World Cup
2026 TIPS

1. Introduction

Linkbound Administrative Support Services (“the Company”, “we”, “us”, or “our”) is a company registered in the Philippines (Company Registration Number 8005101). We operate the online platform www.2milliontipping.com (“the Website” or “the Platform”), which promotes and
facilitates tipping competitions on sportsbooks worldwide, including in Europe, the United Kingdom, Canada, Australia, the United States of America, South-East Asia, and India.

We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you use our Platform, and sets out your rights in relation to that data.

Please read this policy carefully. By registering an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

Linkbound Administrative Support Services
Company Registration Number: 8005101
Republic of the Philippines
Email: marketing@2milliontipping.com

Website: www.2milliontipping.com

If you have any questions about this Privacy Policy or our data practices, please contact us at the details above.

3. Data We Collect

We may collect and process the following categories of personal data:

3.1 Data You Provide Directly

• Full name
• Email address
• Cell phone number
• Date of birth (for age verification)
• Country of residence
• Username and account credentials
• Any other information you voluntarily provide when contacting us

3.2 Data We Collect Automatically

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent on pages, and clickstream data
• Referral source (how you arrived at our Website)
• Cookie identifiers and similar tracking data (see Section 10 — Cookies)

3.3 Data From Third Parties

We may receive personal data about you from affiliated sportsbooks, marketing partners, or other third parties where you have consented to that sharing or where those parties are legally authorised to share it with us.

Important: We do not collect, store, or process any credit card, debit card, bank account, or
other payment or financial information.

4. How We Use Your Data

We use your personal data for the following purposes:
• To create and manage your account
• To provide and improve our tipping competition services
• To verify your identity and confirm you meet age requirements
• To send you service-related communications (account confirmation, competition results, important notices)
• To send you marketing communications by email and SMS, where you have consented (see Section 6)
• To personalise your experience on the Platform
• To analyse usage patterns and improve the Platform
• To comply with legal and regulatory obligations
• To prevent fraud, money laundering, and other illegal activity
• To enforce our Terms & Conditions
• To share data with approved affiliates and partners (see Section 7)
• To support responsible gambling programmes and comply with gambling regulatory requirements

5. Legal Bases for Processing

Where data protection laws require us to identify a legal basis for processing your personal data, we rely on the following:

Consent — for direct marketing by email and SMS; for the use of non-essential cookies; and for sharing your data with affiliates and partners for marketing purposes. You may withdraw consent at any time (see Section 6).

Contract Performance — to create and manage your account and provide competition services as described in our Terms & Conditions.

Legitimate Interests— for fraud prevention, platform security, analytics, and improving our services, where these interests are not overridden by your rights.

Legal Obligation — where we are required to process data to comply with applicable laws and regulations, including responsible gambling obligations and anti-money laundering requirements.

The following jurisdiction-specific frameworks apply to users in the respective regions:

Philippines: Data Privacy Act of 2012 (Republic Act No. 10173) and implementing rules issued by the National Privacy Commission (NPC). European Union: EU General Data Protection Regulation (EU GDPR) 2016/679.

United Kingdom: UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Canada: Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Australia: Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, the Spam Act 2003 (Cth) governs commercial electronic messages, and the Telecommunications (Consumer Protection and Service Standards) Act 1999 governs
unsolicited SMS communications.

United States: There is currently no single federal privacy law in the United States. We comply with applicable US federal laws including the CAN-SPAM Act 2003 (governing commercial email) and the Telephone Consumer Protection Act (TCPA) (governing SMS and automated calls). For residents of California, we comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Residents of other US states with enacted privacy laws (including Virginia, Colorado, Connecticut, and Texas) may also have rights under those laws, which we honour where applicable.

India: Digital Personal Data Protection Act, 2023 (DPDP Act) and any rules made thereunder.

6. Marketing Communications

By registering on the Platform and ticking the relevant consent box(es), you agree to receive marketing communications from us by email and/or SMS. Your consent is voluntary and you may withdraw it at any time.

6.1 Email Marketing

We may send you promotional emails about competitions, offers, and related services. Every marketing email we send will contain a clearly visible unsubscribe link. You may also unsubscribe at any time by emailing:

marketing@2milliontipping.com

Once you unsubscribe, we will remove you from our marketing email list within 5 business days. You will continue to receive essential service emails unless you close your account.

For users in Australia, our email marketing complies with the Spam Act 2003 (Cth), which requires that all commercial electronic messages include a functional unsubscribe mechanism and that opt-out requests are honoured within 5 business days.

For users in the United States, our email marketing complies with the CAN-SPAM Act 2003, which requires that all commercial emails include a valid physical postal address, a clear opt-out mechanism, and that unsubscribe requests are honoured within 10 business days. All our marketing emails include our registered company address and a working unsubscribe link in satisfaction of these requirements.

6.2 SMS Marketing

If you consent to SMS marketing, we may send you text messages about competitions and offers. Every text message we send will clearly explain how to opt out. You may unsubscribe from SMS marketing at any time by replying STOP (or any equivalent opt-out keyword stated in the message) to any text message sent by us. We will process your opt-out promptly.

For users in the United States, SMS marketing is conducted in compliance with the Telephone Consumer Protection Act (TCPA). We will only send marketing text messages to users who have provided prior express written consent. Standard message and data rates may apply. You may revoke consent at any time by replying STOP.

For users in Australia, SMS marketing complies with the Telecommunications (Consumer Protection and Service Standards) Act 1999 and the Australian Communications and Media Authority (ACMA) guidelines on unsolicited communications.

6.3 Withdrawal of Consent

Withdrawing your consent does not affect the lawfulness of any processing carried out before you withdrew consent. Withdrawal of marketing consent does not affect your ability to use the Platform.

7. Sharing Your Data

We do not sell your personal data. We may share your personal data with the following categories of recipients:

Approved Affiliates and Partners: With your consent, we may share your details (including contact and mailing list information) with carefully selected affiliates and partners who offer related products and services. These parties are contractually required to handle your data in accordance with applicable privacy laws and to offer clear opt-out mechanisms.

Service Providers: Third parties who assist us in operating the Platform, such as email delivery services, SMS gateway providers, analytics platforms, IT support, and hosting providers. These parties act as data processors and are bound by confidentiality and data protection obligations.

Sportsbook Partners: Affiliated sportsbooks and competition operators where necessary to administer competitions you have entered.

Responsible Gambling Bodies: Where required by law or regulation, we may disclose information to self-exclusion schemes, gambling regulators, or responsible gambling organisations.

Law Enforcement and Regulators: We will disclose personal data to competent authorities where required by applicable law, court order, or to protect the rights, property, or safety of the Company, our users, or the public.

Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the relevant third party as part of that transaction, subject to the same privacy protections.

All third parties with whom we share your data are required to maintain adequate data protection standards. We do not authorise them to use your data for their own independent purposes beyond those specified.

For California residents: We do not “sell” or “share” your personal information as those terms are defined under the CCPA/CPRA, including for cross-context behavioural advertising, without your express consent.

8. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. These measures include encryption of data in transit and at rest, access controls,
and regular security reviews.

As stated, we do not store any credit card, bank account, or other payment information. All payment processing, where applicable, is handled by third-party payment providers with their own security standards.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by applicable law (typically 72 hours under GDPR; as soon as practicable under the Australian Notifiable Data Breaches scheme; and without unreasonable delay under applicable US state laws). Where the breach is likely to result in a high risk to you, we will also notify you directly where required.

9. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services. When you close your account, or where data is no longer needed, we will securely delete or anonymise it, except where we are required to retain it longer by law (for example,
financial transaction records may be retained for up to seven years under applicable tax and anti-money laundering laws).

Marketing data is retained until you withdraw your consent or as required by applicable anti-spam regulations.

Data collected for regulatory and responsible gambling compliance purposes will be retained for the period required by the relevant laws or regulatory guidance.

10. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies (including web beacons and pixels) to improve functionality, analyse traffic, and deliver relevant content. Cookies are small text files stored on your device.

10.1 Types of Cookies We Use

Essential Cookies: Necessary for the Website to function (e.g., session management, login). These cannot be disabled.

Analytics Cookies: Help us understand how visitors use the Website (e.g., Google Analytics). Used only with your consent.

Marketing/Tracking Cookies: Used to deliver targeted advertising and track the effectiveness
of campaigns. Used only with your consent.

10.2 Managing Cookies

When you first visit the Website, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time via the cookie settings link in our Website footer. You can also manage cookies through your browser settings, though disabling certain cookies may affect Website functionality.

11. International Data Transfers

Because we operate globally and work with international service providers, your personal data may be transferred to, stored in, and processed in countries outside your country of residence. Some of these countries may not provide the same level of data protection as your home country.

Where we transfer personal data outside of the European Economic Area (EEA) or United Kingdom, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or UK Information Commissioner, or we rely on other lawful transfer mechanisms recognised under applicable law.

For transfers involving Australian users, we comply with Australian Privacy Principle 8 (APP 8), which governs cross-border disclosure of personal information. Before disclosing your personal data to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information.

For transfers involving US users, data may be stored and processed in the Philippines or other jurisdictions. We implement appropriate contractual protections to safeguard your data in transit and at rest.

Transfers from the Philippines are conducted in accordance with the National Privacy Commission’s cross-border transfer rules under the Data Privacy Act of 2012. Transfers involving Indian users are conducted in accordance with the DPDP Act 2023 and any rules made thereunder.

12. Age Verification and Minors

Our services are intended for adults who meet the minimum age requirement applicable in their jurisdiction. The general minimum age to register and participate is 18 years. However, higher minimum ages apply in certain jurisdictions — most notably, participation in sports betting and related competitions in the Philippines is restricted to persons aged 21 or over under PAGCOR regulations. Where local law sets a higher minimum age than 18, that higher age applies to users in that jurisdiction. We do not knowingly collect or process personal data from individuals who do not meet the applicable minimum age.

By registering, you confirm that you meet the minimum age requirement applicable in your country of residence. We may request proof of age at any time. If we become aware that we have collected data from a person who does not meet the applicable minimum age, we will delete it promptly. If you believe we have inadvertently collected such data, please contact us immediately at marketing@2milliontipping.com.

13. Responsible Gambling

The legal classification of tipping competitions varies by jurisdiction. In some countries and territories where we operate — including the Philippines (regulated by PAGCOR), Canada (where paid entry competitions may be treated as gambling under the Criminal Code), and certain US states — our activities may be subject to gambling regulations. In other jurisdictions, such as Australia and the United Kingdom, tipping competitions structured as skill-based contests are generally not classified as gambling, and responsible gambling obligations do not directly apply.

In jurisdictions where our activities are subject to gambling regulation, we are committed to supporting responsible participation. Where required by applicable gambling laws or regulations, we may process personal data to monitor for signs of problem gambling behaviour and to comply with self-exclusion, cooling-off, or harm-minimisation obligations. We may share relevant information with licensed responsible gambling bodies and self-exclusion schemes as required by the laws of the relevant jurisdiction.

Regardless of jurisdiction, if you have concerns about your participation or wish to discuss self-exclusion options, please contact us at marketing@2milliontipping.com.

14. Your Rights

Depending on your country of residence, you may have some or all of the following rights regarding your personal data. To exercise any right, contact us at marketing@2milliontipping.com. We will respond within the timeframe required by applicable law and may need to verify your identity before processing your request.

14.1 Rights Under EU GDPR, UK GDPR, and PIPEDA (Canada)

Right of Access: To request a copy of the personal data we hold about you.

Right to Rectification: To ask us to correct inaccurate or incomplete personal data.

Right to Erasure: To request deletion of your personal data, subject to legal retention obligations.

Right to Restrict Processing: To ask us to limit how we use your data in certain
circumstances.

Right to Data Portability: To receive your personal data in a structured, machine-readable format and transfer it to another provider.

Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: To withdraw consent at any time without affecting prior lawful processing.

14.2 Rights Under Australian Privacy Law

Australian residents have the right to access personal information we hold about them and to request correction of any inaccurate, out-of-date, incomplete, or misleading information, in accordance with Australian Privacy Principles 12 and 13. You also have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC) if you believe we have not handled your personal information in accordance with the Privacy Act 1988 (Cth).

14.3 Rights Under US Privacy Laws (including CCPA/CPRA for California Residents)

Residents of California and other US states with enacted privacy legislation may have the following rights:

Right to Know: To request details about the categories and specific pieces of personal information we have collected about you, the sources of collection, our business purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete: To request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Correct: To request correction of inaccurate personal information we maintain about you.

Right to Opt-Out of Sale/Sharing: To opt out of the “sale” or “sharing” of your personal information for cross-context behavioural advertising. As noted in Section 7, we do not sell or share your personal information in this manner without your consent.

Right to Limit Use of Sensitive Personal Information: To limit our use of sensitive personal information to what is necessary to provide our services.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

California residents may submit a verifiable consumer request up to twice in a 12-month period. We will respond within 45 days (extendable by a further 45 days where necessary, with prior notice).

14.4 Rights Under Philippines Data Privacy Act and India DPDP Act

Users in the Philippines have rights under the Data Privacy Act of 2012, including rights to be informed, to object, to access, to rectification, to erasure or blocking, and to damages. Users in India have rights under the Digital Personal Data Protection Act 2023, including the right to access information, correct or erase personal data, and nominate a representative.

15. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the relevant data protection supervisory authority in your country:

Philippines: National Privacy Commission (NPC) — www.privacy.gov.ph

United Kingdom: Information Commissioner’s Office (ICO) — www.ico.org.uk

European Union: The data protection supervisory authority in your EU member state

Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca

Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au. You must first give us a reasonable opportunity to resolve your complaint before referring it to the
OAIC.

United States: Federal Trade Commission (FTC) — www.ftc.gov. California residents may also contact the California Privacy Protection Agency (CPPA) at www.cppa.ca.gov. Residents of other states may contact their relevant State Attorney General.

India: Data Protection Board of India (once established and operational under the DPDP Act
2023)

We encourage you to contact us first so we can try to resolve your concern directly.

16. Third-Party Links

The Platform may contain links to third-party websites, sportsbooks, or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (to the address registered on your account) and/or by placing a prominent notice on the Website. The updated policy will show the new effective date and version number at the top.

Your continued use of the Platform after notification of changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Platform and may request deletion of your account.

18. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
Email: marketing@2milliontipping.com
Website: www.2milliontipping.com
Company: Linkbound Administrative Support Services
Reg. No.: 8005101 (Philippines)

We aim to respond to all privacy-related enquiries within 5 business days.