This is the General Privacy Notice regarding privacy and the protection of personal data (the "Privacy Notice"), adopted by the operator and owner of the ZeroBet.ro web platform, PRIME TECH DEVELOPMENT SRL (“Prime Tech”, “we”).

Prime Tech respects your privacy and is committed to protecting the personal data you have provided to us. We are committed to collecting and using personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (known by the abbreviation “GDPR”).

ZeroBet.ro is an entertainment/gaming platform offered to users free of charge, on a “free-to-play” basis, with no real stakes. The platform focuses on the gaming experience and therefore collects a minimum of personal data required for its functionality. Because the Virtual Items available on the platform have no monetary value, ZeroBet.ro does not carry out identity verification (KYC) or anti-money laundering (AML) checks for standard gameplay.

We will not request, collect or process sensitive personal data relating to you. Furthermore, the ZeroBet.ro platform is not intended for minors, and we therefore do not knowingly collect personal data belonging to minors.

It is important that you read this Privacy and Personal Data Protection Notice together with any other privacy notice or processing notice we may provide on certain occasions when we collect or process personal data about you, so that you are fully informed of how and for what purpose such data is used. This Privacy Notice supplements the other notices and is not intended to replace them.

For the purposes of the GDPR, applicable legislation, and in the context of this Privacy Notice, the following terms are defined as follows:
● personal data - any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier, or one or more factors specific to that person’s identity;
● controller - the person who determines the purposes and means of the processing of personal data. For the purposes of personal data protection legislation, Prime Tech acts as a “controller” when it processes your personal data.
● processing - any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Personal data is processed on the basis of user consent, legitimate interest, or legal requirements, as set out in applicable European and national legislation, including but not limited to:
● Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - GDPR;
● The Polish Act of 10 May 2018 on the protection of personal data;
● Romanian Law no. 190/2018 on measures implementing the GDPR;
● The Polish Act of 1 March 2018 on counteracting money laundering and terrorist financing;
● Romanian Law no. 129/2019 on preventing and combating money laundering and terrorist financing (as amended by Law no. 315/2022);

We process your personal data only when we have a legal basis to do so, including:

The ZeroBet.ro platform is designed to minimise the collection of personal data. The data processed is generally limited to the technical and activity data required for the functionality and security of the game, linked to the user account you create on the platform.

Prime Tech does not intentionally collect special categories of personal data (such as health information or religious beliefs) unless required by law or unless you voluntarily provide such information with your explicit consent.

Your personal data will be accessible to our employees and members of our group of companies to the extent reasonably necessary to fulfil the purpose for which it was collected under this Privacy Notice.

We may share your personal data with external Third Parties - limited to the providers necessary for the operation of the ZeroBet.ro website (for example, cloud hosting, security tools).

We do not sell your data. We may share your personal data, for legitimate purposes and to the extent strictly necessary, only with:

a. Third-party service providers, including
● Cloud hosting (for example, AWS, Google Cloud);
● Email and marketing tools (for example, Mailchimp, SendGrid);
● External consultants, such as lawyers, accountants, auditors, etc.

b. Legal and regulatory authorities
Where required by law or to protect our rights or the safety of users, such as the National Supervisory Authority for Personal Data Processing (ANSPDCP), the General Inspector of Financial Information (GIIF), or UODO.

c. Business transfers
If Prime Tech is involved in a merger, acquisition, or sale of assets, your personal data may be transferred subject to appropriate confidentiality safeguards.

We ensure that these third parties’ access to your personal data takes place only under contracts entered into with them, in compliance with the legal safeguards regarding the protection of personal data and the confidentiality of information.

Your personal data may also be disclosed to public authorities and institutions if required by law or if necessary for the exercise of our rights or the protection of our legitimate interests (including the legitimate interests of third parties), within the limits and conditions set by law.

Except as provided in this Privacy Notice, we will not disclose your personal data to other persons.

Your personal data, collected in accordance with this Privacy Notice, is stored on the servers of Amazon Web Services Inc. (AWS), located in Germany (eu-central-1).

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

ZeroBet.ro activity data and associated technical data are retained for the duration of your relationship with ZeroBet.ro (for as long as you have a user account) and for a further period of five (5) years from the end of that relationship, in order to meet accountability requirements.

If you would like to change, rectify, or delete certain information, or close your account, you may send us a request at any time. We will respond promptly to your request and will stop processing your personal data in accordance with your request and within its limits. However, we may need to retain certain personal data if required by law or where we have a legitimate interest, such as establishing, exercising, or defending our rights in ongoing or future legal proceedings.

Prime Tech adheres to the personal data protection principles set out in the EU GDPR. In accordance with these principles, Prime Tech ensures that users’ personal data is:
● Processed lawfully, fairly, and transparently in relation to the data subject;
● Processed only for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes;
● Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
● Kept accurate and up to date;
● Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed;
● Processed in a manner that ensures appropriate security;

Prime Tech also ensures that users’ personal data is not transferred outside the European Economic Area (EEA) without adequate protection.

We use cookies and similar technologies to improve functionality and personalise your experience. Cookies are used in accordance with the GDPR and therefore require user consent for non-essential cookies. These may include:
● Necessary cookies: essential for the website to function;
● Analytics cookies: to analyse website performance (for example, Google Analytics, Microsoft cookies);
● Marketing cookies: for advertising and retargeting (only with your consent).
You can manage your cookie preferences through our cookie banner and your browser settings. For more information, please see our Cookie Policy.

Whenever a transfer of personal data outside the EEA takes place, Prime Tech implements appropriate safeguards, as set out in Chapter V of the GDPR. Where your personal data is, by way of exception, transferred outside the European Union or the EEA, the transfer will be carried out:
● pursuant to a European Commission decision determining that the third country in question ensures an adequate level of protection for your personal data;
● on the basis of the existence and implementation of appropriate binding corporate rules, adopted by the supervisory authority in accordance with the law;
● on the basis of the existence and implementation of standard contractual clauses for data protection adopted by the European Commission or by the supervisory authority and approved by the European Commission.

In certain circumstances, you have rights under applicable data protection legislation with regard to your personal data. These rights are:
● The right to access your personal data: this gives you the right to a copy of the personal data we hold about you and to verify that it is being processed lawfully.
● The right to rectification and completion of your personal data: you may request that we correct or update the personal data we hold about you. This allows you to have any incomplete or inaccurate data we hold about you corrected. Please note that we may need to verify the accuracy of any new data you provide to us.
● The right to request erasure of your personal data (“the right to be forgotten”): this allows you to ask us to delete or remove your personal data where there is no good reason for us to continue processing it. Please note, however, that we may not always be able to comply with your request for erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your specific request.
● The right to object to the processing of your personal data: where we are processing data on the basis of a legitimate interest (of ours or a third party) and you feel, in your particular situation, that it impacts your fundamental rights and freedoms. You can also object to us processing your data for marketing purposes. In some cases, we may demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.
● The right to request restriction of the processing of your personal data: this allows you to ask us to suspend the processing of your personal data in the following circumstances:
(a) if you want us to establish the data’s accuracy;
(b) where our use of the data is unlawful but you do not want us to erase it;
(c) where you need us to hold the data even if we no longer require it, because you need it to establish, exercise, or defend legal claims; or
(d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
● The right to request the transfer of your personal data (data portability): we will provide you, or a third party of your choosing, with your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information for which you initially gave consent for us to use, or where we used the information to perform a contract with you.
● The right to withdraw consent: where we are relying on your consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
● The right not to be subject to any solely automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. This right does not apply where the decision is necessary for entering into or performing a contract with you, is authorised by law and includes appropriate safeguards for your rights and freedoms, or is based on your explicit consent. In such cases, you nevertheless have the right to obtain human intervention, to express your point of view regarding the decision, and to contest it.
● The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) at: https://www.dataprotection.ro/formulare/formularBresaGdpr.do?action=view_action&newFormular=true.
● The right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) at: https://uodo.gov.pl.

Please note that these rights may be limited in certain circumstances and are subject to applicable data protection laws and regulations.

In order to process your requests relating to the exercise of these rights, we reserve the right to verify your identity by requesting additional information for the purpose of confirming your identity.

To exercise your rights, please contact us at dpo@primedev.ro. We will respond within 30 days.

Users have the right to request, at any time, the permanent deletion of their user account and the data associated with it. Deletion of a user account can be carried out:
directly by the user, by following these steps:
● log in to the ZeroBet.ro platform
● go to the “Your Profile” section
● locate and press the “Delete Account” button
● press the “Confirm” button to permanently confirm deletion of the user account
by sending a request to this effect to dpo@primedev.ro.

Following deletion of the user account, the associated personal data will also be deleted within 30 days, except for data that must be retained after the end of the relationship with the ZeroBet.ro platform, but only for the periods and under the conditions set out in this Privacy Notice.

Where deletion of the user account is not requested, any personal data will only be deleted after:
(a) the User or the data subject submits a data deletion request in accordance with the applicable procedures; or
(b) the purpose of the data processing has been fulfilled, including expiry of the retention period provided for by applicable legislation.

Data deletion requests should be sent to the email address: dpo@primedev.ro

A User’s request to delete some or all of their personal data does not amount to deletion of their user account itself. Any request to delete some or all of the personal data relating to a User will be fulfilled within 30 days of receipt of the request.

To delete data from files located on removable media (external/detachable storage), we refer to the settings and tools designated for the sanitisation method as deletion or purging. If the deletion method is not sufficiently secure given the sensitivity of the information, and the information could be recovered, the removable media containing that information must be completely destroyed (for example, shredded, crushed, disintegrated, pulverised, or incinerated by burning the device in an authorised incinerator, etc.).

To delete data from mobile devices (for example, smartphones, tablets), the means provided by the device itself are used. If a given mobile device is intended to be reused/recycled/donated, or is no longer used by Prime Tech staff, that staff member must reset the device to its original factory settings. As a general rule, the procedure for Apple iPhone and iPad OS is: select “Settings > General > Reset > Erase All Content”. For devices running the Android operating system: select “Settings > Backup & reset > Factory data reset > Reset phone”.

Managing any sensitive data on any equipment, removable media, or mobile device outside these procedures is prohibited.

It may also be necessary for us to retain certain records that have been confirmed as being linked to fraudulent applications or accounts, or to obtain and maintain records to demonstrate compliance with legal obligations within and outside the EU. Where the purpose relates to the establishment, exercise, or defence of legal claims (so-called “litigation hold”), the retention period is limited to the duration of such proceedings in a specific case or circumstance. In any event, we do not retain your data for longer than we have a legal basis to do so.

You will not have to pay a fee to access your personal data or to exercise any of your rights in relation to it. However, we may charge a reasonable fee if your request is manifestly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We try to respond to all legitimate requests within thirty (30) days. Occasionally, it may take us longer than 30 days, but no more than two (2) months, if your request is particularly complex or you have made multiple requests. In such cases, we will notify you within thirty (30) days of receiving your request and keep you updated on its status.

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed without authorisation, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a genuine business need for it. They will only process your personal data in accordance with our instructions and will be subject to a duty of confidentiality.
The technical and organisational measures implemented by Prime Tech to ensure the protection of personal data include, but are not limited to, the following:
● SSL/TLS encryption;
● Access controls and authentication;
● Regular security audits;
● Staff training and confidentiality agreements.
However, no online system is 100% secure. We encourage you to take precautions when sharing data online.

If a personal data breach occurs or is suspected, it is immediately reported to the Data Protection Officer (DPO) or a director and, where applicable, to the data protection authority (ANSPDCP, within 72 hours), the affected User and, where applicable, the person affected by the breach. The report includes full and accurate details of the incident (including its causes and scope) and sets out the measures planned to address the breach.
The report is provided directly to the user concerned, and additional measures to mitigate the breach are taken.

Our website may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before sharing any data.

We may update this privacy notice to reflect legal, technical, or business changes. When we do, we will revise the “Last updated” date. Significant changes will be notified by email or by a visible notice on the site.
Prime Tech is committed to updating this Privacy Policy promptly and proactively, at least once a year, or upon the publication of legislative or regulatory changes.

For questions, concerns, or to exercise your rights, please contact our Data Protection Officer at: dpo@primedev.ro.