Draft — subject to legal review
This document is a working draft prepared for review by qualified counsel. It is not legal advice, it is not yet in force, and it may change materially before publication. Bracketed text marks information that has not been confirmed yet.
How to Use This Template
Operators can add the text below to their own privacy notice, or publish it as a separate page linked from their privacy notice and from the rewards area where the Afterparty widgets appear. It is not legal advice. The operator must adapt it to its actual configuration, replace every bracketed placeholder, delete statements about features it does not use, and have it reviewed by its own counsel. The operator is the controller of its players' data and remains responsible for its privacy notice.
Statements in this template that describe how the Afterparty service itself works, such as the widget storage statement and the hosting location, reflect the hosted service as of the date above and do not need to be changed. Statements that depend on the operator's configuration are in brackets, with the Afterparty defaults given as guidance. Check the actual values in the brand settings (raw event retention and rollup retention) and in the retention policies of the Afterparty back office before publishing, and update the notice whenever you change them. If your own site stores the Afterparty launch token in a cookie or in browser storage, describe that in your own cookie notice.
Rewards and Engagement Features — Player Notice
Who provides these features
The rewards, missions, tournaments, raffles, mini-games, jackpots and messaging features on [Brand name] are provided by our technology provider, Codexx Nepal Pvt. Ltd. ("Afterparty"). Afterparty processes your personal data only on our behalf and on our instructions, as our processor and service provider. [Operator legal name] remains responsible for your data as controller.
What information is used
- Your account identifier issued by [Brand name], which our site passes to the features in a signed token, and your nickname if you choose one.
- Your contact details and preferences, such as email address, phone number and push notification settings, where you have agreed to receive messages from us.
- Account status information that we share, such as your country, language, currency, VIP tier, verification status and responsible-gaming status.
- Activity information that we share, such as deposits, bets, wins, bonuses and logins, which is used mainly in summarised form.
- How you use the features, such as opening the rewards area, claiming rewards, playing mini-games, entering raffles, and reading or clicking messages.
- Technical information, such as your IP address and device information, used to keep the features secure, prevent bonus abuse and apply country restrictions. Device and network identifiers are stored as keyed hashes where they are kept.
The features do not set cookies and do not store information in your browser's local storage, session storage or other on-device storage. The short-lived session token that connects the features to your account is kept only in the memory of the open page and is discarded when you close or reload it.
Why it is used
We use this information to show you rewards and progress, decide which offers and messages you are eligible for, run fair raffle draws that you can verify, send you messages you have agreed to receive, apply responsible-gaming, age and country restrictions, detect fraud and bonus abuse, and improve our promotions. [State the legal basis for each purpose, for example performance of our contract with you, legitimate interests or consent.]
Profiling
We group players into segments and calculate scores, such as the likelihood that a player will stop playing or the expected value of a player, to personalise offers. These scores do not by themselves decide whether you win a prize, receive a reward or have your account restricted; a member of our team reviews decisions with significant effects. Responsible-gaming restrictions always take priority over promotions: if you are self-excluded or have set limits, you will not receive promotional rewards or marketing. You can object to profiling for direct marketing at any time.
Who receives it
Afterparty and the sub-processors it uses for hosting, message delivery and AI-assisted operations, listed at [https://afterparty.example.com/legal/subprocessors, or your own list]. The features are hosted in the United States, and Afterparty personnel may access information remotely from Nepal to operate and support them. Where information is transferred out of the European Economic Area, the United Kingdom or Switzerland, it is protected by safeguards such as the European Commission's standard contractual clauses.
How long it is kept
[Describe the retention periods configured for your brand. Afterparty defaults, which you can shorten: detailed activity events are kept for [395 days, about 13 months]; daily activity summaries for [760 days, about 25 months]; records of messages sent to you for [400 days]; messages in your on-site inbox for [90 days]; and feature sessions for [7 days]. Add the periods you keep reward, ledger and draw records for, for example [number] years to meet our regulatory obligations, and any retention policies you have configured.] When you ask us to delete your data, your player record is anonymised and your activity events, identifiers and referral records are deleted, unless we must keep them for a legal reason such as a regulatory or legal hold.
Your rights
To access, correct, delete or export your data, to object to processing, or to withdraw consent to marketing, contact [Brand name] at [privacy contact email or link]. Please do not contact Afterparty directly; Afterparty will forward any request it receives to us. You also have the right to complain to [your data protection supervisory authority].