Privacy Policy

Rhinoplay is a business-to-business supplier of online games and related software. We develop game content and supply it, to gaming operators and platform providers (“Operators”) who make that content available to their own end users. We do not operate gambling websites and we do not hold player accounts or player funds.

We respect your privacy and are committed to protecting your personal data. We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), and any other applicable data protection legislation.

This Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have.

1. Who we are and how to contact us

• The data controller in respect of the processing described in this Policy is Rhinoplay.

• Our Data Protection Officer / privacy contact can be reached at: [email protected]

• General legal correspondence: [email protected]

By accessing our website at www.rhinoplay.com (the “Website”) or otherwise interacting with us, you confirm that you have read and understood this Policy.

2. Definitions

Capitalised terms not defined here have the meaning given to them in the GDPR or in our Terms of Use. In addition:

• User / you — any natural person who accesses or browses the Website, contacts us, or otherwise interacts with our Services.

• Services — the Website, our games and demonstration content, our partner portal, and any related services we provide.

• Operator — a gaming operator, platform provider or other business customer to whom we licence our content.

• Personal Data — any information relating to an identified or identifiable natural person.

3. Scope of this Policy

This Policy applies to:

• visitors to and users of the Website;

• representatives, employees and contacts of our clients, prospective clients, suppliers and business partners;

• users of our partner portal or back-office tools;

• candidates who apply for a position with us; and

• individuals who contact us by any channel.

This Policy does not apply to the processing of player data carried out by an Operator on its own websites or applications. When you play a Rhinoplay game inside an Operator’s platform, that Operator is the controller of your player data and its own privacy policy applies. If you have questions about your player account, betting history, deposits, withdrawals or self-exclusion, you should contact the Operator concerned.

4. Our role: controller and processor

• As a controller, we determine the purposes and means of processing in relation to Website visitors, business contacts, partner portal users, job applicants and our own personnel.

• As a processor, we process certain data on behalf of and on the documented instructions of Operators. Where a Rhinoplay game is integrated into an Operator’s platform, we may receive a pseudonymous session or player identifier, wager and outcome data, game session data and technical data. In these cases the Operator is the controller and we act under a written data processing agreement that reflects the requirements of Article 28 GDPR. We do not use such data for our own independent purposes beyond providing, securing, auditing and improving the licensed services and complying with our legal and regulatory obligations.

5. Principles we apply

When processing Personal Data we ensure that it is:

• processed lawfully, fairly and transparently;

• collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;

• adequate, relevant and limited to what is necessary;

• accurate and, where necessary, kept up to date, with reasonable steps taken to correct or erase inaccurate data without delay;

• kept in a form permitting identification for no longer than is necessary; and

• processed in a manner ensuring appropriate security through suitable technical and organisational measures.

6. Categories of Personal Data we collect

6.1 Data collected automatically when you access the Website

• IP address and approximate location derived from it

• Device and browser data (device type, operating system, screen resolution, language settings)

• Browsing data (pages visited, referring URL, time and duration of visit, clicks)

• Age-gate confirmation

• Cookie and similar identifiers, and preference settings

Log data generated for security and fraud-prevention purposes

6.2 Data you provide to us directly

• Identification and contact data (name, job title, company, email address, telephone number)

• The content of your enquiries, messages and correspondence

• Commercial and relationship data (records of meetings, demonstrations, proposals and contract negotiations)

• Marketing preferences and subscription data

• Event registration data (for trade shows, conferences and webinars)

6.3 Partner portal and back-office users

• Account credentials and authentication data

• Access logs, activity logs and audit trails

• Support tickets and configuration requests

6.4 Recruitment data

• CV, cover letter, employment and education history, references, right-to-work information and any other data you choose to submit

6.5 Data processed on behalf of Operators (processor role)

• Pseudonymous player or session identifiers

• Game session data, bets, outcomes, balances and transaction identifiers

• Technical and device data associated with the game session

• We do not intentionally collect special categories of personal data (Article 9 GDPR). Please do not submit such data to us unless we have specifically requested it.

7. Purposes and legal bases

We process personal data only where we have a lawful basis to do so under Article 6 GDPR.

7.1 Performance of a contract, or steps taken at your request prior to entering into one (Art. 6(1)(b))

We rely on this basis to respond to your enquiries, to negotiate and manage our relationship with clients, suppliers and partners, to provide and support the services we licence to Operators, and to assess candidates who apply for a position with us.

7.2 Compliance with a legal obligation (Art. 6(1)(c))

We rely on this basis to meet our regulatory, licensing, certification, audit, accounting and tax obligations, to respond to lawful requests from courts and competent authorities, and to comply with obligations relating to the prevention of fraud, money laundering and other unlawful activity.

7.3 Our legitimate interests (Art. 6(1)(f))

We rely on this basis to operate, maintain, secure and develop the Website and our Services; to detect, investigate and prevent fraud, cheating, collusion, abuse and other unlawful activity; to carry out statistical analysis and product research that improves our games; to verify compliance with our Terms of Use; to communicate with business contacts about services relevant to their professional role, where permitted by applicable law; and to establish, exercise or defend legal claims.

Before relying on this basis we carry out a balancing assessment to confirm that our interests are not overridden by your interests, rights and freedoms. You may request further information about any such assessment at [[email protected]]. 7.4 Your consent (Art. 6(1)(a))

We rely on your consent for non-essential cookies and similar technologies, for direct marketing communications where consent is required, and for retaining your recruitment data in our talent pool after a selection process has concluded.

You may withdraw your consent at any time by writing to the contact details above or by using the unsubscribe link in our communications. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where we ask you to provide personal data in order to comply with a legal obligation or to enter into a contract with us, we will make this clear at the point of collection and explain the consequences of not providing it.

8. Cookies and similar technologies

The Website uses cookies and similar technologies for strictly necessary, functional, analytics and, where applicable, marketing purposes. Non-essential cookies are set only with your consent, which you may give, refuse or withdraw at any time through our cookie banner or preference centre.

9. Recipients of Personal Data

We may disclose Personal Data to:

• Group companies and affiliates, where necessary for the purposes described in this Policy;

• Service providers acting as processors - hosting and cloud infrastructure, content delivery networks, IT support, security and monitoring providers, analytics providers, CRM and marketing platforms, recruitment platforms, and professional advisers. These providers act only on our documented instructions and under contracts imposing obligations equivalent to those in this Policy;

• Operators and their platform providers, where necessary to deliver, reconcile or support the licensed content;

• Regulators, licensing authorities, testing laboratories and auditors, where required for certification, compliance or supervision purposes;

• Courts, law enforcement and public authorities, where we are legally required to do so or where disclosure is necessary to investigate unlawful activity, including money laundering, fraud and the protection of our rights;

• Prospective purchasers or investors, in connection with a merger, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality safeguards.

We do not sell Personal Data.

10. International transfers

We primarily process Personal Data within the European Economic Area. Where a transfer to a country outside the EEA is necessary, we ensure that an appropriate safeguard under Chapter V of the GDPR is in place, such as:

• an adequacy decision of the European Commission; or

• Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.

11. Security

We apply appropriate technical and organisational measures designed to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or damage. These measures include access controls and role-based permissions, encryption in transit and, where appropriate, at rest, network segregation, logging and monitoring, secure development practices, vendor due diligence, business continuity arrangements, and staff confidentiality obligations and training.

Personal Data is accessible only to authorised personnel who need it to perform their duties and who are bound by appropriate confidentiality obligations.

In the event of a Personal Data breach, we will assess and respond to the breach in accordance with applicable data protection laws and, where required, notify the competent supervisory authority and/or affected individuals in accordance with Articles 33 and 34 of the GDPR.

While we take appropriate measures to protect Personal Data, no method of transmission or storage can be guaranteed to be completely secure.

12. Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, taking into account the principles of data minimisation and storage limitation.

The applicable retention period will depend on the nature and purpose of the processing, our ongoing relationship with the relevant individual or organisation, and any applicable legal, regulatory, accounting, contractual or reporting requirements.

We may retain Personal Data for longer where required by law or where necessary to establish, exercise or defend legal claims.

Once Personal Data is no longer required for the relevant purpose or legal obligation, it will be securely deleted or irreversibly anonymised, where appropriate.

13. Your rights

• Subject to the conditions and exceptions in applicable law, you have the right:

• to be informed about how we process your Personal Data;

• to access your Personal Data and obtain a copy;

• to have inaccurate or incomplete data rectified;

• to have your data erased (“right to be forgotten”);

• to restrict processing in the cases provided by law;

• to data portability in a structured, commonly used, machine-readable format;

• to object to processing based on legitimate interests, and to object at any time to direct marketing;

• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;

• to withdraw consent at any time where processing is based on consent.

Requests should be addressed in writing to [email protected].

14. Automated decision-making

We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing. We may use automated tools for fraud detection, anomaly monitoring and platform security; where such tools generate an alert, material decisions are subject to human review.

15. Age restriction

The Website and our content are intended for persons aged 18 or over (or the higher minimum age applicable in the jurisdiction where you are located). We do not knowingly collect Personal Data from minors. If we become aware that we have collected data from a minor, we will delete it without undue delay. If you believe a minor has provided us with Personal Data, please contact [email protected].

16. Your obligations

When you provide Personal Data to us, you must ensure that it is accurate, complete and up to date, and inform us of any changes. Where you provide data about another individual (for example a colleague), you confirm that you are authorised to do so and that the individual has been informed of this Policy.

If we have reasonable grounds to believe that information you provide is false, incomplete or otherwise contrary to applicable law or this Policy, we may refuse, suspend or terminate your access to the Services without notice and without compensation.

17. Third-party websites

The Website may contain links to third-party websites, including those of Operators and partners. We are not responsible for the privacy practices or content of those websites. We encourage you to review their privacy policies before providing them with any Personal Data.

18. Changes to this Policy

We may amend this Policy from time to time. The updated version takes effect from the moment it is published on the Website, and the “version” and “effective date” above will be revised accordingly. Where changes are substantial, we will take reasonable steps to notify you.

19. Contact

[email protected]