1 GDPR DATA PROTECTION NOTICE FOR PERSONNEL

GDPR DATA PROTECTION NOTICE FOR PERSONNEL

DraftKings Inc. is committed to protecting the privacy and security of your personal information.

In this regard, this Privacy and Data Protection Notice (“Notice”) provides details about how your personal

information will be collected and processed by DraftKings Inc. or, as relevant, the particular company named in

your offer letter, employment agreement or other contract, such as one of the EU or UK affiliates/subsidiaries

listed in Appendix 1 (Group Companies) of this Notice (referred to herein as "DraftKings", "we", "us" or

"our").

We will be a "data controller" within the meaning of the GDPR. This means that we are responsible for deciding

how we hold and use personal information about you. This Notice details how we collect and use personal

information about you as part of our recruitment process, and during and after your working relationship with us,

in accordance with the GDPR.

For the purposes of this Notice:

GDPR means the General Data Protection Regulation (EU 2016/679), the UK’s retained EU law

version of the General Data Protection Regulation (EU 2016/679), and any other applicable national

implementing laws, as amended or updated from time to time;

Group Company means a company which is a subsidiary of DraftKings Inc.

Personal Data is defined as any information relating to a living individual from whom that individual can

be identified directly from that data or indirectly in conjunction with other information. It does not include

data where the identity has been removed (anonymous data). We will collect, hold and use the

following categories of Personal Data about you as set out in Section 2 (Information we may collect

from you) of this Notice.

Please read the following carefully to understand how and why we are using such information and what your

rights are under the applicable data protection legislation.

1. Scope

This Notice applies to you if you are in the European Economic Area (“EEA”) or United Kingdom (“UK”) or if

your Personal Data is processed in the EEA or UK, whether you are a prospective, current or former employee,

partner, worker, intern, agency worker, consultant, individual contractor or director of DraftKings. It also applies

to third parties whose information you provide to us, e.g., emergency contacts, pension beneficiaries, etc.

Where we refer to “employee,” “employment,” or “personnel” in this Notice we do so for convenience only and

this should in no way be interpreted as purporting to confer employment status on applicants and other non-

employees to whom this Notice also applies. This Notice does not form part of any contract of employment and

does not confer any contractual rights on you, nor place any contractual obligations on us.

This Notice applies to all personal data collected, maintained, transmitted, stored, retained, or otherwise used

(i.e., processed) by us regardless of the media on which that personal data is stored. We may update this

Notice at any time, in our sole discretion, and will notify you in writing of any material changes as soon as is

reasonably practical.

Data Protection Principles

DraftKings is committed to complying with the GDPR. Any personal information that we hold about you must be:

1. Used lawfully, fairly and in a transparent way;

2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is

incompatible with those purposes;

3. Relevant to the purposes that we have told you about and limited only to those purposes;

4. Accurate and kept up to date;

5. Kept only as long as necessary for the purposes we have told you about; and

6. Kept securely.

2. Information we may collect from you

The type of information we collect is set out in Appendix 2 (Personal Data Collected) of this Notice.

If you fail to provide certain information when requested, we may not be able to successfully operate our

recruitment process or perform the contract we have entered into with you (such as paying you or providing a

benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and

safety or our workers).

Note: If you provide us with personal data or special categories personal data relating to other people you must

first: (a) inform the person about the content of this Privacy Notice; and (b) obtain any legally required consent

from that person to the sharing of their personal data or special categories personal data in this manner.

Information about you from other sources: We may receive personal information about you from third-party

websites. Information from these third-party websites will consist of the profile information you have provided to

third party websites (e.g. your LinkedIn profile). This will include [email addresses]. If you elect to use any third

party websites, you should review their third party privacy policies in relation to any information transferred to

us.

3. Purpose and Basis for Processing

We will only use your personal data for the purposes and legal bases set out in the table below:

Purpose(s) for Processing Legal Basis for Processing

 Recruitment/appointment including assessing your

job application; and

 Contacting job applicants in connection with future

job opportunities.

 We will obtain your consent for the processing of

your personal data

as part of our recruitment

process and for the purposes of contacting you in

elation to future job opportunities as further

detailed in Section 9 (Data Retention).

 You can withdraw your consent at any time by

contacting our Data Protection Officer whose

contact details are available in the Section 11

(see Further Information below)). More detailed

Information on your right to withdraw consent

is provided in Section 10 (Your Data Rights).

 Providing you with building and IT access;



Payroll and finance including paying salary,

reimbursing expenses and other payments;

 Keeping attendance and working time records;



Performance appraisals and management of

performance;

 Benefit payments and administration; and

 Administering employment termination.

This processing of your data is necessary to process

job applications submitted by, or on your behalf, and

for performance of your contract of employment (or

engagement), if any.

 Contacting potential job applicants in connection

with future job opportunities and related

information in connection with our business.

 Monitoring and promotion of equal opportunities,

including the review of gender breakdown and

progression;



Monitoring use of IT and communications in

accordance with our IT, email and internet policy;

 Provision of references;



Investigating and responding to complaints from

personnel, clients, business partners, regulators;

 Maintaining emergency contact details; and

 Exercising our right to conduct legal proceedings.

 The processing of your data is necessary for our

legitimate business interest

in managing our

business operations,

including legal, personnel,

administrative and management purposes and for

the prevention and detection of crime, provided

our interest is not overridden by your interest.

 Please note that you have a right to object to

processing of your personal data where that

processing is carried on for our legitimate

interest.

 Where we rely on our "legitimate interest" as a

reason for processing personal data, we have

considered whether those interests are

overridden by employees' rights and

freedoms and have concluded that they are

not.



You have a right to request information on the

legitimate interests assessment (LIA) we use.

 Managing health and safety at work and incident

reporting;



Compliance with our regulatory (for example

disclosing tax data to the office of the revenue

commissioners) and professional requirements;

and

 Exercising our right to defend, respond or conduct

legal proceedings.

 This processing of your data is necessary in order

for us to comply with any

legal or regulatory

obligations.

We will only use your personal information for the purposes for which we collected it, unless we reasonably

consider that we need to use it for another reason and that reason is compatible with the original purpose. If we

need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal

basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance

with this Notice, where this is required or permitted by law.

4. Special Categories of Personal Data

Certain categories of your personal data are regarded as 'special' including information relating to an

individual's:

• Physical or mental health, including any medical condition, health and sickness records;

• Religious, philosophical or political beliefs;

• Trade union membership;

• Ethnic or racial origin;

• Sexual orientation;

• Biometric or genetic data; and

• Criminal convictions and offences.

We only process such data where necessary for the purpose of carrying out the obligations, and exercising

specific rights, of DraftKings or of an employee under employment law or for the assessment of your working

capacity.

We will only process data relating to your criminal convictions or involvement in criminal proceedings when

permitted by law, or where provided voluntarily by you.

5. Consent

In general, we do not rely on your consent for data use aside from as part of our recruitment process. We may

from time to time, (i) ask for your consent to use your personal data for a specific purpose; and/or (ii) process

your personal data (including special categories of data) in order to protect your vital interests or the interests of

another. If we do so, we will provide you with full details of the data that we would like and the reason we need

it so you can carefully consider whether you wish to consent. We will also inform you about the fact that you can

revoke your consent at any time and how you should do that.

Please be assured that withholding your consent will never have an impact on your employment with us or

otherwise negatively affect you.

6. Security and Storage of Personal Data

We have put in place appropriate security measures to prevent your personal information from being

accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We securely store your personal data in a centralised database, with controlled access to such database.

Access to personal data (including special data) in both electronic and paper form is restricted to limited

authorised personnel and employees who have a legitimate and justifiable reason to view such data.

Third parties will only process your personal information on our instructions and where they have agreed to

treat the information confidentially and to keep it secure.

We have put in place procedures to deal with any suspected data security breach and will notify you and any

applicable regulator of a suspected breach where we are legally required to do so.

7. Recipients of Your Personal Data

We may disclose your personal data to a Group Company including, without limitation, for the following

reasons: in order to run global processes, carry out group wide reporting, or take decisions about hiring or

promotion.

It may be necessary from time to time for us to disclose personal data to third parties or agents, including

without limitation to the following:

• Third parties to assist in the administration, processing and management of certain activities pertaining

to past, current and prospective employees;

• Individuals or companies employed by DraftKings to carry out specific services, functions or

consultancy work including external reference agencies and other financial institutions;

• Relatives or legal representatives of past, current and prospective employees;

• Regulatory, legal, and judicial bodies and authorities to whom we are obliged or required to disclose

information including, without limitation, Workplace Relations Commission, Courts, Court-appointed

persons and arbitrators;

• Insurance or assurance companies and health insurance providers or trade unions;

• Legal and medical practitioners;

• Payroll and employee benefit service providers;

• Pension providers;

• Potential purchasers or bidders;

• Relevant Government departments and agencies; and

• Other support service providers necessary to assist DraftKings with the above or with its business or

personnel operations.

We will inform you in advance if we intend to further process or disclose your personal data for a purpose other

than the purposes set out above. We take all reasonable steps, as required by law, to ensure the safety, privacy

and integrity of such data and information and, where appropriate, enter into contracts with such third parties to

protect the privacy and integrity of such data and any information supplied.

8. Transfer of Personal Data outside the EEA

The personal data that we collect from you may be transferred to, and stored at, a destination outside the EEA

and UK, for the purposes described above. Due to the global nature of our business, your personal data may be

disclosed to Group Companies outside the EEA and UK. It may also be processed by personnel operating

outside the EEA and UK who work for us or for one of our suppliers who act on our behalf.

We will ensure suitable safeguards are in place to protect the privacy and integrity of your personal data in such

circumstances including standard contractual clauses under Article 46.2 or an adequacy decision under Article

45 of the GDPR. You can obtain information and a copy of documentation pertaining to these safeguards by

contacting our Data Protection Officer (whose contact details are available in the Further Information section

below).

9. Data Retention

Unsuccessful Candidates:

We retain the personal data of unsuccessful candidates for 2 years following the conclusion of our recruitment

process on the basis of consent, unless a different retention period is required by applicable law or regulation –

this may include documents relevant to the recruitment process including interview feedback – or unless you

indicate that you would like us to retain such information for a longer period. Unsuccessful candidates have a

right to withdraw this consent at any time as further detailed in Section 10 (Your Data Rights).

The personal data of unsuccessful candidates will be held in any event for at least 12 months following the

conclusion of our recruitment process in all cases, unless a different retention period is required by applicable

law or regulation, for the purposes of defending any potential claims that could accrue under relevant

employment and discrimination legislation.

Successful Candidates:

With respect to successful candidates and employees of DraftKings, we retain your data for the duration of your

employment with us and for 7 years following the termination of your employment with us (for any reason),

unless a different retention period is required by applicable law or regulation. Since there are additional

statutory and regulatory retention periods that may apply in respect of certain documents, we provide all

employees of DraftKings with a copy of our Records Retention Policy & Schedule.

Our retention practices are reviewed and updated from time to time in line with legal and regulatory

requirements and best practice.

10. Your Data Rights

You have several rights in relation to your personal data under applicable privacy and data protection law,

which may be subject to certain limitations and restrictions such as when the processing of your data is

necessary to comply with a legal obligation or for the exercise or defence of legal claims.

Under certain circumstances, by law you have the right to:

Your Right What this Means

Right to Withdraw

Consent

If we are processing your personal data on the legal basis of consent, you are entitled

to withdraw your consent at any time (see Further Information below).

However, the withdrawal of your consent will not invalidate any processing we carried

out prior to your withdrawal and based on your consent.

Right of Access You can request a copy of the personal data we hold about you (a data subject access

request).

Right to

Rectification

You have the right to request that we correct any inaccuracies in the personal data we

hold about you and complete any personal data where this is incomplete.

Right to Erasure

(‘Right to be

Forgotten’)

You have the right to request that your

personal data be deleted in certain

circumstances including:

• The personal data is no longer needed for the purpose for which it was collected;

• You withdraw your consent (where the processing was based on consent);

• You object to the processing and there are

no overriding legitimate grounds

justifying us in processing the personal data (see Right to Object below);

• The personal data has been unlawfully processed; or

• To comply with a legal obligation.

However, this right does not apply where, for example, the processing is necessary:

• To comply with a legal obligation; or

• For the establishment, exercise or defence of legal claims.

Right to

Restriction of

Processing

You can ask that we restrict your personal data (i.e., keep but not use) where:

• The accuracy of the personal data is contested;

• The processing is unlawful, but you do not want it erased;

• We no longer need the personal data, but you require it for the establishment,

exercise or defence of legal claims; or

We can continue to use your personal data:

• Where we have your consent to do so;

• For the establishment, exercise or defence of legal claims;

• To protect the rights of another; or

• For reasons of important public interest.

Right to Data

Portability

Where

you have provided personal data to us, you have a right to receive such

personal data back in a structured, commonly-used and machine-readable format, and

to have those data transmitted to a third-party data controller without hindrance but in

each case only where:

• The processing is carried out by automated means; and

• The processing is based on your consent or on the performance of a contract with

you.

Right to Object You have a right to object to the processing of your personal data in those cases where

we are processing your personal data in reliance on our legitimate interests. In such a

case we will stop processing your personal data unless we can demonstrate

compelling legitimate interests which override your interests and you have a right to

request information on the balancing test we have carried out. You also have the right

to object where we are processing your personal data for direct marketing purposes.

Right to Complain You have the right to lodge a complaint with your local supervisory authority, if you

consider that the processing of your personal data infringes on the GDPR.

If you wish to exercise any of your rights in this regard please contact our Data Protection Officer (whose

contact details are available in the Further Information section below). We will respond to your request as soon

as practicable. We may request proof of identification to verify your request.

We will respond to any valid requests within one month, unless it is particularly complicated or you have made

repeated requests in which case we will respond, at the latest, within three months. We will inform you of any

such extension within one month of receipt of your request, together with the reasons for the delay. You will not

be charged a fee to exercise any of your rights unless your request is clearly unfounded, repetitive or

excessive, in which case we will charge a reasonable fee in the circumstances or refuse to act on the request.

11. Further Information

If you require any further clarification regarding this Notice or wish to contact DraftKings about the foregoing,

please contact our Data Protection Officer, Ethan A. Park, at privacy@draftkings.com

APPENDIX 1

EU GROUP COMPANIES

Affiliates or subsidiaries of DraftKings include:

• Crown Gaming Ireland Limited, an Irish registered company;

• Crown DFS Malta Limited, a Malta registered company;

• Crown Gaming Malta Limited, a Malta registered company;

• Crown Europe Malta Limited, a Malta registered company;

• DK UK Services Limited, an English registered company;

• SBTech (Global) Limited, an Isle of Man registered company;

• SBTech Subsidiary Bulgaria, a Bulgarian registered company;

• SBTech Gibraltar Limited, a Gibraltar registered company;

• Sky Star Eight Limited, an English registered company;

• Software Co-Work Cyprus Limited, a Cyprus registered company;

• Crown Gaming Inc., a Delaware corporation;

• Crown DFS Inc., a Delaware corporation;

• SBTech US Inc., a Delaware corporation; and

• DraftKings Australia PTY Ltd., an Australian registered company.

APPENDIX 2

PERSONAL DATA COLLECTED

Part 1 - General Personal Data

• Personal- contact/identifying details including name, address, email address, date of birth, photograph,

civil status, gender, nationality, domestic partners, dependents;

• Emergency Contact - name and contact details of emergency contacts (as set out above, you must

provide a copy of this Notice to any third parties whose personal data you provide to us);

• Professional - Curriculum Vitae and/or application form, previous employment background, references

from previous employers, record of interview/interview notes, selection and verification records,

educational details, professional and/or academic transcripts, professional certifications, special skills

including (driver) licenses, language skills, memberships of committees or other bodies;

• Financial - salary and benefit details including bank details, PPS number, tax information;

• Employment - work contact details (corporate email address and telephone number), identification

number, photograph, details regarding the job function, primary work location, working hours,

employment status, your terms and conditions of employment or engagement, contract of employment,

signed confidentiality agreement, immigration status, work permit details, job description, history and

details of current position;

• Premises and IT access - information required to access DraftKings' systems and applications such

as email account and system passwords, login and access records ,download and print records, call

recordings, records of email and internet usage in accordance with our email and internet policy, CCTV

images captured through the legitimate use of CCTV within the premises of the Group Company;

• Fees, remuneration and benefits – fees/payment and benefits package, base salary, bonus,

compensation type, long term incentives, pension scheme, PRSA, health insurance scheme (and any

third party beneficiaries, including family members or dependents), DraftKings' credit card data, salary

reviews;

• Leave - including documentation which may be provided in connection with any statutory leave, sick

leave, holiday and family related leave records, garden leave, and any other type of leave;

• Performance management - performance assessments/meetings (including probationary

assessments), colleague and manager feedback, appraisals, outputs from talent programs and formal

and informal performance management processes;

• Training and development - such as data relating to training and development needs or training

received;

• Disciplinary and grievance - such as any personal data contained in records of allegations,

investigation and proceeding records and outcomes;

• General correspondence/meetings - relating to grievance and/or disciplinary processes, misconduct

or performance issues, data arising in connection with litigation and complaints, involvement in incident

reporting and disclosures;

• Termination - for example, dates and reason for leaving, termination agreements and payments, exit

interviews and references;

• Incapacity/Disability - any accommodations or adjustments in connection with any

incapacity/disability; and

• Statements concerning securities trading and equitable or beneficial interests, including information

relating to family members and other accounts under employees' control and details relating to shares

of stock or directorships;

Part 2 - Special Categories of Personal Data

We may also collect, hold and use the following "special categories" of more sensitive personal information:

• Physical or mental health data - such as information about your physical or mental health or

condition; for example, we record your days of sickness, or workplace adjustments due to health

reasons.

• Other special categories of personal data - such as racial or ethnic origin; commission or alleged

commission of any offence; and any proceedings for any offence committed or alleged to have been

committed, the disposal of those proceedings or the sentence of any court in those proceedings.

Special categories of personal data will only be collected and used in so far as such is necessary for the

purposes of carrying out an obligation in the field of employment/social security/social protection law, or

exercising specific rights or when the use is authorized by law or for the assessment of working capacity.