Privacy Policy

Rookie Gaming Inc. ("Rookie," "we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use the Rookie platform (the "Platform").

This Privacy Policy applies to all users worldwide, including users in the United States, Canada, Mexico, Brazil, Colombia, Peru, India, and all other jurisdictions where we operate. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into our Terms of Service.

1. Data Controller

The data controller responsible for your personal data is:

2. Information We Collect

2.1 Information You Provide Directly

(a) Account Registration Information

Full legal name, date of birth, email address, phone number, residential address, username and password, country of residence.

(b) Identity Verification (KYC) Information

Government-issued photo identification; national identification numbers (SSN for US, CPF for Brazil, cédula for Colombia, DNI for Peru, Aadhaar/PAN for India, CURP/INE for Mexico, SIN for Canada); selfie photographs; proof of address documents; source of funds documentation.

(c) Financial and Payment Information

Credit/debit card details (tokenized by our payment processor — we do not store full card numbers), bank account details, cryptocurrency wallet addresses, transaction history, e-wallet account information.

(d) Communications

Customer support correspondence, survey responses, feedback, user-generated content.

2.2 Information We Collect Automatically

(a) Device and Technical Information

IP address, device type and operating system, browser type and version, screen resolution, device identifiers, language and timezone.

(b) Usage and Activity Information

Pages visited, games played, bet amounts, outcomes, session durations, click patterns, login/logout timestamps, referral source.

(c) Location Information

Approximate geographic location from IP address; precise location only with explicit consent for territorial eligibility verification.

(d) Cookies and Tracking Data

Cookie identifiers, session tokens, web beacons, local storage data. See our Cookie Policy for details.

2.3 Information from Third Parties

Identity verification results, payment confirmations and fraud assessments, social media profile information (when using social login), analytics data, fraud prevention risk scores, public databases and sanctions lists.

3. How We Collect Your Information

We collect information through direct interaction (account creation, purchases, support), automated technologies (cookies, server logs), third-party sources (verification services, payment processors, social platforms), and public sources (government databases, sanctions lists).

4. Legal Bases for Processing

Legal Basis	Examples
Contract Performance	Account registration, managing your Account, processing purchases and Prize redemptions, providing Games
Legal Obligation	AML/KYC verification, tax reporting, responding to lawful requests, sanctions screening
Legitimate Interests	Fraud prevention, Platform security, analytics, personalization, direct marketing (where permitted)
Consent	Marketing communications, non-essential cookies, precise location tracking

Where we rely on consent, you may withdraw it at any time, though withdrawal does not affect the lawfulness of prior processing.

5. How We Use Your Information

5.1 Platform Operation

Create and manage your Account, process purchases and Prize redemptions, operate Games, provide customer support, manage responsible play settings.

5.2 Safety, Security, and Compliance

Verify identity and age, detect and prevent fraud, enforce territorial restrictions, monitor for prohibited conduct, comply with applicable laws.

5.3 Communication

Send transactional notifications, marketing communications (with consent where required), respond to support requests.

5.4 Improvement and Analytics

Analyze usage patterns, conduct A/B testing, develop new features, generate aggregated statistical data.

5.5 Responsible Play

Monitor gameplay patterns, deliver responsible play interventions, enforce self-exclusion and cool-off periods.

6. Information Sharing and Disclosure

6.1 Categories of Recipients

• Service Providers: Payment processors, identity verification providers, cloud hosting, customer support tools, email services, analytics, fraud detection — all contractually bound to process data only as instructed.
• Regulatory and Law Enforcement: Where required by law — financial regulators, tax authorities, law enforcement, courts.
• Professional Advisors: Legal, accounting, and insurance advisors under confidentiality obligations.
• Corporate Transactions: In connection with mergers, acquisitions, or sales of assets.
• Other Players: Limited info (username) in leaderboards, tournaments, or chat. Never your real name, financial info, or documents.

6.2 We Do NOT Sell Your Personal Data

We do not sell your personal data to third parties for their own marketing or commercial purposes.

7. International Data Transfers

Your data may be stored and processed in any country where we or our service providers operate. We implement Standard Contractual Clauses (SCCs), Data Processing Agreements (DPAs), and adequacy determinations to ensure adequate protection. For Brazil, we comply with LGPD international transfer provisions.

8. Data Retention

Data Category	Retention Period
Account registration data	Duration of Account + 5 years
KYC/identity verification documents	Duration of Account + 7 years
Transaction and purchase records	7 years from transaction date
Game round history	Duration of Account + 5 years
Customer support communications	3 years from resolution
Marketing consent records	Duration of consent + 3 years
Server logs and IP addresses	12 months
Cookie data	As specified in Cookie Policy

When no longer required, data is securely deleted or anonymized. Anonymized data may be retained indefinitely for analytics.

9. Data Security

We implement comprehensive security measures including:

• Encryption: TLS 1.2+ for data in transit, AES-256 for data at rest
• Access Controls: Role-based access on a need-to-know basis
• Authentication: Multi-factor authentication for administrative access
• Monitoring: Continuous monitoring with automated alerts for suspicious activity
• Payment Security: PCI DSS-compliant payment processors
• Penetration Testing: Regular security assessments
• Employee Training: Regular data protection awareness training
• Incident Response: Documented breach response procedures

In the event of a data breach posing risk to your rights, we will notify you and applicable authorities as required by law.

10. Your Rights

Regardless of your jurisdiction, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion, subject to legal retention requirements
• Withdraw Consent: Withdraw consent at any time
• Marketing Opt-Out: Opt out of marketing communications
• Complaint: Lodge a complaint with your data protection authority

To exercise these rights, contact us at privacy@rookie.gg or through your Account settings. We will respond within 30 days.

11. Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. You can manage preferences through the cookie consent banner, your Account settings, or your browser settings.

12. Children's Privacy

The Platform is not intended for individuals under the minimum age for their jurisdiction. If we discover we have collected data from a minor, we will promptly delete it and close the associated Account. If you believe a minor has provided data to us, contact privacy@rookie.gg.

13. Jurisdiction-Specific Provisions

13.1 United States — CCPA/CPRA (California)

California residents have the right to: know what personal information is collected; request deletion; request correction; non-discrimination for exercising rights. We do not "sell" or "share" personal information as defined by the CCPA/CPRA.

CCPA Category	Examples	Collected?
Identifiers	Name, email, IP address, Account ID	Yes
Personal information	Name, address, phone, financial info	Yes
Protected characteristics	Age, date of birth	Yes
Commercial information	Purchase history, transactions	Yes
Internet/electronic activity	Browsing history, game activity	Yes
Geolocation data	Approximate location via IP	Yes
Sensory data	Selfie photos for verification	Yes
Sensitive personal information	Government ID numbers, financial accounts	Yes

We also comply with Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other applicable state privacy laws.

13.2 Canada — PIPEDA

We obtain meaningful consent for collection, use, and disclosure. You have the right to access and correct your information and to challenge our compliance via the Office of the Privacy Commissioner of Canada. Quebec residents have additional rights under Law 25, including data portability and information about automated decision-making.

13.3 Brazil — LGPD

Under the Lei Geral de Proteção de Dados (Law No. 13,709/2018), you have the right to: confirmation of processing; access; correction; anonymization, blocking, or deletion of unnecessary data; data portability; deletion of data processed with consent; information on sharing; consent withdrawal; filing complaints with the ANPD; and review of automated decisions.

13.4 Mexico — LFPDPPP

You have ARCO rights (Access, Rectify, Cancel, Oppose). You may revoke consent and limit use and disclosure at any time. You may file complaints with INAI. This Privacy Policy serves as your Aviso de Privacidad. Contact privacy@rookie.gg with ARCO requests including your name, Account ID, and description of the right you wish to exercise.

13.5 Colombia — Law 1581 of 2012

You have the right to know, update, rectify, and delete your personal data, and to revoke consent. You may file complaints with the Superintendencia de Industria y Comercio (SIC).

13.6 Peru — Law 29733

You have ARCO-POL rights (Access, Rectify, Cancel, Oppose, Portability, Opposition to automated decisions, Limitation). You may file complaints with the Autoridad Nacional de Protección de Datos Personales.

13.7 India — DPDP Act 2023

Under the Digital Personal Data Protection Act, 2023, you have the right to: consent and withdrawal; access; correction and erasure; grievance redressal; and nomination. You may file complaints with the Data Protection Board of India.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on the Platform, send an email notification, and display a prominent notice upon your next login. Your continued use constitutes acknowledgment of the updates.

15. Contact Us