European Lotto and Betting Ltd (ELBL) Privacy Notice

Version 1.0 Last update 11. April 2024 (valid from 30.04.2024)

1. Introduction and scope of this privacy notice
European Lotto and Betting Ltd./ELBL (“us”, “we” or “our”) operates the Dein LottoClub website (www.dein-lottoclub.com) and is registered at the following address:
Level 5, St. Julian’s Business Centre
Elia Zammit Street, St. Julian’s
STJ3 153, Malta

ELBL respects your privacy and we are committed to protecting your personal information. This privacy notice tells you how we treat your personal information when you visit our website or interact with our services. It informs you about how ELBL collects, stores and process your personal data and tells you about your rights as a data subject.  

When we, ELBL, determine the purpose and means of processing your personal data, we are a “controller” and anyone who acts on our behalf in relation to that processing is a “processor”. In some circumstances, we may act as both a controller and a processor.

We have appointed a Data Protection Officer (DPO) who is responsible for dealing with questions relating to this Privacy Policy. If you have any questions about this Privacy Policy, including requests to exercise your rights as a data subject, please contact the Data Protection Officer using the contact details provided below:
datenschutz@dein-lottoclub.com 

2. Data we collect about you
We may collect, process and transfer different types of personal data about you, which we have grouped into “categories” of personal data as follows:
 
•    Identity data includes: First name and last name, title, date of birth 
•    Contact details includes: E-mail address, postal address, telephone number
•    Financial data includes: details of bank account
•    Transaction data includes:  details of payments to and from you and other details of game orders, games played and any other products purchased from us
•    Profile data includes: your username and password, purchases you have made, your interests, product preferences, feedback and survey responses
•    Usage data includes: information about how you use our website, products and game orders
•    Marketing and communications data includes: your preferences regarding receiving marketing from us and third parties and your communication preferences
•    Technical data includes: Internet Protocol (IP) address, your login details, unique device identifiers, browser type and version (including the search engine and keywords used to find the website), operating system and/or platform used, time zone setting and location, browser plug-in types and versions and other technology on the devices you use to access our products and games. This information may be required by us in the event of attacks on our IT systems but is usually anonymized or depersonalized and therefore is not considered your personal data unless you can be identified from this data. 

3. How your personal data is collected
We use various methods to collect data, including the following:
Direct interaction
You give us your identity, contact and financial data by filling in forms or by corresponding with us by post, telephone, email, chat or otherwise. This includes personal data you provide to us when you:
    a. Place a game order or play games;
    b. open an account with us;
    c. request the sending of advertising material;
    d. participate in a competition, promotion or survey, or
    e. give us feedback, or file a complaint.

Third parties or publicly available sources
As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this data using cookies and similar technologies (such as Google Analytics). We may also receive Technical Data about you when you visit other websites that use our cookies.

Third parties or publicly available sources
We may also receive personal data about you from various third parties (including regulators or statutory bodies, self-exclusion programs, crime prevention agencies, credit or identity verification services and/or publicly available sources) and use this information, for example, to carry out further identity and/or integrity checks to minimise fraud, deception or money laundering risks to ELBL.

4. How we use your personal data
ELBL only use your personal data when permitted by law. We generally use your personal data in the following cases:
(a) where we need to provide services under the contract we are about to enter into or have entered into with you;
(b) where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
(c) if we have to comply with a legal or regulatory obligation, or
(d) with your consent

Generally, we do not rely on consent as a legal basis for processing your personal data, except to send you direct marketing communications by email. You have the right to withdraw your consent for marketing purposes at any time by contacting us at  dlc-service@dein-lottoclub.com or by clicking the "unsubscribe" option within the relevant communication.

5. Purpose for which we use your personal data
Below you will find a tabular description of the main purposes for which we use your personal data and the legal bases we rely on to do so. Where applicable, we have also indicated our legitimate interests. Please note that we may process your personal data on more than one lawful basis depending on the specific purpose for which we are using your data:

6. Disclosure of your personal data
We may need to share your personal information with the following recipients or categories of recipients set out below for the purposes set out in the table in Section 5 of this Privacy Notice:

(a) Other ELBL related companies that act as joint controllers or processors and provide customer service, IT, and system administration services
(b) Identity verification and fraud prevention providers to carry out customer due diligence, including anti-money laundering, fraud and sanctions checks as part of our AML/CFT/CFP obligations
(c) External third parties to carry out marketing and promotions on our behalf.
(d) Third parties to whom we may sell, transfer, or intend to merge parts of our business or assets. We may also seek to acquire or merge with other companies. If our business model changes, the new owners will be free to use your personal information in the ways set out in this privacy policy.
(e) Service providers that offer IT and system administration services.
(f) Professional advisors such as lawyers, banks, auditors, and insurers who provide Lottoland with advisory, banking, legal, insurance and accounting services.
(g) Supervisory authorities and other authorities that require notification of processing activities in certain circumstances.

7. Your data protection rights
If you reside in the European Economic Area (EEA), you have certain data protection rights. We strive to take reasonable steps to allow you to correct, amend, delete or limit the use of your personal data. If you would like to be informed about what personal data we hold about you and if you would like it removed from our systems, please contact us.

•    Right to be informed. You have the right to be informed about the collection and use of your personal data. This privacy notice is designed to provide you with the information needed to allow you to see how and why your personal data is used when visiting this website.

•    Right to the data we have hold on you. You have the right to ask for the personal data that we have about you to increase your awareness of and allow you to verify the lawfulness of the processing. (To protect your privacy, we may ask you to verify your identity).

•    Right to have your data rectified if it is inaccurate. If you believe that personal data we hold on you is inaccurate or misleading then you have the right to request that it is rectified.

•    Right to erasure.  In some circumstances, you can ask for your personal information to be deleted, for example:
- your personal information is no longer needed for the reason it was collected in the first place
- you have removed your consent for us to use your information (where there is no other legal reason for us to use it)
- there is no legal reason for the use of your information

•    Right to have your data restricted or blocked from processing. You have the right to request that we restrict the processing of your personal data in the following situations:
- you dispute the accuracy of the personal data;
- in the event of unlawful processing, you can request, instead of deletion, that we restrict the use of the unlawfully processed personal data;
- we no longer need to process your personal data, but we must retain it for the establishment, exercise or defence of legal claims, or
- you have exercised your right to object (and it remains to be checked whether our legitimate reasons (or those of a third party) outweigh your interests, rights and freedoms.

•    Right of data portability. Where you have provided your personal data directly to us that is processed by automated means and is done so purely on the basis of your consent, then you will have the right to obtain and reuse your personal data in an electronic format for your own purposes across different services.

•    Right to object to direct marketing . You have an unconditional right to object to direct marketing at any time. As noted within this privacy notice, we will not send you direct marketing without your consent and you can withdraw your consent at any time by selecting the 'unsubscribe' link within each email.

•    Right to object to processing of your personal data. Processing is the term under data protection law that describes all uses of your personal data. This will include the collection, sharing, storage, retention, and destruction of your data.

You have the right to object to any aspect of our processing of your personal data:
- that is processed for the performance of a task in the public interest or in the exercise of official authority;
- that is processed based on legitimate interests as a lawful basis;
- that is processed for purposes of scientific/historical research and statistics; and
- if it involves any automated decision making or profiling carried out by us.

•    Right to complain. If you wish to complain about how we have handled your personal data, we ask that you first contact us using the contact details provided in Section 1 of this Privacy Policy so that we can try to find a solution to your complaint.

8. Data retention
ELBL will only store your personal data for as long as is necessary for the purposes set out in this data protection declaration. We will retain and use your personal information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

ELBL also stores usage data for internal analysis purposes. Usage data is typically retained for a shorter period of time, unless this data is used to increase the security or improve the functionality of our Services, or we are required by law to retain this data for a longer period.

9. Cross border data transfers
We pass on your personal data to third-party service providers. We will only share your personal data with third parties or international organizations outside the EEA if there is a legal basis for doing so. This may be the case in order to provide you with our services or if we ourselves use service providers (processors) outside the EEA to operate our business.
Where we transfer your personal data from the EEA to a third country or international organization, we will ensure that such data enjoys a similar level of protection by taking at least one or more of the following measures:

Transfers to appropriate territories
We may transfer your personal data to territories deemed by the European Commission (in relation to processing operations subject to the EU GDPR) on the basis of adequacy for the purposes of the EU GDPR and provide an adequate level of protection for personal data. 

Transfers are subject to appropriate security measures
We may transfer your personal data if we implement “appropriate security measures as required by Article 46 of the EU GDPR.

10. Cookies and other technologies
In order to make visiting our website attractive and to enable the use of certain functions, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser on your next visit (persistent cookies).

Privacy protection on end devices
When using our online offer, we use absolutely necessary technologies in order to be able to provide the expressly requested telemedia service. The storage of information in your end device or access to information that is already stored in your end device does not require consent in this respect.

For functions that are not absolutely necessary, the storage of information in your end device or access to information that is already stored in your end device requires your consent. If you do not give your consent, parts of the website may not be fully usable. Any consent you have given will remain in place until you adjust or reset the respective settings on your device.

Any downstream data processing by cookies and other technologies

We use such technologies that are absolutely necessary for the use of certain functions of our website (e.g. preference settings of the website). These technologies are used to collect and process the IP address, time of visit, device and browser information as well as information about your use of our website (e.g. information about your preferences).  These technologies collect and process IP addresses, time of visits, device and browser information, and information about your use of our website (e.g. information about your preferences). In the context of a balancing of interests, this serves the overriding legitimate interests in an optimized presentation of our offer in accordance with Art. 6 Para. 1 Clause 1 Letter f of GDPR.

We also use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to prove consent to the processing of your personal data) as well as for web analysis and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this data protection declaration.

You can find the cookie settings for your browser under the following links Microsoft Edge ™ / Safari ™ / Chrome ™ / Firefox ™ / Opera ™

If you have consented to the use of the technologies in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, you can revoke your consent at any time by sending a message to the contact option described in the data protection declaration.

Use of cookies and other technologies for web analysis and advertising purposes
Insofar as you have given your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we use the following cookies and other third-party technologies on our website. The data collected in this context will be deleted once the purpose has ceased to exist and we have stopped using the respective technology. You can revoke your consent at any time with effect for the future. Further information on your cancellation options can be found in the section "Cookies and other technologies". Further information, including the basis of our cooperation with the individual providers, can be found under the individual technologies. If you have any questions about the providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.

Use of Google services for web analysis and advertising purposes

We use the following technologies of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The information automatically collected by Google technologies about your use of our website is usually transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. There is no adequacy decision by the European Commission for the USA. Our cooperation with them is based on standard data protection clauses of the European Commission. If your IP address is collected via Google technologies, it will be shortened by activating IP anonymisation before it is stored on Google's servers. Only in exceptional cases will the full IP address be transmitted to a Google server and truncated there. Unless otherwise specified for the individual technologies, data processing is carried out on the basis of an agreement concluded for the respective technology between jointly responsible parties in accordance with Art. 26 GDPR. Further information about data processing by Google can be found in Google's privacy policy.

Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as information on your use of our website), from which user profiles are created using pseudonyms. Cookies may be used for this purpose. Your IP address will not be merged with other Google data. Data processing is carried out on the basis of an agreement on order processing by Google.