Olymoments.com Website Privacy Notice

Valid from: 07.11.2024

1. General provisions

1.1. This notice explains the processing of Participants’ personal data on the website www.olymoments.com (hereinafter Website) and the rights in relation to the processing of personal data.
1.2. The data controllers are the companies referenced in section 1.1 of the Terms and Conditions (hereinafter jointly and separately “Company”)
1.3. The contact details of the Data Protection Officer of Olymoments.com are the following: olybetestoniaDPO@olybet.com, Pronksi 19, Tallinn 10124.
1.4. The Company implements appropriate technical and organisational measures to protect personal data from unauthorised access, unlawful disclosure, accidental loss, alteration, destruction or other unlawful processing. We also require our cooperation partners, to whom we transfer personal data in accordance with this Privacy Notice, to implement the necessary organisational, physical and IT security measures. However, please note that even by using all technical and organisational measures to protect personal data, some risks, such as human error, cyber-attack, loss of electricity, software error or malicious actions of an individual, still remain. Upon discovering such breach, we shall take all reasonable steps to mitigate and minimise the risk to our Participants.
1.5. Provisions on the processing of personal data may also be included in contracts between the Participant and each Company, such as the Terms and Conditions. In such a case, in the event of a conflict of provisions, the provisions agreed upon in the Terms and Conditions shall apply.

1.6. If we amend the notice on the processing of personal data, it will publish the updated version on its website. Depending on the content and effect of the amendment, we may or may not notify the Participant of the amendment. If we materially change our data processing practices, especially when introducing new processing activities or technologies, then we shall provide a reasonable advance notice.

2. Data subject rights in relation to the processing of their personal data
2.1. The Company guarantees all data subject rights as foreseen in the General Data Protection Regulation (the GDPR). To exercise the rights under section 2.2.1 – 2.2.6, the Participant can use the data management application (if you have existing OlyBet account), or by contacting the data protection officer listed in section 1.3.

2.2. Data subject rights under the GDPR:

2.2.1. the Participant has the right to be informed on whether The Company processes their personal data and, if so, to receive a copy of the aforementioned data;

2.2.2. the Participant has the right to request the rectification of inaccurate personal data concerning them;

2.2.3. the Participant has the right to withdraw their consent to the processing of personal data at any time (e.g. direct marketing consent), if the processing is based on consent. Withdrawal of consent does not affect the lawfulness of the processing which took place prior to the withdrawal;

2.2.4. the Participant has the right to demand the erasure of their personal data. The Company may delete data processed on the basis of consent or legitimate interest, if OlyBet’s interests do not outweigh the interests of the Participant. The right to erasure does not apply to data that is processed for the fulfilment of public interest or legal or contractual obligation, as long as that public interest or legal or contractual obligation is valid.

2.2.5. the Participant has the right to object to the processing of their personal data (especially based on legitimate interest) and to restrict the processing of their personal data where justified;

2.2.6. the Participant has the right to receive their personal data, which they have submitted on the basis of consent or to perform a contract, in a structured and machine-readable format (if technically feasible) for transmission to other companies;

2.2.7 the Participant has the right to lodge a complaint at their residence country’s supervisory authority.


3. Processed personal data and their sources

3.1. The Company processes the following Participant personal data.
3.1.1. communication data: e-mail and/or mobile phone number, language of communication, product/service preference, consent to direct marketing, message content, date and time of message.

Source: provided by the Participant when participating in the campaign

3.1.2. Website visit data: IP address (including location based on IP address), Internet service provider, referrer URL, date, time, access token, session key, web browser type and version, operating system, amount and status of data transmitted, MAC address;

Source: provided by the Participant when navigating on the Website

3.1.3. Visual data: image of the data subject, any other identifiers on the content uploaded to the Website.

Source: Source: provided by the Participant when participating in the campaign

3.1.4. Cookie data: The Company uses cookies and/or pixels on its websites to optimise the websites and their functions. Cookies may collect personal data. For more information, please consult OlyMoments’ Cookie Notice.

Source: provided by the Participant when navigating on the Website

3.2. The Company may process special categories of personal data related to the Participant (data concerning racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health and genetic and biometric data). In this case, this is data that is made manifestly public by the Participant by uploading this data to the Website. The Company does not require the Participant to upload this data and any disclosure of this data is solely voluntary by the Participant.

3.3. Depending on the purpose and nature of the processing, The Company collects personal data related to the Participant from the Participant, Participant’s browser by cookies, the Participant’s Internet service provider, as well as from Participant’s social media posts which are tagged #OlyMoments.

4. Legal basis and purposes of the processing of personal data

4.1. The following is a list of processing activities and their legal basis:

4.2. In the case of data processing for the performance of legal or contractual obligations, the Participant is obliged to provide such personal data. Failure to provide such data will prevent The Company from fulfilling its contractual or legal obligations and will limit the Participant’s ability to use the services offered.
4.3. Where The Company processes personal data on the basis of legitimate interest, The Company has assessed that its legitimate interest in processing personal data for certain purposes outweighs the interests and rights of the Participant.
4.4. Where the personal data is processed based on the Participant’s consent, then this consent can be withdrawn by contacting the data protection officer, whose contact details can be found in clause 1.3, or by clicking at the unsubscribe link at the end of every marketing message.

5. Profiling and automated decision-making

5.1. Profiling is used in the following processes and is based on the following logic.
5.1.1. Marketing the services/products offered by The Company Companies based on analysis of website traffic and determining website usage, or when applicable, using data gathered from the Participant’s use of OlyBet’s gaming-related services.
5.2. Automated decision-making is not used on this Website. However, we may use automated monitoring tools to monitor the content posted on the Website which flags the content which is suspected to be in violation of the Terms. The final decision to remove content shall always be taken by a human.

6. Transmission of personal data

6.1. The Company uses various partners as personal data processors, who process data based on and to the extent of the instructions given by The Company or the OlyBet Companies. The partners may be both companies which are part of the OlyBet group, or third parties with whom The Company has entered into appropriate agreements for data processing.

6.2. When processing personal data, The Company will transfer your personal data to the following recipients, which may be either data controllers or processors: its own group companies (the OlyBet Companies as referenced in the Terms and Conditions), public authorities, courts, banks, auditors and legal advisors, insurance companies, analytics service providers, fraud detection and prevention service providers, Participant authentication service providers, survey service providers, archiving service providers, information transmission and communication service providers, streaming service intermediaries, whistleblowing platform operators.

6.3. Usually all of OlyBet’s partners are located in the European Economic Area. If OlyBet’ partner processing the data is located outside the European Economic Area, the safeguards to be used for the transmission of personal data are: an adequate level of data protection in the recipient country in accordance with the European Commission’s decision, or the use of standard contractual clauses for data protection developed by the European Commission in the cooperation agreement.

6.4. The joint controller of Participant data is the OlyBet remote gaming website operator OB Holding  1 OÜ (address Pronksi 19, Tallinn 10124, Estonia, +3726671250, estonia@oc.eu, hereinafter “OlyBet”) , with whom the Company  processes Participant data for the purposes of operating the OlyMoments.com website, marketing services/products, website analytics and managing the Companies’ resources. The parties have entered into an agreement to this effect, which allows the parties to share the personal data to achieve the purposes contained in this Privacy Notice. The campaign is organised by each Company, and they are responsible for their data collected from each respective country, but for internal administrative purposes, OlyBet supports the Company with workforce and infrastructure in order to operate the OlyMoments campaign and the OlyMoments.com website.

6.5. The data processor is Amondo Ltd, a company incorporated in the United Kingdom under number 09043853 whose registered office is at 86-90 3rd Floor, Paul Street, London, England, EC2A 4NE, who is the platform provider of the Website.

7. Time limits for the retention of personal data

7.1. The personal data of a Participant is retained until the purposes of the processing have been fulfilled or until the obligations arising from the legislation have been fulfilled, but not more than 3 months after then end of the campaign.
7.2. Personal data collected based on Participant’s consent, such as Communication data is retained until the Participant withdraws said consent.
7.3. Personal data collected based on legitimate interests is retained as long as necessary for the purposes they were collected.

7.4 Cookie Data is retained according to the timelines indicated under the Cookie Notice, depending on the type of cookie.