Personal data protection policy

This Personal Data Protection Policy complies with the requirements of Regulation 2016/679 EU on the protection of individuals with regard to personal data processing, and on the free movement of such data (“General Data Protection Regulation”/GDPR), in connection with the processing of personal data and the Personal Data Protection Act, as well as other special requirements in the regulations applicable for our activity, incl. but not only: the Gambling Act, the Anti-Money Laundering Measures Act, the by-laws, as well as the mandatory gambling conditions, rules and requirements adopted by the State Gambling Commission for organized gambling by companies operating under the Inbet brand (referred to hereinafter in the current policy as Inbet).

This privacy policy applies to the processing of personal data of individuals for the purpose of participating in and receiving cash and in-kind winnings from games, organized by companies operating under the Inbet brand, on the ground in gaming halls.

What information we collect and why?

We may collect personal data about you when you visit our gaming hall for the purpose of providing a service, to comply with a legal obligation or to protect our legitimate interest. If you do not provide us with identification data, we will not be able to provide you with the relevant service. Depending on the services you use, we may collect and process the following information about you:

When visiting gaming halls

> Names and date of birth so that we can establish your identity and you can participate in bonus games, while fulfilling our legal obligations;

> Е-mail for receiving marketing messages;

> Тelephone number for receiving marketing messages;

> PIN, PNF or any other identification number and ID card data, as well as citizenship – only when paying amounts over EUR 2 000.

> Video recordings when you visit our sites in order to ensure our and your security and/or fulfill a regulatory obligation.

Purpose of processing your data

In most cases, personal data is required in order to comply with a legal obligation, to perform a contract or on the basis of a legitimate interest. Of course, with some of our services, you provide us with this information yourself, choosing and agreeing to it. The personal data we collect and process is most often for the following purposes:

When carrying out our activities, we require and process data on the basis of a number of statutory obligations, such as:

• Gambling Act, Anti-Money Laundering Measures Act, by-laws, as well as the adopted mandatory gambling conditions, rules and requirements for organized gambling;
• The Accounting Act and the Tax and Social Security Procedure Code and other related regulations, in connection with keeping correct and lawful accounts;
• obligations to provide information to all state institutions and regulatory bodies;
• obligations for video surveillance in our gaming halls;
• obligations to provide information to the court and law enforcement agencies.

Data processing based on your consent

When we process your data for the purposes of direct marketing of our products and services, as well as for participation in bonus games and raffles, we will need your explicit consent.

Data processing based on our legitimate interest

• performing video surveillance in our administrative sites;
• making a sound recording during a telephone conversation with the call center, in order to improve the quality of the services provided, as well as to resolve disputes and protect legitimate interests.

Who may we share your data with?

The provision of personal data is in some cases mandatory in order to comply with legal requirements. Depending on the games organized by Inbet in which you participate, we may provide your data to the following categories of recipients:

• The National Revenue Agency and the State Agency for National Security, in compliance with statutory requirements and obligations relating to gambling. These bodies have the right to receive information about the registered users, the bets made, the winnings paid, as well as other data, in the cases and form provided by law;
• Banks, payment institutions, postal money order companies, specifically identified in the relevant rules for organizing and conducting the games, in compliance with the requirements and obligations for making bets and paying out winnings;
• Providers of systems/services for the games, management and maintenance of the activity and quality of services, incl. those related to IT, with which we have a contract (e.g. IT providers, software suppliers, computer support providers, in-kind prizes providers, etc.), in compliance with the requirements and obligations for supporting regulatory system functionalities, identification of participants, placing bets, determining results and paying out winnings;
• State bodies/institutions, public figures, regulators and supervisory bodies (including  Ministry of Youth and Sports, State Commission on Gambling, National Revenue Agency, State Agency for National Security, bodies of the court, prosecution and investigation, the Consumer Protection Commission, the Competition Protection Commission, the Commission for Personal Data Protection, etc.), if we have sufficient grounds to consider that their access, use, keeping or disclosure is necessary for: the implementation of an applicable law or any other binding regulation; in response to an inquiry made by a supervisory body, regulator or any other state institution in connection with or on the occasion of the performance of its statutory functions or initiated inspection, complaint, audit, etc.; detection, prevention or any other actions related to fraud, money laundering, terrorist financing, technical or security issues.

Inbet uses third parties to support certain contractual activities or when performing a legal obligation. We do not provide your personal data to third parties until we have made sure that all the technical and organizational measures to protect this data have been taken, and we make every effort to exercise strict control in this regard. Some of these personal data recipients may be:

• courier companies, external consultants and specialists, collection companies and law firms, banks, security companies, persons who are assigned the maintenance of the equipment, software and hardware used by Inbet, hosting companies and sales agents, etc. to process personal data.

About us

The personal data of the participants in the organized games may be processed by the following administrators:
When you participate in gambling games in our gaming halls, the data are processed by CASINO INBET EOOD, UIC: 205767733, with head office and registered address in the town of Sofia, Mladost District, “Mladost – 2” residential estate, 44A St. Kipriyan Str.

Technical and organizational security measures

In order to ensure the maximum protection of the personal data of the subjects, INBET applies the following technical and organizational security measures:

• Protection of the collected personal data against unjustified use and monitoring the personal data processing;
• Supporting secure computer systems through which personal data is processed. Our systems apply adequate control mechanisms for data separation and management;
• Adopting strict policies and procedures applicable to its staff to minimize the risks of personal data processing;
• Inbet employees are aware of the applicable rules and are trained to process personal data with utmost care and in compliance with established good practices;
• In carrying out its activities, Inbet works only with established organizations and avoids working with companies that it believes may compromise the security of individuals’ personal data;
• Adopted good practices in the implementation and administration of security systems and in monitoring technological developments in terms of potential risks to the information security in the company;
• Compliance with the security requirements for the computer systems and the personal data contained therein, including potential access to certain types of personal data by its employees;
• Providing access only to those personal data that are necessary for the performance of the official obligations of the relevant employee.

Companies operating under the INBET brand have adopted procedures for the effective identification, reporting and investigation of personal data breaches. In the event of a breach of personal data security, each of the companies will take immediate action to limit the effect of the breach, as well as to inform the data subjects concerned and the data protection supervisory authority.

What are your rights and how you can exercise them

Your rights

You have the right to information, to access and to receive a copy of your personal data, which is processed by INBET. If you believe that your information that INBET has is inaccurate or incomplete, you may request your personal data to be edited. You can also exercise the right to correct or update the personal data you provide by accessing your user profile on the Inbet website.

Furthermore, you have the right to:

• object to the processing of your personal data;
• request restrictions on the processing of your personal data; and/or
• withdraw your consent when Inbet processes your personal data on the basis of consent (without such withdrawal affecting the lawfulness of the processing carried out before the withdrawal);
• complain to the supervisory body – CPDP (Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd. or www.cpdp.bg).

Inbet will comply with requests, withdrawals or objections in accordance with the requirements of the applicable data protection rules, but these rules are not absolute: they are not always applicable and there may be exceptions. In response to a request, you will need to verify your identity and/or provide additional information to help you better understand your request. When you re-exercise access to information or a copy of the data in a machine-readable format, Inbet may charge a reasonable fee based on the administrative costs required to provide it.

How you can exercise them?

Each of the rights provided by law may be exercised by submitting a request to exercise the relevant right. A request to exercise the rights of personal data subjects may be submitted as follows:

• By e-mail to the following e-mail address: [email protected].
• At Inbet’s headquarters at: Sofia, Mladost District, “Mladost – 2” residential estate, 44A St. Kipriyan 44A.

The request to exercise personal data rights should contain the following information:

• Identification of the person – names and PIN;
• Contacts for feedback – address, phone, e-mail;
• Request – description of the request.

Inbet provides information on the action taken in connection with a request to exercise your rights within one month of receipt of the request.

If needed, this period may be extended by a further two months, taking into account the complexity and number of requests from a particular person. INBET shall inform the person of any such extension within one month of receipt of the request, stating the reasons for the delay. The information provided to the subject and any communication and actions taken to exercise the data subject’s rights shall be provided free of charge (except in the case of abuse of the granted rights).

We may request additional information to be provided, which is needed to verify your identity when there are concerns about the identity of the requesting individual.

Inbet has no obligation to respond to a request if it is unable to identify the data subject.

Where the request is submitted electronically, where possible the information shall be provided electronically, unless you have requested otherwise.

Use of cookies

Inbet collects or processes personal data through functional cookies, and more details can be found at Inbet’s cookie policy.