Effective from: 01.10.21
Version: 2.0
1. General provisions
As a data controller, we have a legal obligation under the requirements of Regulation (EU) 2016/679 (" General Data Protection Regulation" or GDPR) and the Personal Data Protection Act to collect and process the personal data of all participants, visiting our website and using the services we provide. The purpose of this Privacy Policy is to explain what personal data we collect, why we collect it and how we use it.
By visiting the website and/or registering a user profile on www.topwin.bg (hereinafter referred to as the "site"), you declare that you are familiar with our privacy policy and agree to process the personal data you provide for the purposes and in the manner specified therein.
2. Data for the administrator
The site is owned and managed by "Golden City 7" AD, EIK 207181758, headquarters and management address: 1345 Sofia, "Ilinden" district, "Kukush" street No.2, "Antim Tower" Business Center.
In case of questions about this Privacy Policy or the protection of your data, please do not hesitate to contact the Data Protection Officer at the email address provided below.
3. Basis for collection and processing of personal data
We collect and process your personal data on the following legal grounds:
- consent to the processing of his personal data for one or more specific purposes;
- the processing is necessary for the performance of a contract to which the data subject is a party with the controller, or for taking steps prior to the conclusion of a contract;
- the processing is necessary for compliance with a legal obligation that applies to the administrator;
- the processing is necessary for the performance of a task of public interest or in the exercise of official powers that have been granted to the controller;
- the processing is necessary for the purposes of the legitimate interests of the controller or a third party;
- the processing is necessary to protect the vital interests of the data subject or another natural person.
4. Personal data we collect and process
The personal information we may be asked to use and process includes:
4.1 The data collected in the registration form when opening a user profile:
- first and last name;
- date of birth;
- uniform civil number (EGN)/personal identification number of a foreigner (LNCH);
- citizenship;
- residence;
- Email;
- confirmation that you are over 18 years of age;
- username;
- IP address;
- mobile phone number.
4.2 Correspondence with us via the Website, email, web chat or other means of communication;
4.3 All transaction history in the Player's Account;
4.4 Website entries and their details, including traffic data, GeoIP location data, browser/device data, weblogs, activity logs and other traffic information recorded in our system;
4.5 Documents and evidence requested by us to verify the user profile, to process deposits or withdrawals and checks carried out for the purposes of prevention of money laundering and the financing of terrorism (on our own initiative or as required by applicable legislation);
4.6 Data on a prominent political figure and the persons related to them, according to the Act for Measures Against Money Laundering (AMAML).
4.7 When betting in real time on the site, in accordance with the requirements of the Gambling Act, we are obliged to collect the following information:
- username/identification number data;
- IP address;
- activity data - session start and end time; total amount that was wagered, total wagered amount on which winnings were accumulated during the session; total amount that has been deposited or withdrawn from the gaming account; date, time and duration of the participant's gaming session;
- general information about the user profile - information and balance of the gaming account; disabled gaming accounts and the reason for their deactivation; games played or status of games started, bets made, winnings.
In addition, in compliance with the legal provisions, we are obliged to store and provide you with information regarding: balance on the gaming account; betting history (bets placed, winnings paid out); deposits, withdrawals and related transactions; reference to at least the last 10 IP addresses from which the participant accessed the CCS - for a period not shorter than 60 days. This information is available from your account.
4.8 When depositing and withdrawing funds from the user profile with a bank card, we collect the following information:
- first and last name of the cardholder, as written on the card;
- credit card number;
- credit card expiration date;
- CVV code.
4.9 Telephone Calls
Telephone calls to and from our customer contact center are recorded for training and security purposes, along with resolving any queries arising from the service you receive.
5. Purposes for which we collect and process personal data:
- for the purposes of registration on our Website;
- participant identification and verification;
- accepting bets or paying out winnings;
- providing bonuses;
- analysis and statistics;
- compliance with a legal obligation;
- improving the quality of services provided, as well as resolving disputes and protecting legitimate interests.
- processing your requests, inquiries, complaints and reports.
6. Sharing of Personal Data
Personal data may be provided to third parties in fulfillment of legally established requirements and obligations to state institutions and in particular the National Revenue Agency, which is a state authority for the supervision of gambling activities, as well as other competent state authorities such as the "National Security" State Agency. These bodies have the right to receive information about registered users, bets made, winnings paid, as well as other data, in the cases and form provided for by law. Another group of recipients of personal data may be our trusted business partners, suppliers of goods and services, as well as banks and payment institutions for making money transfers, as well as persons providing technical support for our platform.
7. Term for storing personal data
We will not store your personal data for a period longer than necessary to achieve the purposes for which we process it. In determining the appropriate retention period, we take into account the amount and nature of personal data, the purposes for which we process it, and whether we can achieve those purposes by other means. We are also obliged to comply with the relevant legal requirements for the storage of certain categories of data in order to fulfill our obligations arising from a regulatory act or from a contract.
According to the Gambling Act, we are required to apply the following retention periods:
- all data regarding registration and identification of participants, bets made and winnings paid are stored on the control local server of the Company in the form in which they were created for a period of 5 years after the expiration of the statute of limitations for repayment of public obligations related to these data;
- the data related to the geographical localization of the IP address, identification of the date, time and duration of the game session of the person registered as a participant in a given game on the organizer's website are stored for no less than 12 months from the date of collection and processing of this data;
- 2 years from the date you contacted us by telephone about the data obtained during the telephone conversation.
8. Protection of personal data
We have taken appropriate technical measures to ensure the security of your personal data, including:
- Encrypting your data when stored or transferred to our servers;
- Restrict access to your data to our employees, contractors and agents who may use it for processing purposes;
- Network protection using industry-leading security providers;
- Secure server hosting with 24/7 monitoring, surveillance and on-site security staff;
- Our security team continuously monitors our systems and event logs to identify and manage threats.
9. What rights do you have as a data subject?
According to the General Data Protection Regulation, the data subject (the natural person to whom the data relates) has the right to:
- Information (in connection with the processing of their personal data by the administrator);
- Access to your own personal data;
- Correction (if data is inaccurate);
- Erasure of personal data (right to be forgotten);
- Restriction of processing by the administrator or processor of personal data;
- Portability of personal data between individual administrators;
- Objection to the processing of his personal data;
- The data subject also has the right not to be subject to a decision based solely on automated processing, including profiling, which gives rise to legal consequences for the data subject or similarly significantly affects him;
- Right to judicial or administrative protection in the event that the data subject's rights have been violated.
Any person can exercise their rights as a subject of personal data by submitting a request electronically to the following email address: [email protected] or by post to the following address: Sofia, 2 Kukush St., Antim Tower Business Center.
The request must necessarily contain data for the identification of the sender: names and social security number, as well as contacts for feedback - address, telephone, e-mail.
We will respond to any of your requests within thirty days of receiving them. If we are unable to respond within this time frame, we will notify you promptly, stating the reasons for the delay.
It should be noted that as a company operating in accordance with the Data Protection Act and the Anti-Money Laundering Act we are required to retain some customer data and as such we have the right to refuse requests that include these data.
In case of violation of your rights according to the applicable data protection legislation, you can submit a complaint to the Commission for the Protection of Personal Data at the address: 1592 Sofia, "Prof. Tsvetan Lazarov" Street No.2, phone: 02 915 3518, by email : [email protected], [email protected], Website:www.cpdp.bg