PRIVACY POLICY (Personal Data Processing Policy)
On 27 April 2016, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, "Regulation" or "GDPR") was adopted. This regulation is directly effective throughout the European area on 25 May 2018.
The company MP on-line s.r.o., ID No.: 106 67 156, registered office at Na krčské stráni 712/72, Krč, 140 00 Prague 4, registered in the Commercial Register kept at the Municipal Court in Prague, Section C, Insert 346002 (hereinafter referred to as "Operator" or "MP" or "Controller"), is fully aware of the importance of personal data protection.
This Privacy Policy applies primarily to the processing of personal data of those personal data subjects who choose to use the services of the Controller - i.e. clients of MP.
1) General on the processing of personal data
MP is a gambling operator within the meaning of Act No. 186/2016 Coll., on Gambling (hereinafter referred to as the "Gambling Act"). In this respect, the legal order of the Czech Republic clearly sets out the obligations of the Gambling Operator in the area of personal data processing, in particular by the aforementioned Gambling Act and Act No. 253/2008 Coll., on certain measures against the legalization of the proceeds of crime and the financing of terrorism (hereinafter referred to as "AML").
2) Data controller and data protection officer
The controller of personal data is the MP. Contact details are available on the Controller's website.
MP on-line s.r.o.
Registered office: Na krčské stráni 712/72, Krč, 140 00 Prague 4
ID: 106 67 156
represented by Mgr. Michal Lorenc, MBA, Executive Director
registered in the Commercial Register kept at the Municipal Court in Prague, Section C, Insert 346002
Website: www.magicplanet.cz (hereinafter referred to as the "Website" or "website" or "web pages").
The Operator has appointed a data protection officer. This Data Protection Officer is GDPR Solutions a.s., ID No.: 061 00 091, Opletalova 6, Nové Město 110 00 Prague 1, namely Mgr. Jakub Mareš, who can be contacted at kmares@gdprsolutions.cz.
3) Legal titles of processing
In accordance with data protection laws (in particular the Regulation and Act No. 101/2021 Coll., on the processing of personal data (hereinafter referred to as the "Act")), we will only process your personal data if we have the legal title to do so. These titles within the scope of MP's activities are in particular:
(a) "consent": the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes (for MP, in particular cookies, marketing and loyalty program);
(b) 'contract': the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of measures taken prior to the conclusion of the contract at the request of the data subject (for MP, in particular the establishment of a user account);
c) 'law': processing is necessary for compliance with a legal obligation to which the controller is subject (esp. ZHH, AML, tax and accounting legislation, Act No 480/2004 Coll., on certain information society services, etc.);
d) "legitimate interest": the processing is necessary for the purposes of the legitimate interests of the respective controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data (e.g. protection of our legal claims, necessary cookies (functional cookies)).
4) What personal data do we process (categories of personal data), by whom (categories of data subjects) and for what reasons (purposes of processing)?
In connection with the provision of gambling services, the Controller is obliged to process and store personal data relating to its clients as required by law.
Only a person over the age of 18 who meets the conditions under the HRA and other legislation may be a data subject in the context of the Controller's activities.
You are under no obligation to provide us with any of your personal data - whether you use our Services is entirely up to you. However, if you do not provide the information, we may not be able to provide you with the Services you request (for example, based on compliance with the terms of the HRA and AML, which provide for player identification obligations).
Below we will introduce you to the different purposes of processing:
4.1 Registering the Player and ensuring the operation of the Controller's business
Each technical gambling participant must be duly registered with the Operator within the meaning of the AML Act, identified within the meaning of the AML Act and have a personal user account established.
The registration of each participant shall include, in particular, the identification and verification of the identity and age of the registrant, the allocation of his personal access data or other access means and the activation of his user account on which funds, in particular deposits, bets and winnings, are recorded. Registration cannot be completed without proper verification of the age of the registrant and verification of all identification and contact details provided by the registrant to the Operator.
In order to participate in the online technical game, the Registrant is required to provide the Operator with the following identification and contact details: name, first name, surname, maiden name, if applicable, residence, nationality, birth number or date of birth (if no birth number has been assigned to the Registrant), gender, place of birth, mailing address (if different from the address of residence), bank account and card identifier, source of income, telephone number, electronic mail (e-mail) delivery address and data box identifier (if any). The Registrant is fully responsible for the truthfulness and accuracy of all information provided to the Operator as part of the registration process.
Verification of the identity and age of the Registrant shall be carried out by the Operator remotely via Banking Identity or any other method of identity verification.
As part of the identification process under the AML Act, the Operator shall also ascertain and record whether each applicant is not a politically exposed person within the meaning of the AML Act or a person against whom the Czech Republic applies international sanctions pursuant to Act No. 69/2006 Coll., on the Implementation of International Sanctions, as amended. This obligation also follows from the wording of the AML Act and is the same for all gambling operators in the Czech Republic.
In order to fulfil the purposes of the AML Act, the operator may make copies or extracts from the documents submitted and process the information thus obtained. The Operator is obliged to keep the aforementioned identification data, copies of the documents submitted for identification, if any, and information on who and when the first identification of the gambling participant was made for at least 10 years.
It is not possible to complete the registration of an applicant without individual setting or individual rejection of self-limiting measures pursuant to Section 15(2) of the Gambling Act. Also in this case it is the fulfilment of the legal obligation of the Operator on the basis of the HPA.
The Controller is also legally obliged to check the register of excluded persons pursuant to Section 16 of the German Gambling Act. If a person - data subject - is entered in this register, it is not possible to allow this person to participate in the gambling game.
4.2 Deposit records and suspicious acts
In order to fulfil the obligations set out in the HPA and the AML Act, the Gambling Operator is obliged to keep records regarding all bets, winnings, deposits into the user account and withdrawals of funds from the user account. This obligation lasts for at least 10 years from the end of registration or the last act subject to the record-keeping obligation.
The operator is also obliged under the AML Act to monitor the behaviour of its clients in the context of identifying so-called suspicious transactions within the meaning of the AML Act. The obligation to keep this data lasts for 10 years from each transaction made; or from the end of registration to participate in a technical gambling game.
Therefore, for all the above purposes, the Operator processes in particular the following personal data:
(a) identification and contact data according to the ZHH (first name, surname, if applicable, maiden name, place of residence, nationality, birth number or date of birth, if the birth number has not been assigned to the registrant, mailing address, if different from the address of residence, telephone number and address for delivery of electronic mail - e-mail and data box identifier);
(b) identification and contact details in accordance with the AML Act (first name, surname, maiden name if applicable, place of residence, nationality, birth number, or date of birth and sex if no birth number has been assigned, and place of birth,
c) self-limiting measures according to the ZHH (if set for the technical game);
(d) data relating to participation in the game (stakes, winnings, frequency and duration of visits to the gaming area, ratio of gaming and non-gaming points from the loyalty system, favourite gaming system and benefits, gaming stake per period and gaming funds deposited, etc.);
(e) data relating to the user account (deposit, withdrawal, etc.).
4.3 Marketing, loyalty schemes and benefits
In order to promote the Controller, MP may send you commercial communications, offers and newsletters based on your consent in accordance with Article 6(1)(a) of the Regulation.
Any person over the age of 18 years who meets the conditions for participation in gambling and who agrees to the terms of the loyalty programme and gives their consent to such processing may become a member of the MP loyalty programme.
The following data relating to members of the Loyalty Scheme is processed under the Loyalty Scheme:
(a) contact and identification data within the meaning of the GTC;
b) personal data, where applicable, provided through social accounts (public Facebook profile, etc.) when participating in competitions, where applicable, organised, address for sending prizes and communication;
c) data relating to the member's participation in individual games of chance, including his/her stakes, bets and winnings, time spent playing, etc.
As part of the membership of this loyalty programme, various marketing communications are sent (via email and/or SMS) regarding various bonuses or news.
The purpose of processing the personal data of the members of the loyalty programme is to enable them to benefit from all the advantages offered by this programme to its members, including the sending of up-to-date information messages. The data is processed for the duration of membership in the programme.
Membership in the loyalty program is completely voluntary, the participant can terminate his/her participation at any time and the Operator will stop processing his/her personal data for this purpose. However, the withdrawal of the participant's consent is only effective in the future and does not affect the lawfulness of the previous processing based on his/her consent.
Marketing communications sent via email and SMS can also be unsubscribed from in the user account at any time. Simple instructions for opting out are available at https://www.magicplanet.cz/stop-sms. Further rules of the loyalty program are described in the General Terms and Conditions of MP.
4.4 Cookies
In the context of the use of the Website, certain data may be processed by means of cookies, which are used in particular for the purpose of functionality, optimization, statistics and analysis of the traffic of the aforementioned Website.
Purposes of the use of cookies
Different cookies can perform different tasks. For example, some cookies may be essential for the functionality of our Websites. Removing these cookies would have a major impact on your experience of using our Website. The use of these cookies is also possible without your consent.
So-called preference cookies remember your preferences, such as your bet selection when you create your bet slip or your language choice. You do not have to enter your preferences every time you click on a different part of the website. We process these cookies based on your consent.
Other cookies are needed for analytics. They tell us how you move through our Website and allow us to monitor its performance. We also use cookies that contain information about your access device (such as device type, geolocation data, browser information) to help us prevent fraud, comply with legal requirements against money laundering, and more. We process these cookies based on your consent.
We may also use cookies for marketing purposes. These include, but are not limited to, displaying relevant advertising to each visitor to our website and tracking their behaviour on our website. We only use marketing cookies on the basis of your consent.
We use both first and third party cookies within our website.
You must agree to the use of cookies on our Website. This does not apply to functional (essential) cookies that can be used without your consent. However, disabling certain cookies may have a certain effect on the use and enjoyment of our Website (e.g. you may not see certain elements).
Cookies used by our Website:
Cookie Name, Type, Provider, Retention Time, Description
- is_authenticated, Necessary, magicplanet.cz, 3 months, Maintains information about the user's login status
- use_dark_mode, Preferential, magicplanet.cz, 3 months, Detects whether the user is using the light/dark mode of the application
- sid, Sklik-[advertiser ID], Marketing, Seznam.cz application, max 540 days, Measures site visitor behavior and differentiates them. Identification within the Seznam advertising network, retargeting
- _ga, Analytical, Google, 2 years, User differentiation and limitation of the number of requests. All collected data is analyzed anonymously. Identification within Google's advertising network, retargeting
- _dc_gtm_GTM-W59LZZ6, Analytics, Google, session, Google Analytics code retrieval (Google Tag Manager)
- _gid, Analitic, Google, 1 day, User resolution and request limitation. All collected data is analyzed anonymously.
- _gcl_au, Marketing, Google, 3 months, Detecting advertising effectiveness across sites (Google AdSense)
- _fbp, Marketing, Facebook, 4 months, Facebook Pixel - Used by Facebook to deliver a range of advertising products such as real-time offers from third-party advertisers.
- Presence, Marketing, Facebook, session, Facebook Pixel - Identify and display targeted ads upon entering a page
- sb, Marketing, Facebook, 2 years, Facebook Pixel - Identification, authentication, marketing and other functional cookies specific to Facebook.
- spin, Marketing, Facebook, 1 day, Facebook Pixel - Identification and display of targeted advertising upon entering the page
Consent to the use of cookies
You consent to our use of cookies via the pop-up cookie bar. You should see this bar the first time you visit our website. You can change the settings of the cookie bar and therefore the (non)consent at any time on the website www.magicplanet.cz in the section My account - Personal data - by ticking the checkbox I agree to the processing of personal data for the purpose of sending commercial communications.
Disabling/removing cookies
You can disable the storage of certain cookies on your device in advance by using your browser settings. You can then delete all or only selected cookies in the same way. If you also delete the necessary cookies stored by our website, you will again see a pop-up cookie bar the next time you visit our website.
Transfer of personal data to third countries
We primarily process your personal data within the European Union. However, our website uses Google Analytics and other cookies which may transfer your personal data outside the European Union to so-called third countries. In this particular case, the United States of America.
Please note that if you decide to give us your consent to the use of cookies, your personal data may be transferred to third countries where the same guarantees for the protection of your data as the GDPR cannot be guaranteed.
If you do not wish your personal data to be transferred to third countries, please do not give us your consent to use cookies.
Likewise, we hereby inform you that if you are located outside the EU and decide to visit our website, your personal data may be processed in the territory of that third country in order to enable us to display our website correctly.
If you do not wish your personal data to be processed in a so-called third country, please do not visit our website from outside the EU.
5) Recipients of personal data, sharing of personal data, processors
The Operator may share the personal data of its clients with other entities, in particular those that collaborate on or provide the Operator's services (gambling, loyalty program, administration, software, etc.). The Operator always enters into a so-called processing agreement with the data processors, which guarantees the proper lawful processing of all clients' personal data.
Some personal data of clients may be accessed by suppliers of the Operator's support systems and related services. These are mainly the following entities:
(a) Merchplace s.r.o. , Prague ID No. 08844381, Navrátilova 1421/11, 11000 Prague 1, file No. C 326319/MSPH Municipal Court in Prague
b) BetWell, s.r.o.; ID No: 09646019, with registered office at: Javorová 2718, 438 01 Žatec, file No. C 46109, filed with the Regional Court in Ústí nad Labem
c) Interactive Bakers, s.r.o., ID No.: 10878840, with registered office: Kacákova Lhota 71, 506 01 Kacákova Lhota, file no. C 47723, registered at the Regional Court in Hradec Králové
Certain personal data of clients may be accessed by external auditors, tax advisors or legal representatives if necessary in a particular situation.
In the context of the applicable laws of the Czech Republic, some public authorities, such as the Customs Administration or the Ministry of Finance, have access to the personal data of clients. The Operator is obliged to disclose personal data always to the extent necessary, based on obligations arising from the law or other legal act.
Only a limited number of our employees have access to your personal data. Employees are obliged to maintain the confidentiality of your personal data.
We may also disclose your personal information in an anonymized form (such as a summary statistic or report) to describe our business, client types, traffic, responsible gaming strategies and other information to us or our potential partners, advertisers, investors and other third parties. These statistics will not include your personal information.
6) Transfer of personal data to third countries
The transfer of your personal data may occur in the case of cookie processing, see above, and only if you give us your consent to such processing.
Apart from the above, the controller does not intend to transfer your personal data to third countries. However, if this should happen in the future, it will only be done if the legal conditions are met.
7) Protection of personal data, data security
In order to ensure a standard of data protection, the Operator has implemented internal organisational and technical measures which, taken as a whole, ensure a very high level of privacy protection for all our clients. In this regard, the Operator uses available modern technologies that ensure proper protection of the personal data of all its clients, including protection against loss, destruction, disclosure or alteration of the client's personal data.
Data is stored on hardware owned exclusively by the Operator or its contractors. All HW is stored in specifically designated data centers that meet the highest standards of security standards. The servers are located in the Czech Republic. Access to the data centre is restricted to authorised persons cooperating with the Administrator.
In accordance with the provisions described in this Privacy Policy, we will endeavour to treat all of your personal data in strict confidence and take all reasonable steps to keep your personal data secure within our systems. However, the internet is not a secure medium and we cannot guarantee the security of any data you disclose online - for example, on social media or via email.
If you link to other websites from our Website or any documents, your personal data will be governed by their privacy policies. We recommend that you always read the privacy policy there before interacting with new websites.
Our Website is secured by SSL encryption.
8) Period of processing of personal data
We are entitled to retain your personal data for as long as your user account is active, as set out in this privacy policy, or as long as otherwise necessary to provide you with our services or to protect our legal claims. Accordingly, your personal data will be processed for up to 10 years from the time your account is closed or for that period from the last contact with us by you.
We my retain personal data even after you deactivate your user account or stop using any particular services for as long as reasonably necessary to comply with our legal obligations, resolve disputes involving our users, prevent fraud and abuse, and protect our legal claims and legitimate interests.
We have a data retention policy in place which we apply to the personal data we process.
9) Rights of clients as data subjects
In particular, the rights of the data subject (clients of the Operator) include:
(a) the right to have access to their personal data pursuant to Article 15 of the Regulation,
b) the right to request rectification of Personal Data pursuant to Article 16 of the Regulation,
c) the right to erasure of Personal Data without undue delay if there are grounds under Article 17 of the Regulation,
d) the right to restrict the processing of Personal Data in cases pursuant to Article 18 of the Regulation,
e) the right to data portability in the cases provided for in Article 20 of the Regulation,
f) the right to object pursuant to Article 21 of the Regulation,
(g) the right to withdraw consent to the processing of personal data pursuant to Article 7(3) of the Regulation,
(h) the right to lodge a complaint pursuant to Article 77 of the Regulation.
A fundamental right fulfilling the principle of transparency of processing is the right of the data subject to information, which is intended to guarantee that the data subject (client) is properly informed about the processing of his/her personal data. This right is fulfilled, inter alia, by this document, which informs clients about the processing of their personal data.
Right of access to personal data according to Article 15 of the Regulation
The subject of the right of access to personal data is the client's right to obtain confirmation from the Operator as to whether his personal data is being processed and, if so, he also has the right to access this personal data and the following information:
(a) the purpose of the processing;
b) the categories of personal data;
(c) the recipients to whom the personal data will be disclosed;
(d) the period for which the personal data will be stored;
(e) the existence of the right to request rectification of the stored data;
(f) the right to erasure of the stored data;
(g) the right to lodge a complaint with the OIPO;
(h) information on the source of the personal data;
(i) whether automated decision-making, including profiling, takes place.
Therefore, the Client has the right to request information from the Operator as to whether and to what extent it processes any personal data about the Client.
Right to request rectification of Personal Data pursuant to Article 16 of the Regulation
In accordance with the principle of accuracy, which stipulates that personal data must be accurate and, if necessary, updated, the Client has the right to have the Operator correct inaccurate data without undue delay; at the same time, the Client has the right to have inaccurate data completed.
The right to erasure of personal data pursuant to Article 17 of the Regulation
The Client has the right to request the Operator to delete his/her personal data without undue delay, and the Controller is obliged (provided that all the legal conditions are met) to delete such data if one of the following reasons is given:
(a) the data is no longer necessary for the purposes for which it was collected;
(b) the client withdraws the consent on the basis of which it was obtained (but at the same time there must be no other legal ground for processing, e.g. law);
c) the client objects to the processing of his/her data and there are no overriding legitimate grounds for processing;
(d) the client's data was obtained unlawfully.
However, the above does not apply in situations where the processing of the client's personal data is necessary:
(a) for the exercise of the right to freedom of expression and information;
b) to comply with a legal obligation of the Operator, typically the fulfilment of obligations under the HHH and AML Act;
c) for the establishment, exercise or defence of the Operator's legal claims.
Right to withdraw consent to processing
Any client may withdraw his/her consent to the processing of his/her personal data. However, the withdrawal of consent shall not affect the lawfulness of the processing of personal data prior to the withdrawal of consent by the Client.
Right to restriction of processing
The Client has the right to have the Operator restrict the processing of his/her personal data if:
(a) the client denies the accuracy of his personal data (for the period of their verification);
b) the processing is unlawful and the client refuses to erase it, instead requesting only to restrict its use;
c) the operator no longer needs the client's personal data, but the client requests that it be retained for the establishment, exercise or defence of legal claims;
d) the Client objects to the Operator's processing of his/her personal data and the processing will be restricted until it is verified that the legitimate grounds of the Operator outweigh the legitimate grounds of the Client.
This is only a measure of a temporary nature, which makes it significantly different from the right to erasure of personal data.
Right to data portability
This right provides the client with the possibility of transferring the personal data obtained (processed) by the Operator to a third party, if the processing by the Operator is based on the client's consent or on a contract and is carried out by automated means.
The data may only be provided to the third party in a structured, commonly used and machine-readable format.
Right to object
Any Client may object to the Operator at any time to the processing of their personal data on the basis of the Operator's legitimate interest. Unless the Operator subsequently demonstrates legitimate grounds for processing the Client's personal data that outweigh the Client's interests, or the Operator demonstrates another reason for processing, the Operator will no longer process the data, or will delete or anonymize the data.
Right to lodge a complaint
Every client of the Operator has the right to lodge a complaint with the Office for Personal Data Protection
Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.cz .
How can you exercise your rights?
Any client who wishes to exercise any of his/her rights listed above may do so either by mail to Na krčské strání 712/72, Krč, Prague 4, 140 00 or by email to info@mp-online.cz.
The deadline for sending a reply is 30 days, which may be extended in complex cases.
10) Current wording
This Privacy Policy of the Operator may change over time, the current version can always be found on the Website in the relevant section. The current version is always effective upon its publication. Please check this policy regularly if you want to always have the most up-to-date information on the processing of personal data.
By accessing or using any of our services, you acknowledge that you have read this Privacy Policy.
