Legal
Legal & regulatory information
Who we are, which law applies, and every document on the shelf.
Provisional: this document is not approved yet
Everything below is a draft. It becomes the studio's approved position only when every administrator has signed this exact version in the client area. Until then, read it as an accurate description of what we do and intend, not as a document anybody has signed off.
Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it. What approval means here
This page is the one an operator's legal or compliance team came for. It says who is behind this website, which law governs it, which instruments we hold ourselves to and where each one is answered, and it lists every legal document on the site with the date it took effect.
Where something does not exist yet, we say so. The things that do not exist yet are the company, the VAT registration and the gaming authorisation.
Who runs this website
The particulars article 8C(1) of the Electronic Commerce Act (Cap. 426) asks for, in the order that article lists them.
| Particular | Value |
|---|---|
| Name of the service provider | Does not exist yet. |
| Legal form | Does not exist yet. |
| Register | Does not exist yet. |
| Registration number | Does not exist yet. |
| Registered office | Does not exist yet. |
| Contact | hello@getawaygaming.com |
| VAT identification number | Does not exist yet. |
| Supervisory authority | No gaming authority has authorised anything. See the licence register. |
There is no company behind this website yet
Getaway Gaming is a studio in build. A Maltese private limited company is planned and has not been incorporated, so there is no register entry, no registration number, no registered office and no VAT number to publish. Nothing on this site is a contract with anybody, because there is no party to be one.
What reaches us is the address above. The day the company exists, every page on this shelf names it, because all of them read it from one file.
Which law, and which court
One answer for every document here, so two documents cannot point at two countries.
Every document on this site is governed by the laws of Malta, and any dispute about one goes to the courts of Malta. Nothing in this clause removes a protection that the law of your own country of residence gives you and does not allow to be contracted away.
Malta, because the company will be Maltese and the gaming authorisation will be Maltese. If a supplier's terms point at one jurisdiction and its licence at another, its compliance questionnaire takes three weeks longer than it needs to.
Every legal document on this site
With the audience it is written for, its version, and the date that version took effect. A document that is not on this list does not exist.
| Document | Written for | Answers | Version | In effect |
|---|---|---|---|---|
| Legal and regulatory information | anyone visiting this website | Who runs this website, under which law, and which documents exist. | 1.0 | 2026-10-04 |
| Terms of use | anyone visiting this website | What you may and may not do with this website and what we promise about it. | 1.0 | 2026-10-04 |
| Data processing agreement | licensed operators and their compliance teams | What we process for a licensed operator, on whose instruction, who helps us, and what survives the end of the contract. | 1.0 | 2026-10-05 |
| Privacy notice | anyone visiting this website | What personal data we process, why, on what basis, and what you can demand. | 2.1 | 2026-10-09 |
| Cookies and local storage | anyone visiting this website | Every value this site puts in your browser, and every request that leaves it. | 2.1 | 2026-10-09 |
| Candidate privacy notice | people applying for a job | What happens to an application, and how long it is kept. | 1.0 | 2026-10-04 |
| Security and vulnerability disclosure | security researchers | How to report a weakness, what we will do about it, and what we will not do to you. | 1.0 | 2026-10-04 |
| Business conduct | licensed operators and their compliance teams | Bribery, sanctions, conflicts, suppliers, forced labour, and the channel for saying so. | 1.0 | 2026-10-04 |
| Responsible play | licensed operators and their compliance teams | What the games refuse to do, and where each refusal is enforced. | 1.0 | 2026-10-04 |
| Licences and certifications | licensed operators and their compliance teams | Which authority has authorised us and which laboratory has tested a build. | 1.0 | 2026-10-04 |
| Accessibility statement | anyone visiting this website | What this site commits to, and where it is known to fail. | 1.0 | 2026-10-04 |
| Employee privacy notice | people applying for a job | What we hold about the people who work here, and the four things we will never do. | 1.0 | 2026-10-05 |
What we hold ourselves to
One row per instrument, with the clause that actually reaches a studio like this one, the date somebody opened the instrument rather than a summary of it, and the page that answers it.
| Instrument | Clause | What it obliges | Answered at | Read |
|---|---|---|---|---|
| Electronic Commerce Act (Cap. 426, Laws of Malta), as amended by Act XXXV of 2016 | article 8C(1) | A service provider must make its name, the geographic address where it is established, contact details including an email address, its trade register and registration number, the particulars of its supervisory authority where the activity is authorised, and its VAT number, available in a form that is easily, directly and permanently accessible. | /legal | 2026-10-04 |
| Directive (EU) 2017/1132 relating to certain aspects of company law | article 26 | A company's website must state at least the register in which its file is kept and its registration number in that register, its legal form, the location of its registered office, and where applicable that it is being wound up. | /legal | 2026-10-04 |
| Regulation (EU) 2016/679 (GDPR) | articles 13 and 14 | Anyone whose personal data we process must be told who the controller is, for what purposes and on what legal basis, who receives it, how long it is kept, which rights they have, and that they may complain to a supervisory authority. | /privacy | 2026-10-04 |
| Regulation (EU) 2016/679 (GDPR) | article 28 | Where we process personal data on an operator's behalf, that processing must be governed by a written contract with the specified contents. This is the clause that governs every round a licensed operator sends us, because an opaque player reference is pseudonymised personal data rather than no personal data. | /privacy | 2026-10-04 |
| Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) | regulation 5(1)–(2) | Storing information in, or gaining access to information stored in, a visitor's terminal equipment needs their consent after clear and comprehensive information, unless it is strictly necessary to provide the service they explicitly asked for. | /cookies | 2026-10-04 |
| Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) | regulation 9(1)–(2) | Direct marketing by email needs the recipient's prior consent in writing, except to an existing customer for our own similar products, who must be able to object free of charge in every message. This applies expressly whether the recipient is a natural or a legal person, so Malta has no business-to-business exemption. | /privacy | 2026-10-04 |
| Gaming Act (Cap. 583, Laws of Malta) and the Gaming Authorisations Regulations (S.L. 583.05) | the critical gaming supply authorisation | Supplying, from Malta or to a person in Malta, anything indispensable in determining the outcome of a game requires a business-to-business authorisation from the Malta Gaming Authority. We hold none, which is why nothing on this site is offered for real-money play. | /licences | 2026-10-04 |
| Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01) | the definition of a subject person | A holder of a critical gaming supply authorisation alone is not a subject person, so the customer due diligence regime that binds a casino does not bind us. What does reach us is the ordinary duty to satisfy ourselves that an operator we contract with is authorised. | /conduct | 2026-10-04 |
| Protection of the Whistleblower Act (Cap. 527, Laws of Malta) | the definition of employer, as amended on 18 December 2021 | A private-sector employer with 50 or more employees must operate an internal reporting channel, acknowledge a report within seven days and appoint an impartial person to follow it up. We are far below that threshold, so the channel on this site is offered rather than required. We offer it now because the day of the fiftieth hire is a bad day to design one. | /conduct | 2026-10-04 |
| Directive (EU) 2019/882 (European Accessibility Act) | article 2, the scope | Accessibility obligations attach to services provided to consumers, such as e-commerce, banking, transport and telephony. This site sells to licensed operators and sells nothing to a consumer, so the Act does not reach it. The accessibility statement is published anyway, with its known failures on it. | /accessibility | 2026-10-04 |
| Regulation (EU) 2024/2847 (Cyber Resilience Act) | article 2 and recital 12, on products with digital elements | The Act reaches software placed on the market as a product, not software delivered purely as a service. Our games are served from our own infrastructure, so today we are outside it. The certified client that `apps/game-shell` is reserved for would be a build handed to an operator, and that would change the answer. | /security | 2026-10-04 |
A read date is not a legal opinion. It records that the instrument itself was opened on that day. That is the weakest useful claim, and the only one we can stand behind. Citing an instrument from memory, or from somebody's summary of it, is how two of the nine provider sites in our teardown came to cite a repealed regulation.
The state of this shelf
Written in-house. Not reviewed by a lawyer.
Every document on this shelf was written by the people who built the thing it describes, against the instruments cited on the legal information page, and each citation records the date the instrument itself was read rather than a summary of it. None of it has been reviewed by a qualified lawyer, no Maltese company exists yet to be a party to any of it, and no gaming authority has authorised anything. Read it as an accurate description of what we do and intend, and not as an executed contract.
Where to write
One address for everything on this shelf: a privacy request, a security report, a contract question, a complaint.
Provisional until every administrator has approved this version. Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it.