Privacy Policy · Play Normandie

This policy explains which personal data Play Normandie processes, why, for how long, and what rights you have under the EU General Data Protection Regulation (GDPR). In short: we process only what we need to run your account, the games and your purchases. We use no analytics or advertising trackers, and we do not sell your data.

Article 1. Who is responsible

The controller is TEST COMPANY, TEST ADDRESS 1.

Privacy questions and requests: [privacy email]

Article 2. What we process and why

2.1 Your account

What: Your name, email address and chosen language (for pages and emails); a one-way hash of your password, never the password itself; when the account was created, when your email address was confirmed and when you last claimed a daily bonus. An account can only be opened after you confirm that you are 18 or older.
Signing in: For each sign-in we store a one-way hash of the one-time code we email to you, valid for 10 minutes, and the number of attempts. If you use an authenticator app instead, we store its secret key and your recovery codes in encrypted form.
Why, and legal basis: To open and run your account under our Terms of Service and to make sure that only you can sign in: necessary for the contract (Art. 6(1)(b) GDPR) and our legitimate interest in protecting accounts (Art. 6(1)(f)).

2.2 Games and Wallet

What: Your coins balance and a record of every change to it (welcome gift, daily bonuses, bets, winnings, purchases, corrections by our staff); every round you play, with the game, stake, your choices, the result, the payout and the time; the provably fair seeds and counters used for your results.
Why, and legal basis: To run the games, show you your balance and history, let you check results, and look into errors or misuse: necessary for the contract (Art. 6(1)(b)) and our legitimate interest in a secure and fair service (Art. 6(1)(f)).

2.3 Purchases

What: The package, the number of coins, the price and currency, the payment provider and its payment reference, the status (pending, paid, failed or refunded), the time of payment and the language of the checkout (so that the confirmation email is in the same language). For payment methods that need it, your billing address: country, state or province (for some countries), city, street address and postcode. We do not receive or store card numbers or other payment credentials.; When the coins are credited, we email you a purchase confirmation. If, before paying, you asked for immediate delivery and acknowledged that you would lose your right of withdrawal, we store the time of that consent with the purchase, so that we can show when the right of withdrawal ended.
Why, and legal basis: To sell you coins and handle problems and refunds: necessary for the contract (Art. 6(1)(b)); to keep accounting and tax records: legal obligation (Art. 6(1)(c)); to prevent payment fraud: legitimate interest (Art. 6(1)(f)).

2.4 Technical data

What: While you browse or are signed in, we store your session with your IP address, your browser's user agent and the time of your last activity. Our web server and application keep technical logs, which can include IP addresses and the pages requested.
Why, and legal basis: To keep you signed in, protect forms against forgery, and keep the service secure and working: legitimate interest (Art. 6(1)(f)). The cookies involved are listed in our Cookie Policy.

2.5 When you write to us

What: If you use the contact form, we store your name, email address, the topic you chose, your message, your language and, if you are signed in, a link to your account. We send the message to our support address and a confirmation to you. If you email us, we process your message and contact details.
Why, and legal basis: To answer you: necessary for the contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) or (f)).

2.6 Your cookie choices

What: When you accept, reject or change optional cookies in the cookie banner or under “Cookie settings”, we keep a record of the choice: a random identifier (also stored in your cookie-choice cookie), your account if you are signed in, the categories you allowed or refused, the version of our cookie settings, whether you chose “Accept all”, “Reject all” or your own selection, and the time, with a one-way keyed hash of your IP address (not the address itself).
Why, and legal basis: To be able to prove that you gave or refused consent: legal obligation (Art. 6(1)(c) with Art. 7(1) GDPR); and, when you are signed in, to apply the same choice on your other devices. Details in our Cookie Policy.

2.7 Breaks and account blocks

What: If you ask us to exclude you from play, or if we suspend your account, we record the kind of block (self-exclusion or suspension), its start and end, a short note on the reason (for example “player's request by email”) and the member of staff who set it.
Why, and legal basis: For a self-exclusion: to honour your request and keep you from playing for the period you chose, necessary for the contract (Art. 6(1)(b)) and our legitimate interest in protecting players (Art. 6(1)(f)). For a suspension: our legitimate interest in enforcing our Terms and protecting other players (Art. 6(1)(f)).

Article 3. Payment providers

Payments are made on the hosted payment pages of the providers below. They process your payment details as independent controllers under their own privacy policies, and as our processors for the data we send them.

Stripe, Stripe Payments Europe, Limited (Ireland). We send the purchase reference, the amount, the currency and the package name. Its privacy policy.
Whitelark, [Whitelark legal entity and country]. We send the purchase reference, the amount, the currency, a description of the package, your email address, your billing address and your IP address, which the provider uses to prevent fraud.

The provider tells us whether the payment succeeded, together with its own payment reference.

Article 4. Other recipients

Hosting: [Hosting provider name] ([Data centre country]) runs the servers that hold our database and logs, as our processor under a data processing agreement.
Email delivery: if we use an outside mail service to send sign-in codes, purchase confirmations and replies, it acts as our processor under a data processing agreement.
Authorities and advisers: only where the law requires it, or where it is needed to establish or defend legal claims.

We do not share your data with advertisers or data brokers. Other players never see your email address.

Article 5. Transfers outside the EEA

We aim to keep data within the European Economic Area. Where a provider processes data outside it, for example within a payment provider's group, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses. You can ask us for a copy of the safeguards.

Article 6. How long we keep data

Account, games and Wallet: For as long as your account exists. When you delete it, we remove your name, email address and sign-in details and keep the remaining records only in anonymous form, unless one of the rules below requires more.
Purchases, and billing addresses linked to a paid purchase: [number of] years after the end of the year of purchase, as accounting and tax law requires.
Sessions (with IP address and user agent): Until you sign out or after 120 minutes without activity; expired sessions are then removed automatically. Deleting your account ends all its sessions.
Sign-in codes: A code is valid for 10 minutes and is replaced by the next one.
Technical logs: [number of] days, unless we need them longer to investigate a particular security incident.
Messages to us: For as long as needed to deal with your request, and afterwards only as long as needed for possible legal claims.
Cookie-choice records: 24 months after each choice, then deleted automatically. A choice applies for at most 180 days; then we ask again.
Breaks and account blocks: For as long as the block applies. If you delete your account during a self-exclusion, we keep only your email address and the end date until it ends, so that no new account can be opened before then; for a permanent self-exclusion, until you ask us in writing to delete them.

Article 7. Your rights

7.1 You have the right:

to access your data and receive a copy;
to have inaccurate data corrected;
to have your data erased; you can delete your account yourself under Leave the ship › Delete account in your account settings, or ask us;
to restrict processing in certain cases;
to data portability: to receive the data you gave us in a machine-readable format;
to object, on grounds relating to your situation, to processing based on our legitimate interests.

7.2 To use these rights, write to [privacy email] from the email address registered on your account. We may ask you to confirm your identity. We reply within one month; for complex requests this can be extended by two further months, and we tell you why.

7.3 You may also complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is [Lead data protection supervisory authority].

Article 8. Security

Passwords and sign-in codes are stored only as one-way hashes, and every sign-in needs a second step. Card details are entered on our payment providers' pages and never reach our servers. The session cookie cannot be read by scripts on the page, and forms are protected against cross-site request forgery. Only authorised staff can see player data in our administration area.

Article 9. Adults only, no profiling, no marketing

Play Normandie is for adults aged 18 or older. If we learn that an account belongs to someone younger, we close it and delete its data.
We make no decisions about you based solely on automated processing, and we build no advertising profiles.
We send no marketing emails. We email you only about signing in, your purchases, your account and your messages to us.

Article 10. Changes to this policy

If we change how we use personal data, we update this policy and the “Last updated” date above. We tell you about significant changes by email or in the service before they apply.