Your Privacy at Oshi
Novatrix SRL is the data controller for your personal information. We decide why and how that information is processed. A designated data protection officer handles questions, rights requests and complaints about personal data.
Information we handle
We may process your name, username, date of birth, gender, nationality, identification numbers and identity documents. Contact and financial information can include your address, proof of address, e-mail address, phone number, bank or card details, and evidence of your source of funds or wealth.
We also process deposits, withdrawals, games, login and logout times, wagers, bonuses and responsible gaming measures. Technical data includes your IP address, location, login information, browser and device settings, operating system and platform. Your marketing choices, communications with us and other information you provide during those communications may also be collected.
Why we process it
We use personal data to manage your account, process transactions, verify identity, answer questions and provide access to promotions. The legal basis is performance of our contract with you.
Legal obligations support AML and KYC checks, responsible gaming controls and regulatory reporting. Legitimate interests support fraud and bonus-abuse prevention, risk management, analytics, research, technical troubleshooting, service improvement and streamlined customer communications assisted by artificial intelligence. Security monitoring relies on legitimate interests and legal obligations. Marketing and personalization rely on your consent or our legitimate interests.
Where information comes from
Data may come directly from you, identity and age verification providers, financial institutions, AML and politically exposed person databases, regulators, responsible gaming databases and business partners. Such partners can be affiliate networks, ad platforms or analytics services that pass on pseudonymous information.
Who may receive it
We may share only the information needed for a defined role with group members, game and payment providers, marketing partners where you consent, law enforcement or regulators where law requires it, communication and conversational artificial intelligence providers, AML and KYC tools, lawyers and consultants. Information may also transfer during a merger, acquisition or sale, with notice before that change occurs.
Transfers outside the European Economic Area use appropriate safeguards, such as European Commission-approved standard contractual clauses or transfers to countries recognized as providing adequate protection.
How long we keep it
We retain personal data only as long as needed for its purpose, taking the law, data type and risks into account. AML rules require retention for at least five years after account closure, so an earlier deletion request cannot be processed. We may retain anonymized information for service improvement and marketing communications without automated decision-making.
Your choices and rights
You may withdraw consent subject to legal or contractual restrictions, access or correct your information, request deletion, restrict or object to processing, request portability, opt out of marketing and complain to a data protection authority.
We generally do not use fully automated decisions. If we use them in a specific case, we will inform you separately where the law requires it.
Protection and changes
We use reasonable technical, physical and administrative safeguards and limit access to people who need the information for business purposes. Keep your login details confidential. You may enable two-factor authentication.
We may revise this policy as technology and legal requirements change. For privacy questions or rights requests, contact [email protected].