Privacy policy

Privacy Policy

Table of Contents

• A. General
• B. Inquiries and Data Protection Officer
• C. How Megapixel Entertainment Limited Processes Personal Data
• D. Data Security
• E. Players' Rights Regarding Their Personal Data
• F. Inquiries
• G. Changes to This Privacy Policy

A. General

Megapixel Entertainment Limited (together with other companies within the group), 122 Andrea Debono Street, Naxxar NXR4030, Malta, as the data controller responsible for the collection and processing of personal data on its websites www.wunderino.de, is committed to strictly protecting players' personal data in accordance with applicable legal obligations, including the EU General Data Protection Regulation [Regulation (EU) 2016/679] as well as national Maltese and German data protection laws. This Privacy Policy describes how Megapixel Entertainment Limited processes personal data and informs players of their rights in this regard.

Personal data is any information relating to an identified or identifiable natural person.

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of disclosure, the alignment or combination, restriction, erasure, or destruction.

Personal data is processed by Megapixel Entertainment Limited only if:

• the player has consented to such processing,
• the processing is necessary for the provision of the services offered,
• the processing is carried out to comply with legal requirements applicable to Megapixel Entertainment Limited or requirements arising from Megapixel Entertainment Ltd.'s license to operate virtual slot machine games in Germany, or
• the processing is necessary for the pursuit of the legitimate interests of Megapixel Entertainment Limited, third parties, or the public, provided that such legitimate interests are not overridden by the fundamental rights of the respective player in the individual case.

By accepting this Privacy Policy, the player agrees that Megapixel Entertainment Ltd. may collect and process their personal data as described in this Privacy Policy.

B. Inquiries and Data Protection Officer

For questions regarding data protection, inquiries, and/or further information about data processing by Megapixel Entertainment Limited, please contact the Data Protection Officer at:

Megapixel Entertainment Limited
DPO
122, Andrea Debono Street, Naxxar NXR4030, Malta
[email protected]

C. How Megapixel Entertainment Limited Processes Personal Data

1. Principles of Data Processing

Megapixel Entertainment Limited processes personal data exclusively in accordance with the principles set forth in Article 5(1)(a) to (f) of the EU General Data Protection Regulation (GDPR):

a. Lawfulness, fairness, and transparency: Personal data is processed only lawfully, fairly, and in a manner that is transparent to the data subject.

b. Purpose limitation: Personal data is collected only for specified, explicit, and legitimate purposes and may not be further processed in a manner incompatible with those purposes.

c. Data minimization: Personal data is processed only to the extent that is appropriate and relevant to the purpose, and processing is limited to what is necessary for the purposes of the processing.

d. Accuracy: Personal data shall be processed only in a factually accurate manner and, where necessary, kept up to date.

e. Storage limitation: Personal data shall be stored only in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

f. Integrity and confidentiality: Personal data is processed only in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical and organizational measures.

2. Collection and Processing of Data on the Website and in Connection with Megapixel Entertainment Limited's Gaming Services

a. When Visiting the Website

While visiting the websites of Megapixel Entertainment Limited, the system automatically collects information generated by the browsers of website visitors and temporarily stores it in log files. This may include, but is not limited to:

• the IP address
• date and time of access / timestamp
• the operating system
• the browser used by the visitor
• the Internet service provider (ISP)
• the exit pages
• the platform type
• the number of clicks

This data is used to ensure a secure connection to the website, analyze trends for website management, track visits, monitor player activity on the website, and collect comprehensive demographic information. Log files may contain IP addresses that allow a specific player to be identified, directly or indirectly.

Processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR:

• to ensure a stable and secure connection to the website
• personalization and optimization of the services offered by Megapixel Entertainment Limited
• to detect misuse of the websites operated and/or the services provided by Megapixel Entertainment Limited
• to identify and resolve malfunctions on the websites of Megapixel Entertainment Limited

b. Upon Registration on the Websites of Megapixel Entertainment Limited

Megapixel Entertainment Limited is legally required to collect the following personal data from players upon registration:

• All first and last names
• Maiden name
• Gender
• Full address / place of residence
• Date of birth
• Place of birth
• Nationality
• Email address
• Phone number

This data collection and processing is legally required under the German Money Laundering Act (GwG) and pursuant to Section 6a(2) of the State Treaty on Gaming (GlüStV) 2021. The legal basis for data processing is therefore Article 6(1)(c) of the GDPR.

Megapixel Entertainment Ltd. is required to verify, during player registration, whether the player is a Politically Exposed Person (PEP), a family member of a PEP, or a person known to be closely associated with a PEP (Section 10 AMLA), and conducts a comparison with PEP and sanctions lists accordingly. For this purpose, Megapixel Entertainment Ltd. uses the service provider EezyComply, which acts as a data processor.

For legally required identity verification (Sections 11, 12 GwG and Section 6b(4) GlüStV 2021), Megapixel Entertainment Ltd. uses the following external service providers:

• SCHUFA
• Klarna Bank AB (for "Sign-in-with-Klarna")
• Advanced Living Technologies GmbH (SONIO): Document upload and video verification via selfie with liveness detection
• Insinc: 1-cent transfer with TAN, and if necessary, video verification via selfie with liveness detection

Identity verification must be repeated at least annually and whenever there is a change in the player's personal data. The player is obligated to keep their personal data up to date at all times.

The legal basis is Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests):

• personalization and optimization of the services offered
• detection of misuse of the websites and/or services provided
• fulfillment of contractual agreements and/or legal obligations

Furthermore, Megapixel Entertainment Ltd. collects the player's IP address upon registration and with each subsequent login to ensure a secure and stable connection and guarantee the proper functioning of the services. The legal basis is Art. 6(1)(f) GDPR (legitimate interests):

• ensuring a secure and stable connection to the website
• detecting misuse of the websites and/or services
• identifying and resolving malfunctions on the website
• personalizing and optimizing the services offered

c. Data Processing for the Purpose of Processing Payment Transactions

To use the services of Megapixel Entertainment Limited, it is necessary to conduct transactions on the website. Depending on the payment method selected, the personal data required may vary, but typically includes:

• Player ID
• Full name
• Bank account details (IBAN and BIC) or payment account number or payment card number
• Payment service provider / e-money institution / bank / payment card type (MasterCard/Visa)
• Time and date of the transaction
• Transaction amount
• Transaction status (successful / unsuccessful)
• Transaction type (deposit, wager, winnings, bonus, withdrawal)
• Resulting balance in the player account

The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

Megapixel Entertainment Ltd. is also legally required to verify players' account data. Deposits and withdrawals may only be made from or to a bank or payment account held in the player's name at a credit/e-money/payment institution based in the EU/EEA (§ 16(4), (7) GwG, § 6b(4) GlüStV 2021). E-money institutions and payment service providers act as data processors for this account data verification.

d. Data Processing for the Purpose of Service Provision

(1) For the Purpose of OASIS Verification

Megapixel Entertainment Ltd. is legally obligated to exclude players listed in the nationwide OASIS player exclusion database from participating in games (Section 8(3) GlüStV 2021). For each OASIS Status API query, the following personal data is transmitted:

• The player's full name
• The player's address
• The player's date of birth

Megapixel Entertainment Ltd. is also obligated, at the player's request or based on factual indications of problem gambling, to enter a permanent self-exclusion or third-party ban in OASIS (Section 8a GlüStV 2021). The following data is entered into the exclusion file in accordance with § 23 GlüStV 2021:

• Last names, first names, birth names
• Aliases, false names used
• Date of birth
• Place of birth
• Address
• Photographs
• Reason for the ban
• Duration of the block
• Reporting suspension

Megapixel Entertainment Ltd. also enters a 24-hour temporary block in OASIS following use of the panic button.

The legal basis is Article 6(1)(c) of the GDPR.

(2) For LUGAS

Megapixel Entertainment Ltd. is legally obligated to register every newly registered player in the LUGAS central files (limit and activity file, jointly maintained by the Joint Gambling Authority of the German States, GGL). The following personal data is transmitted for this purpose:

• Last name, first name, birth name
• Date of birth
• Place of birth
• Address
• Player ID
• Amount of the maximum monthly cross-provider deposit limit set by the player
• Date the limit was set

After registration, LUGAS pseudonymizes the player's name, date of birth, place of birth, and address (but not the player ID).

Before each deposit, Megapixel Entertainment Ltd. queries the LUGAS limit file to verify whether the cross-provider deposit limit for the relevant calendar month has been reached or would be exceeded by the intended deposit.

Megapixel Entertainment Ltd. holds a license to grant increased monthly cross-provider deposit limits. To conduct the required financial capacity assessment, it uses:

• SCHUFA Holding AG (SCHUFA-G-Check): transmitting the player's name, date of birth, and address.
• Semla (account review procedure): the player logs in to their bank account; Semla forwards an income and expenditure overview to Megapixel Entertainment Ltd.

The financial eligibility check must be repeated annually.

Megapixel Entertainment Ltd. is also required to conduct enhanced monitoring of players with an increased monthly deposit limit and must report specific players to LUGAS in cases where the conditions for the increased limit no longer apply.

Furthermore, Megapixel Entertainment Ltd. is legally obligated to query the activity file before permitting participation in a game (§ 6h GlüStV 2021), transmitting the player's last name, first name, birth name, date of birth, place of birth, and address. An inactivity notification is automatically sent when a player logs out or after more than 30 minutes of inactivity on the website.

Megapixel Entertainment Ltd. is also legally obligated to operate a secure server accurately recording all data necessary for gambling supervision, stored in a digitally unalterable manner, with electronic access enabled for the GGL/LUGAS (§ 6i(2) GlüStV 2021). LUGAS retrieves data from the secure server at least once a day.

The legal bases are Art. 6(1)(c) and Art. 6(1)(b) GDPR.

(3) Game Manufacturers

Megapixel Entertainment Ltd. does not develop the virtual slot games it offers itself, but licenses them from game manufacturers whose platforms are linked via API. The following personal data is transmitted to game providers for the purpose of enabling gameplay:

• The player ID
• The player's balance in their gaming account
• The IP address
• The device from which the player participates in the games

Current game manufacturers include:

Apparat, Blueprint, BoomingGames, Edict Merkur, ELK Gaming, Evolution Gaming, Games Global, Greentube, Hell Games, No Limit City, Oryx Gaming Limited, Pariplay, PlaynGO, Playson, Playzia, Pragmatic, Push Gaming, Quickspin, RedRake, Relax Gaming, RGS Matrix, Skywind, Spinomenal, Swintt, Synot, Wazdan, Gamomat, Yggdrasil, Zeal

The legal basis is Art. 6(1)(b) GDPR.

(4) Monitoring for Early Detection of Gambling Addiction

Megapixel Entertainment Ltd. is legally obligated to implement an automated, algorithm-based system for the early detection of gambling addiction (§ 6i(1) GlüStV 2021). All player participation data is monitored, including the frequency, duration, and regularity of gaming participation, times of participation, frequency and amount of deposits, and the amount of bets. All transaction and gaming activities are recorded.

The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

(5) Anti-Money Laundering Monitoring

Megapixel Entertainment Ltd. is legally obligated to continuously monitor players and their transactions to detect money laundering or terrorist financing as early as possible (§ 10(1)(5) GwG). All transaction and gaming participation data is monitored, including deposits, withdrawals, and gaming activities.

The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

(6) EDD (Enhanced Due Diligence)

Where an increased risk of money laundering and/or terrorist financing is identified (e.g., in the case of PEPs or unusual transactions), Megapixel Entertainment Ltd. applies enhanced due diligence measures (§ 15 GwG). These may include the following personal data:

• The player's basic information
• The player's financial background (occupation, income, assets, etc.)
• Transaction and gaming behavior

Megapixel Entertainment Ltd. is entitled to request additional documentation directly from players for these purposes. Players are legally obligated to provide the requested documentation.

The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

(7) Reporting Obligations

In the event of suspicion of money laundering or terrorist financing, Megapixel Entertainment Ltd. may be obligated to submit a suspicious activity report pursuant to Section 43 GwG to the Financial Intelligence Unit (FIU). The following personal data may be processed for this purpose:

• The player's master data
• Where applicable, data regarding the player's financial background
• Where applicable, data regarding the player's transaction and gaming behavior
• The facts indicating suspicion of money laundering or terrorist financing
• Where applicable, additional personal data requested by the FIU

The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

e. Use of Service Providers for Back-Office Operations

Megapixel Entertainment Ltd. uses the service provider EveryMatrix for the management of player data and player accounts in its back office. EveryMatrix acts as a data processor, processing personal player data exclusively on the instructions of Megapixel Entertainment Ltd. Legitimate interests for this processing include:

• the efficient, proper provision of services and delivery of an optimized player experience
• making available, optimizing, and improving the services offered
• detection of money laundering and/or misuse of the operated website and/or services
• enforcement of contractual agreements and/or legal obligations

f. Use of Storage Services, Server Maintenance Services, and Other IT Services

Megapixel Entertainment Ltd. uses the service providers Snowflake Inc. and Amazon Web Services for server capacity and server maintenance. Both act as data processors. Legitimate interests include:

• the efficient, proper provision of services and delivery of an optimized player experience
• making the services accessible, optimizing, and improving them
• fulfillment of contractual agreements and/or legal obligations

g. Communication with Players

Megapixel Entertainment Limited stores communications with players and website visitors, such as those with customer support. These communications may include:

• the name of the person seeking contact, if provided
• any contact details provided voluntarily
• other information voluntarily provided which may identify or make the person indirectly identifiable

For customer service, Megapixel Entertainment Ltd. uses the services of Intercom R&D Unlimited Company and another group company, both acting as data processors. Megapixel Entertainment Ltd. also reserves the right to use a chatbot (AI) for customer service.

The legal basis is Art. 6(1)(b) GDPR, along with legitimate interests including the ability to provide the requested information, personalization and optimization of services, and fulfillment of contractual and legal obligations.

g. For the Purpose of Marketing Activities

Depending on the account settings, which the player can set and change at any time, personal data may be used for marketing activities via various channels (mail, email, instant messaging, etc.).

Before sending individualized marketing communications, Megapixel Entertainment Ltd. is required to query the OASIS Marketing API (§ 5(5) GlüStV 2021), transmitting the player's full name, address, and date of birth. Player consent is always obtained before sending personalized advertising. The legal basis for this data processing is Art. 6(1)(a) GDPR. This consent may be revoked or restricted at any time.

The OASIS Marketing API query itself is a legal requirement, providing an additional basis under Art. 6(1)(c) GDPR.

Before granting bonuses, free spins, and/or other rewards, Megapixel Entertainment Ltd. is legally required to perform an OASIS Bonus API query to verify that the player's OASIS suspension has not been lifted within the last four weeks (§ 8(4) sentence 2 GlüStV 2021). The same personal data (full name, address, date of birth) is transmitted. The legal bases are Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) GDPR.

g. For the Purpose of Creating Player Profiles

Megapixel Entertainment Limited processes information collected through cookies, log files, clear GIFs, and/or third-party providers to create player profiles. Contact information from players who have consented to receive personalized advertising is uploaded to Simplify, where groupings are created based on player profiles. Profiles are also used to personalize the player experience and provide targeted marketing information.

Legitimate interests for profiling include making available, optimizing, and improving the services offered, and designing more effective and better-personalized advertising.

Beyond the profiling described above for marketing and risk-profile purposes, no profiling within the meaning of Article 22 of the GDPR takes place.

h. For Other Purposes

In exceptional cases, it may be necessary for Megapixel Entertainment Limited to process personal data for other purposes. The conditions set forth in Section C.1 apply in all cases.

i. Content and Third-Party Tracking Software

Megapixel Entertainment Limited uses cookies, tracking software, website analytics tools, social media plugins, and single sign-on technology, and may provide third-party content on its websites.

(1) Tracking Software

Integrated tracking software:

• Adform
• AppsFlyer
• Cookie yes
• Google Ads
• QuantCast
• Meta
• MyAffiliates

(2) Website Analytics

Integrated website analytics tools:

• Firebase
• Google Analytics
• Google Tag Manager
• Leadlink
• Quantcast
• Posthog
• Spoteffect

(3) Social Media Plugins

Integrated social media plugins:

• Facebook Connect
• X (formerly Twitter)
• LinkedIn

Unless cookies are technically essential for the proper functioning of the website, the use of non-essential cookies, analytics tools, tracking tools, and social media plugins requires the user's consent (Art. 6(1)(a) GDPR). This consent may be revoked or restricted at any time.

Technically necessary cookies are set on the basis of legitimate interests under Art. 6(1)(f) GDPR.

4. Transfer and Disclosure of Personal Data to Service Providers in Third Countries

Megapixel Entertainment Limited will under no circumstances transfer personal data to countries outside the European Economic Area, unless the recipient guarantees a level of data protection comparable to European standards (e.g., through approved contractual clauses, binding corporate rules, other appropriate measures, or based on an adequacy decision by the European Commission).

5. Anonymized Data

Megapixel Entertainment Limited reserves the right to publish gaming data (e.g., game results), the player's first name, the initial letter of the player's last name, and the player's country of origin on its websites, provided that the player cannot be identified either directly or indirectly through the publication of this information. Such publication is carried out to promote the services offered.

6. Data Sharing Within the Corporate Group

Megapixel Entertainment Ltd. may share personal data with other companies within the corporate group, in particular to leverage synergy effects. Such data may also include information regarding a player's self-exclusion.

7. Duration of Storage of Personal Data

Pursuant to § 6g(1) GlüStV 2021, personal player data must be retained for five years from the closure of the player account. Section 8 GwG requires KYC data to be retained for five years from the end of the year in which the business relationship was terminated.

Tax laws and commercial law provisions on proper bookkeeping may require a longer retention period of at least 6 years or even 10 years from the end of the year in which the data was collected. Megapixel Entertainment Ltd. will delete personal player data no later than the end of the longest resulting period.

D. Data Security

All data is processed automatically. Megapixel Entertainment Limited takes all reasonable technical and organizational measures to protect players' data from unauthorized access and to prevent accidental or unlawful processing, disclosure, destruction, loss, alteration, or damage.

• Payment information is encrypted during processing in accordance with PCI DSS.
• Confidential information is protected online through SSL encryption.
• Only authorized personnel of Megapixel Entertainment Limited or contractually bound third-party companies are granted access to player information.
• Megapixel Entertainment Limited monitors the trustworthiness and reliability of all employees and service providers and provides regular training on applicable security and data protection standards.
• Relevant servers are located in a secure environment.

E. Players' Rights Regarding Their Personal Data

The player has the right at any time:

• to submit a request for access pursuant to Art. 15 GDPR to view their personal data;
• to request the rectification of their personal data (Art. 16 GDPR);
• to withdraw consent to the processing of their personal data at any time (Art. 7(3) GDPR) — withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
• to request the erasure of their personal data (Art. 17 GDPR);
• to receive their personal data in a structured, commonly used, and machine-readable format (data portability, Art. 20 GDPR);
• to request the restriction of the processing of their personal data (Art. 18 GDPR); and
• to object to the processing of their personal data for reasons arising from their particular situation, where processing is based on legitimate interests (Art. 21 GDPR).

Furthermore, the player has the right at any time, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular with the Maltese data protection authority responsible for supervising Megapixel Entertainment Ltd.:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
Triq Il-Kbira (High Street)
Tas-Sliema SLM 1549, Malta
idpc.org.mt

Some of these rights are subject to certain conditions set forth in European data protection regulations, including the GDPR.

F. Inquiries

For inquiries or complaints regarding the processing and collection of data on the Megapixel Entertainment Limited website, please contact:

[email protected]

or the Maltese data protection authority:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
Triq Il-Kbira (High Street)
Tas-Sliema SLM 1549, Malta
idpc.org.mt

G. Changes to This Privacy Policy

This Privacy Policy may be subject to changes from time to time, of which players will be informed immediately upon their next login to their player account with Megapixel Entertainment Limited and may be required to consent to such changes. Nevertheless, Megapixel Entertainment Limited recommends that players review this Privacy Policy regularly for any changes.