Privacy notice

For everything in sections 1 to 4 below (this website, correspondence, the client area and job applications), the controller is the studio behind Getaway Gaming, reachable at hello@getawaygaming.com. The full particulars, including the registered office and the register entry once they exist, are on the legal information page.

Section 5 is different. For a player at a casino that runs our games, we are not the controller. The casino is, and we act as its processor under article 28.

We have not appointed a data protection officer. Article 37 requires one where processing is large-scale, systematic monitoring or large-scale special-category data, and ours is neither. Privacy requests go to the address above and reach a named person inside the studio.

There is no analytics on this site. Not a self-hosted one either: no page view is counted, no session is reconstructed, no visitor is assigned an identifier of any kind, and there is no tag manager, pixel, embedded video, map, chat widget or social button anywhere on it.

Two values are written into your own browser's storage: that you confirmed you are over 18, and that you have seen the notice about it. Both are strictly necessary for a page you explicitly asked for under regulation 5(2) of S.L. 586.01, both stay on your device, neither is transmitted to us or to anybody else, and clearing your browser data removes them. The cookies page lists them by name beside every other value any surface of ours writes.

Like every website, this one is served by infrastructure that keeps ordinary request logs: the URL, the timestamp, the response, the IP address the request came from and what the browser said it was. We process those under article 6(1)(f) for keeping the site up and defending it from abuse, we do not use them to build a picture of any visitor, and nothing in the application writes to them beyond serving the page.

If you email us, or use the form in the footer, we hold what you sent: your name and address as you gave them, your organisation, and the content of the exchange. The basis is article 6(1)(b) where you are asking about a contract and article 6(1)(f) otherwise: our interest in answering somebody who wrote to us, which is also plainly yours.

We do not buy lists, we do not enrich what you send us from anywhere else, and we do not send marketing email to an address we have not been given for that purpose. Malta is stricter here than most of the EU and the stricter rule is the one we are under: regulation 9(1) of S.L. 586.01 requires prior consent in writing for direct marketing by email, expressly whether the recipient is a natural person or a company, so the usual business-to-business exemption does not exist here. The only thing we may do without asking first is write to an existing customer about our own similar products, and every such message carries a way to stop it free of charge.

The enquiry form on the contact page is the same correspondence in a fixed shape, and it is for business contacts: somebody writing on behalf of an operator, an aggregator or another company. It asks for your company, your name, your work email address, the markets and currencies you are interested in, the aggregator or platform you use, a rough monthly volume band and your message. The basis is article 6(1)(b), steps you asked us to take before a possible contract, and article 6(1)(f) for anything that is not that. Ticking the box on the form confirms you have read this notice; it is not a consent to marketing, and nothing you send through it is put on a list.

What you send is stored in our own database, in the European Union, behind the same access control as the client area: it can be read only by members of the studio holding a live internal grant, and it is never readable by the form that wrote it. We also record when it arrived, which page it was sent from and how long the form was open before it was sent. The last one is how we tell a person from a script without a third-party challenge. If the database cannot take it, the form offers to open your own mail client with the same text instead, and nothing is kept.

The client area behind the sign-in holds an account for a named person: the email address they sign in with, the role that decides what they may reach, who granted it and why, and when it expires. The basis is article 6(1)(b) and (f): performing the agreement with the operator or the contractor, and running a controlled system.

What is read there is logged, on purpose. A grant carries an author and an end date, an access log records what a person actually opened, and a production change needs a second pair of eyes. A test house asks who could reach what and when, and we answer that with a query rather than from memory.

An external account cannot outlive the window it was opened for, and the quarterly review of who holds what is derived from the grants rather than from a spreadsheet somebody maintains.

A job application has its own notice, because what happens to a CV is nothing like what happens to a round: different data, a different basis, a different retention period, and a different set of people who see it.

If you reached one of our games through a casino, your account is theirs. They hold your name, your address, your payment details, your verification documents and your balance, and the privacy notice you are owed is the one they publish. We are their supplier.

What reaches us is the round: an opaque player reference that the casino generates, the stake, the outcome, the time, the currency and the market. There is no column anywhere in our database for a name, an email address, a postal address, a date of birth, a payment instrument, an IP address or a geolocation. There will not be one by accident, because adding one is a legal decision with a basis behind it, not a schema change. The map in our client area is drawn by the licence a round was played under and not by where anybody was sitting, and it says so on itself.

Here is the part most supplier notices get wrong, including ours until this version. An opaque reference the casino can resolve back to your account is pseudonymised personal data, not anonymous data. We cannot identify you from it and we have no route to the key. That still makes us a processor under article 28, not somebody outside the Regulation. So every operator relationship carries a written data processing agreement: we process on their documented instructions only, we do not use any of it for our own purposes, every sub-processor is named and approved, and we assist with a request made to them.

That is also why a request about a casino account has to go to the casino. We cannot identify a player, cannot verify that you are the person a reference belongs to, and acting on a request we cannot verify would be the actual privacy failure.

Our databases run in the European Union. Access to them is a role with an author and an end date, every table denies by default, production changes need a second person, and what a person read is written to an append-only log. Transport is encrypted everywhere. The only thing deliberately left unencrypted at the application layer is the round record, because a regulator has to be able to replay a round from two years ago and verify it. That is why the record is kept at all.

If a breach happens that is likely to risk somebody's rights, the controller notifies the supervisory authority within 72 hours. Where we are the processor, we notify the operator without undue delay and the operator makes the call. That is the division article 33 sets.

There is no automated decision-making about any person anywhere in our systems, and no profiling. The engine decides the outcome of a round from a committed seed and the rules of the game; it has no model of a player, cannot have one, and takes no input that varies by who is playing. Nothing we run scores, ranks, segments or targets a person.

Where we are the controller you can ask for access to what we hold about you, for it to be corrected, for it to be erased, for processing to be restricted, for a copy in a portable form, and you can object to processing we are doing on the basis of legitimate interests. Where we rely on consent you can withdraw it, and withdrawing it is as easy as giving it was.

Write to the address below. We will answer within one month. If a request is complex we will say so inside that month and tell you how much longer it will take. We may ask you something to establish that you are who you say you are, and we will ask for the minimum that does the job, not for a passport scan.

Where a right does not apply, we will say no in writing and give the reason. The most common case here: for most of what this website does, there is nothing held about you to retrieve, correct or delete, because nothing was collected.