Policy on personal data protection of the participants in the licensed and organized games under the Gaming Act by WINBET
The Policy on personal data protection reflects the requirements of Regulation 2016/679 ЕU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General data protection regulation” or GDPR), in connection with personal data processing and the Personal Data Protection Act, as well as other special requirements of the normative acts applicable to this activity, incl. but not limited to: the Gaming Act, the Measures Against Money Laundering Act, the sublegal normative acts, as well as the compulsory gaming terms and conditions, rules and requirements adopted by the State Commission on Gambling for the hazard games organized by the companies working under the WINBET trademark (hereinafter called “WINBET”).
The current Policy on personal data protection refers to the processing of personal data of natural persons with respect to participating and receiving cash or prize wins from the on-land games in the gaming halls, organized by the companies working under the WINBET trademark.
What information we collect and why?
We may collect personal data about you when you visit our gaming hall. In most cases we request your personal data in order to provide a service, to observe a legal obligation, or to protect our legal interest. If you do not provide us with identification details, we would not be able to provide you the relevant service. Depending on the services you are using, we may collect and process the following information about you:
When visiting an on-land gaming facility (gaming halls)
- Names and date of birth, in order to establish your identity and so you may take part in bonus games, while at the same time we fulfill our legal obligations;
- e-mail address for receiving marketing messages;
- a phone number for receiving marketing messages;
- Personal number, Personal number of a foreigner or another identification number or personal ID card details, as well as citizenship – solely when paying out won amounts of above BGN 4000.
- Records from video cameras when you visit our facilities, in order to ensure your and our security and/or the performance of a normative obligation.
The purpose when processing your data
In most cases personal data is required to observe a legal obligation, to perform a contract, or based on a legal interest. Of course, with part of our services you yourselves are providing this information choosing and agreeing to this.
The personal data we collect and process is most commonly for the following purposes:
When performing our activity we require and process data on the basis of several normatively established obligations, like:
- the Gaming Act, the Measures Against Money Laundering Act, sublegal normative acts, as well as the gaming terms and conditions, rules and requirements for organizing hazard games adopted by the State Commission on Gambling;
- Natural Persons Income Taxation Act;
- The Accountancy Act and the Tax Insurance Procedures Code and other relevant normative acts related to the keeping of correct and lawful accounting;
- Obligations for providing information to all state commissions and regulatory bodies;
- Obligations for performing video surveillance in our gaming halls;
- Obligations for providing information to the court and the enforcement bodies.
Processing the data based on your consent
When we process your data for the purposes of directly marketing our products and services, as well as for participating in bonus games and tombolas, we shall need your express consent.
Data processing based on our legal interest
- performing video surveillance in our administrative facilities;
- performing sound recording when making a phone call from the call-center in order to improve the quality of the provided services, as well as resolve any disputes and protecting legitimate interests.
Who with can we share your personal data?
The provision of personal data in some cases is obligatory in order for us to fulfill our legal requirements. Depending on the games organized by WINBET, in which you take part, we may provide your data to the following categories of recipients:
- State Commission on Gambling, the National Revenue Agency, State Agency “National Security“, in compliance with normatively established requirements and obligations related to the holding of hazard games. These bodies are entitled to receive information regarding the registered users, the placed bets, paid out wins, as well as other information in the cases and in the form provided by law;
- Banks, payment institutions, companies for postal money transfers, specifically identified within the relevant rules for organizing and holding the games, in performance of the requirements and obligations for making bets and the paying out of wins;
- Suppliers of systems/ services providing for the games, management and maintenance of the activity and quality of the services, incl. such related to the information technologies, with whom we have signed contracts (i.e. suppliers of IT, software product suppliers, suppliers of computer maintenance, prize suppliers, etc.), in performance of the requirements and obligations for maintenance of the normatively established functionalities of the system, identifying the participants, making bets, determining the results and the paying out of wins;
- State bodies/ institutions, persons with public functions, regulators and supervisory authorities (incl. Ministry of Youth and Sport, SCG, NRA, SANS, bodies of court, the office of the prosecutor and investigations, Consumer Protection Commission, Commission on the Protection of Competition, Personal Data Protection Commission, etc.), if we have enough reasons to believe that their access, use, keeping or disclosure is necessary for: the performance of an applicable law or another normative act of obligatory nature; upon response to an enquiry made by a supervisory authority, regulator or another state institution in connection with or in the performance of its legally established functions or initiated checks, complaints, audit, or other; disclosure, prevention or other actions in relation to fraud, money laundering, financing of terrorism, technical problems or such related to security.
WINBET uses third parties for assisting certain contractual activities or when performing a legal obligation. We shall not provide your personal data to third parties before we have ensured that all technical and organizational measure for protecting these data have been undertaken, while striving to exercise strict control in order to fulfill this goal. Part of these personal data recipients may be:
- courier firms, external consultants and specialists, collection companies and law offices, banks, security firms, persons, which by assignment maintain equipment, software and hardware used for personal data processing by WINBET, hosting companies and trade agents, etc.
Information about us
The personal data of the participants in the organized games may be processed by the following controllers:
When you are taking part in on-land games in our gaming halls, the data are processed by “Casino Solutions“ ООD, UIC: 131496606, with principle office and business address in the city of Sofia, “Mladost“ region, “Mladost-2“ resid. quarters, “Saint Kipriyan“ St., bl. 292, jointly with the companies working under the WINBET trademark, in their capacity of joint controllers.
While strictly observing the European and local legislation in the field of personal data, an in order to guarantee the rights of the data subjects, the companies working under the WINBET trademark, in their capacity of joint controllers, have agreed that:
- The right to information of each subject must be provided by the company, with which he/she has made initial contact;
- When the grounds for data processing is consent, the same shall be provided the company, to which it was submitted, and it shall be deemed valid grounds for processing also with respect to the remaining companies;
- The official responsible for personal data protection for the companies working under the WINBET trademark, as joint controllers, may be found on the following email address: [email protected];
- Each of the companies shall be obliged to, in a timely manner, but no later than 1 month from the request, provide information about the actions undertaken under rights/claims filed by the subject pursuant to Art. 15 – 22 of the General Data Protection Regulation and the Personal Data Protection Act;
- Inquiries by data subjects communicated electronically shall receive a response electronically unless otherwise requested by them;
- Each of the companies shall be responsible for the fulfillment of requests on the exercising of the rights of data subjects regardless of which company was submitted that specific request;
- The companies shall jointly apply rules, policies, organizational and technical measures, which to guarantee personal data security, their lawful processing, the observation of the rights of the data subjects, as well as the engagement of Processors who can provide guarantees for the same and adequate level of protection and procedures of data processing;
- If the security of processing was violated, the companies working under the WINBET trademark shall cooperate in a way that ensures that all necessary measures have been undertaken to limit the consequences for the data/ rights of the subjects security, as well as for informing (no later than 72 hours from learning thereof) the Personal Data Protection Commission, if necessary, and the data subject;
- Regardless of the agreements between the companies, the data subject may direct his/her requests to any of them. The latter shall be jointly responsible for performing the rights of the data subject.
Technical and organizational security measures
In order to ensure optimal level of personal data protection of the subjects, the companies working under the WINBET trademark shall jointly apply the following technical and organizations security measures by:
- Protection of the collected personal data from unwarranted use and monitoring their processing;
- Maintenance of secure computer systems, through which personal data are processed. Adequate control mechanisms for dividing and managing data are applied to our systems;
- Adopting strict policies and procedures, applicable to their personnel, in order to minimize the risks from personal data processing;
- The employees of WINBET are aware of the applicable rules, and have been trained to process personal data while exerting the greatest care and in line with established good practices;
- When performing its activity, WINBET works solely with well-established organizations and avoids working with companies, which it believes may endanger the personal data security of the individuals;
- Established good practices when entering and administrating the security systems and monitoring the technological development with respect to possible risks for the security of the information in the company;
- Ensuring the security of the computer systems and the personal data contained in them , including the possibilities for access to separate kinds of personal data by its employees;
- Providing access only to those personal data, necessary for carrying out the work of the relevant employee.
The companies working under the WINBET trademark have adopted procedures for effectively recognizing, reporting and investigating personal data security breaches. In the case of personal data security breach, each of the companies shall undertake immediate actions to limit the effect of the breach, as well as to inform the affected data subjects and the supervisory authority on personal data protection.
What are your rights and how can you exercise them?
You dispose with the right to information, to access and receive a copy of your personal data processed by WINBET. If you believe that any information about you that WINBET has in its possession, is incorrect or incomplete, you may request the editing of your personal data.
You may exercise the right to rectification and updating of the personal data provided by you also by accessing your user profile on the internet page of WINBET.
Furthermore, you are entitled to:
- object against the processing of your personal data;
- request the erasure /deletion of your personal data when the legal grounds for processing them are no longer valid;
- request restriction on the processing of your personal data; and/or
- withdraw your consent when WINBET processes your personal data based on a consent (and this withdrawal shall not affect the lawfulness of the processing performed before the withdrawal);
- lodge a complaint with the supervisory authority – CPDP (Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd. or www.cpdp.bg).
WinBet shall fulfill requests, withdrawals and objections according to the requirements of the applicable rules on personal data protection, but these rules shall not be absolute: they are not always applicable, and it is possible to have exceptions. In response to a submitted request you must confirm your identity and/or provide additional information, which to facilitate the better understanding of your request.
When you have exercised the right to access to information or to a copy of the data in machine readable format for a second time, WINBET may impose a reasonable fee based on the administrative expenses necessary for their provision.
How to exercise your rights?
Each one of the rights set forth in the law may be exercised by submitting a request for exercising the relevant right. A request for exercising the rights of the personal data subjects may be submitted in the following way:
- Identification of the person – full name and Personal No.;
- Contact information for feedback – address, phone, email;
- Request – description of the request.
WINBET shall provide information regarding the activities undertaken in connection with request for exercising your rights within one month from receiving the request.
If necessary, this period may be extended by another two months, while taking into account the complexity and number of requests by a certain person. WINBET shall inform the person about each such extension within one month from receiving the request, while indicating the reasons for the delay. The information provided the subject, and any communication and actions on exercising the rights of the data subject shall be provided free of charge (unless there is abuse of the provided rights).
We may request the provision of additional information necessary for confirming your identity when there is uncertainty related to the identity of the natural person submitting this request.
WINBET shall not be obliged to respond to a request if it is unable to identify the data subject.
When the request was submitted using electronic means, if possible, the information shall be provided by using electronic means, unless you have requested otherwise.
WINBET collects and processes personal data through the enabled cookies, and you may find more information in the Cookies Policy on the website of WINBET.
Data protection official
The data protection official of all companies using the WINBET trademark, is lawyer Dessislava Dimitrova, esq., email: [email protected]
Updating the personal data protection policy
The current Policy may be subject to amendment by WINBET, and it was last updated on 01.09.2019. Any future amendments or addenda to this Policy shall be duly recorded.