1. Introduction and General Principles
This Privacy and Data Protection Policy (hereinafter referred to as the "Policy") delineates the comprehensive framework established by 3-102-960819 Sociedad de Responsabilidad Limitada, operating under the commercial name Highstack (hereinafter referred to as the "Company", "we", "us", or "our"), to safeguard the personal information of its users. By accepting the Highstack Terms of Service, you also acknowledge and agree to this Privacy Policy.
The Company respects the privacy of its online visitors and customers and complies with applicable laws for the protection of your privacy, including, without limitation, the General Data Protection Regulation ("GDPR") and applicable data protection legislation in force in the Republic of Costa Rica. We process your personal data in accordance with the applicable legal framework. Where the GDPR applies, we act as the data controller in respect of the personal information you provide to us, and we are responsible for ensuring that it is processed lawfully, fairly, and transparently. This Policy explains what personal data we collect from players, the reasons for its collection, and how it is utilized and protected.
2. Information Collected
The Company collects personal information that is necessary to provide a secure, efficient, and compliant gaming environment. The personal information which we may request, use, and process shall include, without limitation:
Identity and Contact Information: Your email address provided at registration, identity verification documentation, and biometric data submitted as part of our Know Your Customer (KYC) process.
Communication Records: Correspondence submitted through the platform, by email, via our live support function, or through any other means of communication, as well as your responses to surveys, feedback forms, or any other customer assessment activities.
Financial and Transactional Information: Cryptocurrency or blockchain wallet addresses associated with deposits or withdrawals, and all account transaction history, whether conducted through the platform or communicated via other means.
Technical and Usage Information: Website login data and associated details, including traffic data, geolocation data derived from your IP address, activity logs, and information about your behavior on the platform and your device (e.g., screen size, device type, browser type and version, operating system, and preferred language settings).
In accordance with our Terms of Service, you must be at least 18 years of age to use Highstack. We will not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data has been collected from a minor, we will take prompt steps to delete it.
3. Use of Information Collected
We will use the personal information we collect from you to deliver our services and for specific operational and regulatory purposes. These purposes include processing your bets, transactions, deposits, and withdrawals, as well as providing customer support and assistance with account setup, operation, and management.
Furthermore, we utilize this information to comply with our legal and regulatory obligations, including obligations under our Anjouan gaming license and applicable anti-money laundering (AML) legislation. This involves undertaking necessary security measures in relation to your account, such as identity verification and fraud prevention checks, and monitoring and investigating transactions to detect and prevent fraud, money laundering, and other irregular or prohibited activities. We also use the data to create and manage individual player profiles to personalize your platform experience, and to analyze and understand our users' needs in order to improve the platform, optimize the service, and enhance the overall user experience. Finally, we process data to comply with requests from competent regulatory authorities, law enforcement agencies, or courts.
4. Obtaining Personal Information
We shall not collect any personal information about you without your knowledge or permission, except where we are required to do so by applicable law or regulatory obligation. We may receive certain personal information from online vendors and service providers engaged to support the operation of the platform, including third-party identity verification providers, payment processors, and fraud prevention services.
We will use and safeguard any personal information so obtained in accordance with this Privacy Policy. Any information you provide will only be disclosed to third parties outside Highstack in accordance with the terms of this Privacy Policy, and we shall take all necessary steps to ensure that our agreements with third-party service providers adequately protect your personal information and that those providers comply with applicable data protection law.
5. Marketing Communication
We may send you marketing communications if you have explicitly given your consent or permission for us to do so. Consent is obtained at the point of registration or through your account preferences. This includes providing registered players with information about our promotional offers, products, and services, or sharing promotional content from our selected business partners and affiliates.
Should you prefer to stop receiving marketing and other promotional material, you may opt out at any time by contacting our customer support service, by following the unsubscribe instructions contained in any marketing communication we send you, or by updating your preferences in your account settings. Opting out of marketing communications will not affect the delivery of transactional or service-related communications necessary for the operation of your account.
6. Cookie Policy
By accepting our Terms of Service, registering an account, and using our services, you acknowledge that Highstack will use cookies and similar tracking technologies to store certain information on your device when you access our platform. Cookies are small text files that record your preferences and send information from your browser, helping to improve your Highstack experience and deliver a more personalized service.
Some cookies we use are essential for the platform to function correctly; others are used to understand how you interact with the platform and to help us improve it over time. We use web analytics and session-recording tools to help us understand how users navigate the platform, how long they spend on particular areas, which pages they visit most frequently, and how they interact with features. This information is collected on an aggregated, anonymized basis where possible. If you wish to delete any cookies already stored on your device, or to prevent the platform from setting new cookies, you can do so by adjusting your browser's privacy settings. Please note that disabling certain cookies may affect the functionality of the platform.
7. Sharing of Personal Information
We may share your personal information with specific categories of recipients. This includes our group companies, third-party service providers, and partners who provide data processing services to us (e.g., to support the delivery of the platform, provide functionality, or help enhance platform security). We may also share data with any competent law enforcement body, regulatory authority, government agency, court, or other third party where we believe disclosure is necessary as a matter of applicable law or regulation, to exercise, establish, or defend our legal rights, or to protect your vital interests or those of any other person.
Furthermore, data may be shared with a potential or actual acquirer, and its agents and advisers, in connection with any proposed or actual purchase, merger, or acquisition of any part of our business, provided that we inform the acquirer that it must use your personal information only for the purposes set out in this Privacy Policy. Relevant regulatory authorities, licensing bodies, and authorized personnel of Highstack shall also have access to your personal information to the extent necessary for the execution of their duties.
Where personal data is transferred across international borders — including from the European Economic Area (EEA) or countries subject to the GDPR to countries outside that area — we ensure that appropriate safeguards are in place to protect your information, such as Standard Contractual Clauses approved by the European Commission.
8. Retention of Personal Data
Both you and Highstack may choose to close your account at any time. Following closure, we will retain your personal data for as long as required by applicable law and our obligations under our Anjouan gaming license, including any applicable anti-money laundering record-keeping requirements. Where applicable law requires the retention of records for a specified period following account closure, we will comply with that obligation regardless of any deletion request.
If your account is suspended or permanently restricted due to a breach of our Terms of Service, your personal data will be retained for the purposes of investigation, legal defense, and regulatory reporting, unless and until you make a valid and enforceable request for erasure that is not overridden by a legal obligation. After the applicable retention period has expired, your personal data will be deleted, blocked, or anonymized in accordance with applicable law. We will respond to all data subject erasure requests within 30 days, clearly communicating where any retention obligation prevents full deletion.
9. Data Protection Rights
You have specific data protection rights, which you may exercise at any time by contacting us. These include the right to access, correct, update, or request the deletion of your personal information. You also have the right to object to the processing of your personal information where that processing is based on our legitimate interests, to ask us to restrict processing, or to request portability of your personal information in a structured, machine-readable format.
Additionally, you have the right to opt out of marketing communications at any time, and where we process your personal information on the basis of your consent, the right to withdraw that consent at any time. You possess the right to lodge a complaint with a competent data protection supervisory authority if you believe that our processing of your personal information does not comply with applicable data protection law, and the right to limit or disable the use of cookies via your browser settings. We will respond to all requests received from individuals wishing to exercise their data protection rights within 30 days of receipt.
10. Security of Personal Data
We are committed to protecting the personal data of our players and maintaining a secure platform environment. We implement appropriate technical and organizational measures designed to protect the personal information we collect and process against unauthorized access, disclosure, alteration, or destruction. The security measures we apply are designed to be proportionate to the risk associated with the relevant data processing activities.
These measures include encryption of personal data both in transit and at rest, access controls limiting data access to authorized personnel on a need-to-know basis, regular review of our security practices and infrastructure, and contractual obligations imposed on third-party processors to maintain equivalent standards of security. In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the relevant regulatory authority within 72 hours of becoming aware of the breach, and where the breach is likely to result in a high risk to individuals, we will also notify affected users directly without undue delay. While we take all reasonable steps to protect your personal data, no transmission of data over the internet or electronic storage system can be guaranteed to be completely secure, and by using the platform, you acknowledge and accept this inherent risk.
