Privacy Policy

General Provisions

As a data controller, we have a legal obligation under the requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and the Personal Data Protection Act to collect and process the personal data of all participants who visit our website and use the services we provide. The purpose of this Privacy Policy is to explain what personal data we collect, why we collect it, and how we use it.

By visiting the website and/or registering a user account at www.elitbet.bg, you declare that you are familiar with our Privacy Policy and agree that we may process the personal data you provide for the purposes and in the manner specified herein.

Data Controller Details

Elitbet.bg is owned and operated by “Stel Bet” Ltd., a company registered under the laws of the Republic of Bulgaria, with its registered office and management address at 10 Vrabcha St., Floor 5, Oborishte District, Sofia, Bulgaria.

If you have any questions regarding this Privacy Policy or the protection of your data, please do not hesitate to contact the Data Protection Officer at [email protected]

Legal Basis for the Collection and Processing of Personal Data

We collect and process your personal data on the following legal grounds:

• consent to the processing of personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject and the controller are parties, or in order to take steps prior to entering into a contract;
• processing is necessary for compliance with a legal obligation applicable to the controller;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• processing is necessary in order to protect the vital interests of the data subject or another natural person.

Personal Data We Collect and Process

The personal information that we may request, use and process includes:

4.1 Data collected through the registration form when opening a user account:

• first and last name;
• date of birth;
• Bulgarian Personal Identification Number (EGN) / Foreigner Personal Number (LNCh);
• citizenship;
• place of residence;
• email address;
• confirmation that you are over 18 years of age;
• username;
• IP address;
• mobile phone number;

4.2 Correspondence with us through the Website, email, web chat or other means of communication;

4.3 The complete transaction history in the Player Account;

4.4 Website logins and their details, including traffic data, GeoIP location data, browser/device data, web logs, activity logs and other traffic information recorded in our system;

4.5 Documents and evidence requested by us for user account verification, processing deposits or withdrawals, and checks carried out for the prevention of money laundering and terrorist financing (on our own initiative or as required by applicable law);

4.6 Data concerning politically exposed persons and persons related to them, in accordance with the Measures Against Money Laundering Act.

4.7 When betting in real time on the Website, in accordance with the requirements of the Gambling Act, we are required to collect the following information:

• username / identification number data;
• IP address;
• activity data – start and end time of the session; total amount wagered; total amount wagered on which winnings were accumulated during the session; total amount deposited into or withdrawn from the gaming account; date, time and duration of the participant’s gaming session;
• general user account information – gaming account information and balance; deactivated gaming accounts and the reason for their deactivation; games played or status of games in progress, bets placed and winnings;

In addition, in compliance with legal requirements, we are required to retain and provide you with information regarding: gaming account balance; betting history (bets placed and winnings paid); deposits, withdrawals and related transactions; and a record of at least the last 10 IP addresses from which the participant accessed the central computer system (CCS), for a period of no less than 60 days. This information is available in your account.

4.8 When depositing and withdrawing funds from the user account by bank card, we collect the following information:

• cardholder’s first and last name as shown on the card;
• credit card number;
• credit card expiry date;
• CVV code;

4.9 Telephone Calls

Telephone calls to and from our customer contact centre are recorded for training and security purposes, as well as for resolving any enquiries arising from the service you receive.

Purposes for Which We Collect and Process Personal Data:

• for registration on our Website;
• identification and verification of a participant;
• accepting bets or paying out winnings;
• providing bonuses;
• analysis and statistics;
• compliance with legal obligations;
• improving the quality of the services provided, resolving disputes and protecting legitimate interests.
• processing your requests, enquiries, complaints and reports.

Sharing of Personal Data

Personal data may be disclosed to third parties in fulfilment of statutory requirements and obligations to public authorities, in particular the National Revenue Agency, which is the state authority responsible for supervision of gambling activities, as well as other competent public authorities such as the State Agency for National Security. These authorities are entitled to receive information concerning registered users, bets placed, winnings paid and other data in the cases and form prescribed by law. Other recipients of personal data may include our trusted business partners, suppliers of goods and services, banks and payment institutions for carrying out money transfers, as well as persons providing technical support for our platform.

Personal Data Retention Period

We will not retain your personal data for longer than is necessary to achieve the purposes for which we process it. When determining the appropriate retention period, we take into account the amount and nature of the personal data, the purposes for which we process it, and whether we can achieve those purposes by other means. We must also comply with the applicable legal requirements for retaining certain categories of data in order to fulfil our obligations arising from law or contract.

Under the Gambling Act, we are required to apply the following retention periods:

• all data concerning the registration and identification of participants, bets placed and winnings paid shall be stored on the local control server of “Stel Bet” Ltd. in the form in which they were created for a period of 5 years after the expiry of the limitation period for public liabilities related to such data;
• data related to the geographical location of the IP address and the identification of the date, time and duration of the gaming session of a person registered as a participant in a game on the organiser’s website shall be retained for no less than 12 months from the date on which such data is collected and processed;
• 2 years from the date on which you contacted us by telephone, for data obtained during the telephone call.

Protection of Personal Data

We have implemented appropriate technical measures to ensure the security of your personal data, including:

• Encrypting your data when it is stored or transferred to our servers;
• Restricting access to your data to our employees, contractors and agents who may use it for the purposes of processing;
• Protecting the network using industry-leading security providers;
• Secure server hosting with 24/7 monitoring and on-site security personnel;
• Our security team continuously monitors our systems and event logs to identify and manage threats.

What Rights Do You Have as a Data Subject?

Under the General Data Protection Regulation, the data subject (the natural person to whom the data relates) has the right to:

• Be informed (in relation to the processing of their personal data by the controller);
• Access their own personal data;
• Rectification (if the data is inaccurate);
• Erasure of personal data (the “right to be forgotten”);
• Restriction of processing by the controller or processor;
• Data portability between controllers;
• Object to the processing of their personal data;
• The data subject also has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them;
• The right to judicial or administrative remedy if the data subject’s rights have been infringed.

Any person may exercise their rights as a data subject by submitting a request electronically to the following email address: [email protected] or by post to: 10 Vrabcha St., Floor 5, Oborishte District, Sofia 1000, Bulgaria.

The request must contain information identifying the applicant: full name and EGN, as well as contact details for correspondence – address, telephone number and email address.

We will respond to each request within thirty days of receiving it. If we are unable to respond within this period, we will notify you in a timely manner and state the reasons for the delay.

Please note that, as a company operating in accordance with the Personal Data Protection Act and the Measures Against Money Laundering Act, we are required to retain certain customer data and, accordingly, we are entitled to refuse requests insofar as they concern such data.

If your rights under the applicable personal data protection legislation have been infringed, you may lodge a complaint with the Commission for Personal Data Protection at: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; telephone: 02 915 3518; email: [email protected], [email protected]; website: www.cpdp.bg