Privacy Policy
1. Introduction
Gameshop Limited and its’ subsidiaries including Gameshop Malta Limited, Gameshop Americas Limited, Gameshop Software Limited and Dreamshot EOOD (hereinafter referred to as “the Company”, “us”, “Octoplay Group”, “Octoplay” or “we”), is a Business-to-Business (B2B) online slot game supplier, incorporated under the laws of Malta, registered in the Malta Business Registry, and a member of the EU.
2. Overview
Octoplay values your privacy and is committed to safeguarding the personal data of our website visitors. This Privacy Policy explains how we collect, use, protect, disclose and process your personal data when you use our website or apply for a vacant position. It also explains your rights under the General Data Protection Regulation (EU) 2016/679 and applicable Maltese data protection legislation — including your right to manage your information preferences and opt out of certain processing.
Due to the size and nature of our operations, we are not required to appoint a Data Protection Officer; instead, our Board of Directors have designated a member of management to handle data protection matters, also referred to as our Data Protection Lead. If you have any requests concerning your personal information, or any queries regarding these practices, please contact us at legal@octoplay.com.
3. What Personal Data Do We Collect and How do we use it?
We collect:
Business contact details of representatives of our partners and prospects (name, job title, email, phone number, company).
Correspondence and communications records.
Technical and usage data collected via our website (see our Cookie Policy).
KYC/due diligence information where required by regulatory obligations.
Under GDPR Article 4(1), "Personal Data" means any information relating to an identified or identifiable individual, including names, identification numbers, online identifiers, and factors specific to a person's physical, physiological, genetic, mental, economic, cultural or social identity.
4. Purpose and Legal Basic for Collecting and/ or Processing Personal Data
We Use Your Data:
to perform and manage our contracts with business partners (Art. 6(1)(b)).
to comply with regulatory, licensing, and AML/KYC obligations (Art. 6(1)(c))
for our legitimate interests in managing business relationships, security, and marketing our services (Art. 6(1)(f)).
Additionally, as you navigate our website — visiting pages, reading content, or downloading files — we record which pages are visited and what content is downloaded, measured only in aggregate and never on an individual basis.
When you email us, via legal@octoplay.com, or use the contact form on our website, we collect your email address and any information you choose to include.
CVs submitted through job applications are used for recruitment purposes.
5. Do We Share Your Personal Data?
We may share your Personal Data or information about you with other parties for Octoplay’s business purposes or as permitted or required by law, including:
if we need to do so to comply with a law, legal process or regulations;
to law enforcement authorities or other government officials, or other third parties pursuant to a subpoena, a court order or other legal process or
requirement applicable to Octoplay;
if we believe, in our sole discretion, that the disclosure of Personal Data is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity;
to protect the vital interests of a person
to protect our property, Services and legal rights;
to support our audit, compliance, and corporate governance functions.
We may disclose some Personal Information between two or more of our group companies; including companies in other countries, inside the European Union, in order to ensure that we are dedicating the appropriate group resources to Customer requirements, as well as for certain of our business purposes, such as for internal record keeping, accounting and regulatory compliance.
6. International Transfers of Personal Data
As part of the Octoplay Group, we may transfer your Personal Data to, and process it in, other jurisdictions outside of Malta and the European Economic Area (EEA), including to Gameshop Americas Limited and other group entities. Some of these jurisdictions may not have been assessed by the European Commission as providing an adequate level of data protection.
Where we make such transfers, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs), an applicable adequacy decision, or another lawful transfer mechanism recognised under Article 46 GDPR. You may contact us using the details in this Policy to obtain further information on the safeguards we have put in place for a specific transfer.
7. Why Do We Retain Personal Data?
We retain Personal Data in an identifiable format for the least amount of time necessary to fulfil our legal or regulatory obligations and for our business purposes, in line with our internal Data Retention Policy.
We may retain Personal Data for longer periods than required by law if it is in our legitimate business interests and not prohibited by law.
8. What Are Your Rights?
Your principal rights under GDPR are:
the right to access - You have the right to confirmation as to whether or not we process your Personal Data and, where we do, access to the Personal Data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of Personal Data concerned and the recipients of the Personal Data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data.
the right to rectification - You have the right to have any inaccurate Personal Data about you rectified and, taking into account the purposes of the processing, to have any incomplete Personal Data about you completed.
the right to erasure - In some circumstances you have the right to the erasure of your Personal Data without undue delay. Those circumstances include:
the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw consent to consent-based processing;
you object to the processing under certain rules of applicable data protection law;
the processing is for direct marketing purposes; and
the Personal Data have been unlawfully processed. However, there are exclusions of the right to erasure.
There are certain exceptions to the right to erasure, including where processing is necessary for the exercise of the right to freedom of expression and information, compliance with a legal obligation, or the establishment, exercise or defence of legal claims.
the right to restrict processing - In some circumstances you have the right to restrict the processing of your Personal Data, when:
you contest the accuracy of the Personal Data;
processing is unlawful but you oppose erasure;
we no longer need the Personal Data for the purposes of our processing, but you require Personal Data for the establishment, exercise or defense of legal claims; and
you have objected to processing, pending the verification of that objection.
the right to object to processing - You have the right to object to our processing of your personal data, but only to the extent that the legal basis for the processing is that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the Personal Information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
the right to data portability – In that context you have the right to receive the Personal Data you have provided to us in a structured, commonly used and machine readable format. It also gives you the right to request that we transmit this data directly to another controller. The right to data portability only applies when:
our lawful basis for processing this information is consent or for the performance of a contract; and
if we are carrying out the processing by automated means (excluding paper files).
the right to complain to a supervisory authority - If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
the right to withdraw consent - You have the right to withdraw consent at any time.
To exercise these rights, contact us using the details above.
9. Can Children Use Our Services?
Our website and services are directed at business partners, prospects and professionals in a Business-to-Business (B2B) context and are not intended for use by children. We do not knowingly collect Personal Data from anyone under the age of 18. If you believe a child has provided us with Personal Data without appropriate consent, please contact us using the details in this Policy so that we can take steps to remove that information.
10. Do We Process Special Categories of Personal Data?
As per Article 9 GDPR, "Special category data" includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, and data concerning health or sex life/sexual orientation.
Octoplay does not process any personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying an individual, data concerning health or data concerning an individual’s sex life or sexual orientation.
11. How Do We Protect Your Personal Data?
We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Data against loss, misuse, unauthorized access, disclosure, and alteration. The security measures include firewalls, data encryption, physical access controls to our data centres, and information access authorization controls.
We are not responsible for the security practices of third parties with whom Personal Data is shared as a result of an integration or account connection that you or your organisation has specifically authorized, except to the extent such sharing is governed by a separate data processing agreement between Octoplay and that third party.
12. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State at your habitual place of residence, place of work or place of the alleged breach, if you consider that the processing of your personal data infringes the provisions of the Regulation or other applicable personal data protection requirements.
The supervisory authority in Malta is the Office of the Information and Data Protection Commissioner, address: Floor 2, Airways House, Triq Il - Kbira, Tas-Sliema SLM 1549; Phone: 2328 7100; Website: https://idpc.org.mt/
13. Changes to the Policy
We may update this Policy from time to time in order to reflect any changes in the processing of your personal data or to comply with changes in current legislation.
14. Contact Us
You may contact us if you have general questions or concerns about this Privacy Policy or the way in which we handle your Personal Data.
If you want to execute any of your rights, as defined above, do not hesitate to contact us.
Our Designated Data Protection contact can be reached at legal@octoplay.com or at address: Level 5, Octoplay, CF Business Centre, Triq Gort, St. Julians, STJ 9023, Malta.
