1.1. This Privacy Policy describes how we process the personal data of
users of the Riseodds service (www.riseodds.com, also as an app installed from the browser;
the "Service").
1.2. The controller of personal data is Heliodo sp. z o.o., registered
office in Warsaw, ul. Wronia 45/U2, 00-870 Warszawa, Poland, KRS 0000607780, NIP (tax ID)
5252651403 (the "Controller" or "we").
1.3. For matters concerning personal data, contact us at
support@riseodds.com or in writing at our registered office.
2.1. Account: e-mail address, password (stored only as an
encrypted hash), registration date, confirmation of being an adult and of accepting the
Terms, and Account settings (e.g. favourite leagues, notification settings, language).
2.2. Purchases: first and last name, the plan and period
chosen, amount, payment method, transaction ID and status, and the data sent by the payment
operator about the payment result. We do not receive or store payment card numbers or online
banking login details.
2.3. Channels and notifications: your Discord username if
you provide it, and the device or browser identifier needed to send push notifications if
you turn them on.
2.4. Technical data: IP address, information about the
device and browser, and the time of logging in and using the Service, recorded in server
logs and with login sessions.
2.5. Correspondence: the content of messages you send us
and the data in them, e.g. in a complaint.
2.6. Sign-in with Google: if you sign in or create an
Account with “Continue with Google”, Google gives us (after you agree on Google's screen) your
e-mail address and whether it is verified, and your first name, last name and profile picture
URL. We use the e-mail address only to sign you in to the Account with that address or to
create a new Account; we save the first and last name in the new Account's data (you can
change them in the settings). We do not store your profile picture or Google account ID, and
we do not receive your Google password or access to any other Google data or services. We do
not sell data received from Google, share it with anyone (other than the infrastructure
providers in point 4.1) or use it for advertising or to train artificial intelligence models.
We keep it with the Account data until the Account is deleted (point 5.1); you can ask us to
delete the Account and this data by writing to support@riseodds.com. You can revoke the app's
access to your Google account at any time at myaccount.google.com/permissions. Our use of
information received from Google APIs adheres to the Google API Services User Data Policy,
including the Limited Use requirements.
2.7. Providing data is voluntary, but without an e-mail address and
password (or signing in with Google) you cannot create an Account, and without a first and
last name you cannot buy Premium.
3.1. Running the Account, providing Tips, statistics and Premium, handling
payments, channels and notifications, and sending service messages (e.g. purchase
confirmations, password resets, notices of changes to the Terms or prices) – to conclude and
perform the contract (Article 6(1)(b) GDPR).
3.2. Keeping accounting and tax records and handling complaints and
withdrawals – to comply with legal obligations (Article 6(1)(c) GDPR).
3.3. Keeping the Service and Accounts secure, preventing abuse (e.g. Account
sharing), anonymous statistics on how the Service works, and establishing, pursuing and
defending claims – on the basis of our legitimate interest (Article 6(1)(f) GDPR).
3.4. We send marketing e-mails (e.g. about promotions) only with your
consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
3.5. We do not make decisions about Users based solely on automated
processing, including profiling, that produce legal effects or similarly significantly
affect them. We do not sell personal data.
4.1. Data may be received by entities that help us run the Service and
process it on our behalf: the cloud infrastructure provider (Google Cloud; servers in the
Warsaw region), the e-mail hosting and delivery provider (MyDevil.net, ADMIN.NET.PL Tomasz Rzepka Arkadiusz Nowara s.c., Tarnów, Poland), push notification providers (e.g. Google
Firebase Cloud Messaging and the push services of browser and operating system makers), the
provider of the Google Analytics analytics tool (Google Ireland Ltd.; only with your consent,
see 7.3), and our accountants and legal advisers.
4.2. Payment operators – Przelewy24 (PayPro S.A., Poznań) and the card
payment operator indicated in the Service – receive the data needed to process a payment and
process it as separate controllers, on the terms described in their privacy policies.
4.3. If you join the Telegram or Discord channels, data processed on those
services is subject to their operators' rules.
4.4. We may also disclose data to public authorities where the law
requires it.
4.5. Some providers (e.g. Google) may process data outside the European
Economic Area. This is done on the basis of a European Commission adequacy decision (e.g.
the EU-US Data Privacy Framework) or standard contractual clauses. You can obtain a copy of
the safeguards by writing to us.
5.1. We keep Account data until the Account is deleted.
5.2. We keep payment data for the period required by tax and accounting law
(as a rule 5 years from the end of the year in which the tax payment deadline passed), and
data needed to defend claims until the claims become time-barred.
5.3. We usually keep server logs for no longer than 30 days, unless they are
needed to investigate a security incident.
5.4. We keep data processed on the basis of consent until the consent is
withdrawn.
6.1. You have the right to access your data, to have it rectified, erased
or its processing restricted, to data portability, and to object to processing based on our
legitimate interest.
6.2. Where we process data on the basis of consent, you may withdraw it at
any time; this does not affect the lawfulness of processing before withdrawal.
6.3. To exercise these rights, write to support@riseodds.com. We reply
without undue delay and within one month at the latest.
6.4. You have the right to lodge a complaint with the President of the
Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland).
7.1.
Without your consent, the Service uses only cookies and browser storage that are necessary
for it to work: session cookie
– keeps you signed in and protects forms against abuse,
deleted when the browser is closed; "remember me" cookie
– keeps you signed in for up to 14 days; language cookie
– remembers the chosen language for a year; browser local storage (localStorage)
– remembers the colour theme, your
last Analysis settings and that you dismissed the prompt to install the app.
7.2. The Service installs a script in the browser (a service worker) that
stores copies of static files (styles, scripts, fonts, images) and the page shown when
there is no Internet connection. It does not store personal data or page content.
7.3.
Only with your consent to analytics cookies (Art. 6(1)(a) GDPR and
Art. 399 of the Polish Electronic Communications Law) we use Google Analytics 4, a service of Google Ireland Ltd. (Gordon House, Barrow
Street, Dublin 4, Ireland), which processes the data on our behalf. We use it to measure
traffic in the Service in order to improve it: the number of visits, pages viewed, traffic
sources, device and browser type, approximate location (country, city) and Premium
purchases (transaction ID and amount). Google Analytics stores the cookies _ga
and _ga_*
(up to 2 years) with a random browser identifier on your device; the IP address is used
only to determine the approximate location and is not stored. We do not send your e-mail
address or Account identifier to Google, we do not use this data for advertising, and
Google Signals is turned off. Data in Google Analytics is kept for 14 months. Google may
also process the data outside the European Economic Area, as described in 4.5. You can
withdraw consent at any time through the "Cookie settings" link in the footer: we then stop
sending data to Google Analytics and delete its cookies from your device. Withdrawing
consent does not affect the lawfulness of processing before the withdrawal. The Service
uses no advertising tools and does not track Users across websites.
7.4.
On your first visit we ask for consent to cookies in three categories: necessary
(always on, described in 7.1), analytics
and marketing
(off by default). Your choice is stored for 12 months in the
necessary ro_consent
cookie; you can change it or withdraw consent at any time
through the "Cookie settings" link in the footer. The analytics category covers Google
Analytics (7.3). We do not use any marketing tools today; when we add them, we will list
them here and ask for consent again.
7.5. Cookie settings can be changed in the browser. Blocking the necessary
cookies will prevent you from signing in to the Service.
8.1. We apply technical and organisational measures appropriate to the
risk, including an encrypted connection (HTTPS), password hashing and limiting access to
data to the people who need it.
8.2. We never ask for your password by e-mail, phone or messaging apps.
9.1. This Privacy Policy may change, e.g. when the law or the way the
Service works changes. We will announce significant changes in the Service or by e-mail.
9.2. This Privacy Policy applies from the day it is published in the
Service.