Definitions
The terms used in this policy carry the following meaning:
Personal Data – any information relating to an identified or identifiable natural person.
Processing – any operation or set of operations performed on personal data (collection, storage, use, disclosure, erasure, etc.).
Data Subject – the natural person to whom the personal data relate.
Controller – the entity which determines the purposes and means of the processing of personal data (in this case Big Bet Games Ltd.).
1. Purpose & Scope
1.1. Purpose of the Policy
This Privacy Policy (the “Policy”) sets out the rules by which Big Bet Games Ltd. (the “Company”, “we”, “our”) collects, uses, stores and protects personal data when you visit or use our websites, mobile applications, communication channels or other services related to the organisation of online gambling games. The Policy fulfils our transparency obligation under Articles 13–14 of Regulation (EU) 2016/679 (GDPR) and aims to help you understand what data we process, why, and what your rights are.
1.2. Scope of Application
The Policy applies to:
- visitors and registered users of the domain bigbet.bg and the related mobile applications;
- individuals who communicate with us via chat, email, telephone or social media;
- participants in promotional campaigns, tournaments and loyalty programmes;
- individuals verified through the Sumsub system for KYC/AML purposes.
Important: This document does not describe the use of “cookies” and similar technologies. For that information, please refer to our separate Cookie Policy.
1.3. Regulatory Framework
The Policy reflects the requirements of:
- Regulation (EU) 2016/679 (GDPR);
- the Bulgarian Personal Data Protection Act;
- the Gambling Act and its implementing regulations;
- the Measures against Money Laundering Act (MAMLA) and the Measures against Financing of Terrorism Act;
- the applicable guidance of the CPDP (Bulgarian DPA), EDPB and the NRA.
2. Legal Bases and Purposes for Processing Personal Data
| Purpose of Processing | GDPR Legal Basis | Examples |
|---|---|---|
| Registration and account management | Contract performance – Art. 6 (1)(b) | Opening an account; identity verification via Sumsub |
| Organising bets & paying winnings | Legal obligation – Gambling Act; Art. 6 (1)(c) | Bet history, balance, transactions |
| KYC / AML / CTF checks | Legal obligation – MAMLA/MFTA; public interest | Source‑of‑funds checks; PEP screening |
| Fraud prevention & platform maintenance (Softswiss) | Legitimate interest – Art. 6 (1)(f) | Monitoring abnormal patterns; blocking accounts |
| Direct marketing (opt‑in) | Consent – Art. 6 (1)(a) | Newsletters, bonus offers |
| Statistics & service improvement | Legitimate interest – Art. 6 (1)(f) | Aggregated reports on player behaviour |
You may update inaccurate data at any time via Profile ► Personal Data, thereby supporting the accuracy principle under Art. 5 (1)(d) GDPR.
3. Categories of Personal Data We Process
Identification: full name, Bulgarian PIN/Foreigner’s Number, date of birth, nationality, identity‑document data, PEP status.
- Contact: email, mobile number, address.
- Account: username, password hash, IP address, session logs, preferred language.
- Financial: IBAN, masked card details, declared source of funds.
- Gaming activity: deposits, bets, winnings, responsible‑gaming limits.
- Technical: device ID, cookies (see Cookie Policy).
- Records: chat/email correspondence and voice calls (up to 24 months).
4. Data Disclosure and Recipients
Personal data are disclosed only when necessary and on an appropriate legal basis to the following categories:
- Public authorities: National Revenue Agency, State Agency for National Security, competent courts and prosecutors;.
- Payment providers: banks, Cashterminal, EasyPay, Skrill, Neteller, etc.
- Technology partners:
- Softswiss – gambling platform provider;
- Sumsub Tech Ltd. – identity verification (KYC);
- Cloud & IT‑support vendors, auditors and legal advisers.
- Sports‑integrity bodies and national self‑exclusion schemes.
International transfers are performed only if an adequacy decision or appropriate safeguards under Art. 46 GDPR exist.
5. Retention Periods
| Data Category | Retention Period |
|---|---|
| Registration, identity, bets, winnings | 5 years after the statutory limitation period for public liabilities (Art. 22 (3) Gambling Act) |
| IP address, session metadata | ≥ 12 months |
| Call recordings & chat logs | 24 months |
| AML documentation | 5 years (Art. 67 MAMLA) |
| Marketing preferences | Until consent is withdrawn |
6. Security Measures
Big Bet applies technical and organisational measures aligned with ISO 27001, including but not limited to:
- TLS 1.3 encryption of all public channels;
- bcrypt hashing of passwords;
- network segmentation and IDS/IPS;
- strict role‑based access control;
- incident register: each security breach is logged and assessed within 24 hours; where a high risk exists, data subjects are notified without undue delay and, in any event, within 72 hours.
7. Rights of Data Subjects
7.1. Main rights
Access – to obtain confirmation whether we process your personal data and to receive a copy;
Rectification – to correct inaccurate or incomplete data (most fields can be edited directly in Profile ► Personal Data);
Erasure (“right to be forgotten”) – when the legal basis for processing no longer exists;
Restriction – to suspend processing while the accuracy, lawfulness or necessity is contested;
Portability – to receive your data in a structured, machine‑readable format and/or have it transmitted to another controller;
Objection – to processing based on legitimate interest or for direct marketing purposes;
Withdrawal of consent – where processing relies on consent;
Not to be subject to a fully automated decision that produces legal or similarly significant effects on you;
Complaint – to the Bulgarian Data Protection Commission (CPDP) or another competent supervisory authority.
7.2. How to Exercise Your Rights
Submit a request:
- via the “Personal Data Management” form in your account;
- by email to [email protected] from your registered address; or
- by post to the Company’s registered office.
7.3. Complaints
If you believe that we infringe your rights, you may lodge a complaint with the CPDP (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, [email protected]) or seek judicial remedy.
8. Changes to This Policy
We review this Policy regularly to reflect legal requirements, service changes and technological developments.
- An updated version is published in the Privacy section of bigbet.bg and takes effect on the publication date.
- For material changes (e.g. new data categories or processing purposes) we will inform you in advance through an in‑app pop‑up at your next login and/or by email/SMS where valid contact details are available.
- A revision history is maintained at the end of this document.