Privacy Policy
Effective Date: January 1, 2026 • GDPR & ISO/IEC 27001 Standard Compliant • Applicable to B2B Operators & API Integrations.
Data Processor vs Data Controller Architecture
Under international privacy regulations (including GDPR, UK Data Protection Act, and LGPD), the Operator acts as the Data Controller regarding their registered consumer players. NoviSoft acts strictly as a Data Processor, processing only pseudonymous member tokens and numerical transaction values necessary to execute game launch routing and wallet settlement.
01. Categories of Data We Process
In our capacity as a B2B game aggregation engine, we collect and process the following limited data types:
A. Operator Corporate Telemetry
Corporate email, company registration name, contact handle (Telegram/Skype/Slack), billing settlement records, and designated server IP addresses.
B. Pseudonymous Gameplay Telemetry
Obfuscated member_account identifiers, game studio product codes, transaction IDs, bet amount, win payout, currency ISO, and round timestamps.
02. Legal Basis & Purpose of Processing
- Contractual Execution: To authenticate game launch requests, verify player session tokens, and route bet/win webhooks synchronously.
- Financial Settlement & GGR Audits: To compute exact Gross Gaming Revenue (GGR) shares, 10x credit quota balances, and multi-tier agent commissions.
- Fraud & Abuse Prevention: To monitor transaction velocity, identify malicious replay attacks, and enforce IP allowlist firewalls.
- Regulatory Compliance: To retain audit-ready mathematical logs required by independent testing labs (GLI, BMM, iTech Labs).
03. Security, Encryption & Storage Architecture
3.1 In-Transit Encryption: 100% of API communications between Operator servers, NoviSoft gateway, and game studios are encrypted using TLS 1.3 with high-grade AES-256 ciphers.
3.2 Data at Rest: Transactional logs and database ledgers are encrypted at rest with military-grade AES-256 hardware security modules.
3.3 Cryptographic Signing: Webhook communications are signed with HMAC-SHA256 digests utilizing private secret keys to prevent tampering and payload modification in transit.
04. Data Sharing with Authorized Game Studios
When a player launches a game, pseudonymous session tokens and transaction amounts are securely passed to the authorized game provider (e.g., Pragmatic Play, Evolution, PG Soft) exclusively to render the game UI and calculate random number generator (RNG) outcomes. No third-party data monetization or marketing sharing occurs.
05. Retention Periods & Operator Data Rights
5.1 Retention Schedule: Game transaction ledgers and financial audit logs are retained for five (5) years in compliance with international anti-money laundering and tax accounting regulations.
5.2 Right to Erasure / GDPR Requests: Operators may request anonymization or deletion of inactive server telemetry upon account closure by contacting our Data Protection Officer.
For data protection inquiries or to execute a Data Processing Addendum (DPA):
Contact our Data Protection Officer (DPO) →