SureWin Terms & Conditions

The Company supplies a web-based management system (“The Services”) which enables The Customer to utilize and manage integrated mobile messaging, e-mail messaging and payment card processing for the benefit of one or more of its consumers (“The Users”). The parties have agreed that The Services shall be provided by The Company to The Customer in accordance with and subject to the terms of The Agreement as set out hereunder:

Gambling

Please gamble responsibly and only ever bet what you can afford to lose. Past results are not a guarantee of future profits and Tipster Platforms Ltd accept no responsibility or liability for any losses incurred from following the advice from any services on SureWin. No refunds will be given for any unprofitable terms and the customer agrees not to request any refunds or file any chargebacks due to quality of results during their subscription. No partial refunds can be offered more than 24 hours after each subscription payment.

All decisions made by the SureWin T/A Tipster Platforms Ltd team are final.

Definitions

“Applicable Laws” – Means, in relation to any undertaking and any circumstance pertaining to the provision of The Services to The Customer, all laws, regulations and standards determined by any governmental or regulatory authority, and all generally applicable industry or self-regulatory standards, whether the same are regional, national or international which apply to such undertaking or to such circumstance;

“Intellectual Property Rights” – Means all intellectual and industrial property rights, whether registered or unregistered, including trade and service marks, patents, utility models, designs and design rights, trade and business names, domain names, topography rights, copyright and related rights, database rights, moral rights and all other similar propriety rights in every case which may subsist in any part of the world including any registration of any such rights and applications and any rights to make applications for any foregoing;

“Message” – Means a message comprising text and/or numerals in the form sent by The Company to a User’s mobile phone via such mobile messaging service platform as may be used by The Company from time to time to provide the Services;

“Minimum Term” – Means the period starting on the Commencement Date and ending on the first anniversary of the Commencement Date;

“Operator” – Means any person who provides a mobile telephony communications network in the United Kingdom;

“Revenue Share” – Means the amount payable by the Company to the Customer in relation to use by The Customer of The Services, as specified in a Support Level;8

“Term” – Means the period starting on the Commencement Date and ending in accordance with The Agreement;

“Services” – Means the period starting on the Commencement Date and ending in accordance with The Agreement;

“User” – Means an end-user, recipient and/or beneficiary of The Services, whether as a consequence of receiving a Message and/or an E-Mail via The Services or as a consequence of The User having submitted to The Company details of a payment card for use with, or payment for, The Services, or as a consequence of any other action or undertaking pertaining to The Services; and “Users” shall be construed accordingly;

“User Data” – Means an end-user, recipient and/or beneficiary of The Services, whether as a consequence of receiving a Message and/or an E-Mail via The Services or as a consequence of The User having submitted to The Company details of a payment card for use with, or payment for, The Services, or as a consequence of any other action or undertaking pertaining to The Services; and “Users” shall be construed accordingly;

“Acquiring Bank” – Means the banking service provider to whom The Company has contracted as a merchant for the purposes of processing card transactions on behalf of The Users;

“Aggregator” – Means the supplier of the card processing API to which the Customer’s transactions are sent via The Services, to be processed subsequently by the Acquiring Bank;

Duration & Notice

The Agreement shall commence on the Commencement Date and shall continue, unless terminated in accordance with the terms of The Agreement, for so long as The Services are provided to The Customer.

Except where The Agreement is terminated sooner in accordance with the terms of The Agreement, either Party shall be entitled to give notice to terminate The Agreement by giving to the other not less than 30 days prior written notice, provided that such notice expires no earlier than twelve months from the Commencement Date. In such case, The Customer will pay The Company all sums properly due in respect of The Services provided up to and including the termination date and any additional costs reasonably incurred as a result of the termination of The Services, such as any expenses legitimately incurred following termination, any costs relating to sub-contracts or agreements with suppliers involved, directly or indirectly, in the provision of The Services.

Either party may terminate this Agreement and/or any individual Services Request at any time immediately by giving written notice if:

• the other party commits a material breach of this Agreement and, where such breach is capable of remedy, fails to remedy such breach within 30 days of receiving written notice thereof; or

• the other party is or may be (in the reasonable opinion of the other party) unable to pay its debts or has a receiver, administrator, administrative receiver or liquidator or similar appointed or calls a meeting of its creditors or ceases for any other reason to carry on business.

Termination of this Agreement does not affect the accrued rights, obligations or liabilities of the Parties prior to termination.

Provision Of The Services

The Company shall provide The Services with effect from the Commencement Date in accordance with the terms of The Agreement.

The Company shall take all reasonable steps to ensure that The Services are provided and supported by competent and appropriately trained staff.

The Company shall take all reasonable steps to ensure the Services are compliant with all relevant industry regulations, Codes of Practice and best practice guidelines.

The Company may, from time-to-time, make changes to the nature or scope of The Services, in the interests of both parties, provided that this is done in a manner which minimises any impact on the day-to-day operation of The Services.

Details of any proposed changes shall be submitted in writing to The Customer and be of sufficient detail to enable The Customer to assess the impact of the proposed changes. Except where The Customer is able to demonstrate strong commercial grounds for withholding consent The Customer shall agree to the prompt implementation of the planned changes.

Customer Obligations

The Customer shall provide to The Company all reasonable assistance necessary in relation to enquiries by any governmental, industry or other regulatory body having responsibility in relation to the adherence by The Customer to any and all Applicable Laws;

The Customer shall ensure that:

The Users are made aware of the identity of The Customer as the sole provider of the Services;

The Users are provided with an adequate description of the Services, which shall include: (i) the cost of any message(s) received by the User; (ii) the number and/or frequency of any Messages sent to the User; (iii) The User’s rights to cancel; (iv) full details relating to payments to be processed on behalf of The Users via The Services, including but not limited to the method of payment, the frequency of payment and the means by which The User can subsequently identify payments processed via The User’s credit, debit or other acceptable payment card; (iv) the contact details for enquiries and other help services provided to The Users.

The Customer further warrants that:

Nothing contained in the content of The Services provided hereunder by The Customer, or in any related advertising material, promotional material or resulting communication to The User(s) (i) will infringe the Intellectual Property Rights of any third party or (ii) will be defamatory or abusive, or (iii) will breach any Applicable Laws.

The Customer shall not use the Services or permit the Services to be used by a third party (i) to send or to facilitate communications of any kind whatsoever to any User without that User’s explicit request for or consent to receive such communications or (ii) for any improper, fraudulent, immoral or unlawful purpose (iii) or in a manner which infringes the rights of any third party;

The Customer accepts sole responsibility for the promotion and conduct of the Services and agrees to comply with The Company’s reasonable requests to provide evidence either of the manner of promotion or the conduct of the Services.

The Customer shall at all times throughout the duration of this Agreement:

comply with all reasonable directions and conditions issued by The Company from time to time in relation to any and all aspects of the provision of The Services, including but not limited to compliance with The Company’s best practice guidelines; and:

shall not act in a manner likely to bring The Company or its suppliers or associates into disrepute.

The Customer undertakes not to:

Corrupt or interfere with any software or other processing material provided by The Company or its suppliers from time to time in connection with the provision of the Services;

Cause or permit any person to decompile, reverse‑engineer or disassemble all or any part of any software or other processing material used by The Company or its suppliers in the provision of the Services;

The Customer will use all reasonable endeavors to ensure that no person other than The Customer or its authorized representatives gains access to The Services or has the means to control, to any extent, how The Services are provided.

The Company reserves the right to refuse or to withdraw The Services from the Customer in circumstances whereby The Company determines or suspects that the Customer may be engaged in reselling of The Services to any third party in any form of joint venture, revenue share, advertising deal or other arrangement without the prior written consent of The Company.

The Company reserves the right to disclose to any person any information relating to User Data where such disclosure is made for the purpose of assisting any civil or criminal investigations or proceedings or as otherwise required by law or regulation.

User Data

Each Party warrants that it has and will maintain all necessary data protection registrations and that it will comply with all applicable data protection legislation in respect of User Data obtained as a result of providing the Services.

Prior to The Customer engaging in marketing activity of any kind involving data obtained from The Users, the parties shall agree when and how Users will be provided with an opportunity to positively opt that any user data obtained from them may lawfully be used for direct marketing purposes by The Customer, its affiliates and/or any third parties authorized by Customer. The Customer hereby grants The Company a royalty free, non-exclusive, irrevocable license to use the User Data during the Term solely (unless otherwise agreed between the Parties) in meeting The Company’s obligations under The Agreement.

Security And Privacy

The Customer shall exercise reasonable care at all times to prevent disclosure of The Users’ information, including but not limited to all personal information and payment card details submitted by Users, other than disclosure of same to the Acquiring Bank, The Aggregator or The Company as necessary and/or as required by law. The Customer shall comply with all security standards and guidelines that may be published from time to time by The Company, The Aggregator, The Acquiring Bank or by Visa, MasterCard or any other Card Scheme, which shall jointly and severally comprise “The Security Guidelines”. The Customer understands and agrees that failure by The Customer to comply with the Security Guidelines may result in fines and/or penalties being levied against The Company, The Aggregator or The Acquiring Bank. If this occurs the Customer agrees to reimburse The Company, The Aggregator or The Acquiring Bank immediately and in full for any fine or penalty imposed due to violation by The Customer of the Security Guidelines.

GDPR Policy

The EU General Data Protection Regulation (“GDPR”) comes into force across the European Union on 25th May 2018 and brings with it the most significant changes to data protection law in two decades. Based on privacy by design and taking a risk-based approach, the GDPR has been designed to meet the requirements of the digital age.

The 21st Century brings with it broader use of technology, new definitions of what constitutes personal data, and a vast increase in cross-border processing. The new Regulation aims to standardise data protection laws and processing across the EU; affording individuals stronger, more consistent rights to access and control their personal information.

Our Commitment

SureWin is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the GDPR.

SureWin is dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of, and appreciation for the new Regulation. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance..

Our GDPR Policy

Information Audit – carrying out a company-wide information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed and if and to whom it is disclosed.

Policies & Procedures – revising/implementing new data protection policies and procedures to meet the requirements and standards of the GDPR and any relevant data protection laws, including:

Data Protection – our main policy and procedure document for data protection has been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.

Data Retention & Erasure – we have updated our retention policy and schedule to ensure that we meet the ‘data minimisation’ and ‘storage limitation’ principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’ obligation and are aware of when this and other data subject’s rights apply; along with any exemptions, response timeframes and notification responsibilities.

Data Breaches – our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.

International Data Transfers & Third-Party Disclosures – where SureWin stores or transfers personal information outside the EU, we have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the countries with sufficient adequacy decisions, as well as provisions for binding corporate rules; standard data protection clauses or approved codes of conduct for those countries without. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.

Subject Access Request (SAR) – we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.

Legal Basis for Processing – we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.

Privacy Notice/Policy – we have revised our Privacy Notice(s) to comply with GDPR, ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.

Obtaining Consent – we have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.

Direct Marketing – we have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.

Data Protection Impact Assessments (DPIA) – where we process personal information that is considered high risk, involves large scale processing or includes special category/criminal conviction data; we have developed stringent procedures and assessment templates for carrying out impact assessments that comply fully with the GDPR’s Article 35 requirements. We have implemented documentation processes that record each assessment, allow us to rate the risk posed by the processing activity and implement mitigating measures to reduce the risk posed to the data subject(s).

Processor Agreements – where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organisational measures in place and compliance with the GDPR.

Special Categories Data – where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.

Data Subject Rights – In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our website, emails and SMS of an individual’s right to access any personal information that SureWin processes about them and to request information about: –

Information Security & Technical and Organisational Measures

SureWin takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures, including: – SSL, access controls, password policy, encryptions, practices and authentication

Security And Privacy

The Customer shall exercise reasonable care at all times to prevent disclosure of The Users’ information, including but not limited to all personal information and payment card details submitted by Users, other than disclosure of same to the Acquiring Bank, The Aggregator or The Company as necessary and/or as required by law. The Customer shall comply with all security standards and guidelines that may be published from time to time by The Company, The Aggregator, The Acquiring Bank or by Visa, MasterCard or any other Card Scheme, which shall jointly and severally comprise “The Security Guidelines”. The Customer understands and agrees that failure by The Customer to comply with the Security Guidelines may result in fines and/or penalties being levied against The Company, The Aggregator or The Acquiring Bank. If this occurs the Customer agrees to reimburse The Company, The Aggregator or The Acquiring Bank immediately and in full for any fine or penalty imposed due to violation by The Customer of the Security Guidelines.

GDPR Roles and Employees

SureWin have appointed a data privacy team to develop and implement our roadmap for complying with the new data protection Regulation. The team are responsible for promoting awareness of the GDPR across the organisation, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures and measures.

SureWin have appointed a data privacy team to develop and implement our roadmap for complying with the new data protection Regulation. The team are responsible for promoting awareness of the GDPR across the organisation, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures and measures.

Liability

The Customer hereby indemnifies The Company from and against any and all claims, penalties, demands, losses, charge-backs, costs, expenses, obligations, liabilities, damages, recoveries, and deficiencies, including interest, penalties and reasonable legal fees that result from, or relate directly or indirectly to any acts or omissions, gross negligence, willful default or fraud by The Customer or its assignees, agents, employees, officers or directors. The Company shall not be liable, whether in contract, negligence or otherwise, for any indirect, special, penal or consequential losses, damage, cost or expense of any kind whatsoever and howsoever caused including without limitation loss of production or operation time, loss of profits or of contracts, loss of business, failure to realize anticipated savings or benefits, loss of goodwill, loss of or corruption to data and wasted management or staff time, even if The Company has been advised of the possibility of the same.

Warranties

Each Party warrants and undertakes to the other Party that:

Force Majeure

For the purposes of this clause “Force Majeure Event” means any event beyond the reasonable control of either party including strikes, lock-outs, labour disputes, acts of God, war, terrorism, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, theft or vandalism, inclement weather, fire, flood, storm or other natural disaster.

If the Force Majeure Event shall continue for more than 90 days either Party may terminate this Agreement by giving not less than five Business Days’ notice in writing to the other Party.

General

The Company reserves the right to employ agents and sub-contractors to provide any part of the Services provided that The Company shall remain primarily responsible for any Services provided by such agents or sub-contractors. Except as aforesaid, neither party may assign, transfer or sub contract to any other party any of its rights or obligations under The Agreement.

The Company is an independent contractor and nothing in The Agreement shall render The Company an agent or create any kind of partnership between the parties. The Company shall not have any right or power to bind you to any obligation to a third party.

No waiver of any terms of The Agreement shall be effective unless made in writing and no delay by either party in enforcing any terms of The Agreement will constitute a waiver of such term nor will it affect or restrict such party’s rights and powers arising under The Agreement.

No amendment of any term of the Agreement will be effective unless agreed in writing and signed by the authorized representatives of both parties.

Each term of The Agreement shall be construed separately and in the event that a court or other body of competent jurisdiction decides that any part of The Agreement is invalid, unlawful or unenforceable then that part will be severed from the remainder of The Agreement, which will continue in full force and effect to the fullest extent permitted by law.

The Agreement, including all applicable Services Requests and any attachments or referenced documents, constitutes the entire understanding and agreement between the parties concerning the Services and replaces and supersedes all previous proposals, correspondence, understandings or other communications whether written or oral, save that this nothing shall be construed as hereby attempting to exclude or limit any liability in respect arising from fraud.

The Parties shall perform all such further deeds, assurances, acts and execute such other documents as may be reasonably be required to carry the provisions of The Agreement in full force and effect.

Notices must be sent by pre-paid first class post or faxed to the address of the other Party as set out at the top of The Agreement, or as stated in a Services Request, or as notified in writing from time to time.

The Agreement will be governed by and construed in accordance with English law and the parties hereby submit to the exclusive jurisdiction of the English courts.