Introduction

With this Privacy Notice, OPAP S.A., with registered office at 112 Athinon Avenue, Athens (hereinafter the "Company"), which is the Data Controller of your personal data, wishes to provide you with information on the personal data it collects within the context of the provision of games of chance services online (hereinafter the “Games of Chance”) and specifically through OPAP S.A’s Online Points with the use of mobile or non-mobile devices as well as any other mean that could be raised by modern technologies in the future.

The present Privacy Notice aims at informing you on the type of personal data that we collect about you, on the way and the purposes for which we collect your data, on the third parties with which we share such data, as well as on your rights, in order for the Company to comply with the applicable Greek Law on Data Protection, L. 4624/2019, as well as with EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (GDPR).

Protecting your personal data is very important to us. The Company has taken all adequate technical and organizational measures for the protection of your personal data, collected through its Online Points, against any unauthorized access, processing, loss, or erasure.

Please note that this Privacy Notice applies to all information collected by the Company through the use of its Online Points, regardless of how you access it (via web or mobile app). However, it does not apply to third-party websites that may be linked from the Online Points. These external websites are controlled by independent parties and are not affiliated with the Company. We encourage you to review the privacy notices of any websites you visit, as the Company is not responsible for their content or privacy practices.

Categories of personal data we process

During your navigation through Company’s Online Points, your registration for the Game of Chance services, and your participation in those games, the Company processes your personal data. Specifically:

• Identification and demographic data, such as full name, father’s name, date and place of birth, ID/passport number, issue and expiry dates and issuing authority, gender, residential address, city, postal code, and data derived from verification documents requested to confirm the above (e.g. ID/passport).
• Biometric data, including photographic images, real-time video with audio, and facial characteristics.
• Contact details, such as mobile phone number and email address.
• Player Account activity, including available balance, deposits, withdrawals, payment method details (e.g. IBAN, cards) used for participation or winnings withdrawal, winnings certificates, and other financial/tax-related information.
• Gaming behavior data, including information about games played, winnings received, limits set, and account status, as well as significant changes in your gaming activity—particularly your average daily monetary loss and deposit amounts, and instances where you exceed your predefined financial limits—in accordance with the legislation governing Responsible Gaming.
• Feedback and communication data, such as responses to service evaluation surveys, complaints or comments submitted directly to the Company, records of phone conversations with our call center, written electronic communications (email, chat sessions), and identity verification documents (e.g. ID card, mobile provider confirmation, or other documents submitted via mail, email, or uploaded in chat).
• Reward program participants may provide additional personal data, either their own or of third parties, voluntarily. In addition to basic identification and contact details, data such as Social Security Number (AMKA—for ticket issuance), delivery address for gifts, or other information may be requested depending on the type of reward. Participation in certain activities or selection as a winner may require completing forms or expressions of interest, or may occur automatically through enrollment in the reward program, depending on the terms of each activity. Additional data may be collected following acceptance of the reward and participation in related activities, such as audiovisual material.
• Other data generated through use of our Online Points, such as:
  • Username and password,
  • Navigation and behavioral data, including login/logout activity (date, time, duration), sessions, actions and clicks, screens viewed, average time spent, categorization based on transactional/behavioral profile, preferred language, display settings, communication and push notification preferences (for app users),
  • Technical data, such as IP address, error reports, performance statistics, response time, device identifiers (UUID, MSISDN), and other device-related information (e.g. device type and software),
  • Quick login data, such as extra PIN and token used for optional FaceID functionality (for app users). Note: The Company does not access your facial biometric data; it only retains the code confirming successful unlocking. Your biometric data remains solely on your device.
  • Geolocation data (GPS), if you choose to enable it.

If you provide Company with personal data of third parties (e.g. for participation in promotional activities, gift redemption through the reward program, or the “refer a friend” feature), you must inform those individuals about the processing of their personal data by Company and their rights (for example, by sharing this Privacy Notice).

Why We Collect Personal Data

The above information and personal data collected by Company’s S.A. from its Players and/or third parties are stored in Company’s databases and servers, always in accordance with applicable legislation, particularly laws concerning the confidentiality of communications and the protection of individuals with regard to the processing of personal data.

The processing of your personal data in the context of your participation in Games of Chance through our Online Points is carried out based on the following legal bases:

1. Contract:

We process your personal data as necessary to fulfill the terms of our contractual relationship and to provide Games of Chance services to you. Specifically, we process your data for the following purposes:

• To create, operate, and manage your Player Account, in accordance with the terms of the Membership Agreement.
• To manage bets and participation in other Games of Chance, and to process transactions made through the Online Points, including payments.
• To communicate with account holders regarding pending actions or additional documents required for account verification, matters related to account functionality and security, redemption of rewards through available loyalty programs or promotional activities, and important updates to services or changes to the Terms of Use (including this Privacy Notice).
• To perform support tasks, such as user verification, error resolution, security of the Online Points, and player support services.
• To provide evidence of completed transactions by processing recorded verbal or written (electronic and/or paper-based) communications.

2. Legal Obligation:

We process your personal data as required to comply with our legal obligations. Specifically, we process your data for the following purposes:

• To ensure Company’s compliance with the applicable legislative and regulatory framework governing the online Games of Chance market in Greece. This includes, among others, restricting access to games for individuals under the age of 21, verifying that players are real individuals, providing requested information to players, verifying tax obligations arising from winnings, and issuing and delivering winnings certificates.
• To comply with Company’s obligations regarding the safeguarding of Responsible Gaming, which are established to protect public interest and society from gambling addiction, we process your gaming behavior and the information you provide during your communication with us. This is done using automated tools and artificial intelligence applications to faster response to messages regarding Responsible Gaming issues and to create a player profile. Based on each player’s profile, appropriate communication and protective measures are determined (e.g. phone calls, automated notifications, and other communications that do not fall under the category of marketing communications).

For clarity, these communications—intended to protect players from excessive participation in Games of Chance—do not constitute marketing communications as described in Section D below.

• To conduct necessary security checks, verify payment and withdrawal methods, confirm identity details and age through document verification, and ensure that contact details genuinely belong to you.
• To mitigate risks related to money laundering, fraud, and terrorist financing, in accordance with the relevant regulatory framework. Specifically, by processing the personal data mentioned in the previous section, cross-checking them against sanction lists, and applying tailored monitoring mechanisms, the Company aims to detect unusual and/or suspicious activities and take appropriate action as quickly as possible.
• If you declare that you do not wish to receive marketing communications, or if this is required due to self-exclusion, we will process your contact details to comply with electronic communications regulations and Responsible Gaming obligations. In particular, your email address will be forwarded to Company’s Games of Chance marketing affiliates to ensure the cessation of promotional communications related to our Company.

3. Legitimate interest:

We process your personal data where necessary to pursue our legitimate interests. Specifically:

• To improve and develop the Games of Chance services provided through our Websites, by analyzing aggregated usage data from our Online Points.
• To enhance customer service, particularly by recognizing the player when calling our customer support center, allowing for prioritized assistance and enabling the representative to access a complete view of the player’s account upon verification. For these internal management purposes, a player profile is created (e.g. tier categorization based on gaming behavior) using automated processing, without producing any significant effects for the individual.
• To conduct market research that allows us to gather feedback from you regarding your experience as a player and improve our services based on your responses.
• To use the mobile phone number you provide for immediate notifications and to enhance transaction security, in case activities are detected on your account that reasonably suggest unauthorized use or fraud. This does not imply that Company undertakes an obligation to detect all such cases.
• To exchange account data with other companies within the Company’s Group, in order to more effectively identify suspicious transactions and activities, with the aim of preventing and detecting fraud and deception against the Company.

4. Consent

We process your personal data based on your explicit consent, which you provide by selecting the relevant option during registration or at a later time. If you choose to do so, the Company will process your data for the following purposes:

• To verify your identity, if you choose to submit your biometric data for processing as part of the identification procedure.
• To understand your preferences based on your gaming behavior, in order to send you personalized promotional communications with offers tailored to your interests, such as bonuses or free bets, updates on loyalty points collected, and information about rewards or gifts you are entitled to. As part of this personalized marketing communication, a player profile is created based on your gaming behavior using automated processing, without producing significant effects for you.
• To send you general promotional communications from Company’s Group companies, including updates, news, and marketing messages about their services. Specifically, if you select the relevant option, you will receive communications from Company’s Group companies offering Games of Chance (OPAP S.A., Hellenic Lotteries S.A., Horse Races S.A.) and other Group companies (TORA Wallet S.A., TORA Direct S.A.).
  The communication channels used will be those you select when providing your consent, such as browser or mobile device notifications (web/push notifications), email, SMS, Viber/WhatsApp, phone calls, and social media platforms where your profile is identified based on your email or mobile number.
• In accordance with electronic communications legislation, and subject to your consent via the dedicated notice field on our Online Points (website or mobile app), we may use software applications on your device that function as trackers or cookies and collect data (e.g. Device ID). This allows us to better analyze usage of our Online Points, personalize communications, analyze traffic, receive error reports, and send personalized messages (including push notifications) to your device.

You may withdraw your consent for any or all of the above purposes at any time via the “Settings” section of your account, by selecting the unsubscribe link included in promotional messages, or through the dedicated cookie/tracker consent withdrawal field found at the bottom of the Cookie Policy of the Company Group website you are using, or in the Privacy Settings menu of the corresponding mobile app. In such cases, the Company will cease any processing based on your consent, without affecting the lawfulness of processing carried out before its withdrawal or other processing described under sections A–C.

Likewise, through the “Settings” section, you may modify your preferences at any time regarding the communication channels we use to contact you for advertising or promotional purposes.

Recipients

The processing of your personal data in the context of providing Games of Chance services is carried out by Company’s responsible and duly authorized employees. The recipients of your personal data include:

• Third-party providers acting as Independent Data Controllers, who determine the purposes and means of processing:
  • Entities involved in payment processing or winnings collection (e.g. financial institutions or payment service providers), for the purpose of completing transactions and verifying the player and payment methods.
  • In case of participation in reward program activities, depending on the type of reward: courier services, travel agencies, transportation companies (e.g. ferry or airline operators), hotels, sponsors, event/show organizers, sports teams.
  • other companies of the Company Group, for the purpose of detecting fraud incidents, or money laundering, in accordance with the provisions of the current regulatory framework for combating money laundering.

• In the context of our use of the analytics and advertising tools provided by Facebook (Facebook Business Tools), we act as Joint Controllers with Meta Platforms Ireland Ltd, in accordance with the data sharing agreement, which – among other things – sets out our compliance obligations, under the GDPR, with respect to joint processing. Meta Platforms Ireland is responsible for the satisfaction of your requests in accordance with Articles 15-20 GDPR, in relation to the personal data stored by Meta Platforms Ireland after the joint processing. You can find more information in the  Meta Platforms Ireland Data Policy.

• Our partners acting on our behalf (Data Processors), such as:
  • Call center service providers.
  • IT system providers that support, deliver, and promote the commercial operation of Games of Chance services.
  • Artificial intelligence application providers used for biometric identification of players who choose this method.
  • store agents, to the extent necessary for providing services and ensuring customer support.
  • Technology providers supporting cookies/trackers, which enable the functionality of these tools for purposes such as navigation security, storing display preferences, traffic analysis, referral tracking, personalized notifications, and commercial use by the Company and its partners.
  • For more information about the names of these providers and their specific purposes, please refer to the Cookie Policy (websites) or Tracker Policy (mobile apps) of the relevant Online Point.

The Company ensures that all partners acting as Data Processors operate under its control, follow its instructions, are specifically authorized for this purpose, and are fully bound by confidentiality and legal obligations regarding the collection and processing of personal data.

We may disclose your personal data to competent administrative or judicial authorities, as required by applicable laws and regulations, upon request or where the Company is legally permitted or obligated to report such data.

Where possible, we aim to process personal data within the European Economic Area (EEA). However, your data may be transferred outside the EEA by the above-mentioned providers, particularly to the United States, the United Kingdom, and Israel. In such cases, the Company or its processors will ensure that transfers are made either to countries with an adequacy decision from the European Commission or with appropriate safeguards in place, in accordance with applicable data protection legislation. The U.S., U.K., and Israel are considered by the European Commission to offer adequate protection for personal data transfers.

Retention Period

Your personal data related to identity verification and information concerning transactions carried out through the Online Points (including correspondence history) will be retained for ten (10) years from the date of their creation, and in any case for five (5) years following the end of the customer relationship.

Regarding your biometric data processed during the identity verification stage— if you choose to verify your identity using this method— such data is permanently deleted once your identity has been successfully verified. However, we retain an image of the photo taken during the verification process and the outcome of that process (i.e. whether identity verification was completed or not).

Finally, for information on the retention periods of cookie-related data, please refer to the detailed timelines provided in the Cookie Policy of the Online Point you are using.

Your rights

In all cases, we would like to inform you that, in accordance with applicable legislation and in the context of using our Online Points, you have the following rights, which you may exercise:

• Right of access to your personal data and to information related to its processing.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure, subject to cases where data retention is required to comply with legal obligations.
• Right to restriction of processing, where explicitly provided by law.
• Right to data portability, allowing you to receive your data in a structured, commonly used, and machine-readable format (e.g. USB).
• Right to transmit your data directly to another data controller.
• Right to object to the processing of your personal data based on our legitimate interests.
• Right to withdraw consent at any time and at no cost, for any processing based on your prior consent.

You may exercise any of the above rights by submitting a written request to the Company. Your request must include supporting documents verifying your identity.

If you exercise your rights to rectification, erasure, or restriction of processing, the Company will notify third parties/recipients to whom your data has been disclosed in the context of providing Games of Chance services.

You can expect a response to your request within one (1) month from its receipt and verification of your identity by the Company, or within three (3) months if your request is complex or if a high volume of requests is being processed.

Finally, you are required to promptly inform the Company of any changes to the personal information you have provided.

Disclaimer

Our services are not intended for individuals under the age of twenty-one (21), and therefore we do not process personal data of minors. Any individual who provides their personal information through any of our services declares that they are over twenty-one (21) years of age.

We do not assume any responsibility or liability for practices, actions, or policies beyond our control.

This Privacy Notice may be updated. We will make every effort to inform you of any material changes; however, we encourage you to regularly visit Company’s Online Points, where the most up-to-date version of this Privacy Notice will be available.

Our Commitments

In order to ensure the minimization, accuracy and completeness of the personal data it collects, the Company undertakes to check the data at regular intervals, in order to correct or securely delete those data that are no longer necessary.

The Company has taken all appropriate technical and organizational measures, in accordance with current technological standards and applicable laws and regulations, in order to ensure that the processing of your personal data is lawful, appropriate and secure against any unauthorized or accidental access, disclosure, processing, deletion, modification or other use.

Contact Information

For any request relevant to the processing of your data, as well as in case you ascertain that we have not observed the principles stipulated in the present Privacy Notice, we kindly ask you to address, the soonest possible, Group's Data Protection Officer, using the following contact details: Website: www.allwyn.gr/gdpr | Address: 112 Athinon Ave., 10442, Athens | Telephone: +30 210 5798888 | E-mail: dpo@allwyn.gr

In case you deem we did not sufficiently address your request and the protection of your personal data is affected in any way, you may submit a complaint via the special online portal to the Hellenic Data Protection Authority (Athens, 1-3, Kifissias Ave., P.C. 115 23| Detailed instructions on the submission of complaints are provided on the Authority's webpage.

Our Commitments

We commit to maintain your data updated and accurate, to store and delete them securely, to not collect and maintain data that are not necessary for us, to protect your data against loss, misuse, unauthorized access or disclosure, and in general, to reassure that all adequate technical and organizational measures for their protection, are in place.