Valid from: 12.09.2024

1. General provisions

1.1. This notice explains the processing of website visitors’ personal data on the website and the rights in relation to the processing of personal data.
1.2. The data controller is OB Holding 1 OÜ (hereinafter OlyBOOST), registry code 14975047, address Pronksi 19, Tallinn 10124, Estonia, +3726671250, estonia@oc.eu.
1.3. The contact details of the Data Protection Officer of Olyboost.eu are the following: olybetestoniaDPO@olybet.com, Pronksi 19, Tallinn 10124.
1.4. OLYBET implements appropriate technical and organisational measures to protect personal data from unauthorised access, unlawful disclosure, accidental loss, alteration, destruction or other unlawful processing. We also require our cooperation partners, to whom we transfer personal data in accordance with this Privacy Notice, to implement the necessary organisational, physical and IT security measures. However, please note that even by using all technical and organisational measures to protect personal data, some risks, such as cyber-attack, loss of electricity, software error or malicious actions of an individual, still remain. Upon discovering such breach, we shall take all reasonable steps to mitigate and minimise the risk to our website visitors.
1.5. Provisions on the processing of personal data may also be included in contracts between the website visitor and OlyBet, such as the Terms and Conditions. In such a case, in the event of a conflict of provisions, the provisions agreed upon in the Terms and Conditions shall apply.
1.6. If OlyBet amends the notice on the processing of personal data, it will publish the updated version on its website www.olyboost.eu.

2. Website visitor rights in relation to the processing of their personal data

2.1. The website visitor has the right to be informed on whether OlyBOOST processes their personal data and, if so, to receive a copy of the aforementioned data.
2.2. The website visitor has the right to request the rectification of inaccurate personal data concerning them.
2.3. The website visitor has the right to withdraw their consent to the processing of personal data at any time (e.g. direct marketing consent), if the processing is based on consent. Withdrawal of consent does not affect the lawfulness of the processing which took place prior to the withdrawal.
2.4. The website visitor has the right to demand the erasure of their personal data. OlyBOOST may delete data processed on the basis of consent or legitimate interest, if OlyBOOST’ interests do not outweigh the interests of the website visitor. The right to erasure does not apply to data that is processed for the fulfilment of legal or contractual obligations, as long as the legal or contractual obligation is valid.
2.5. The website visitor has the right to object to the processing of their personal data (especially based on legitimate interest) and to restrict the processing of their personal data where justified.
2.6. The website visitor has the right to receive their personal data, which they have submitted on the basis of consent or to perform a contract, in a structured and machine-readable format (if technically feasible) for transmission to other companies.
2.7. The website visitor has the right to lodge a complaint about the processing of personal data with the Estonian Data Protection Inspectorate of by e-mail to info@aki.ee or in person at Tatari 39, Tallinn.

3. Processed personal data and their sources

3.1. OlyBOOST processes the following website visitor personal data.
3.1.1. Website visit data: IP address (including location based on IP address), Internet service provider, referrer URL, date, time, access token, session key, web browser type and version, operating system, amount and status of data transmitted, MAC address;
3.1.2. Cookie data: OlyBOOST uses cookies on its websites to optimise the websites and their functions. Cookies may collect personal data. For more information, please consult OlyBOOST’ Cookie Notice.

3.2. OlyBOOST does not process special categories of personal data related to the website visitor (data concerning racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health and genetic and biometric data).
3.3. Depending on the purpose and nature of the processing, OlyBOOST collects personal data related to the website visitor from the website visitor, website visitor’s browser by cookies, the website visitor’s Internet service provider.

4. Legal basis and purposes of the processing of personal data

4.1. The legal bases for the processing of the website visitor’s personal data are: performance of contractual obligations, the data subject’s consent and OlyBOOST’ legitimate interest. The following is a list of processing activities and their legal basis:
4.1.1. For performance of contract we process: website visit data, cookie data.
4.1.2. Based on legitimate interests, we process: website visit data, cookie data.

4.2. The purposes of processing the website visitor’s personal data are: displaying the content on the Website, marketing OlyBOOST services/products, handling website visitor feedback, expanding the website visitor base, building website visitor loyalty and providing added value, managing OlyBOOST’ resources, improving the website.
4.3. In the case of data processing for the performance of legal or contractual obligations, the website visitor is obliged to provide such personal data. Failure to provide such data will prevent OlyBOOST from fulfilling its contractual or legal obligations and will limit the website visitor’s ability to use the services offered.
4.4. Where OlyBOOST processes personal data on the basis of legitimate interest, OlyBOOST has assessed that its legitimate interest in processing personal data for certain purposes outweighs the interests and rights of the website visitor.
4.5. Where the personal data is processed based on the website visitor’s consent, then this consent can be withdrawn by contacting the data protection officer, whose contact details can be found in clause 1.3, or by clicking at the unsubscribe link at the end of every marketing message.

5. Profiling and automated decision-making

5.1. Profiling is used in the following processes and is based on the following logic.
5.1.1. Marketing the services/products offered by OlyBOOST based on analysis of website traffic and determining website usage.
5.2. Automated decision making is not used on this website.

6. Transmission of personal data

6.1. In order to provide services and/or to fulfil its legal obligations, OlyBOOST uses partners as personal data processors, who process data based on and to the extent of the instructions given by OlyBOOST.
6.2. When processing personal data, OlyBOOST will transfer your personal data to the following recipients, which may be either data controllers or processors: its own group companies, public authorities, courts, banks, auditors and legal advisors, insurance companies, analytics service providers, fraud detection and prevention service providers, website visitor authentication service providers, survey service providers, archiving service providers, information transmission and communication service providers, streaming service intermediaries, whistleblowing platform operators.
6.3. If OlyBOOST’ partner processing the data is located outside the European Union, the safeguards to be used for the transmission of personal data are: an adequate level of data protection in the recipient country in accordance with the European Commission’s decision, or the use of standard contractual clauses for data protection developed by the European Commission in the cooperation agreement (click on the relevant link for more information).
6.4. The joint controller of personal data is Kungla Investeeringu Osaühing (address Pronksi 19, Tallinn 10124, Estonia, +3726671250, estonia@oc.eu), and which are part of the same group as OlyBOOST, with whom OlyBOOST processes personal data for the purposes of marketing services/products, website analytics and managing OlyBOOST’ resources. The parties have entered into an agreement to this effect, which allows the parties to share the personal data to achieve the purposes contained in this Privacy Notice.

7. Time limits for the retention of personal data

7.1. The personal data of a website visitor is retained until the purposes of the processing have been fulfilled or until the obligations arising from the legislation have been fulfilled.
7.2. Website visit data is retained in accordance with the retention times stated in the Cookie Notice. This depends on different types of cookies that are used.
7.3. Personal data collected based on legitimate interests is retained as long as necessary for the purposes they were collected.