Take the time to read our Privacy Notice in order to learn how we handle your personal data
A few words about us
Our company, with name “OPAP S.A.”, having its seat at 112 Athinon Ave., Athens (hereinafter “OPAP S.A.”), is according to the applicable legislation, responsible for processing your personal data within the framework of the provision of games of chance services online (hereinafter the “Games of Chance”) and specifically through OPAP S.A’s Online Points with the use of mobile or non-mobile devices as well as any other mean that could be raised by modern technologies in the future.
The protection of your personal data is very important to us. OPAP S.A. has taken all adequate technical and organizational measures for the protection of your personal data, collected through its Online Points, against any unauthorized access, processing, loss, or erasure.
The present Privacy Notice aims at informing you on the type of personal data that we collect about you, on the way and the purposes for which we collect your data, on the third parties with which we share such the data, as well as on your rights, in order for OPAP S.A. to comply with the applicable Greek Law on Data Protection, L. 4624/2019, as well as with EU Regulation 2016/679 “on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (GDPR).
Categories of personal data that we process
OPAP S.A. processes your personal data through your browsing in OPAP S.A’s Online Points as well as through your registration to the services provided through Online Points and your participation in the Games offered through them. In particular:
- Identity verification details, such as: full name, date of birth, home address, ID or passport number, as well as other information contained in the documents you will be asked for (such as a utility bill).
- Contact details, such as: email address, mobile phone number.
- Ιnformation regarding the transactions of the Player Account, such as: balance, deposits, withdrawals, payment methods information (e.g. IBAN, cards) used by the player for the deposit of the amount for his/her participation or withdrawal of winnings.
- Information relevant to your playing behavior, your browsing in the websites through which Games of Chance services are offered and your use of Mobile Apps, such as: websites preferences, software bug reports, geolocation data, information collected via cookies/trackers, date and time of connection, IP addresses.
- Other information that may contain personal data, such as: complaints or remarks regarding the services provided, for which a file of recorded phone calls with our Call Center and a file of written communication (email, chat sessions) is retained.
Why we collect personal data
The information above and the personal data collected by OPAP S.A. regarding its Players and/or third parties will be saved in OPAP S.A.’s databases and servers, always in accordance with the provisions of the applicable legislation and, especially, with those provisions on the confidentiality of communications and on the protection of individuals against the processing of personal data.
The legal basis, as well as the purposes of processing are the following:
- Processing that is necessary for the performance of the terms of our contractual relationship and for the provision of the Games of Chance services to you. Within this context, we process your data for the following purposes:
- To create, operate and manage each Player’s Account, in accordance with the terms of the Agreement of Accession.
- To manage bets and participations to other Games of Chance and process transactions effected through OPAP S.A.’s Online Points, including payments.
- For supporting tasks such as user confirmation, debugging, security of online contact points and providing support services to Players.
- For the provision of evidence as to the transactions effected, by processing recorded oral or written (in soft and/or hard copy) communication
ii. Processing necessary for the compliance with our legal obligations. Within this context, we process your data for the following purposes:
- For the compliance of OPAP S.A. with the current legislative and regulatory framework applicable to the online gaming market in Greece, such as, in particular, the exclusion of access to the games for persons under 21 years of age, the matching of players with actual natural persons, the provision of data to the player upon request, the cross-checking of tax obligations arising from winnings and the issuance of winnings certificate.
- To comply with the provisions related to Responsible Gaming. For the purpose of complying with the obligations relating to responsible gambling and in particular to intervene in a timely manner and inform players about the risks of participating in gaming, we process the gaming behaviour and the information you provide when you communicate with us, using automated means and artificial intelligence applications, in order to create a player profile. Based on each player's profile, appropriate communication, and protection measures from excessive participation in the games, are determined.
- To conduct the necessary security controls, for the verification of the payment methods or/and withdrawal of winnings, identity verification and age confirmation of the Customers, by checking their identification documents and by using their contact details, in order to ascertain that they indeed belong to you.
- To monitor the transactions, aiming at deterring or verifying cases of fraud, irregular betting, money laundering, for sports integrity matters etc.. Please note that in the context of investigating cases of fraud, or money laundering from illegal activities, your data is exchanged with other companies of the Group, in accordance with the provisions of the current regulatory framework governing the Online gaming market (Articles 4 and 5 of Regulation 554/5/15.04.2021).
- To mitigate the risks of money laundering, fraud and terrorist financing, as specifically set out in the relevant regulatory framework. In particular, through the processing of the personal data referred to in the previous section, their cross-checking with lists of sanctioned persons and the application of appropriately adapted control mechanisms, OPAP aims to identify unusual and/or suspicious activities and to take the necessary management actions as soon as possible.
iii. Processing necessary for the purposes of our legitimate interests, in particular:
- For the improvement and the business development of the Games of Chance services provided through the Online Points, by using aggregated statistics of the Online Points use. In addition, for the optimum service of OPAP S.A.’s Customers, especially by recognizing the Player when he/she calls the call center, so that he/she is prioritized in terms of service, and so that the agent attending to him/her has the details of his/her online account readily available. For these specific internal operations, a player’s profile is created (segmentation based on player’s behavior data) via automated processing, without resulting to any significant insight for the player.
- For the conduction of customer satisfaction surveys that will provide us with insights, regarding your experience as player, which will allow us to improve our services.
- Specifically, the mobile telephone number provided by the Player will also be used for his/her immediate information in case of detection of transactions from his/her online account that raise reasonable suspicions of unauthorized use or fraud, without these meaning that OPAP S.A. undertakes the obligation to detect any unauthorized use or suspicious transaction.
- Sharing your Online account information with other companies of the OPAP Group, in order to be able to detect more effectively suspicious transactions and activities and to prevent fraud and deception of the Company.
iv. Processing based on your specific consent, which is provided by selecting the relevant field upon your registration or afterwards. If you wish so, the company will process your personal data for the purposes below:
- To understand your preferences through your playing behavior in order to send you personalised promotional communications with offers that match with your preferences Bonus / Free bets according to your playing behavior, to inform you about points you have collected through your participation in loyalty programs, as well as, about rewards/gifts you may be qualified for/deserve. As part of this personalised commercial communication, a player profile is created based on all the data of your playing behaviour, with automated processing, but without producing (legal) effects that significantly affect you.
- In order for OPAP Group Companies to send you general promotional communication such as advertising messages, newsletters and promotional messages for the Companies and their services provided. Specifically, in case you select the relevant tick box, you will receive communication from OPAP Group Companies that provide games of chance (OPAP S.A., HELLENIC LOTTERIES S.A., HORSE RACES S.A.) and the rest Group Companies (Tora Wallet S.A., Tora Direct S.A).
- The channels that we will use for the abovementioned communication will be the ones you select when providing your consent (Notification via browser or mobile device (web/push notifications), e-mail, SMS, Viber/Whatsapp, phone call, social media in which your profile is identified on the basis of your email address or mobile phone number).If you provide your consent to the use of technologies such as cookies/trackers on your device via the specific cookie banner on the OPAP Group website you visit or the relevant mobile application, information about you is automatically collected, in order for OPAP Group Companies to offer you personalized navigation, for the analysis of our traffic, as well as for commercial use by us and our partners. OPAP may process the data collected through cookies/trackers (e.g., Device ID) in combination with your other player data to formulate personalized communication to you.
In any case, you hold the right to revoke the aforementioned specific consent to the processing of your personal data for the entire or particular purposes at any given moment via the “Settings” section at your online account or by selecting the relevant link to stop message delivery, which is included in the promotional messages you receive or through the specific field for withdrawal of consent for the installation of cookies/trackers, that you will find at the bottom of the Cookies Policy of the OPAP Group website you visit, or in the Privacy Settings from the menu of the respective mobile application of the Group. In such case, the company will stop any processing that is based on your consent, without this affecting the lawfulness of the processing that was based on your consent prior to its withdrawal or of the processing described under points i to iii.
Respectively, you may change at any given moment, via the ‘Settings” section at your online account, your selections regarding the channels that we will use for our commercial / promotional communication.
The processing of your personal data, within the context of the provision of Games of Chance services, will be carried out by the duly authorized, competent employees of OPAP S.A. Recipients of the personal data are third parties involved in payment procedures or receipt of winnings from you (financial institutions or payment services providers) for the purpose of concluding transactions or/and for the purpose of player’s and payment methods’ verification, also external partners acting on our behalf (Data Processors), such as Call Center services providers, IT systems providers, through which Games of Chance services are provided, supported and commercially promoted, OPAP S.A. agents to the extent that this is necessary for your optimum service and for the provision of our services. Recipients of your personal data are also other OPAP Group companies, for the purpose of investigating cases of fraud, or money laundering, in accordance with the provisions of the applicable anti-money laundering legislation.
Your data is also being processed by providers of technology solutions such as cookies/trackers, which support the operation of these tools, for purposes of secure browsing, storing of display preferences, traffic analysis, measuring referrals from partners, displaying personalized notifications, and commercial use by us and our partners. For more information about the name of the respective providers and the relevant purposes, please consult the Cookies Policy (websites) or Trackers Policy (mobile applications) of the respective Online Point.
Your personal data may be transferred outside of the EU, from these providers, and especially in U.S.A., the United Kingdom and Israel, despite the fact that the relevant data storage takes place mainly inside EU and that measures are applied for such transfer, such as, strict contractual clauses. Please note that both the UK and Israel are considered adequately safe countries for the transfer of your data.
Our company undertakes that its partners are under the control and act only following its orders, that they have been specifically authorized for this purpose and that they are fully bound by confidentiality and by the obligations set forth in the legislation on the collection and processing of the aforementioned data.
Moreover, specifically in the context of the Facebook Business Tools, we operate as Joint Controllers along with Meta Platforms Ireland Ltd, according to our data sharing agreement, which sets -among others- our responsibilities for compliance with the obligations under the GDPR with regard to the Joint Processing. Meta Ireland is responsible for enabling Data Subjects’ rights under Articles 15-20 of the GDPR, with regard to the Personal Data stored by Meta Ireland after the Joint Processing. You can find more information in Meta Ireland’s data policy.
Finally, we shall inform you that our company may disclose your data to the competent administrative or judicial authorities, insofar as this is imposed by the applicable legislative and regulatory framework, following relevant request or when it ought or has the right to submit a report with the said data.
Your personal data that refer to your identity verification, as well as the information referring to the transactions effected through Online Points (including mailing history) will be retained for ten (10) years as of their registration and, in any case, for five (5) years as of the end of the customer relationship. Regarding the retention period of data collected through cookies, you may refer to the detailed retention periods as described in the Cookies Policy of each Online Point you browse.
In accordance with applicable legislation you have and you can exercise the following rights:
- right to access your personal data, as well as the information related to their processing;
- right to correct inaccurate or incomplete personal data of yours;
- right to erasure;
- right to restrict the processing of your personal data, when explicitly provisioned by the legislation;
- right to data portability in a structured, commonly used and machine-readable format (e.g. USB);
- right to have your data (directly) transmitted to a different controller;
- right to object to the processing of your personal data, which is founded on our legitimate interest; as well as
- the right to withdraw any consent you may have given at any time and at no cost.
You may exercise any of the aforementioned rights by submitting a written request to the Company. The relevant request/ application shall include supporting documents verifying your identity.
You may expect a reply to such a request within one (1) month following its receipt by the Company. This period may be extended by two (2) additional months, if the complexity of your request or the overall number of requests received requires so.
In case that you exercise the rights to correction, deletion and limitation of your data, these requests will be forwarded as well to the third parties/recipients, to which this data was disclosed within the framework of provision of Games of Chance services.
Finally, you shall promptly notify OPAP S.A. of any change to the information that you provided upon registering and opening of your online account.
Our services are not addressed to persons below twenty-one (21) years of age and as result, we do not process any personal data of minors. Any person that provides his/her details to us through any of our services, warrants that he/she is above twenty-one (21) years of age.
We do not take on any obligation or liability for the practices, actions or policies that are beyond our control.
The present Privacy Notice may be amended. We will make sure to inform you on any significant amendment but, in any case, we invite you to visit OPAP S.A’s Online Points regularly, where the updated Privacy Notice will be posted.
We commit to maintain your data updated and accurate, to store and delete them securely, to not collect and maintain data that are not necessary for us, to protect your data against loss, misuse, unauthorized access or disclosure, and in general, to reassure that all adequate technical and organizational measures for their protection, are in place.
For any request regarding the processing of your data, within the framework of provision of Games of Chance services through Online Points of OPAP S.A., as well as in case you ascertain that we have not complied with the principles contained in the present Privacy Notice, we kindly ask you to address, the soonest possible, to OPAP S.A.’s Personal Data Protection Officer using the following contact details: Website: www.opap.gr/gdpr | Postal Address: L. Athinon 112, 10442, Athens | Call Center: +30 210 5798888 |Email address firstname.lastname@example.org.
In case you consider that we have not properly addressed your complaint and the protection of your personal data is violated in any way, you may lodge a complaint through the special online platform of the Hellenic Data Protection Authority (Website: www.dpa.gr | Address: 1-3 Kifisias Ave., 115 23, Athens | Call Center: +30 210 6475600 | Fax: +30 210 6475628). Detailed instructions for submitting a complaint are provided on the website of the Authority.