Privacy statement

Latest update on: 15/0/2023

Privacy statement

Latest update on: 30/03/2023

 

1.     Introduction

1.1.  General

The website www.twow.be (hereinafter the "Website") and the services are offered by TIGERLILY WORLD OF WONDERS BV (hereinafter "we" and "us"). Any person who visits our Website (hereinafter the "Visitor") as well as any person who uses our services by purchasing a game code (hereinafter the "Customer") almost inevitably discloses certain personal data. These personal data constitute information that allows us to identify you as a natural person, whether or not we actually do so.

When we process your personal data, the General Data Protection Regulation ("GDPR") and other relevant legal provisions apply. Any reference in this privacy statement to the GDPR is a reference to the Regulation of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Through this privacy statement, we want to inform you in a transparent way about the processing activities that we, as data controller (controller), may carry out. In other words: when we decide "why" and "how" personal data should be processed.

1.2. What are personal data?

Personal data is defined in the GDPR as "any information relating to an identifiable person who can be identified, directly or indirectly." Personal data, in simpler terms, is any information about you that allows you to be identified. Personal data includes obvious information, such as your name and contact information, as well as less obvious information, such as identification numbers, electronic location data and other online identifiers.

1.3. Changes

We may update this statement from time to time by publishing a new version. You will find the date of the current version at the top ("Latest Update on:"). This may be necessary, for example, if the law changes, or if we change things in a way that affects the protection of personal data. We recommend that you check this page from time to time to make sure you are happy with any changes to this privacy statement.

2.     Contact details

Our Website and services are offered and operated by TIGERLILY WORLD OF WONDERS BV. We are registered in Belgium under registration number 0765.352.269 and our registered office is located at Grote Markt 57, 2500 Lier.

You can contact us:

(a) by e-mail, to the mailing address listed above;

(b) via the contact form on our Website;

(c) by telephone, at 03 318 60 55; or

(d) by e-mail, using info@twow.be.

3.   What personal data is processed and how is it used?

3.1. Information processing

Depending on what applies to you in your capacity as a Visitor or Customer, we process the following personal data.

Categories of personal data

Technical data through the use of (non-) necessary cookies:

  • IP address;
  • geographical location;
  • browser type and version;
  • operating system;
  • reference source;
  • duration of your visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your use of the service.

Processing purposes

The source of the technical data is the use of non-essential cookies.

Non-essential cookies containing technical data may be processed for analysing/improving the use of the Website. For more information on cookies, please see our cookie banner.

In addition, we also use essential cookies. Such cookies are processed for the technically correct functioning of the Website. More information can be found in our cookie banner.

Legal basis

Your consent obtained through our cookie banner for non-essential cookies.

Our legitimate interests so that the Website functions properly from a technical standpoint, so that we can provide you with the requested services, and to prevent fraud or to ensure the network and information security of our IT systems.

Retention period

See the cookie banner on this Website.

----

Categories of personal data

Communication data

Processing purposes

The source of communication data is the information you provide to us when you contact us.

Communication data may be processed for the purpose of this communication with you.

Legal basis

Our legitimate interest, namely to respond to your requests, questions or comments.

Retention period

Communication data will be kept for a maximum of 3 years.

----

Categories of personal data

Transaction data of Customers

  • Contact details (Last name and first name, email address, phone number, address details)
  • Card details
  • Transaction details (purchased game code, time of purchase)
  • Time of use of game code

Processing purposes

The source of transaction data is the information you provide to us when you purchase a game code through our Website/webshop.

The transaction data may be processed for the purpose of delivering the purchased game code(s) and keeping proper records of such transaction(s).

Legal basis

Performance of a contract between you as a Customer and us (the General Terms).

Retention period

After termination of the agreement, personal data will be kept for another seven years to fulfill a legal obligation (tax obligation).

----

Categories of personal data

Newsletter data (direct marketing):

  • First name
  • Last name
  • E-mail address

Processing purposes

The source of newsletter data is the information you provide to us when you subscribe to the newsletter.

Newsletter data is processed to send you newsletters, for which you have given your consent. You may unsubscribe at any time by clicking the "unsubscribe" link in the relevant e-mail or by any other action described therein.

Legal basis

Your consent.

Retention period

Your data will be processed until you unsubscribe from the newsletter.

----

Categories of personal data

Contest participation data

  • First name
  • Last name
  • E-mail address
  • Your answers to the contest questions
  • Time of submission of participation.

Processing purposes

The source of the contest participation data is the information you provide to us when you participate in a contest organised by us.

The contest participation data is processed to manage your participation in the contest, as well as to let you know whether you have won or not.

Legal basis

Execution of an agreement, or taking steps to reach such an agreement, between you as a participant and us.

Retention period

Your data will be processed up to 1 month after the end of the competition.

----

In addition, we may retain your personal data where this would be necessary for the establishment, exercise or defense of legal claims, whether in judicial proceedings or in administrative or extrajudicial proceedings. The legal basis for this processing is our legitimate interests, namely the protection and exercise of our legal rights.

3.2. Processors

A processor is a natural person or legal entity that processes personal data at our request or on our behalf. We may contract with this party to provide certain products and/or services. In other words: We use processors because it is necessary for the provision of our services. In this case, we will enter into a written agreement with the processor whereby the protection of your personal data is guaranteed by the processor. The processor will always act according to our instructions.

We use the following categories of processors:

  • Companies we have engaged for marketing purposes;
  • Companies we have engaged for ICT -technical support and hosting purposes;
  • Companies we have engaged for administrative purposes (e.g. CRM system);
  • Companies we have engaged for communication purposes;
  • Companies we have engaged for logistical purposes (e.g. order picking, delivery, etc.);
  • Companies we have engaged for analytical purposes;
  • Companies we have engaged for payment purposes.

4.     Providing your personal data to third parties

We will not share your personal data with third parties (other than processors) for any purposes, subject to the following exceptions.

In some circumstances, we may be required by law to share certain personal data, including yours, if we are involved in legal proceedings or for compliance with legal obligations, a court order or the instructions of a government agency.

5.     International transfer (outside EEA) of your personal data

We may store or transfer some or all of your personal data in countries that are not part of the European Economic Area (the "EEA" consists of all EU member states, plus Norway, Iceland and Liechtenstein). These are known as "third countries" and may have less stringent data protection laws than those in the EEA. This means that we take additional steps to ensure that your personal data is treated as securely and reliably as it is in the EEA.

We use specific contracts with external third parties approved by the European Commission (also known as Standard Contractual Clauses: SCC) for the transfer of personal data to third countries. The SCCs guarantee the same level of protection of personal data as would apply under the GDPR. In addition, additional measures are taken to protect your data from unauthorized access. More information is available from the European Commission.

6.     Your rights

Some rights are complex and not all details are included here. Therefore, please read the relevant provisions and guidelines of supervisory authorities for a full explanation of these rights.

You may exercise your rights with respect to your personal data by notifying us in writing at info@twow.be.

We will respond to your request within one month of receiving your request. We normally aim to provide a full response within that time. However, in some cases, especially if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of the progress.

6.1. The right of access

You have the right to confirm whether or not we process your personal data and, where we do, to access the personal data, along with certain additional information. This additional information includes details of the purpose of the processing, the categories of personal data involved and the recipients of the personal data. Provided that the rights and freedoms of others are not affected, we will provide you with a copy of your personal data. The first copy will be provided free of charge, but additional copies may be provided for a reasonable fee.

6.2. The right to rectification

You have the right to have inaccurate personal data about you corrected and, taking into account the purposes of processing, to have incomplete personal data about you completed.

6.3.  The right to erasure ("right to be forgotten")

In some circumstances, you have the right to have your personal data erased without undue delay. These circumstances include:

  • the personal data are no longer necessary in connection with the purposes for which   they were collected or otherwise processed;
  • you withdraw your consent to processing based on consent;
  • you object to processing under certain rules of applicable data protection law (the GDPR);
  • the processing is for direct marketing purposes;
  • the personal data were processed unlawfully;
  • the personal data were collected in the event of a direct offer of services to a child and the processing is thereby based on consent; and
  • personal data must be deleted to comply with a legal obligation imposed on us.

However, there are exclusions to the right to erase data. The general exclusions include where processing is necessary:

  • for the exercise of the right to freedom of expression and information;
  • for compliance with a legal obligation imposed on us; or
  • for the establishment, exercise or defense of legal claims;
  • for archiving in the public interest, scientific or historical research or statistical purposes;
  • for public health reasons.

6.4. The right to restrict processing

In some circumstances, you have the right to restrict the processing of your personal data. These circumstances are: you dispute the accuracy of the personal data; the processing is unlawful, but you oppose erasure; we no longer need the personal data for our processing, but you need personal data for the establishment, exercise or defense of legal claims; and you have objected to the processing, pending verification of that objection.

If processing is restricted on this basis, we may continue to store your personal data. However, we will only process them by other means: with your consent; for the establishment, exercise or defense of legal claims; for the protection of the rights of another natural or legal person; or for important reasons of public interest.

6.5. The right to object to processing

You have the right to object to our processing of your personal data for reasons relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for the purposes of legitimate interests pursued by us or by a third party. If you raise such an objection, we will stop processing the personal data unless we can demonstrate that there are compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or that the processing is for the establishment, exercise or defense of legal claims.

In addition, you have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you object, we will stop processing your personal data for this purpose.

Furthermore, you have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes for reasons related to your particular situation, unless the processing is necessary for the performance of a task carried out in the public interest.

6.6. The right to data portability

To the extent that the legal basis for our processing of your personal data is based on:

(a) consent;

(b) the processing is necessary for the performance of a contract to which you are a party, or to take action at your request before entering into a contract; or

(c) such processing shall be automated,

you have the right to receive your personal data from us in a structured, commonly used and machine-readable format.

However, this right does not apply when it would interfere with the rights and freedoms of others.

6.7. The right to file a complaint with a supervisory authority

If you believe that our processing of your personal data violates the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a supervisory authority responsible for data protection. In Belgium, the supervisory authority is the Data Protection Authority or “Gegevensbeschermingsautoriteit” (GBA). Data subjects from other Member States have the right to complain to their own national supervisory authority. For an overview of the contact details of these authorities, click on this link.

Gegevensbeschermingsautoriteit (GBA).

Drukpersstraat, 1000 Brussels

+32 (0)2 274 48 00

contact@apd-gba.be

https://www.gegevensbeschermingsautoriteit.be

6.8. The right to withdraw your consent

Insofar as the legal basis for our processing of your personal data is consent, you have the right to withdraw this consent at any time. Revocation does not affect the lawfulness of the processing prior to the revocation.