Privacy Policy - Pinateros.org | Data Protection & Player Privacy

Effective Date: 12th June 2024

1. Introduction

Welcome to Pinateros.org. This Privacy Policy outlines how Pinateros Entertainment Ltd. ("we," "us," or "our"), as the operator of Pinateros.org, collects, uses, stores, and protects your personal data when you interact with our website and play our exciting slot game, "Pinateros" by Swintt.

At Pinateros.org, we understand that trust is paramount, especially in the online gambling industry. We are committed to protecting your privacy and ensuring the security of your personal information. This policy is designed to be transparent, easy to understand, and to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the specific requirements of the UK Gambling Commission (UKGC), alongside other relevant regulations.

Your financial security and well-being are our highest priorities. We strive to provide a safe and legitimate gaming environment, and this Privacy Policy is a testament to our operational culture and commitment to responsible conduct.

2. Who We Are (Data Controller)

Pinateros.org is operated by Pinateros Entertainment Ltd., a company registered in England and Wales under company number 12345678. Our registered office is located at Unit 5, Innovation Hub, Tech Park, Manchester, M1 7ED, United Kingdom.

We hold a remote gambling licence from the UK Gambling Commission (UKGC) under licence number 000-012345-R-321098-001.

For the purposes of data protection law, Pinateros Entertainment Ltd. is the "Data Controller" of your personal data. This means we are responsible for deciding how and why your personal data is processed.

3. The Data We Collect About You

We collect various types of personal data to provide our services, manage your account, ensure compliance, and improve your gaming experience. This data may include:

a. Identity and Contact Data:

Full name, date of birth, gender, nationality.
Residential address, email address, telephone number.
Copies of identity documents (e.g., passport, driving licence) for verification purposes.

b. Financial Data:

Payment method details (e.g., bank account details, debit card information). Please note, we do not store full payment card details; these are securely handled by PCI DSS compliant payment processors.
Deposit and withdrawal history, betting transaction records.
Source of funds information, where legally required for Anti-Money Laundering (AML) checks.

c. Gameplay and Activity Data:

Detailed records of your gaming activity, including specific games played (e.g., "Pinateros"), bet amounts, win/loss records, session duration, and feature usage (e.g., Chili Feature triggers, Mystery Bonus outcomes, Risk Game participation, autoplay settings, bet adjustments).
Login/logout times, game session IDs, and device identifiers.

d. Responsible Gambling Data:

Any self-exclusion requests, deposit limits, or other responsible gambling tools you utilise.
Data related to your gaming patterns and behaviours that may indicate potential gambling risks, which we monitor to fulfil our responsible gambling obligations.

e. Technical and Usage Data:

Internet Protocol (IP) address, device type, operating system, browser type and version.
Time zone setting and location data (derived from your IP address).
Information about how you use our website and services, including pages visited, time spent on pages, navigation paths, and interactions with UI elements (e.g., menu options, controls). This data is collected through cookies and web analytics tools, including Yandex.Metrica.

f. Communication and Marketing Data:

Your preferences in receiving marketing from us and our third parties.
Records of your communications with us (e.g., emails, live chat transcripts, customer support tickets).

g. Affiliate and Referral Data:

Information about the website or source that referred you to Pinateros.org, for affiliate program tracking purposes. This data is typically aggregated and anonymised where possible.

h. Publicly Available Data:

Information from public registers or social media (where relevant for KYC/AML or fraud prevention).

4. How We Use Your Data and Our Legal Bases

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

a. To Fulfil Our Contract with You (Contractual Necessity):

To register and manage your account.
To enable you to play the "Pinateros" slot game and other available games.
To process your deposits and withdrawals securely.
To provide customer support and respond to your queries.
To notify you about changes to our services.

b. To Comply with Legal Obligations (Legal Obligation):

To verify your age and identity (Know Your Customer - KYC) and prevent underage gambling.
To conduct Anti-Money Laundering (AML) checks and fraud prevention.
To comply with UK Gambling Commission (UKGC) licence conditions and reporting requirements.
To monitor and enforce responsible gambling measures, including self-exclusion and deposit limits.
To maintain accurate records for tax and accounting purposes.

c. For Our Legitimate Interests (Legitimate Interest):

To improve our website, game performance, and user experience (e.g., by analysing gameplay data, site traffic via Yandex.Metrica).
To ensure the security of our services and prevent fraudulent or malicious activity.
To personalise your gaming experience and offer relevant content.
To manage and track our affiliate marketing programs, ensuring transparency and proper commission attribution.
To conduct internal business analysis, research, and development.
To defend our legal rights or pursue legal claims.

d. With Your Consent (Consent):

To send you marketing communications about new games, promotions, and offers, where you have explicitly opted in. You have the right to withdraw this consent at any time.

We do not use automated decision-making processes that would have a significant legal effect on you without human intervention, except where necessary for compliance with legal obligations (e.g., automated age verification checks) or with your explicit consent.

5. How We Share Your Data

We may share your personal data with third parties in the following circumstances:

a. Game Providers: We share necessary data with our licensed game provider, Swintt, to facilitate your gameplay, ensure game fairness, and resolve any technical issues related to the "Pinateros" game.

b. Payment Processors: Your financial data is shared with trusted, PCI DSS compliant payment service providers to securely process your deposits and withdrawals.

c. Identity Verification & AML Providers: We use third-party services to conduct identity verification, age verification, and AML checks as required by law.

d. Responsible Gambling Organisations: In specific circumstances, and to comply with regulatory requirements, we may share anonymised or aggregated data with responsible gambling bodies, or share specific data if you have requested self-exclusion that extends across multiple operators.

e. Regulators and Law Enforcement: We will disclose your data when legally required by the UKGC, other regulatory bodies, law enforcement agencies, or courts.

f. Service Providers: We engage third-party service providers for website hosting, IT support, technical maintenance, analytics (Yandex.Metrica), and customer support functionalities. These providers are contractually bound to protect your data and only process it according to our instructions.

g. Affiliate Partners: If you registered via an affiliate link, we may share anonymised or aggregated data with our affiliate partners for commission tracking. This data does not typically identify you personally unless required for specific fraud prevention measures.

h. Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the new entity. We will ensure appropriate safeguards are in place.

We ensure that all third parties respect the security of your personal data and treat it in accordance with the law. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International Data Transfers

We primarily store and process your personal data within the United Kingdom and the European Economic Area (EEA). However, some of our service providers, or the location of their data processing, may involve transferring your data outside the UK/EEA.

Specifically, we use Yandex.Metrica, a web analytics service provided by Yandex Oy, to understand how users interact with our website. Please be aware that Yandex.Metrica servers are located in Russia. The European Commission and the UK government have not issued an adequacy decision for data transfers to Russia. This means that data transferred to Yandex.Metrica may not benefit from the same level of protection as afforded by UK data protection laws.

While we implement contractual safeguards (Standard Contractual Clauses where applicable) and aim to process data in an anonymised form wherever possible with Yandex.Metrica, by using our site, you acknowledge and accept this transfer and the associated risks. You can learn more about Yandex's data processing and opt-out options in their privacy policy. We encourage you to review their policy for full details.

Where we transfer your personal data outside the UK/EEA, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

Transferring your data to countries that have been deemed to provide an adequate level of protection for personal data by the UK government or European Commission.
Using specific contracts approved by the UK government or European Commission which give personal data the same protection it has in the UK/EEA (Standard Contractual Clauses).
Where service providers are based in the US, we may transfer data to them if they are part of a framework that ensures adequate protection.

7. Data Security

We have implemented robust security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include:

Encryption: All data transmitted between your device and our servers is encrypted using Secure Socket Layer (SSL) technology.
Access Controls: Strict access controls and authentication mechanisms are in place to limit access to your personal data to authorised personnel only.
Firewalls: Our systems are protected by advanced firewalls to prevent unauthorised external access.
Regular Audits: We conduct regular security audits and vulnerability assessments to identify and address potential weaknesses.
Employee Training: Our staff receive regular training on data protection and security best practices.
PCI DSS Compliance: We ensure that our payment processing partners are fully compliant with the Payment Card Industry Data Security Standard (PCI DSS) to protect your financial information.

In the event of a suspected personal data breach, we have procedures in place to deal with it promptly and will notify you and any applicable regulator where we are legally required to do so.

8. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Specifically, we are legally required to retain certain data related to your account and transactions for a minimum of five (5) years after your account is closed, in accordance with our UKGC licence conditions and Anti-Money Laundering (AML) obligations.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

9. Your Legal Rights

Under UK GDPR, you have the following rights regarding your personal data:

a. The Right to Be Informed:

To receive clear, transparent, and easily understandable information about how we use your data and your rights. This Privacy Policy serves that purpose.

b. The Right of Access:

To request a copy of the personal data we hold about you.

c. The Right to Rectification:

To request that we correct any inaccurate or incomplete personal data we hold about you.

d. The Right to Erasure ("Right to Be Forgotten"):

To request that we delete your personal data. Please note this right is not absolute and may be subject to legal obligations (e.g., AML laws require us to retain certain data for a minimum period).

e. The Right to Restrict Processing:

To request that we limit the way we use your personal data in certain circumstances (e.g., if you dispute its accuracy).

f. The Right to Object to Processing:

To object to our processing of your personal data, particularly where we are relying on legitimate interests.

g. The Right to Data Portability:

To request that we transfer your data to you or another service provider in a structured, commonly used, machine-readable format.

h. Rights in Relation to Automated Decision-Making and Profiling:

To object to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

i. The Right to Withdraw Consent:

Where we are relying on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

To exercise any of these rights, please contact us using the details provided in Section 15. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enhance your user experience, analyse site traffic, and for security purposes. Cookies are small text files placed on your device.

For detailed information about the cookies we use, their purpose, and how you can manage your preferences, please refer to our dedicated Cookie Policy.

11. Responsible Gambling and Player Protection

As a licensed gambling operator, we are deeply committed to promoting responsible gambling and protecting our players. This commitment is integral to our Privacy Policy.

We use certain data, including your gameplay and activity data, to monitor for patterns that may indicate problem gambling. This allows us to intervene proactively and offer support. We provide various tools to help you manage your gambling, such as deposit limits, session limits, and self-exclusion options.

For further support and resources on responsible gambling, we encourage you to visit reputable organisations like GamCare and GambleAware.

12. Children's Privacy

Our services are strictly for individuals aged 18 years or older. We do not knowingly collect personal data from anyone under this age. If we become aware that we have collected personal data from a minor, we will take immediate steps to delete that information and close the associated account.

13. Third-Party Links

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any changes will be posted on this page, and we will update the "Effective Date" at the top of this policy. For significant changes, we will notify you through prominent notices on our website or directly via email. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

15. How to Contact Us

If you have any questions about this Privacy Policy, our data practices, or if you wish to exercise any of your legal rights, please contact us:

Data Protection Officer / Privacy Team

Pinateros Entertainment Ltd.

Unit 5, Innovation Hub, Tech Park

Manchester, M1 7ED

United Kingdom

Email: [email protected]

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. Their website is www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.