PRIVACY POLICY


Last updated 14/05/2021

Version 3.1


INTRODUCTION


Welcome to the Expekt Nordics Limited’s privacy policy relating to provision of the Services (e.g. Games) of Expekt Nordics provided via www.Expekt.se and/or any local country-code websites and/or any sub-website and/or associated domains (and/or sub-domains) and any related software applications (“Site”, “Website”), where Personal Data is processed by the same relating to You.


Expekt Nordics Limited respects your privacy and is committed to protecting your personal data and processing it in compliance with applicable laws – notably:

In summary of this Privacy Policy we think that this information is the most relevant for you:


We however recommend that you read this Privacy Policy in full, with care. For the ease of your orientation, these are the contents of this Privacy Policy:


  1. IMPORTANT INFORMATION AND WHO WE ARE

  1. THE DATA WE COLLECT ABOUT YOU

  1. WHY AND HOW WE USE YOUR PERSONAL DATA

  1. RETENTION

  1. RECIPIENTS OF YOUR PERSONAL DATA

  1. INTERNATIONAL TRANSFERS

  2. DATA SECURITY

  3. YOUR RIGHTS UNDER DATA PRPOTECTION LAWS

  1. AUTOMATED PROCESSING – PROFILING

  1. COOKIES



  1. IMPORTANT INFORMATION AND WHO WE ARE

    1. PURPOSE OF THIS PRIVACY POLICY


This privacy policy aims to give you information on how We collect and process your personal data through or in conjunction with your use of this website and Our Services.


This Privacy Policy stipulates details and conditions of collecting and processing your Personal Details and provides you with information in terms of articles 12 and 13 of General Data Protection Regulation (GDPR).


This website is not intended for children and we do not knowingly collect data relating to children (below 18 years of age).


    1. CONTROLLER


Expekt Nordics Limited is the controller and responsible for your personal data (referred to as "Expekt Nordics", "We", “we”, "us" or "our" in this Privacy Policy).


We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise rights please contact Us or the DPO using the details set out below.


    1. CONTACT DETAILS


Although Our goal is to always be as clear and transparent as possible, if You need any clarification on this Privacy Policy or a specific legal basis We are relying on to process Your Personal Data for a specific processing operation, We would be happy to provide You with any such information You may need.


Our full details are:


    1. CHANGES TO THE PRIVACY NOTICE AND YOUR DUTY TO INFORM US OF CHANGES


We reserve the right, at Our complete discretion, to change, modify, add and/or remove portions of this Privacy Policy at any time. You shall be, in advance, informed by Us of any changes made to this Privacy Policy (as well as other terms and conditions relevant to the Site). We shall also archive and store previous versions of the Privacy Policy for Your review upon request.


  1. THE DATA WE COLLECT ABOUT YOU


    1. Personal Data: means any information that identifies You as an individual or that relates to an identifiable individual.


Whenever it is not possible or feasible for Us to make use of anonymous and/or anonymised data (in a manner that does not identify any Users of the Site or customers of Our services), We are nevertheless committed to protecting Your privacy and the security of Your Personal Data at all times.



    1. Data obtained from You: We collect from You, through interaction with You or through Your interaction with Us or our Services different kinds of personal data about you which we have grouped together follows:


  1. Registration Data provided by you when you register and/or open Your Member Account (notably in the terms of Clause 2.1.6 of the T&Cs) including first name, last name, username or similar identifier, date of birth, territory applicable social security number where permitted or required by law, gender, country.

  2. Contact Data includes permanent address, email address and telephone numbers.

  3. Identification and Verification Data (Anti-Money Laundering/Due Diligence/KYC data) that include your name, surname, permanent address and proof, age, nationality, family members, degrees and qualifications, schools/universities attended, employment history and information, media involvement, financial status information (e.g. bank statement, source of income and source of wealth, tax information), masked credit card details, proof of e-wallet ownership such as Netller, Skrill, Paypal, Paysafe, personal identification number (PID) in case of Swedish players, KYC documentation (e.g. ID card, Power of attorney).

  4. Responsible Gambling Data (RG) including name, surname, Zip Code, email, phone number, country, date of birth, territory applicable social security number where permitted or required by law , approved transactions (deposits and withdrawals), denied transactions (deposits and withdrawals), Identification and Verification Data, Self-exclusion Data,

  5. Self-exclusion Data include data pertaining to you and your self-exclusion such as your Registration and Contact Data and your self-exclusion info such as reason, start and date, utilisation of self- exclusion tools such as exclusions, session limit, loss limit, wager limit, deposit limit, reality check.

  6. Payments Data includes bank/payment account details, as well as information pertaining to a transaction such as currency, location, amount/value, client IP, user ID, token.

  7. Transaction and Usage Data generated through your use of our Services (e.g. playing Games) and include payments to and from you (deposits, withdrawals, failed deposits and reversed withdrawals) and other details of Services you have purchased from Us (such as bets, wagers (real and bonus), wins), date and time of the transactions, account balances (bonus and real), bonuses used (conversion and forfeiture), bonuses turnover, bonuses balance, channels used, transaction games played, language, country, account balances.

  8. Log in Data includes internet protocol (IP) address, your logins (first log in last login, last failed login), duration of log ins, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Services.

  9. Profile Data includes internal notes to your account, interests, preferences, feedback, information about events which you have attended; Your preferences as to whether you wish to attend any events, and what type of events you prefer; Any bonus/cash back deals, or bonus preference you have been offered or benefitted from; Whether you have received any giveaways or, and your preferences regarding what type of gifts you would like to receive; Your preferences as to contact channels; information regarding your hobbies and interests;

  10. Marketing Communications Data includes your preferences in receiving marketing from us (opt in/opt out), as well as your Contact and Registration Data.

  11. Other Communication Data provided by you in communication with Us (via recorded calls, chats, emails, or SMS) which may include various data such as your intentions, interests, complaints, preferences, as well as internal communication and notes.

  12. Analytics data include various data provided by your observed with respect to your use of our Website and Services such as your player ID, language, location, browser data, campaigns utilised, channels used, device, payment provider, Transaction and Usage data and in case of online acquisition analytics also pages visited, postcards clicked, scroll depth. Certain information is collected using cookies and/or similar tracking technology – please see further section “Cookies”.


    1. Data from different sources


      1. We collect information for AML/CFT purposes on the background of the player, which we source from third party providers (private companies working mostly with public sources), namely Bisnode, Transunion international UK limited (this will not negatively impact your Transunion credit score. More information including Transunion’s privacy notice can be found here, GBG Group, HooYu Ltd (previously known as 192.com Ltd) and which includes information whether player is politically exposed person and whether any international and/or financial sanctions have been imposed and/or information on any corporate or property ownership, court judgements and/or insolvency, and with respect to Swedish players also taxation information for the purpose of establishment of the source of funds and source of wealth during the AML risk monitoring and due diligence process, which information is sourced via Bisnode Kredit AB. Moreover, background information is, using so-called OSINT analyses (Open-Source Intelligence) collected from publicly available sources (e.g. Google search, all social media services like Facebook, Twitter, Pinterest, Instagram, LinkedIn as well as other services/sites like pipl.com, https://www.zopla.co.uk/https://www.glassdoor.comhttps://www.gov.uk/government/organisations/companies-househttps://www.ratsit.se/ ).

      1. To comply with our legal obligations stemming from applicable laws and license conditions , when applicable, we collect Self Exclusion Data also from other licensed gaming operators belonging to the same group of companies as Expekt Nordics (the LeoVegas Mobile Gaming Group). Likewise, for the same purposes, Expekt Nordics uses Self Exclusion Data collected with respect to any other brands under which Expekt Nordics operates its licensed gaming business.


      1. If a player is registered with a National Self-Exclusion Register (incl. without limitation GAMSTOP, ROFUS, spelpaus.se, RUA) certain Self-Exclusion Data is also received from such register. In particular, information on whether you are/are not self-excluded. This information is received once you log-in. Registration with such register mean that you cannot register with Expekt Nordics and you will not be able to log on to your Member Account. You will also not be sent any commercial messaged directed to you personally.


      1. Profile data (hobbies, interests) are also gathered by search of publicly available sources such as Facebook, LinkedIn, Twitter and Instagram, Google search.


      1. In order to prevent and detect fraud and misuse of our systems (e.g. use of VPN), certain Log In Data, such as; IP address, device model/type, browser information, operating system and other device identification data are sourced and processed by Us utilizing a services of third-party fraud detection software provider.


      1. We obtain information on your sports risk segment (Sports Risk Data) from our sportsbook provider Kambi Group plc (“Kambi”). All information on its processing activities may be found here: https://www.kambi.com/player-fair-processing-notice. As Kambi does not obtain a player's real name or email address and does not process any personal data of players on an identified basis, please contact us if you have any queries as to how Kambi processes your personal information or if you wish to exercise any of your data subject rights. This clause is not applicable to players registered on gogocasino.com .


      1. With respect to Swedish players, to simplify the sign-up procedure a separate process - BankID – may be used for identification and verification purpose. If such process is used, once the personal identification number (PID) is provided by You upon sign up, and You are successfully verified via Bank ID, personal data (Registration and Contact Data) in the extent: name, surname, date of birth and permanent address will be automatically fed to the players profile. The source of data in that case is Bisnode Kredit AB and BankID service which is access via Skandinaviska Enskilda Banken AB (publ). Such data is used as per information contained in this Privacy Policy. In case of a failed account opening (due to failure of the verification via Bank ID or otherwise), the PID is stored for up to 24 hours and is thereafter automatically deleted from the Expekt Nordics systems.


      1. To simplify the sign-up procedure a separate process – Facebook connect / Google sign-In /Trustly Pay n’Play – may be used for identification and verification purpose. If such process is used, once the authorisation of access is provided by You upon sign up, personal data (Registration and Contact Data) in the extent: name, surname, date of birth, email will be automatically fed to the players profile. The source of data in that case is the Facebook or Google profile which is access via you Facebook or google depending which service is used). Such data is used as per information contained in this Privacy Policy.


2.4 Special Categories of Personal Data


We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). However, from our experience, we may not exclude that You, at your own discretion, send us such data in communication with Us.

Please note that although ID cards are processed, images contained therein are not specifically technically processed to allow or confirm unique identification. Therefore, such data is not to be considered biometric data (special category of data).  


2.5 IF YOU FAIL TO PROVIDE PERSONAL DATA


Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with Our Services).


2.6 USERNAME


Please make sure that your username does not contain any personally identifiable information, as the username is shared with certain partners and in the course of the sharing of the username, this is not, separately, considered personal data. Please contact us if your user name contains your personally identifiable data, so we can make proper arrangements to protect your data and guide you as to how to change the username.



3. WHY AND HOW WE USE YOUR PERSONAL DATA


    1. We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:



    1. Detailed purposes and legal basis


3.2.1. We have set out below, in a table format, a description of all the possible ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.


3.2.2. Please note that the below table sets out the general information about the Personal Data We process. Certain data categories and/or purposes may differ in different jurisdictions and/or brands under which Expekt Nordics provides its services. Please contact us if you need further details about the specific purpose for processing or data category in your jurisdiction.



Purpose

Data Category

Legal Basis

To register you as a new player; to identify you and verify you when you access your Account to allow you to participate in in Games

Registration Data

Contact Data

Log-in Data

 Performance of the contract with you

To allow your participation in the Games

Transaction and usage data

Performance of the contract with you

To process and manage payments transactions

Payments Data

Transaction and Usage Data

Performance of the contract with you

To manage our relationship with you, to communicate with you, to provide you with access to Games and any ancillary services

Registration Data

Contact Data

Profile Data

Other Communication Data

Transaction and Usage data

Self-exclusion Data

Performance of the contract with you


Compliance with legal obligations

For AML/CTF and due diligence purposes

Registration Data

Contact Data

Identification and Verification Data

Transaction and Usage Data

(As further specified in Clause 9)

Compliance with legal obligations

To establish and investigate any suspicious behaviour in order to protect our business from any risk and fraud

Registration Data

Contact Data

Identification and Verification Data

Log in Data

Payments Data

Other Communications Data

Legitimate interest (detection and prevention of fraud)

Identification and investigation of gaming activity for responsible gaming purposes

Responsible Gaming Data

Self-exclusion Data

Other Communications Data

Compliance with legal obligations

Responsible gaming profiling

Responsible Gaming Data

Transaction and Usage Data

Other Communication Data

(As further specified in Clause 9)

Compliance with legal obligations

To ensure that self-excluded players with respect to Expekt Nordics or any other brand/company within the group are duly self-excluded and do not access Our Services (e.g. Games) and to handle and action requests made by the customer relating to the use of the Responsible Gaming Tools through the website

Self-Exclusion Data

Compliance with legal obligations

Direct Marketing of our own goods and services (Games) – incl. bonuses and offers


Marketing Communications Data


Legitimate interest (to promote our own Service, to develop our business and enhance relationship with)

Consent


Direct Marketing of our own goods and services (Games) –loyalty programme/VIP experience


Registration data

Contact Data

Marketing Communications Data

Profile Data

Legitimate interest (to promote our own Service, to develop our business and enhance relationship with you by targeted offers)

Consent


Social Media Marketing

Contact Data


Legitimate interest (to promote our own Service, to develop our business and enhance relationship with you by targeted offers)

Consent


Customer segmentation for the purpose of tailored offers and bonuses sent via direct marketing


Transaction and Usage data

Registration Data

Sports Risk Data

(As further specified in Clause 9)

Legitimate interest (to promote our own Service, to develop our business and enhance relationship with you by targeted offers)

Loyalty program/VIP Experience purposes to (i) offer you attendance to events which would be of interest to you and possible guests, based on previous attendance; (ii) offering bonuses and other gifts which would be of interest to you, based on previous bonuses or gifts you may have benefitted from; (iii) contacting you on your preferred contact channels



Profile Data

Registration Data

Contact Data

Transaction and Usage data

Legitimate interest (to promote our Services, improve your experience with our Services and for offer you tailored loyalty programme)

Customer segmentation for the loyalty program purposes and responsible gambling purposes.

Transaction and Usage Data

Registration Data

(As further specified in Clause 9)

Compliance with legal obligations


Legitimate interest (to promote our Services, improve your experience with our Services and for offer you tailored loyalty programme)

To monitor player activity, detect and prevent fraud and to manage risk exposure


Sports Risk Data

Performance of the contract with you

Compliance with legal obligations

Legitimate interest (detection and prevention of fraud and management of risk exposure)

Commercial business analyses for the creation of standard, periodical as well as ad hoc reports.

Transaction and Usage Data

Analytics Data

(data are pseudonymised)

Legitimate interest (to develop our products/services and grow our business)

Web Analytics

Analytics Data

Transaction and Usage Data


Legitimate interest (to develop our products/services and grow our business)

Games recommendation


Transaction and Usage Data

(As further specified in Clause 9)


Legitimate interest (to provide customised, quality experience for the players)



    1. DIRECT MARKETING


      1. In accordance with the applicable laws (incl. local regulations) and on the basis of Our legitimate interest or Your consent, Expekt Nordics may, from time to time, inform You about its own similar products or services (incl. without limitation Own new services and promotions, bonuses and offers, VIP experience) via, as applicable:

When relying on legitimate interest, Expekt Nordics will give you the opportunity to oppose to such direct marketing when registering on Our site.

When relying on consent, the consent may be granted by You when registering on Our site.


In both cases, if you do not wish to receive direct marketing any longer, You may opt out, easily, at any time and free of charge, as applicable, either by:



3.3.2. Please note that even if You object to receiving direct marketing material from, from time to time We may still need to send You certain important communications from which You cannot opt-out.



  1. RETENTION


    1. Criteria used to determine retention period: We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.


The criteria We use to determine what is ‘necessary’ depends on the nature of the particular personal data in question. Our normal practice is to determine whether there is/are any specific EU and/or national law(s) (for example license requirement, tax or corporate laws) permitting or even obliging Us to keep certain personal data for a certain period of time (in which case We will keep the personal data for the maximum period indicated by any such law) and if not, whether there are any laws and/or contractual provisions that may be invoked against Us by You and/or third parties and if so, what the prescriptive periods for such actions are. In the latter case, We will keep any relevant personal data that We may need to defend Ourselves against any claim(s), challenge(s) or other such action(s) by You and/or third parties.


Where Your personal data is no longer required by Us, We will either securely delete or anonymise the personal data in question.


    1. Details on our retention periods


4.2.1. We have set out below, in a table format, a description of all the possible data retention period, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.


4.2.2. Please note that the below table sets out the general information about the retention periods. Certain periods may differ in different jurisdictions. Please contact us if you need further details about the specific purpose for processing or data category in your jurisdiction.


Retention scenario

Data Categories (HIGH LEVEL)

Purpose

Legal ground

Duration

Start of the period

1

Registration Data

Transaction and Usage data

Tax & accounting

Legal obligation

10 years

Transaction

2

Identification and verification data (KYC/AML)

Payments Data

AML

Legal obligation


up to 10 years

Closure of account

3

Registration Data

Transaction and Usage data

Other communication Data

Profile Data

Payments Data

Defence of legal claims brought by customers

Legitimate interest

6 years

Up to 10 years

Closure of account

4

Registration Data

Contract Data

Identification and Verification Data

RG Data

Self-exclusion Data

Transaction and Usage Data

Payments Data

Profile data

Other communication Data


Defence of claims brought by authorities (UK, MGA)

Legitimate interest

Up to 10 years

Closure of the account

5

Identification and Verification Data

Responsible Gaming Data

Self-Exclusion data

Other Communication Data

RG (closure of the account

Legal obligation

Up to 10 years

Closure of the account

6

Identification and Verification Data

Responsible Gaming Data

Self-Exclusion data

temporary exclusion

Legal obligation

Up to 10 years

Exclusion

7

Registration and Contact Data

Log In Data

"CPR no" and "NEMID" in case of Danish Players


RG (permanent self-exclusion – MGA & DGA)

Legal obligation

Indefinite

Closure of the account/permanent self-exclusion

8

Transaction and Usage data

Registration Data

Sports Risk Data


Possibility to communicate with the Player (in relation to tailored offers and bonuses) in case of the Account re-opening by the Player

Legitimate interest

2 years

Closure of the account


Due to gaming authority restrictions relating to the use of multiple accounts, players are only permitted to create and use a single account per brand on the Expekt Nordics system as per our terms and conditions, therefore as long as we store, for the abovementioned purposes, all of the Personal Data of the player, the player may, following a closure only re-open their existing account, provided the account its eligible for opening.


Further details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by Contacting us.


  1. Recipients of your Personal data


5.1. As Expekt Nordics’s business partners, suppliers or service providers are responsible for certain parts of the overall functioning or operation of the Website, Games and other services, Personal data are processed also by them for the above-mentioned purposes on behalf of Expekt Nordics.


We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, after thorough vetting of these partners and on the basis of strict data processing agreements.


5.1.1. Details on the categories of the processors of the personal data



5.2. Authorised disclosure: If You are suspected to have breached our Terms and Conditions or any applicable laws (for example when we suspect that a crime may have been committed), or for the purpose of preventing, detecting or surpassing fraud or other criminal activity, Expekt Nordics has a right to:


5.3. Group companies/other brands for Responsible Gaming Purposes

When applicable, Your Self-Exclusion Data is, for the purpose of compliance with legal obligations, and Our license conditions, shared also with other companies within the same group. Likewise, for the same purposes, Expekt Nordics shares your Self Exclusion data with other brands under which it operates its gambling activities.


5.4. Group companies/other brands for AML Purposes

Your Identification and Verification Data in the extend of first name, surname, date of birth and postcode is, for the purpose of compliance with legal obligations, shared between various brands under which Expekt Nordics operates its gambling activities.


5.5. Data sharing for AML and Responsible Gaming Purposes between brands

Your Identification and Verification Data, Transaction and Usage Data, Registration Data and Contact data are for the purpose of compliance with legal obligations, shared with as well as sourced via various brands under which Expekt Nordics operates its gambling activities.



5.6. Corporate restructuring

Third parties, incl. any companies belonging to the same group of companies as Expekt Nordics, to whom we may choose to sell, transfer, or merge parts of our business, our assets or operations or as a result of restructuring. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.


5.7. Joint controllers: Certain data is shared with other parties, acting as joint controllers. The following are the details on the essence of the joint-controller arrangements:



The following Data are processed with Kambi as joint controllers: Transaction and Usage data in the extent: gender, first part of post code, currency, language, last method of deposit, account balance and bet history, Player ID for the purpose of provision of the Sportsbook services. Kambi does not process a player's real name or email address but makes use of a pseudonymised ID relating to each player.


Further information on the Kambi’s processing activities may be found here: https://www.kambi.com/player-fair-processing-notice


The essence of the Joint Controller Arrangement between Expekt Nordics and Kambi:


In other cases, each party acts as a sole controller. However, we will in all cases be responsible for handling any queries that players may have with respect to Kambi's data processing activities


  1. INTERNATIONAL TRANSFERS


Some of your suppliers and partners (as listed above) are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:


Please Contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.



  1. DATA SECURITY


We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In order to comply with GDPR, various technical controls ensure data and information are always encrypted during transit and at rest using industry standard encryption techniques across the board. This ensures confidentiality and integrity at all times. At an organisation level, the handling of all information is governed by our comprehensive Information Security Policies. This is complemented by an information Security awareness programme designed to specifically ensure we embrace security best practices whenever it comes to handling information. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a need to know business requirement. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.


  1.  Your Rights Under the Data Protection Laws


    1. Your Right of Access


You may, at any time, with reasonable intervals, request Us to confirm whether or not We are processing personal data that concerns You and, if We are, you shall have the right to access that personal data and to the following information:


The easiest way to obtain this information is to contact us on sar@leovegas.com or request this information via another channel.

Upon such request, We shall (without adversely affecting the rights and freedoms of others including Our own) provide You with such information and/or with a copy of the personal data undergoing processing within one month of receipt of the request, which period may be extended by two months where necessary, taking into account the complexity and number of the requests. We shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay.


8.2. The Right to Rectification


Although all reasonable efforts will be made to keep Your Personal Data updated, you are kindly requested to inform Us promptly. With respect to your residential address and phone number, you can notify us of the change by amending Your profile of any changes to Your Personal Data. If the change pertains to data that cannot be amended by changing your profile, please contact us. To this end You have the right to ask Us to rectify inaccurate personal data and to complete incomplete personal data concerning You. We may seek to verify the accuracy of the data before rectifying it.


8.3. The Right to Erasure (The Right to be Forgotten)


You have the right to ask Us to delete Your personal data and We shall comply without undue delay but only where:


In any case, We shall not be legally bound to comply with Your erasure request if the processing of Your personal data is necessary:


There are other legal grounds entitling Us to refuse erasure requests although the two instances above are the most likely grounds that may be invoked by Us to deny such requests. You may request the erasure by contacting us.


8.4 The Right to Data Restriction


You have the right to ask Us to restrict (that is, store but not further process) Your personal data but only where:


Following Your request for restriction, except for storing Your personal data, We may only process Your personal data:


You may request the restriction by contacting us.


8.5. The Right to Data Portability


You have the right to ask Us to provide Your personal data (that You shall have provided to us) to You in a structured, commonly used, machine-readable format, or (where technically feasible) to have it 'ported' directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall only apply where:

                                                                                 


To a great extent, you may exercise this right by activating “download my data” functionality of your profile. For any request over and above the data such provided or if you would like us to assist you with the actual transfer of such data to other operator, please contact us.

If you are a customer of other gaming operator and would like to have your data “ported” to Us, please contact us. In this respect please note, that notwithstanding any portability right utilisation, you will still be expected to provide all Registration and Contact Data due to the requirements of our customer registration / sign up procedure requirements.


8.6. The Right to Object to Certain Processing


In those cases where We only process Your personal data when this is 1.) necessary for the performance of a task carried out in the public interest right or in the exercise of official authority vested in Us or 2.) when processing is necessary for the purposes of the legitimate interests pursued by Us or by a third party (as indicated in the Table in the clause 3.2 above), You shall have the right to object to processing of Your personal data by Us.


When Your data is processed for direct marketing purposes, You have the right to object at any time to the processing of Your personal data, which includes profiling to the extent that it is related to such direct marketing.


For the avoidance of all doubt, when We process Your personal data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which We are subject or when processing is necessary to protect Your vital interests or those of another natural person, this general right to object shall not subsist.


With respect to Direct marketing of our own goods and services incl. related profiling, You may object such processing at any time, by contacting us or by selecting your preferences on your account Profile – Settings page.


8.7. Right to withdraw consent (when we process your data on the basis of consent)


In those cases where We process on the basis of Your consent (which We will never presume but which We shall have obtained in a clear and manifest manner from You), YOU HAVE THE RIGHT TO WITHDRAW YOUR CONSENT AT ANY TIME and this, in the same manner as You shall have provided it to Us.


Should You exercise Your right to withdraw Your consent at any time (by writing to Us at the physical or email address below), We will determine whether at that stage an alternative legal basis exists for processing Your Personal Data (for example, on the basis of a legal obligation to which We are subject) where We would be legally authorised (or even obliged) to process Your Personal Data without needing Your consent and if so, notify You accordingly.


When We ask for such Personal Data, You may always decline, however should You decline to provide Us with necessary data that We require to provide requested services, We may not necessarily be able to provide You with such services (especially if consent is the only legal ground that is available to Us).


Just to clarify, consent is not the only ground that permits Us to process Your Personal Data. In the last preceding section above We pointed out the various grounds that We rely on when processing Your Personal Data for specific purposes.


8.8. The Right to lodge a Complaint


You also have the right to lodge complaints with the appropriate Data Protection Supervisory Authority. The competent authority in Malta is the Office of the Information and Data Protection Commissioner (OIDPC). We kindly ask that You please attempt to resolve any issues You may have with Us first (even though, as stated above, You have a right to contact the competent authority at any time). 


8.9. WHAT WE MAY NEED FROM YOU


When exercising your rights by contacting us, we may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.


8.10. TIME LIMIT TO RESPOND


We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.


8.11. DIFFERENT BRANDS


Expekt Nordics is operating its gaming business also under other brands and trademarks. For the purpose of the exercise of your rights as provided above, and for the purpose of clarity and legibility of our reply, we will initially comply with the requests with respect to data processed under the brand from where the request is originating. Should you wish your requests to be complied with respect to all of the brands with respect to which Expekt Nordics operates its business, please make sure to flag this in your request.


  1. AUTOMATED PROCESSING - PROFILING


    1. Meaningful information about the logic involved in the automated processing for responsible gaming purposes


Expekt Nordics is on the basis of the applicable laws and license conditions legally obliged to monitor its players in order to identify people who may be experiencing, or at risk of developing, problems with their gambling, and interact with them to offer help or support. To this end, and to fulfil this obligation, by using historic data describing behaviour of players , in particular certain Responsible Gaming Data, Transaction and Usage Data, and Other Communication Data (in particular notably sentiment used in message) Expekt Nordics has established rules regarding who is likely to suffer from gambling addiction and then take relevant action.

Our approach is based on classification trees because they allow for clear interpretation of why players get classified as potential gambling addicts. Based on data describing unique players, the algorithm provides us with an estimated probability of gambling addiction. Decisions, on the basis of the prediction, are not taken automatically without human intervention.


    1. Meaningful information about the logic involved in the automated processing for AML purposes


Expekt Nordics is, on the basis of the applicable laws and license conditions, legally obliged to monitor its players in order to identify potentially suspicious activities regarding AML/CFT.  Based on data describing the behaviour of players, in particular Transaction and Usage Data, the algorithm suggests a risk profile. 

Decisions, on the basis of the prediction, are not taken automatically and require human intervention. 


9.3. Meaningful information about the logic involved in the automated processing for loyalty/VIP segmentation purposes


By making use of the historical data that players generated in their first 2 days, We assess whether You will qualify for our VIP/loyalty program. This model is used on fresh players and depending on their involvement with our services the VIP status is predicted. The result of the model is a prediction as to whether the player will become a VIP. Apart from gender, country and age, we do not make use of personally identifiable information as input in the model. Decisions, on the basis of the prediction, are not taken automatically without human intervention. The process is based on our compliance with legal obligation and with respect to the loyalty offers, on legitimate interest of Expekt Nordics regarding providing customised, quality experience for the players and reward loyalty of the players. You can object to such processing by contacting us or changing your preferences in your account.


    1. Meaningful information about logic involved in automated processing with respect to direct marketing segments


By making use of Your Transaction and Usage data, certain Registration Data such as gender, country, date of birth and Your overall interaction with our services, We analyse and establish various segments of the customers. These segments are then processed manually, in order to ensure that We provide the most appropriate offers and bonuses to our customers. These decisions are not taken automatically without human intervention. The process is based on legitimate interest of Expekt Nordics regarding providing customised, quality experience for the players and reward loyalty of the players. You can object to such processing by contacting us or changing your preferences in your account.


    1. Meaningful information about logic involved in automated processing with respect to Sports Risks Segments


Expekt Nordics is manually processing your Sports Risks Segments as established by the sportsbook provider – Kambi. The Sports Risk Segments are established by Kambi on the basis of automated profiling performed by Kambi. They use automated processing to suggest a risk profile, however such risk profile is confirmed or amended by Kambi's personnel. In conjunction with provision of its services, Kambi uses automated risk management technology to assess the risk of particular betting activities. If You seek to undertake a bet that falls outside of the parameters associated with your risk profile, the bet is flagged for Kambi’s personnel to review. To safeguard your rights and interests, Kambi allows you to contest any decision that they make about your risk profiling or to object to our use of profiling. To this end, please contact us (Expekt Nordics). More information on processing activities performed by Kambi please consult Kambi’s privacy notice here: https://www.kambi.com/player-fair-processing-notice


    1. Meaningful information about logic involved in automated processing with respect to Game recommendation


By making use of your Transaction and Usage data, we provide you a list of games that is aligned with your taste. The system determines your affinity towards different games and generalise your preferences to unseen games. Ranking the computed preferences, an ordered list of games is produced and can be served as recommendations.

The games recommendation is produced without human intervention. The process is based on legitimate interest of Expekt Nordics regarding providing customised, quality experience for the players.


  1. Cookies


Our site uses cookies, for further information on what cookies are, which cookies we use, how and why we use cookies, and how you can control which cookies are dropped, please read our Cookies Policy: https://app.expekt.com/cookie-policy