Data Protection and Privacy Policy

1. Introduction

This Data Protection and Privacy Policy ("Policy") outlines how the Golden Visa Lottery system ("we," "our," or "the System") collects, uses, stores, and protects personal information of users ("you" or "users"). We are committed to protecting your privacy and ensuring the security of your personal information in compliance with applicable data protection laws and regulations.

2. Legal Basis

This Policy is designed to comply with relevant data protection regulations, including but not limited to:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection
• Other applicable national and international data protection laws

3. Information We Collect

3.1 Personal Information

We collect the following categories of personal information:

3.1.1 Account Information

• Full name
• Email address
• Phone number
• Date of birth
• Authentication credentials
• Authentication method (Google, Apple, Phone)

3.1.2 Identity Verification Information

• Passport or national ID details
• Live photographs
• Address verification documents
• Nationality
• Date of birth

3.1.3 Financial Information

• Payment method details
• Transaction history
• Wallet information

3.1.4 Communication Information

• Communication preferences
• Correspondence with our support team
• Notification settings

3.2 Automatically Collected Information

3.2.1 Device Information

• IP address
• Device type and model
• Operating system
• Browser type and version
• Mobile device identifiers

3.2.2 Usage Information

• Pages visited
• Features used
• Time spent on the platform
• Click patterns
• Lottery participation history

3.2.3 Cookies and Similar Technologies

• Session cookies
• Persistent cookies
• Web beacons
• Pixel tags
• Local storage

4. How We Use Your Information

4.1 Primary Purposes

We use your personal information for the following primary purposes:

• To create and manage your user account
• To verify your identity for KYC compliance
• To process lottery ticket purchases
• To conduct lucky draws and select winners
• To facilitate prize distribution and visa processing
• To process payments and manage your wallet
• To communicate with you about your account and transactions
• To provide customer support

4.2 Secondary Purposes

With your consent, we may also use your information for:

• Sending promotional communications about new lotteries
• Conducting market research and analytics
• Improving our services and user experience
• Developing new features and offerings
• Personalizing your experience on our platform

5. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contractual Necessity: To fulfill our contractual obligations to you when you participate in lotteries
• Legal Obligation: To comply with legal requirements such as KYC, anti-money laundering regulations, and tax laws
• Legitimate Interests: To operate and improve our services, prevent fraud, and ensure security
• Consent: For marketing communications and certain types of data processing where required by law

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We may share your information with trusted third-party service providers who assist us in:

• Payment processing
• Identity verification
• Cloud hosting and storage
• Customer support
• Email and SMS delivery
• Analytics and performance monitoring

All third-party service providers are contractually obligated to use your information only for the purposes of providing services to us and in compliance with this Policy.

6.2 Legal Requirements

We may disclose your information when required by law, such as:

• In response to a court order or legal process
• To comply with regulatory requirements
• To protect our rights, privacy, safety, or property
• To investigate, prevent, or take action regarding illegal activities

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information.

7. International Data Transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country.

We have implemented appropriate safeguards to ensure that your personal information remains protected in accordance with this Policy when transferred internationally, including:

• Standard contractual clauses approved by the European Commission
• Data processing agreements with third-party service providers
• Compliance with cross-border data transfer mechanisms

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• The duration of your relationship with us
• Legal obligations to retain data for certain periods
• Relevant statutes of limitations
• Ongoing or potential legal disputes
• Guidelines from regulatory authorities

When personal information is no longer necessary, we will securely delete or anonymize it.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

9.1 Access and Information

You have the right to:

• Confirm whether we process your personal information
• Access your personal information
• Receive information about how we process your data

9.2 Correction and Deletion

You have the right to:

• Correct inaccurate or incomplete personal information
• Delete your personal information under certain circumstances (right to be forgotten)

9.3 Restriction and Objection

You have the right to:

• Restrict the processing of your personal information
• Object to processing based on legitimate interests
• Object to direct marketing

9.4 Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit this data to another controller.

9.5 Withdrawal of Consent

Where processing is based on consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing based on your consent before its withdrawal.

9.6 Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal information violates applicable data protection laws.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Encryption of sensitive data at rest and in transit
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Employee training on data protection and security
• Incident response procedures
• Regular backups and disaster recovery planning

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

Our services are not directed to individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

12. Cookies and Tracking Technologies

12.1 Types of Cookies We Use

• Essential Cookies: Required for the operation of our platform
• Functional Cookies: Enable enhanced functionality and personalization
• Analytical Cookies: Help us understand how users interact with our platform
• Marketing Cookies: Used to deliver relevant advertisements and track marketing effectiveness

12.2 Cookie Management

You can manage your cookie preferences through:

• Our cookie consent banner
• Your browser settings
• Third-party opt-out mechanisms

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated Policy on our platform
• Sending an email to the address associated with your account
• Displaying a prominent notice on our platform

The date of the latest revision will be indicated at the top of the Policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Policy or our data practices, please contact our Data Protection Officer at:

15. Specific Regional Provisions

15.1 European Economic Area (EEA) and United Kingdom

If you are located in the EEA or UK, the data controller for your personal information is [Company Legal Name]. You have the right to lodge a complaint with your local data protection authority.

15.2 California Residents

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect
• The right to delete personal information
• The right to opt-out of the sale of personal information
• The right to non-discrimination for exercising these rights

15.3 UAE Residents

Under UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, UAE residents have specific rights regarding their personal data, including:

• The right to be informed about processing activities
• The right to access and correct personal data
• The right to data portability
• The right to object to processing in certain circumstances