Data Protection & Privacy

Data We Collect

Pragmatic Play Ltd, operating the platform accessible at aztec-bonanza.com under a recognised gaming authority, processes personal data in strict accordance with applicable data protection legislation, including but not limited to the General Data Protection Regulation (EU) 2016/679. The following categories of personal data are subject to collection and processing within the scope of legitimate operational activities:

• Identification Data: Full legal name, date of birth, nationality, and government-issued identification document details are collected for the purposes of identity verification and regulatory compliance.
• Contact Data: Electronic mail addresses, telephone numbers, and residential or correspondence addresses are recorded to facilitate communication and account administration.
• Technical Data: Internet Protocol (IP) addresses, browser type and version, operating system identifiers, device fingerprints, session identifiers, and connection timestamps are automatically captured upon interaction with the platform.
• Transactional Data: Records pertaining to financial transactions, payment instrument details, transaction histories, wagering activity, and account balance information are retained in accordance with applicable financial and regulatory requirements.
• Behavioural Data: Navigation patterns, platform interaction logs, user preferences, session duration metrics, and feature utilisation data are collected through automated means including cookies and similar tracking technologies.
• Verification Data: Documentation submitted for the purposes of Know Your Customer (KYC) procedures, source of funds verification, and anti-money laundering compliance, including copies of identity documents and supporting financial records.
• Communication Data: Records of correspondence initiated by or directed to data subjects, including electronic mail exchanges, support ticket content, and chat transcripts, are retained for quality assurance and dispute resolution purposes.

Personal data is collected through direct submission by the data subject, automated technical collection mechanisms, and, where applicable, third-party verification service providers engaged under appropriate data processing agreements.

Data Usage

Personal data collected through the platform is processed exclusively for specified, explicit, and legitimate purposes in accordance with the principle of purpose limitation. The following processing purposes have been identified and applied within the operational framework of Pragmatic Play Ltd:

• Account Administration and Service Provision: Personal data is utilised to establish, maintain, and administer registered user accounts, to facilitate access to platform services, and to ensure the continuous and secure delivery of gaming and entertainment content.
• Regulatory and Legal Compliance: Processing activities are carried out to fulfil obligations imposed by a recognised gaming authority, including but not limited to identity verification, responsible gaming monitoring, anti-money laundering procedures, and the generation of mandatory regulatory reports.
• Transaction Processing and Financial Administration: Personal and transactional data is processed to authorise, record, and reconcile financial transactions, to facilitate withdrawals and deposits, and to maintain accurate financial records as required by applicable accounting and financial regulations.
• Fraud Prevention and Security: Behavioural, technical, and transactional data is analysed for the detection and prevention of fraudulent activity, unauthorised access, collusion, and other security threats to the integrity of the platform and the interests of registered users.
• Customer Support and Dispute Resolution: Communication and account data is accessed by authorised personnel for the purposes of responding to enquiries, resolving disputes, and providing technical assistance to registered users.
• Responsible Gaming: User activity and behavioural data is monitored and assessed to identify indicators of problematic gambling behaviour and to implement appropriate responsible gaming measures, including self-exclusion mechanisms and intervention protocols.
• Legal Proceedings and Enforcement: Personal data may be processed in the context of legal proceedings, regulatory investigations, or the enforcement of contractual terms and conditions where such processing is necessary for the establishment, exercise, or defence of legal claims.
• Platform Improvement and Analytics: Aggregated and anonymised behavioural and technical data may be subjected to analytical processing for the purposes of improving platform functionality, enhancing user experience, and optimising operational performance.

All processing activities are grounded in an identified and documented legal basis, which may include the performance of a contract, compliance with a legal obligation, the legitimate interests of the data controller, or, where required, the explicit consent of the data subject.

Data Security

Pragmatic Play Ltd has implemented a comprehensive framework of technical and organisational measures designed to ensure an appropriate level of security for personal data processed in connection with the platform at aztec-bonanza.com. Such measures are applied in consideration of the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity posed to the rights and freedoms of natural persons.

The following technical and organisational safeguards are maintained and periodically reviewed:

• Encryption: Personal data transmitted between user devices and platform infrastructure is protected through industry-standard Transport Layer Security (TLS) protocols. Data at rest is encrypted utilising Advanced Encryption Standard (AES) algorithms of appropriate key length to prevent unauthorised access.
• Access Controls: Access to systems and databases containing personal data is restricted on the basis of the principle of least privilege. Role-based access control mechanisms are applied, and access rights are subject to regular review and revocation upon change of personnel status.
• Authentication Mechanisms: Multi-factor authentication protocols are enforced for administrative access to critical systems. Password policies mandating complexity, length, and periodic rotation are implemented across all relevant systems.
• Network Security: Perimeter and internal network security is maintained through the deployment of firewalls, intrusion detection and prevention systems, and network segmentation practices designed to limit the exposure of sensitive data environments.
• Vulnerability Management: Regular security assessments, penetration testing, and vulnerability scanning exercises are conducted by qualified internal or third-party security professionals. Identified vulnerabilities are subject to documented remediation procedures and defined resolution timelines.
• Incident Response: A documented personal data breach response procedure is maintained, providing for the identification, containment, assessment, and notification of data security incidents in accordance with applicable regulatory obligations, including mandatory notification to the relevant supervisory authority within prescribed timeframes.
• Third-Party Due Diligence: Third-party service providers engaged in the processing of personal data on behalf of Pragmatic Play Ltd are subject to rigorous due diligence assessments and are required to enter into data processing agreements incorporating appropriate contractual safeguards prior to any transfer or disclosure of personal data.
• Staff Training: Personnel with access to personal data are required to undertake data protection training commensurate with their role and responsibilities. Awareness programmes are maintained and updated in response to changes in applicable legislation and emerging threats.
• Data Minimisation and Retention: Personal data is retained only for the period necessary to fulfil the purposes for which it was collected or as required by applicable legal and regulatory obligations. Retention schedules are documented and enforced through defined data lifecycle management procedures, following which data is securely deleted or anonymised.

Notwithstanding the foregoing measures, no system of security can be guaranteed to be impenetrable. In the event that a data subject becomes aware of circumstances suggesting a potential compromise of their account security, immediate notification to the platform's data protection contacts is strongly encouraged.

Your Rights

In accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national implementing legislation, data subjects whose personal data is processed by Pragmatic Play Ltd in connection with the operation of aztec-bonanza.com are entitled to exercise the following rights with respect to their personal data:

• Right of Access: Data subjects are entitled to obtain confirmation as to whether personal data concerning them is being processed and, where such processing is confirmed, to receive a copy of the personal data undergoing processing together with supplementary information regarding the nature, purposes, and conditions of such processing.
• Right to Rectification: Data subjects are entitled to request the correction of inaccurate personal data concerning them and, having regard to the purposes of processing, to request the completion of incomplete personal data, including by means of providing a supplementary statement.
• Right to Erasure: Data subjects are entitled to request the deletion of personal data concerning them where such data is no longer necessary in relation to the purposes for which it was collected, where consent has been withdrawn and no alternative legal basis exists, or where the data has been unlawfully processed, subject to applicable legal retention obligations that may preclude immediate erasure.
• Right to Restriction of Processing: Data subjects are entitled to request that the processing of their personal data be