Data Protection Policy

Last updated: 17 July 2026

Introduction

This Data Privacy Policy describes how Kupaline OÜ, the company providing the Playerly service, collects, uses, stores, and shares data in connection with the provision of the Service.

Playerly is intended for use by organizations and their authorized representatives. The Client independently determines which available categories of data to provide to Playerly based on the selected integration method, the required functionality of the Service, and the agreed technical requirements. The Client may choose not to provide data that is not required for the functionality selected by the Client; however, this may limit the availability or accuracy of certain Playerly features, reports, and analytics.

The Client independently controls the sources and categories of the data it provides and must have a lawful basis for its transfer and processing. Playerly processes the data it receives only for the purposes described in this Policy, the Terms of Use, the Data Processing Agreement, and any separate agreements between the parties.

Playerly does not require the transfer of personal data that directly identifies players, including their names, email addresses, telephone numbers, identification documents, payment information, or gaming account login credentials. The Client must not provide such data without the prior written approval of Kupaline OÜ.

This Policy applies to the following data:

organization name;
business email address;
telephone number;
website address;
date and time of acceptance of legal documents;
IP address;
browser and device information.

1. Roles of the Parties in Data Processing

Depending on the category of data, the Company acts in one of the following two roles.

The Company as a Data Controller. With respect to organization information, data relating to the Client’s representatives, account information, data relating to the acceptance of legal documents, and technical data recorded when the Service is used, the Company independently determines the purposes and means of processing and acts as a Controller within the meaning of applicable data protection law. Such processing is governed by this Policy.

The Company as a Data Processor. With respect to Client Data transferred through an integration, including pseudonymized identifiers, gaming events, gaming session information, and commercial performance data, the Company acts on behalf of the Client. The Client acts as the Controller of such data, and the processing is governed by the Data Processing Agreement, which forms part of the agreement between the parties.

If a Data Subject’s request relates to data processed by the Company on behalf of the Client, the Company will forward the request to the relevant Client and provide reasonable assistance in responding to it.

2. Information We Collect

The scope of the data collected depends on the integration method selected by the Client and the Playerly functionality used. The Client independently determines which data to provide, except for information required to create access to and ensure the operation of the Service.

Playerly may collect the following categories of data.

2.1. Organization Information

organization name;
business email address;
telephone number;
website address.

2.2. Client Representative Information

first and last name;
business email address;
position or role within the organization;
account information;
date and time of acceptance of legal documents.

2.3. Technical Information

When Playerly is used, the following technical information may be recorded automatically:

IP address;
browser type and version;
device type and operating system;
date and time of login;
actions performed within the account;
technical logs, error information, and requests made to the Service.

2.4. Data Provided Through an Integration

Depending on the Client’s settings, such data may include:

information about referrals and traffic sources;
technical and gaming events;
anonymous or pseudonymized identifiers;
information about gaming sessions;
betting, winnings, and gross gaming revenue data;
country, device, and other technical information;
other analytical data selected by the Client.

Playerly does not require personal data that directly identifies players, including names, email addresses, telephone numbers, identification documents, payment information, passwords, or gaming account login credentials. The Client must not provide such information without the Company’s prior written approval.

Certain technical or pseudonymized information may qualify as personal data under applicable law. In such cases, it will be processed in accordance with this Policy, the Data Processing Agreement, and applicable data protection laws.

3. How We Collect Information

Playerly may collect information in the following ways.

3.1. Directly From the Client and Its Representatives

We collect information provided by the Client or its representatives when they:

complete the organization’s details;
accept an invitation to Playerly;
create and use an account;
contact technical support;
communicate with the Company’s representatives;
arrange and configure an integration.

3.2. Through Integration With the Client’s Systems

Playerly receives technical, gaming, and analytical data that the Client chooses to provide through a configured integration.

The categories and scope of such data depend on:

the selected integration method;
the enabled functionality of the Service;
the settings selected by the Client;
the agreed technical requirements.

3.3. Automatically When the Service Is Used

When a person visits the website, follows an invitation link, or uses Playerly, certain technical information may be recorded automatically, including:

IP address;
date and time of actions;
browser, device, and operating system information;
login information and actions performed within the account;
technical logs, errors, and requests made to the Service.

3.4. From the Client’s Authorized Representatives

The Company may receive information about Users from administrators or other authorized representatives of the Client, including when an organization is created, invitations are sent, or access is managed.

The Company does not obtain information about players from public or independent third-party sources unless separately agreed with the Client.

4. Purposes of Processing

The Company collects and uses data only to the extent necessary for the following purposes.

4.1. Provision of the Service

creating and maintaining accounts;
providing access to Playerly;
configuring and operating integrations;
processing technical and gaming events;
generating analytics and reports;
providing the functionality selected by the Client.

4.2. Communications With the Client

processing inquiries and requests;
providing technical support;
sending service-related notices;
notifying the Client of changes to the Service or legal documents.

4.3. Security

verifying the identity of Users;
preventing unauthorized access;
identifying technical failures, misuse, and suspicious activity;
investigating security incidents;
protecting the rights and legitimate interests of the Company, Clients, and third parties.

4.4. Maintenance and Improvement of the Service

monitoring the operation of Playerly;
identifying and resolving errors;
analyzing the use of the Service’s functionality;
improving the accuracy of analytics and the quality of Playerly;
developing and improving the Service’s functionality.

For these purposes, the Company may use aggregated and anonymized information that does not identify an individual User or player or disclose the Client’s Confidential Information.

4.5. Compliance With Legal Obligations

recording the acceptance of legal documents;
complying with applicable law;
handling claims and resolving disputes;
responding to lawful requests from courts and authorized public authorities;
exercising and protecting the Company’s legal rights.

The Company does not sell the data it collects and does not use Client Data to communicate directly with the Client’s players, solicit them, or circumvent the Client.

5. Legal Bases for Processing

The Company processes Personal Data for which it acts as a Controller on the following legal bases under applicable data protection law, including Article 6(1) of the General Data Protection Regulation:

Performance of a contract or steps taken at the request of the Data Subject before entering into a contract — Article 6(1)(b) of the GDPR:

creating and maintaining accounts;
providing access to the Service and its functionality;
configuring and operating integrations;
providing technical support and responding to inquiries.

The Company’s legitimate interests — Article 6(1)(f) of the GDPR:

ensuring the security of the Service, data, and accounts;
recording the fact, date, and time of acceptance of legal documents, together with related technical information, including IP address, browser information, and device information, to provide evidence of legally significant actions;
maintaining, analyzing, and improving the Service;
sending service-related notices;
establishing, exercising, and defending legal claims.

When processing Personal Data on the basis of legitimate interests, the Company considers the balance between its interests and the rights and freedoms of Data Subjects.

Compliance with a legal obligation — Article 6(1)(c) of the GDPR:

maintaining accounting records and complying with tax obligations;
responding to lawful requests from courts and authorized public authorities;
complying with other requirements of applicable law.

Consent — Article 6(1)(a) of the GDPR:

using optional cookies and similar technologies where consent is required by applicable law;
other circumstances in which the Company separately requests consent.

Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Parties With Whom We Share Information

The Company does not sell Client Data or disclose it to third parties for their independent advertising or commercial purposes.

The Company may share data with the following categories of recipients.

6.1. Technical Service Providers and Contractors

Data may be shared with service providers that assist in the operation of Playerly, including providers of:

cloud infrastructure and data hosting;
technical maintenance and monitoring;
communications and service notifications;
information security;
technical support.

Such recipients receive access only to the data necessary to perform their respective functions and are required to maintain its confidentiality and security. The list of Sub-processors engaged to process Client Data on the Client’s behalf is set out in the Data Processing Agreement.

6.2. Professional Advisers

The Company may share necessary data with legal, financial, audit, and other professional advisers where required to conduct its business, comply with applicable law, or protect the Company’s legitimate interests.

6.3. Public Authorities

The Company may disclose data to a court, law enforcement agency, or other authorized public authority where such disclosure is required by applicable law or a valid and binding request.

Where reasonably possible, the Company will notify the Client of such a request and limit the disclosure to the minimum amount of data required.

6.4. Corporate Transactions

In connection with a reorganization, merger, acquisition, sale of the business, or transfer of Playerly to another legal entity, data may be disclosed or transferred to the parties involved in the relevant transaction and their advisers.

The Company will take reasonable measures to preserve the confidentiality of the data and ensure that it is used in accordance with this Policy.

6.5. Data Sharing at the Client’s Direction

The Client may independently determine which data should be shared through Playerly and with which third parties. In particular, the Client may provide selected data to traffic acquisition partners, advertising partners, contractors, or other authorized parties.

The Client independently determines:

the recipients of the data;
the categories and scope of the data shared;
the purposes for which the data is provided;
the duration and conditions of access.

The Company shares such data only at the Client’s direction and within the scope of the settings or permissions selected by the Client.

The Client confirms that it has a lawful basis and the necessary authority to share data with the selected third parties. The Client is also responsible for selecting such recipients and determining the scope of the data made available to them.

The Company is not responsible for the subsequent use of data by third parties selected by the Client, except where such use results from the Company’s failure to comply with the Client’s instructions or this Policy.

The Client may amend or withdraw its authorization. Termination of access does not affect processing lawfully carried out before such authorization was withdrawn.

7. International Data Transfers

The Company and its technical service providers may process data outside the country in which the Client or its representatives are located.

Where data is transferred to a country whose laws do not provide an adequate level of Personal Data protection, the Company applies safeguards required by applicable law. Such safeguards may include:

Standard Contractual Clauses approved by the European Commission;
contractual confidentiality and data protection obligations imposed on the recipient;
assessment of the recipient’s technical and organizational safeguards;
other lawful mechanisms for international data transfers.

Where data is transferred to a third party selected by the Client, the Client independently determines the recipient and confirms that it has a lawful basis for the transfer. The Company follows the Client’s instructions only within the available functionality of the Service and subject to applicable law.

The Client may contact the Company to request additional information about the countries in which data is processed and the safeguards applied.

8. Data Security

The Company implements reasonable technical and organizational measures designed to protect data against:

unauthorized access;
unlawful use or disclosure;
accidental alteration;
loss or destruction;
other security incidents.

Access to data is granted only to employees, contractors, and technical service providers who require such access to perform their duties. Such persons are required to comply with confidentiality obligations and use the data only for authorized purposes.

The Company periodically reviews its security measures, taking into account the nature of the data processed, available technologies, potential risks, and applicable legal requirements.

If the Company becomes aware of a security incident that may affect Client Data, the Company will take reasonable measures to:

determine the cause and circumstances of the incident;
limit its potential consequences;
restore data security and the operation of the Service;
prevent similar incidents from recurring;
notify the Client without undue delay where such notification is required by applicable law or justified by the nature of the incident.

Although the Company applies reasonable safeguards, no method of transmitting or storing data can guarantee absolute security. The Client is responsible for protecting its account credentials and must notify the Company without undue delay if it suspects unauthorized access to Playerly.

9. Data Storage and Retention

The Company retains data only for as long as necessary to fulfil the purposes described in this Policy, provide the Service, and comply with applicable legal requirements.

Retention periods are determined based on:

the nature and scope of the data;
the purposes of processing;
the duration of the relationship with the Client;
applicable legal requirements;
the need to resolve disputes and protect the parties’ legal rights;
the potential risks associated with continued retention.

Following termination of the relationship with the Client or fulfilment of the relevant processing purposes, the Company will delete or anonymize the data unless continued retention is necessary to comply with legal obligations, resolve disputes, or protect the Company’s legitimate interests.

Data may be stored:

in the Company’s systems;
on infrastructure operated by technical service providers;
in backups for a limited period determined by the Company’s internal data retention and recovery procedures.

Data may not be deleted from backups immediately and may remain until the relevant backup is overwritten or deleted in accordance with the applicable backup cycle. Until final deletion, such data will not be used for other purposes and will remain protected in accordance with this Policy.

The Client may submit a request for the deletion or return of data. The Company will consider such a request subject to technical feasibility, the terms governing the relationship with the Client, and applicable legal requirements.

10. Rights of Data Subjects

Depending on applicable law, an individual whose Personal Data is processed by the Company may have the right to:

receive information about the processing of their Personal Data;
request access to their Personal Data;
request the correction of inaccurate or incomplete data;
request the deletion of Personal Data;
request restriction of processing;
object to the processing of Personal Data;
withdraw previously given consent;
receive the data they provided in a structured, commonly used, and machine-readable format;
lodge a complaint with a competent data protection authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in the place of their habitual residence.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise their rights, an individual may submit a request to the Company using the email address provided in the “Contact Us” section. The Company may request additional information necessary to verify the requester’s identity and prevent unauthorized access to data.

The Company will respond to requests within the time limits and in accordance with the procedures established by applicable law. In certain circumstances, the exercise of these rights may be limited where continued storage or processing is necessary to comply with applicable law, perform an agreement, resolve disputes, or protect the legal rights of the Company or third parties.

If a request relates to data that the Company processes solely on behalf of a Client, the requester may need to contact the relevant Client directly. In such cases, the Company will provide reasonable assistance to the Client in responding to the request.

11. Changes to This Policy

The Company may amend this Policy from time to time, including in response to changes in applicable law, data processing practices, technologies used, or the functionality of the Service.

The current version of this Policy will be published on the Playerly website together with the date of the latest update.

Where material changes affect how data is collected, used, or shared, the Company will notify the Client before such changes take effect. Notice may be provided by email, through the Service, or by another reasonable method.

Continued use of the Service after the changes take effect means that the Client has reviewed the updated Policy. Where applicable law requires separate consent to a change, the Company will obtain such consent before commencing the relevant processing.

12. Contact Us

For communication and inquiries, the following email address is used: info@playerly.io