Privacy Policy

1. Data controller

Platform1 OÜ ("Platform1", "we", "us") is the data controller responsible for your personal data. We are committed to protecting your privacy and to being transparent about how we handle your information.

Company: Platform1 OÜ
Registration: Estonian Business Register
Address: Tallinn, Estonia
Email: [email protected]

2. Personal data we collect

We collect different types of personal data depending on how you interact with us. All data is collected with your knowledge and, where required, your explicit consent.

Contact information

Full name
Business email address
Phone number or messenger handle
Company name and position
Business address

Business information

Industry experience and current platform, if migrating
Business requirements and objectives
Expected volumes, budget range and timeline
Target markets and licensing status
Technical specifications and preferences

Technical data

IP address and approximate location
Browser type and version
Device information
Website usage patterns
Referral sources and campaign parameters (UTM)

Communication records

Email correspondence
Call notes
Meeting notes and presentations
Support ticket information
Feedback and survey responses

3. How we use your personal data

We process personal data for specific, legitimate business purposes and for no other purpose than those listed here.

Service provision: to respond to your enquiries, hold scoping calls and demos, and deliver our platform services.
Business relationships: to establish and manage client relationships, including contract negotiation and partnership discussions.
Service improvement: to analyse usage patterns and feedback and improve the platform and our services.
Marketing communications: to send occasional product updates and industry notes, only where you have opted in.
Legal compliance: to meet legal obligations, including anti-money-laundering and other regulatory requirements.
Security and fraud prevention: to protect our systems, prevent fraud and keep the platform and our services secure.

4. Legal basis for processing

Under the GDPR we must have a lawful basis for each processing purpose. The basis we rely on depends on the purpose.

PROCESSING PURPOSE	LEGAL BASIS	DESCRIPTION
Service provision and business enquiries	Legitimate interest	Necessary for our business operations and within your reasonable expectations
Contract performance	Contractual necessity	Required to fulfil our contractual obligations
Marketing communications	Consent	Explicit consent obtained through an opt-in checkbox
Legal compliance and AML	Legal obligation	Required by applicable laws and regulations
Security and fraud prevention	Legitimate interest	Protecting our systems and preventing misuse

5. Data sharing and transfers

We do not sell personal data. We share it only in the circumstances below and with appropriate safeguards in place.

Service providers

We work with third-party service providers who help us deliver our services:

Cloud hosting and infrastructure providers
Email and communication platforms
CRM and analytics service providers
Payment service providers (for client invoicing)
Legal and professional advisers

Protection: all service providers are bound by data processing agreements and GDPR requirements.

Business partners

In certain circumstances we may share information with:

Licensing partners and regulatory bodies
Game content providers and aggregators (for platform integration)
Payment method providers
Compliance and verification services

Protection: sharing is limited to what is necessary for the business purpose and is subject to confidentiality agreements.

Legal requirements

We may disclose information when required by law:

In response to court orders or legal proceedings
To comply with regulatory investigations
To prevent fraud or criminal activity
To protect our legal rights and safety

International transfers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer data internationally we rely on:

Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs)
Appropriate technical and organisational measures
Regular review of transfer safeguards

6. Data retention

We keep personal data only as long as necessary for the purposes in this policy, or as required by law.

Contact and enquiry data: 3 years from last contact, to maintain the history of the business relationship.
Marketing communications: until consent is withdrawn or you unsubscribe.
Contract and client data: 7 years, in accordance with Estonian accounting law and regulatory requirements.
Website analytics data: up to 26 months, in aggregated or pseudonymised form.
Legal and compliance records: up to 10 years, including AML documentation, as the applicable regulation requires.

Deletion: personal data is deleted when its retention period expires, unless an ongoing legal obligation requires longer retention.

7. Your privacy rights

Under the GDPR you have the following rights regarding your personal data. We will help you exercise them.

Right of access: request a copy of the personal data we hold about you and information about how we process it.
Right to rectification: request correction of inaccurate or incomplete data. We correct data within 30 days.
Right to erasure: request deletion of your data in certain circumstances, for example when it is no longer needed for the original purpose. Some data may be retained for legal compliance.
Right to restrict processing: ask us to limit how we process your data. We will store it but not process it further.
Right to data portability: request a machine-readable copy (JSON or CSV) of the data you have provided to us.
Right to object: object to processing based on legitimate interests or for direct marketing. Every marketing email contains an opt-out link.
Right to withdraw consent: where processing is based on consent, withdraw it at any time. This does not affect the lawfulness of prior processing.
Right to complain: lodge a complaint with a data protection authority. In Estonia this is the Data Protection Inspectorate (aki.ee); EU authorities are listed at edpb.europa.eu.

Exercising your rights

Submit a request: email [email protected] with your specific request.
Verification: we may ask for additional information to verify your identity and protect your data.
Response: we respond within 30 days, or explain if we need more time.

No fees: exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

8. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

Technical safeguards

Encryption: data is encrypted in transit (TLS) and at rest.
Access controls: multi-factor authentication and role-based access.
Monitoring: 24/7 security monitoring and intrusion detection.
Backups: encrypted, geographically distributed backups.

Organisational measures

Staff training: regular privacy and security training for everyone who handles personal data.
Data processing agreements: all third parties are bound by GDPR-compliant contracts.
Regular audits: periodic security reviews and penetration testing of the platform.
Incident response: documented data breach response and notification procedures.

Infrastructure and payment providers

Platform1 does not hold ISO, SOC or PCI certifications of its own. The platform and our business systems are hosted with ISO 27001-certified cloud providers in the EU. Card data is handled only by PCI DSS-certified payment service providers; Platform1 never stores card numbers.

Data breach notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

Notify the supervisory authority within 72 hours
Inform affected individuals without undue delay
Provide clear information about the nature of the breach
Explain the measures taken to address it
Offer guidance on steps you can take to protect yourself

9. Policy updates

We may update this policy to reflect changes in our practices, technology or legal requirements.

Material changes: for changes that affect your rights, we notify you by email at least 30 days before they take effect.
Minor updates: for clarifications or administrative changes, we update the "Last updated" date and publish the revised policy here.
Your options: if you disagree with a material change, you can exercise your rights to object, restrict processing or withdraw consent.

Version history: 15 January 2025, initial version. 11 October 2026, controller details updated to Platform1 OÜ; security section revised to describe hosting and payment providers accurately; contact addresses consolidated.

10. Contact

If you have questions about this policy or how we handle your personal data, contact us.

Email: [email protected] (subject line "Privacy")
Post: Platform1 OÜ, Tallinn, Estonia, attention: Privacy
Supervisory authority: Estonian Data Protection Inspectorate, aki.ee

We answer privacy enquiries within two business days, in plain language, and keep a record of every request and response. See also the cookie policy.