1. Data controller
The controller of your personal data (the “controller” under the GDPR and the “controlador” under the LGPD) is:
Registration No. HE 476032, Republic of Cyprus
Registered office: Nikis, 1, Anthoupoli, 2350 Nicosia, Cyprus
Email: info@sete7group.com
In this policy, “we”, “us” and “our” refer to SETE7 GROUP HOLDINGS LTD. For any question about this policy or about your personal data, including requests addressed to our data protection contact (the “encarregado” channel under the LGPD), write to info@sete7group.com.
2. Scope
This policy applies to:
- the website sete7group.com (the “Website”);
- the mobile applications published by us, including our online card games and our clubs and tournaments platform (the “Apps”), once available; and
- communications you exchange with us by email or other channels.
An App may display additional, specific privacy information. In that case, that information complements this policy.
3. Data we collect
3.1 When you visit the Website
The Website does not require registration, does not use cookies and does not use analytics, advertising or tracking tools. Like any website, the servers that deliver it automatically process technical data needed to deliver pages and protect the service: IP address, date and time of the request, page requested, browser type and version, operating system and referring page (“server logs”).
3.2 When you contact us
If you write to us by email or through the contact form (which opens your own email app), we process the data you choose to send: your name, email address, the subject and content of your message, and any attachments.
3.3 When you use our Apps
- Account data: username, email address or phone number, password (stored in encrypted form), date of birth or confirmation that you are 18 or older, preferred language.
- Profile and activity data: avatar and nickname, matches played, scores, rankings, club memberships, tournament registrations and results, friends and invitations, and messages you send to other users or to clubs where such features exist.
- Transaction data: records of in-app purchases (product, date, amount, status). Payments are processed by the app store or payment provider you use; we do not receive or store your full card details.
- Device and technical data: device model, operating system and version, app version, language and region settings, IP address, app-specific identifiers, crash reports and performance logs.
- Security and fair-play data: login history, signals used to detect cheating, collusion, fraud, multiple accounts and abuse.
- Support data: the content of your support requests and our replies.
We do not intentionally collect sensitive personal data (such as health data, religious or political beliefs, or biometric data). Please do not send such data to us.
4. Purposes and legal bases
We process personal data only for specific purposes and on the legal bases listed below (GDPR Article 6(1); LGPD Article 7).
| Purpose | GDPR legal basis | LGPD legal basis |
|---|---|---|
| Delivering the Website and keeping it secure (server logs) | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Answering your messages and requests | Legitimate interests; steps prior to a contract (Art. 6(1)(b), (f)) | Preliminary procedures to a contract; legitimate interest (Art. 7, V and IX) |
| Creating and managing your account and providing the Apps | Performance of a contract (Art. 6(1)(b)) | Performance of a contract (Art. 7, V) |
| Verifying that users are 18 or older | Legal obligation; legitimate interests (Art. 6(1)(c), (f)) | Legal or regulatory obligation; legitimate interest (Art. 7, II and IX) |
| Processing purchases and keeping accounting records | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) | Performance of a contract; legal obligation (Art. 7, V and II) |
| Preventing cheating, fraud and abuse; protecting users and our services | Legitimate interests (Art. 6(1)(f)) | Legitimate interest; fraud prevention and user security (Art. 7, IX; Art. 11, II, g) |
| Customer support | Performance of a contract (Art. 6(1)(b)) | Performance of a contract (Art. 7, V) |
| Improving stability and performance (crash reports, technical logs) | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Optional communications (e.g. launch news), when you opt in | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Complying with legal obligations and requests from authorities; exercising or defending legal claims | Legal obligation; legitimate interests (Art. 6(1)(c), (f)) | Legal obligation; regular exercise of rights (Art. 7, II and VI) |
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can object to this processing at any time (see section 9). Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Sharing of data
We do not sell personal data, and we do not share it with third parties for their own advertising purposes. We only share personal data with:
- Service providers (processors / operadores) that act on our behalf and under our instructions, such as hosting and cloud infrastructure, email services, customer support tools and crash reporting. They are bound by contracts that require confidentiality and appropriate security measures.
- App store and payment providers, to the extent necessary to distribute the Apps and process purchases you make.
- Public authorities, courts and regulators, when required by law or to protect our rights, our users or the public.
- Professional advisers (such as lawyers and auditors) under duties of confidentiality.
- A successor entity in the event of a merger, acquisition or corporate reorganization, subject to this policy.
Other users of the Apps can see the information you choose to make public, such as your nickname, avatar, rankings and tournament results.
6. International transfers
We are established in the European Union (Cyprus) and our first market is Brazil. Personal data may therefore be processed in the European Economic Area, in Brazil and in other countries where our service providers operate.
When personal data is transferred outside the European Economic Area to a country without an adequacy decision of the European Commission, we use the safeguards provided by Chapter V of the GDPR, in particular the Standard Contractual Clauses approved by the European Commission, together with additional measures where necessary.
For data subject to the LGPD, international transfers are carried out only under the mechanisms of Article 33 of the LGPD, including standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD), or other lawful grounds provided for in that article.
You may request information about the safeguards applied by writing to info@sete7group.com.
7. Retention
We keep personal data only for as long as necessary for the purposes described above:
| Data | Retention period |
|---|---|
| Website server logs | A short period, normally not exceeding 30 days, unless needed to investigate a security incident |
| Messages and support requests | Up to 2 years after the last contact, unless a longer period is needed for a legal claim |
| App account and activity data | While your account is active; deleted or anonymized within 90 days after account closure |
| Purchase and accounting records | For the period required by applicable tax and accounting laws |
| Security and fraud-prevention records | For as long as necessary to protect the service and for the applicable limitation periods |
| Data processed on the basis of consent | Until you withdraw consent |
After these periods, data is deleted or irreversibly anonymized. Under the LGPD (Article 16), we may retain data after the end of processing only to comply with a legal or regulatory obligation, for the exercise of rights in legal proceedings, or in anonymized form.
8. Security
We apply technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), encryption of passwords, access controls based on the principle of least privilege, logging and monitoring, and regular review of our providers. No system is completely secure; if a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent authorities and, where required, affected users, within the time limits established by law.
9. Your rights
Under the GDPR
Subject to the conditions of the GDPR, you have the right to:
- access your personal data and obtain a copy (Art. 15);
- rectify inaccurate or incomplete data (Art. 16);
- obtain erasure of your data (“right to be forgotten”) (Art. 17);
- restrict processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests, and to direct marketing at any time (Art. 21);
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22);
- withdraw consent at any time (Art. 7(3)).
Under the LGPD
Under Article 18 of the LGPD, you have the right to obtain from us:
- confirmation of the existence of processing;
- access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
- portability of your data to another service or product provider;
- deletion of data processed on the basis of your consent;
- information about the public and private entities with which we share data;
- information about the possibility of not giving consent and the consequences of refusal;
- revocation of consent;
- review of decisions taken solely on the basis of automated processing (Article 20).
How to exercise your rights
Send your request to info@sete7group.com with the subject “Privacy request”. We may ask for information to confirm your identity before acting on the request. We will reply within one month under the GDPR (extendable by two further months for complex requests, in which case we will inform you) and, for requests under the LGPD, within the periods set by that law (including up to 15 days for a complete statement of the processing, under Article 19). Exercising your rights is free of charge.
10. Complaints
If you believe that the processing of your personal data infringes the law, you may contact us first so that we can try to resolve the issue. You also have the right to lodge a complaint with a supervisory authority, in particular:
- in Cyprus: the Office of the Commissioner for Personal Data Protection (Nicosia), or the supervisory authority of your habitual residence or place of work in the EU;
- in Brazil: the Autoridade Nacional de Proteção de Dados (ANPD).
11. Age restriction
The Website and the Apps are intended exclusively for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the related data, except where retention is required by law. If you believe a minor has provided us with personal data, please contact info@sete7group.com.
12. Cookies and similar technologies
The Website does not use cookies. It does not use analytics, advertising, social media or any other tracking technologies, and it does not load content from third-party servers.
The only information the Website stores on your device is your language preference (English or Portuguese), kept in your browser’s local storage under the key s7-lang. It is strictly necessary to remember the choice you made, is never sent to us, and can be deleted at any time by clearing your browser’s site data.
The Apps may store information on your device that is strictly necessary for them to work (for example, keeping you signed in and saving your settings). If an App ever uses non-essential technologies, such as analytics or advertising identifiers, we will inform you within the App and ask for your consent where required by law.
13. Automated decisions
To protect fair play, our systems may automatically flag activity that suggests cheating, collusion or fraud. Flagged cases can lead to restrictions on an account. You can always request a human review of such a decision and present your point of view by writing to info@sete7group.com.
14. Changes to this policy
We may update this policy to reflect changes in our services or in the law. The “Last updated” date at the top shows the latest version. If changes are significant, we will give notice on the Website or within the Apps before they take effect.
15. Contact
Email: info@sete7group.com
Post: Nikis, 1, Anthoupoli, 2350 Nicosia, Cyprus