REPUBLIC OF CYPRUS OFFICE OF THE COMMISSIONER FOR PERSONAL DATA PROTECTION Decision IMI Article 56 identification of LSA and CSA entry 55239 National file number Controller 11.17.001.006.019 Marikit Holdings Ltd (22bet.com) 12 November 2019 Marikit Holdings Ltd 22bet.com Nicosia, Cyprus Dear Mr. XXXXX, Further to the exchange of communications between the Office of the Commissioner and Marikit Holdings Ltd (22bet.com), concerning a complaints involving 22bet.com, we would like to bring to your attention the following assessment of the Commissioner. Summary of the Case The data subject created an account with the controller (22bet.com) in the context of the enrolment was a prerequisite so as to be able to participate to a competition. The data subject tried for days to delete his account and to erase his data on this website, but the website did not provide such opportunity. The data subject further sent an email asking the controller the deletion of his account and to erasure of all his data. The controller did not comply with the erasure request and alternatively proposed to merely block the account for one year. Investigation by CY SA Cyprus SA contacted Marikit Holdings in January
- In the initial response to the Commissioner the controller alleged that the data subject could not be identified, as it was discovered later, the data subject did not provide the relevant email address used upon registration to 22bet.com. In the response received from the support team of 22bet.com on 01/08/2019, we were informed that in general the organisation holds data that can be requested by regulatory bodies in Cyprus for a wide range of purposes, including, but not limited to the following:
- Ascertainment of the fairness of the games offered
- Identification in accordance to KYC and AML requirements
- Resolutions of disputes, claims, etc. connected with the games offered Marikit Holdings further alleged that is not in a position to delete data which it reasonably believe will be requested by the regulatory bodies prior to their request as it may entail penalties and other reprimands. Moreover, Marikit Holdings affirmed that it holds data until reasonably sure that no complaint shall be sent by the user to the regulatory authorities for which it could be called upon to give explanations with supporting evidence. The controller finally confirmed the data of the specific user were deleted as soon as it was reasonably possible to delete. Regarding the subject matter of the complaint, considering the fact that the controller reacted to the deletion request within the time-frame provided in the GDPR and eventually, the erasure request was granted after verification that the deletion of relevant data would not infringe other legal obligations of the controller, Cyprus SA considers that the investigation proceedings can be concluded and no repressive measures are necessary. Cyprus SA reviewed 22bet.com privacy policy and found that the information provided therein is not sufficient to facilitate the exercise of data subjects rights. The controller is therefore requested to revise its privacy policy of 22bet.com regarding the th the GDPR and inform the Commissioner accordingly. The Commissioner reserves the right, in the event of any future complaints lodged by data subjects, to use all powers afforded to her by the GDPR and by national Law 125(I)/
- Commissioner for Personal Data Protection