Privacy Notice

1. What is the purpose of this privacy notice?

1.1. B2Nova OÜ (we or us) offers the FLOP PM platform for legal entities, assisting poker rooms in automating and optimizing their operations, and the Flop Up for individuals, enabling poker players to find gaming opportunities and enhance their poker experience.

1.2. We value your privacy and are committed to protecting your personal data. We process your personal data in accordance with the General Data Protection Regulation (the GDPR) and other applicable laws.

1.3. This privacy notice explains how we process, including collect, use and retain, your personal data when you or the legal entity you represent conclude a contract with us, when you access and use the Flop Up, when you visit our website, when you communicate with us, or engage in any other actions that involve us receiving and processing your personal data.

1.4. Please note that this privacy notice does not describe how we process personal data when providing the FLOP PM platform, as we process personal data as a processor. The processing of such personal data is governed by the data processing agreement concluded with our client, the controller. The controller is responsible for such data processing and is obliged to provide you information about such personal data processing.

1.5. If you disclose any personal data regarding any third parties, such as your employees or management board members, you are obligated to refer them to this privacy notice.

2. Who is the data controller of your personal data?

2.1. Controller of the personal data is a person, who determines the purposes and means of the processing of the personal data.

2.2. For the personal data processing activities described in this privacy notice, the controller of your personal data is B2Nova OÜ, a company registered under the laws of Estonia, with registry code 17118964.

2.3. If you have any questions on how we process personal data or wish to exercise your data subject rights, please contact us by writing to contact@b2nova.com.

3. What personal data do we process?

3.1. Personal data is any information that can be used to directly or indirectly identify you as an individual. We may process the following personal data about you:

Category of personal data	Types of personal data
Main Data	Full name username password e-mail address Country of residence City of residence Profile picture phone number the legal entity you represent and your position geolocation privacy mode
Gaming Data	Played live games history Favourite Game Variants and Game Sizes Personal Player Biography (About me)
Communication Data	Full name username e-mail address phone number country the legal entity you represent and your position date and time of the communication your message
Marketing Data	Full name e-mail address phone number the legal entity you represent and your position obtained consent
Loyalty Program Data	Full name username activity game history loyalty points rewards
Usage Data	user ID actions made, attributes to that action error logs clickstream data session duration user agent string page load times
Log Data	session ID IP address device information date and time of your visit visited pages and screens session duration geolocation data network data website cookies

3.2. If you do not provide the necessary data, we may not be able to contact you, conclude a contract with you or the legal entity you represent or fulfil any other purposes provided in this privacy notice.

4. What are the sources from where we collect your personal data?

4.1. We may collect the personal data:

4.1.1. From you, for example if you create account at Flop Up or contact us;
4.1.2. When you use the Flop Up or visit the website, by generating the personal data;
4.1.3. From third parties, for example from the legal entity you represent.

5. What are the purposes and legal basis of processing?

5.1. The legal basis for processing your personal data is determined by the purpose and context in which the data is collected. We may process your personal data for the following purposes and legal basis:

Processing purpose	Legal basis	Category of personal data
Handling pre-contractual negotiations and communications	Taking and implementing pre-contractual measures of the potential contract to be concluded between us; Our legitimate interest in taking and implementing pre-contractual measures of the potential contract to be concluded between the legal entity you represent and us	Main Data, Communication Data
Performing the contract, including managing contractual relationship, providing and managing the service, managing your account, providing information about updates, responding to communications you send to us, monitoring the fulfilment of the contract	Performing the contract concluded between us; Our legitimate interest in performing the contract concluded between the legal entity you represent and us	Main Data, Gaming Data, Communication Data
Analysing the use of our service to improve, upgrade and enhance the service	Our legitimate interest in improving, upgrading and enhancing our service	Gaming Data, Usage Data, Log Data
Making available the website, administering the website, including gathering information about your navigation on the website	Our legitimate interest in providing the website, ensuring optimal functionality, enhancing user experience, and improving website performance and content relevance	Usage Data, Log Data
Conducting direct marketing to promote our services, such as newsletters, blogs, and live event promotion	Consent	Marketing Data
Measuring the effectiveness of marketing tools	Our legitimate interest in improving the efficiency of marketing tools	Marketing Data
Storing information containing personal data in our backup systems	Our legitimate interest in ensuring the continuity and security of data processing operations	All data categories (as necessary)
Complying with legal or regulatory obligations or requests	Performance of legal obligation	All data categories (as necessary)
Establishing, exercising, or defending legal claims, whether in court, administrative, or out-of-court proceedings	Our legitimate interest in protection our, our clients' and/or employees' rights	All data categories (as necessary)

6. To whom may we transfer your personal data?

6.1. We may share your personal data with the following recipients:

6.1.1. Poker room providers: to provide our services to you, including find live games and register for waiting lists;
6.1.2. Service providers: hosting and infrastructure provider and data storage provider, to provide the our services;
6.1.3. Business partners: to carry out joint ventures or collaborations to enhance business offerings;
6.1.4. Our affiliates: to enhance operational efficiency, collaborate on product development, and ensure compliance and risk management across the organization;
6.1.5. Public sector authorities, including supervisory and law enforcement authorities: to fulfil our statutory obligation, a court order, to establish exercise or defend our legal rights or in other cases where this is necessary to prevent and deter unlawful acts;
6.1.6. Professional advisors: to maintain compliance, manage risks, and make informed decisions;
6.1.7. Legal successors and/or potential acquirers: to facilitate business transitions such as mergers, acquisitions, or restructuring, ensuring continuity and compliance during the transfer of business operations and assets;

6.2. If we transfer personal data to recipients located outside the European Union or European Economic Area (the EU/EEA), we implement safeguards, such as standard contractual clauses approved by the European Commission, to ensure that your personal data receives a level of protection comparable to that within the EU/EEA. Upon request, we will provide additional information regarding the safeguards in place.

7. How long do we retain your personal data?

7.1. We retain your personal data for as long as is necessary for the purposes set out in this privacy notice or until the legal obligation stipulates that we do so. When determining the retention period for personal data, we consider the type of personal data being processed, including its nature and sensitivity, the purpose of processing, whether the purpose can be achieved by other means, and the potential harm from personal data breaches. We also take into consideration the need to resolve disputes and enforce contracts. We retain the following categories of personal data as follows:

Category of personal data	Retention period
Main Data	While account is active: Retained in full After account deletion: 24 months
Gaming Data	While account is active: Retained in full After account deletion: 24 months (anonymized where possible)
Communication Data	While account is active: Retained in full After account deletion: 12 months
Marketing Data	While account is active: Retained in full After account deletion: 12 months
Loyalty Program Data	While account is active: Retained in full After account deletion: 24 months
Usage Data	While account is active: Retained in full After account deletion: 12 months (aggregated/anonymized)
Log Data	While account is active: Retained in full After account deletion: 6-12 months

7.2. Following the retention period, or if the respective personal data is no longer necessary for the processing purposes, we will erase the data, unless retention is required for compliance with legal obligations or for the establishment, exercise, or defence of legal claims.

8. What are your rights as a data subject?

8.1. As a data subject, you have the following rights, which you may exercise at any time, subject to the limitations imposed by applicable data protection laws:

8.1.1. Right to rectification: you have the right to request that we correct any of your personal data if we process inaccurate or incomplete personal data. If you use the Flop Up, you can correct your personal data at any time in your account settings;
8.1.2. Right to erasure: you have the right to request that we delete your personal data, for example when the personal data is no longer necessary for the purposes for which it as collected, the personal data has been unlawfully processed or if the personal data must be erased for compliance with a legal obligation to which we are subject to. If you use the Flop Up, you can delete your account at any time in your account settings;
8.1.3. Right to restrict the processing: you have the right to request that we restrict certain processing of your personal data, for example if the accuracy of the personal data is contested by you or if we no longer need your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
8.1.4. Right to data portability: you have the right to receive your personal data which you have provided to us, in a structured, commonly used and machine-readable format and transmit those data to another controller if the processing is based on consent or on a contract and the processing is carried out by automated means;
8.1.5. Right to object: you have the right to object to the processing of your personal data, for example if we process your personal data for marketing purposes or when processing is based on our legitimate interests;
8.1.6. Right to withdraw your consent: if the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal;
8.1.7. Right to submit a complaint to a data protection authority: if you are not satisfied with our response to your request, or if you believe we are processing your personal data in violation of applicable law, you have the right to submit a complaint to your local data protection authority. The contact details of the data protection authorities can be found here.

8.2. To exercise the above rights, please contact us as specified in Section 2 of this privacy notice. Please note that you should supply us with adequate information for us to respond to your requests. Prior answering your request, we may ask you to provide additional information for the purposes of authenticating you and evaluating your request.

9. Updates to this privacy notice

9.1. We may update or modify this notice from time to time to reflect changes in our personal data processing practices. The most recent version of the notice will always be available on this webpage. Please revisit this page regularly, especially before submitting any new personal data.