OlySafe Privacy Notice

Valid from: 24-04-2026

1. GENERAL PROVISIONS

1.1 This notice explains the processing of personal data on the website olysafe.com, which provides information on responsible gaming, and the rights of the website visitor in relation to the processing of personal data.

1.2 The data controller is OB Holding 1 OÜ (hereinafter OBH) with registry code 14975047, address Pronksi 19, Tallinn 10124, Estonia, +3726671250, estonia@oc.eu.

1.3 The contact details of the Data Protection Officer of OBH are: OlybetEstoniaDPO@olybet.com, Pronksi 19, Tallinn 10124.

1.4 OBH implements appropriate technical and organisational measures to protect personal data from unauthorised access, unlawful disclosure, accidental loss, alteration, destruction or other unlawful processing. We also require our cooperation partners, to whom we transfer personal data in accordance with this Privacy Notice, to implement the necessary organisational, physical and IT security measures. However, please note that even by using all technical and organisational measures to protect personal data, some risks, such as human error, cyber-attack, loss of electricity, software error or malicious actions of an individual, still remain. Upon discovering such breach, we shall take all reasonable steps to mitigate the risk to our visitors.

1.5 If OBH amends the notice on the processing of personal data, it will publish the updated version on its website footer under Privacy Notice. Depending on the content and effect of the amendment, we may or may not notify the website visitor of the amendment. If we materially change our data processing practices, especially when introducing new processing activities or technologies, then we shall provide a reasonable advance notice.

2. WEBSITE VISITOR’S RIGHTS

2.1 OBH guarantees the website visitor all the rights prescribed by the General Data Protection Regulation (GDPR). To exercise the rights under section 2.2, the website visitor can contact the Data Protection Officer listed in section 1.3, by transmitting his/her IP address to OBH.

2.2 Data subject rights guaranteed under the GDPR:

2.2.1 the website visitor has the right to be informed on whether OBH processes their personal data and, if so, to receive a copy of the aforementioned data;

2.2.2 the website visitor has the right to request the rectification of inaccurate personal data concerning them;

2.2.3 the website visitor has the right to withdraw their consent to the processing of personal data (e.g. consent to the use of cookies) at any time if the processing is based on consent. The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal;

2.2.4 the website visitor has the right to demand the erasure of their personal data. OBH may delete data processed on the basis of consent or legitimate interest, if OBH’s interests do not outweigh the interests of the visitor. The right to erasure does not apply to data that is processed for the fulfilment of public interest, or legal or contractual obligation, as long as that public interest or legal or contractual obligation is valid;

2.2.5 the website visitor has the right to object to the processing of their personal data (especially based on legitimate interest) and to restrict the processing of their personal data where justified;

2.2.6 the website visitor has the right to receive their personal data, which they have submitted on the basis of consent, in a structured and machine-readable format (if technically feasible) for transmission to other companies;

2.2.7 the website visitor has the right to lodge a complaint about the processing of personal data with the Data Protection Inspectorate of the Republic of Estonia by sending it by e-mail to the address info@aki.ee or on site at Tatari 39, Tallinn.

3. CATEGORIES OF PERSONAL DATA

3.1 OBH processes the following personal data to a limited extent when visitor visits the website:

3.1.1 technical data of the website: IP address (including approximate location derived from IP address, e.g. country), internet service provider, referrer URL, date and time of visit, type and version of web browser used, operating system, device type, amount and status of data transmitted. Source: Visitor’s device and web browser

3.1.2 cookie data: OBH uses cookies on the website to optimize the website and its functions. Some web cookies may collect personal data. For more information, please refer to OBH Cookie Notice.

Source: Visitor’s device and web browser

4. LEGAL BASIS AND PURPOSES

4.1 The legal bases and purposes for processing the website visitor’s personal data are listed in the table below:

4.2 Where OBH processes personal data on the basis of legitimate interest, OBH has assessed that its legitimate interest in processing personal data for certain purposes outweighs the interests and rights of the visitor.

5. TRANSMISSION OF PERSONAL DATA

5.1 OBH uses various partners as personal data processors, who process data based on and to the extent of the instructions given by OBH. The partners may be both companies which are part of the OBH group, or third parties with whom OBH has entered into appropriate agreements for data processing.

5.2 The personal data of website visitors may be transferred to the following categories of recipients of OBH:

5.2.1 to providers of website analytics services (e.g. Google Analytics) if the visitor has given their consent;

5.2.2 service providers related to the cookie consent management and the technical operation of the website;

5.2.3 to providers of web hosting and IT services, insofar as it is necessary to ensure the functioning, security and prevention of misuse of the website;

5.2.4 to OBH group companies to the extent necessary for the operation, administration and supervision of the website and in accordance with this document.

5.3 Generally, OBH’s cooperation partners are located in Estonia or the European Economic Area. If OBH’s cooperation partner processing personal data is located outside the European Economic Area, the safeguards used for the transmission of personal data are: an adequate level of data protection in the recipient country in accordance with the European Commission’s decision or the use of standard contractual sections for data protection developed by the European Commission in the cooperation agreement.

6. PERSONAL DATA RETENTION

6.1 The personal data of website visitors is stored only for as long as it is necessary to achieve the purposes described in this document.

6.2 IP addresses and other technical log data of the website are processed for the purpose of the technical operation and security of the website and are stored for a limited period of time in accordance with the standard practice of storing technical logs.

6.3 The retention periods for the data collected through cookies are as follows:

6.3.1 analytics cookie data (e.g. Google Analytics) is stored for up to 2 years;

6.3.2 data related to the cookie consent management (Cookie Consent) is stored for up to 1 year;

6.3.3 functional and preference cookies (including language selection) are stored for the duration of the session or according to their technical functioning.