This Privacy Notice and Consent Form should be read together with the CoinPoker Free-to-Play Privacy Policy and Terms and Conditions(collectively, the “Platform Policies”). Capitalised terms used but not defined herein have the meaning given to them in the Platform Policies.

Identity and Contact Details of the Data Controller

Vantix Tech Limited, a company incorporated under the laws of Malta and having its registered office at 2nd Floor Tower Business Centre Office Number 207, Triq IT-Torri, Swatar Msida, BKR 4013, Malta (the “Data Controller”, “we”, “us” or “our”), is the controller responsible for the collection and processing of your personal data on the CoinPoker Free-to-Play platform (the “F2P Platform”).

You may contact us in relation to data protection matters at [email protected].

Data Protection Officer

Our Data Protection Officer can be contacted — Anthony Debono at [email protected]. Where a DPO is not mandatorily required, the above is our designated contact point for all data protection queries and the exercise of your rights.

Categories of Personal Data We Collect

The following categories of personal data may be collected and processed in connection with the F2P Platform (as may be updated from time to time and notified to you):

Account data: email address and password (stored in hashed form), collected at registration.
Gameplay data: hand histories, chip balances, Reward Point balances, leaderboard rankings, ring-game participation records, and freeroll tournament results.
Engagement and behavioural data: in-app events, session data, and feature usage signals.
Device and attribution data: device identifiers, operating system, campaign source, and install data collected.
Communications data: support tickets submitted to [email protected] and related correspondence.

We do not collect GPS or real-time location data. We do not use social login. We do not knowingly collect any special categories of personal data unless separately and explicitly consented to or otherwise permitted under Applicable Laws.

Purposes of Processing and Legal Bases

We process your personal data only for the purposes set out below, each on a corresponding lawful basis under the General Data Protection Regulation (“GDPR”) and applicable national data protection law. Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests are not overridden by your interests, rights, and freedoms. You may request further details using the contact information above.

Purpose of Processing	Legal Basis	Personal Data Used
Account creation, authentication, and management	Performance of a contract	Email address, password (hashed)
Running the game — gameplay, chip balances, Reward Point balances, leaderboards, ring games, and freeroll tournaments	Performance of a contract	Gameplay data, chip and RP balances, hand histories, rank
Transactional and service communications — account security, verification, and service updates	Performance of a contract	Email address
Analytics, in-app behavioural event tracking, engagement measurement, and retention analysis	Legitimate interests	In-app events, session data, feature usage signals
Security monitoring, fraud prevention, anti-cheat, and anti-collusion enforcement	Legitimate interests	Gameplay data, device data, behavioural events
Mobile attribution and campaign measurement	Legitimate interests	Device identifiers, campaign and install data
Customer support — handling queries and resolving issues submitted to [email protected]	Performance of a contract / legitimate interests	Support correspondence, account data
Marketing and promotional communications about the CoinPoker F2P Platform by email	Consent	Email address
Compliance with legal, regulatory, and law-enforcement obligations in applicable jurisdictions	Legal obligation	As required by the relevant authority

Your personal data will not be processed for any purpose other than those stated above without a further lawful basis or fresh consent, as applicable.

We will send you marketing and promotional communications about the F2P Platform, only if you give your separate and specific consent below. Marketing consent is not a condition of account creation or use of the F2P Platform. You may withdraw your consent at any time as described in the Withdrawal of Consent section.

Recipients and Categories of Recipients

We may disclose your personal data, on an appropriate lawful basis and subject to appropriate safeguards, to the following categories of recipients:

CoinPoker group entities and their authorised personnel;
third-party service providers acting as processors under written data processing agreements and standard terms of service;
professional advisers, auditors, and consultants;
competent regulatory authorities, law enforcement agencies, and courts in applicable jurisdictions, where required to comply with a lawful request; and
potential or actual purchasers, investors, or successors in the context of a corporate transaction, subject to equivalent data-protection obligations.

International Transfers of Personal Data

Where personal data is transferred outside your country of residence to our group entities or processors, we take steps to ensure that such transfers are carried out in accordance with applicable data protection law and that appropriate safeguards are applied. You may request further information about the safeguards applicable to any specific transfer by writing to us at [email protected].

Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required or permitted under applicable data protection law. The applicable retention period depends on the category of data and the purpose of processing, including:

account data: retained for the duration of your account and for a reasonable period following closure to handle any post-closure queries or legal claims;
gameplay and Reward Point data: retained during the operation of your account and for a reasonable period thereafter, or longer where required for fair-play investigations or legal claims;
analytics and attribution data: retained in accordance with the retention settings of our analytics and attribution providers;
marketing consent records: retained for as long as your consent is active and for a reasonable period thereafter as proof of consent; and
data required for legal claims: retained until the expiry of the applicable limitation period.

Once no longer required, personal data is securely deleted or irreversibly anonymised.

Your Rights as a Data Subject

Subject to the conditions and exceptions under Applicable Laws, you have the following rights in relation to your personal data:

Right of access – to obtain confirmation of, and access to, the personal data we hold about you;
Right to rectification – to have inaccurate or incomplete personal data corrected;
Right to erasure – to have your personal data deleted in certain circumstances;
Right to restriction of processing – to restrict processing in certain circumstances;
Right to data portability – to receive your personal data in a structured, commonly used, machine-readable format;
Right to object – to object to processing based on our legitimate interests and, at any time, to processing for direct marketing;
Right to withdraw consent – to withdraw any consent at any time without affecting the lawfulness of processing before withdrawal;
Rights regarding automated decision-making – not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and
Right to lodge a complaint – with the supervisory authority in your jurisdiction (see below).

To exercise any of these rights, contact us at [email protected] or our DPO, Anthony Debono, at [email protected]. We will respond within one (1) month of receipt, extendable by two (2) further months for complex or numerous requests. An in-app account-deletion flow is available for self-service erasure requests.

Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with the supervisory authority in your country of residence or place of the alleged infringement:

If you are located in the EEA: the supervisory authority in your EEA country of residence.
If you are located in the UK: the Information Commissioner’s Office (ICO) at www.ico.org.uk.
If you are located in another jurisdiction: the applicable local supervisory authority or consumer-protection body.

Whether Provision of Data is Mandatory

Provision of your email address and password is a contractual requirement necessary to create and maintain your account and use the F2P Platform. If you do not provide these, we will be unable to register you.

All other processing, including analytics and attribution, is carried out on the basis of our legitimate interests as described in the Purposes of Processing section. Marketing communications are entirely optional and based solely on your consent. You may use the F2P Platform without giving marketing consent.

Automated Decision-Making and Profiling

We use automated tools and profiling for security monitoring, fraud prevention, anti-cheat, and anti-collusion detection across the Platform. In some cases, these tools may result in decisions taken without human involvement. For example, the automated restriction, suspension, or termination of an Account where our systems detect suspected cheating, collusion, use of prohibited third-party software, multi-accounting, or fraudulent activity. Where such a decision produces legal or similarly significant effects on you, you have the right to obtain human review of the decision, to express your point of view, and to contest the decision by writing to us at [email protected].

You may withdraw your marketing consent given below at any time, with effect from the date of withdrawal, by: (a) using your in-app settings; or (b) writing to us at [email protected].

Upon withdrawal:

we will stop sending you marketing communications;
the lawfulness of any processing carried out before withdrawal is not affected; and
your ability to use the F2P Platform is not affected by withdrawal of marketing consent.

Declaration, Age Affirmation, and Consent

By ticking the checkboxes below you confirm each of the following. Each confirmation is independent.

Age Affirmation — Required

☐ I confirm that I am at least 18 years of age (or the higher minimum age required in my jurisdiction of residence) and that I am legally permitted to use the CoinPoker Free-to-Play Platform in my jurisdiction.

Acceptance of Platform Policies — Required

☐ I have read and understood this Privacy Notice and Consent Form and the CoinPoker Free-to-Play Privacy Policy and Terms and Conditions. I understand that processing based on contract performance or legitimate interests does not require my consent, and that my marketing consent above, if given, is entirely optional and separately recorded.

Marketing Communications — Optional

☐ I consent to receiving marketing and promotional communications by email.

Date: DD/MM/YYYY
Username / User ID: User identifier
Country of residence: Country

Privacy Notice & Consent Form