Privacy Policy

• Personal data — information relating to an identified or identifiable person.
• Controller — the party that decides why and how personal data is processed.
• Processor — a party that processes personal data on a controller's instructions.
• Operator — a business that licenses the QuanticPlay platform to run its own competitions or loot-box products.
• Player — an end user taking part in an Operator's competition.

As controller. When you visit this website, submit an enquiry, speak to our team, apply for a role or use an administrative account, QuanticPlay decides how that data is handled. This policy describes that processing.

As processor. When an Operator runs its product on our platform, the Operator is the controller of its Players' data and we process it on their instructions under the data-processing terms in their agreement. If you are a Player, the notice that applies to you is the privacy policy of the website you registered with — not this one.

Quantic Play Limited is a private technology company registered in Cyprus (registration number HE 470521), with its registered office at 236 Strovolou Avenue, Strovolos, Nicosia 2048, Cyprus. It operates the QuanticPlay platform and this website.

For any privacy question, rights request or data-protection matter, contact our data-protection team at DPO@quanticplay.com. For anything else, info@quanticplay.com.

As controller, we may collect:

• Contact and business details — name, work email, phone number, company, role, country, and the content of your enquiry.
• Account data — administrative login identifiers, permissions and authentication events.
• Communications — emails, meeting notes, support tickets and messages you send us.
• Commercial and due-diligence data — information gathered during onboarding and know-your-business checks, including details of directors or beneficial owners where required.
• Technical and usage data — IP address, device and browser information, pages viewed, referring URL, and interactions with the site.
• Marketing data — your preferences, campaign source, and whether you opened or clicked our emails.

We do not seek special-category data through this website. Please don't send it to us.

• Responding to enquiries and providing demos — legitimate interests, or steps towards a contract.
• Providing, supporting and improving the platform — performance of contract and legitimate interests.
• Security, fraud prevention and abuse detection — legitimate interests and legal obligation.
• Onboarding and due-diligence checks — legal obligation and legitimate interests.
• Business-to-business marketing about the platform — legitimate interests, or consent where required.
• Analytics and site measurement — consent, via our cookie banner.
• Accounting, tax and record keeping — legal obligation.
• Responding to legal claims or regulator requests — legal obligation and legitimate interests.

We send business communications about the platform to business contacts. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing us. Withdrawing consent does not affect operational messages such as service notices or billing correspondence.

We do not sell personal data.

We use cookies and similar technologies on this website. What they do, how long they last and how to change your choices are set out in our Cookie Policy.

• Service providers — hosting, database, email, analytics, CRM, customer support and payment processing suppliers acting under contract.
• Professional advisers — legal, accounting, audit and insurance advisers, where needed.
• Operators — where you have identified yourself as a Player of a specific Operator and we need to route your query.
• Regulators, law enforcement and courts — where we are legally required to disclose.
• Corporate transactions — a prospective buyer or investor, under confidentiality, in the event of a reorganisation or sale.

Suppliers acting as processors may only use the data to deliver their service to us, under written terms that require confidentiality, security and deletion or return of the data at the end of the engagement. We keep an internal record of the sub-processors we use for each service and will provide the current list for a specific service on request to DPO@quanticplay.com.

We host and process personal data inside the European Economic Area wherever we can. Some suppliers we rely on operate, or provide support, from outside the EEA and the UK. Where personal data is transferred to those countries we rely on a European Commission adequacy decision where one exists, and otherwise on the EU standard contractual clauses (with the UK international data transfer addendum where UK data is involved), together with a transfer risk assessment and any additional technical or contractual safeguards the transfer requires. You can ask us for details of the safeguards that apply to a specific transfer by emailing DPO@quanticplay.com.

We keep personal data only as long as we need it:

• Enquiries that don't progress — a limited period after the last contact, then deleted or anonymised.
• Client records and contracts — for the relationship plus the period required for tax, accounting and legal-claim purposes.
• Due-diligence records — for the period the applicable rules require.
• Security and access logs — a short rolling window, unless retained for an investigation.
• Marketing preferences and suppression lists — kept for as long as needed to honour your opt-out.

Player data hosted for an Operator is retained according to that Operator's instructions.

Depending on where you are, you may have the right to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• ask us to erase data where there is no continuing reason to keep it;
• restrict or object to processing, including profiling and direct marketing;
• receive your data in a portable format;
• withdraw consent where processing relies on it;
• complain to your data-protection authority.

Email DPO@quanticplay.com to exercise a right. We may need to verify your identity, and we aim to respond within one month. If your request concerns data we hold as processor for an Operator, we will forward it to them and tell you.

We use technical and organisational measures appropriate to the risk, including encrypted transport, access controls and least-privilege permissions, authentication controls on administrative accounts, logging and monitoring, supplier due diligence, and staff confidentiality obligations. No system can be guaranteed completely secure, and we will notify affected parties and regulators where a notifiable incident occurs.

We do not make decisions about you that have a legal or similarly significant effect based solely on automated processing. The platform includes automated logic that Operators configure — for example draw allocation, instant-win outcomes and risk flags — and the Operator is responsible for how that logic affects its Players.

This website is aimed at business users and is not intended for children. We do not knowingly collect data from anyone under 18 through this site. Age restrictions for Player-facing products are set and enforced by the Operator.

This site links to other websites, including those run by Operators and partners. We are not responsible for their content or privacy practices — please read their own policies.

We may update this policy as our services or the law change. The "last updated" date above shows the current version. Material changes will be highlighted on this page.

For any privacy question, email DPO@quanticplay.com. If you are unhappy with our response, our complaints policy explains how to escalate, and you can also complain to your local data-protection authority.