Privacy Notice

1. Data Controller

For all questions relating to this Privacy Notice or to exercise any of your rights, please contact us using the details provided in our Legal Notice.

2. Personal Data We Process and Why

2.1 Participation Data

• Data categories: name, e-mail address and any additional information you provide in the participation form. Where required for individual promotions, additional information such as place of residence, age or preferred redemption location may be processed.
• Purpose: processing participations in our promotions and services, managing voucher issuance, verifying eligibility and communicating in connection with the respective campaign.
• Legal basis: Article 6(1)(b) GDPR (performance of a contract).

2.2 Server Log Files

• Data categories: IP address, date and time of access, browser type and version, operating system, referrer URL and other technical data.
• Purpose: ensuring the technical availability, stability and security of our website.
• Legal basis: Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest is the reliable operation and security of our website.

2.3 Cookies

Our website uses cookies to extend functionality and improve usability. We employ the following types of cookies:

• Strictly necessary cookies (legal basis: Article 6(1)(f) GDPR).
• Analytics and marketing cookies, used only with your consent (legal basis: Article 6(1)(a) GDPR). You can withdraw your consent at any time via our cookie banner.

These practices follow the requirements of Article 5(3) of Directive 2002/58/EC (e-Privacy Directive) as implemented in Cyprus by Law 112(I)/2004.

2.4 Newsletter and Marketing Communications

If you consent to receiving e-mail communications, we process your e-mail address, where applicable your name, and campaign, consent, preference or location data to the extent you provide such information. The purpose of processing is to send news, events, offers and promotions from Triwer Ltd and, where applicable, to personalise such communications.

Legal basis: Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link at the end of each e-mail or using the contact details provided above. The data are generally stored until withdrawal of consent or unsubscribe, unless statutory documentation or retention obligations require longer storage.

3. Recipients of Personal Data

We share personal data with technical service providers, hosting providers, consent and cookie providers and, where required, campaign partners or participating partner venues only to the extent necessary to carry out the respective promotion, issue vouchers or technically provide our services. Where service providers act on our behalf, processing is carried out under a data-processing agreement compliant with Article 28 GDPR.

Legal basis: Article 6(1)(b) or (f) GDPR.

4. Storage Period

We retain personal data only for as long as necessary to provide our services or as required by statutory retention obligations. Participation data are generally deleted after completion of the respective campaign unless longer retention is required by law or documentation obligations. Server log files are stored for security purposes and are anonymised or deleted after a few weeks.

5. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or manipulation. These measures are reviewed regularly and adjusted to the state of the art.

6. Your Rights

You have the following rights under the GDPR:

• Right of access (Article 15).
• Right to rectification (Article 16).
• Right to erasure ("right to be forgotten", Article 17).
• Right to restriction of processing (Article 18).
• Right to data portability (Article 20).
• Right to object (Article 21).
• Right to withdraw consent at any time (Article 7(3)).

7. Contact for Data Protection Matters

If you have any questions or wish to exercise your rights, please contact us at the address provided in Section 1.

8. Right to Lodge a Complaint

You can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. In Cyprus the competent authority is the Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia (www.dataprotection.gov.cy, e-mail: [email protected]).

9. Updates to This Privacy Notice

We may update this Privacy Notice from time to time to comply with legal requirements or to reflect changes in our services. The current version will always be available on our website.