the context of his or her professional activity.

Reports should relate to:

• breaches in the field of public procurement;
• financial services, products and markets, including the prevention of money‑laundering and terrorist financing;
• product safety and conformity;
• transport safety;
• environmental protection;
• radiation protection and nuclear safety;
• food and feed safety, animal health and welfare;
• public health;
• consumer protection;
• protection of personal data and privacy;
• security of networks and information systems;
• breaches affecting the financial interests of the European Union within the meaning of Article 325 of the Treaty on the Functioning of the EU;
• breaches of the rules of the internal market under Article 26(2) of the Treaty on the Functioning of the EU, including competition and state aid;
• cross‑border tax arrangements aimed at obtaining a tax advantage contrary to the objectives of the applicable corporate tax law;
• crimes of general nature that have become known in connection with the reporter’s labour or service duties;
• breaches related to the payment of public state or municipal receivables;
• breaches of labour legislation;
• breaches of regulatory acts related to the performance of public service.

9. Submission of a Report

A report on a breach within the meaning of this Policy may be submitted in the following ways:

• Written Form – by completing the standard form available on the website of the Commission for Personal Data Protection: https://cpdp.bg/wp-content/uploads/2023/12/ZZLPSPOIN_Formuljar-za-registrirane-na-signal_13.12.2023.docx and sending it by e‑mail to [email protected]. You will receive confirmation of receipt within seven (7) days.
• Oral Form – by arranging a meeting with the Compliance Manager or another designated officer. The oral report is recorded in the written form, which must be signed by the reporter.

The report must contain at least the following data:

• the reporter’s full name, current correspondence address, telephone and e‑mail (if any);
• the capacity in which the person submits the report (e.g. employee, job applicant, contractor, etc.);
• data regarding the person against whom the report is submitted, if known – name and workplace;
• description of the circumstances indicating a breach or a real danger of such a breach;
• place, period of occurrence and description of the specific act;
• other known circumstances relevant to the subject of the report;
• date and identification of the reporter – by signature, electronic signature or other identifier.

The Company shall take all necessary measures to ensure the confidentiality of the reporter’s identity, including during the collection, storage and processing of the submitted information.

In addition to the possibility of using the internal channel, any person has the right to submit a report through an external channel to the Commission for Personal Data Protection – https://signal-public.cpdp.bg/, as well as to make a public disclosure under the conditions provided by the Law.

10. Procedure After Submission of a Report

Upon submission of a report under this Policy, the following procedure shall apply:

1) Acknowledgement of Receipt – Confirmation of receipt of the report is sent within seven (7) days, and the report is registered with a unique identification number.

2) Preliminary Assessment – A preliminary check is carried out regarding the admissibility and credibility of the report. Where omissions or inconsistencies are identified, the reporter is notified and given a deadline to remedy the deficiencies.

3) Substantive Examination – If the report is admissible, an objective investigation is conducted, including the collection of relevant information and evidence, through communication with the parties concerned and, where necessary, with the reporter. All actions are carried out in strict compliance with the principles of confidentiality, impartiality and personal data protection.

4) Additional Information – During the investigation, if additional data or clarifications are required, the Company may seek cooperation from the reporter or other persons, guaranteeing their protection.

5) Feedback – The reporter receives information on the actions taken and the results of the investigation within three (3) months of the acknowledgement of receipt.

6) External Reporting – Where there is reasonable belief that effective actions will not be taken or there is a risk of retaliation, the reporter may submit a report via the external channel – to the Commission for Personal Data Protection.

7) Termination of Proceedings – The file may be closed where:

• the content of the report is manifestly untrue or misleading;
• the breach is of minor significance and does not require further action;
• the report duplicates a previously submitted one and contains no new substantive information.

The Company guarantees protection against any form of retaliation that could impair the legal or factual situation of the reporter.

11. Register of Reports

The Company shall establish and maintain a non‑public electronic register of reports in accordance with Article 18 of the Law. The register shall contain the following information:

• identification of the employee who received the report;
• date of submission of the report;
• person concerned (if known);
• data on the alleged breach – description, place, period and circumstances;
• link to related reports (if any);
• follow‑up actions taken and results of the investigation;
• feedback provided and date of provision;
• retention period for the report.

The register shall be stored under conditions guaranteeing confidentiality, and access shall be granted only to authorised persons.

12. Processing of Personal Data

The processing of personal data related to submitted reports shall be carried out in accordance with Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act, and Article 32 of the Law on the Protection of Persons Who Report or Publicly Disclose Information on Breaches.

The Company collects and processes only those personal data that are strictly necessary for:

• identifying the reporter (where applicable);
• verifying the allegations set out in the report;
• taking follow‑up actions where necessary; and
• ensuring the protection of the person who submitted the report.

Personal data that are manifestly unrelated to the examination of a specific report shall not be collected, and where such data are inadvertently collected, they shall be deleted immediately.

Personal data shall be stored in strict compliance with the principles of purpose limitation, data minimisation, confidentiality and security, for periods corresponding to the purposes of processing and statutory requirements.