Privacy Policy
1. About this Privacy Policy
1.1. This Privacy Policy explains how Mosaik Innovations Limited (trading as GGR Partners) (“GGR Partners”, the “Company”, “we”, “us”, “our”) collects, uses, shares and otherwise processes personal data in connection with:
(a) the website located at https://ggrpartners.com, together with any subdomain, landing page, partner portal or log-in area operated by us (the “Website”);
(b) the GGR Partners affiliate programme and the partner relationship established under our Terms and Conditions (the “Affiliate Programme”); and
(c) our business communications with affiliates, applicants, operators, advertisers, suppliers, service providers and prospective partners.
1.2. This Privacy Policy should be read together with our Terms and Conditions and our Cookie Policy. Where there is any conflict between this Privacy Policy and the Terms and Conditions in relation to the processing of personal data, this Privacy Policy prevails.
1.3. GGR Partners is a marketing intermediary. We provide consulting and advertising services and we are not the owner or the operator of the gambling products promoted through the Affiliate Programme. Where an individual registers an account, deposits funds or plays with an operator, that operator is a separate and independent controller of that individual’s personal data and its own privacy policy applies. We are not responsible for the privacy practices of operators or of affiliate websites.
1.4. Capitalised terms not defined in this Privacy Policy have the meaning given to them in the Terms and Conditions. For the avoidance of doubt, and notwithstanding any definition in the Terms and Conditions, “personal data” in this Privacy Policy means information relating to an identified or identifiable natural person, as defined in the UK GDPR and the EU GDPR. Information relating solely to a legal entity is not personal data.
2. Who we are and how to contact us
2.1. The controller of your personal data is:
| Legal entity | Mosaik Innovations Limited |
|---|---|
| Trading name | GGR Partners |
| Registered address | Unit G, 15/F., Tal Building, 49 Austin Road, Kowloon, Hong Kong |
| Company registration number | 76828442 |
| Website | https://ggrpartners.com |
| Privacy contact | privacy@ggrpartners.com |
2.2. We are established in Hong Kong. Where we process the personal data of individuals located in the United Kingdom or the European Economic Area (“EEA”) in connection with offering our services to them, or with monitoring their behaviour, we do so in accordance with the UK GDPR and the EU GDPR respectively, and we have appointed the representatives identified above. You may contact our representatives on all matters relating to the processing of your personal data.
3. Who this Privacy Policy applies to
3.1. This Privacy Policy applies to:
(a) Affiliates and applicants — individuals who apply to join, or who participate in, the Affiliate Programme, whether in their own name or as a sole trader;
(b) Individual representatives of corporate affiliates, operators, advertisers, agencies, suppliers and other business counterparties (for example directors, account managers, finance and compliance contacts, beneficial owners);
(c) Website visitors, including visitors who do not register;
(d) Job applicants who contact us or apply through the Website; and
(e) Recipients of our marketing communications.
3.2. Players. In the ordinary course of the Affiliate Programme we do not receive the names, contact details, account credentials or transaction details of individual players. We receive from operators and from our tracking platform pseudonymous identifiers (such as click IDs, sub-IDs, player reference numbers), conversion events and aggregated performance statistics. Where such identifiers can be linked to an identifiable individual by the operator, they constitute personal data and we process them as described in this Privacy Policy, on the basis of our legitimate interests in verifying commission, preventing fraud and meeting our contractual obligations to operators.
4. Personal data we collect
4.1. We collect and process the following categories of personal data.
| Category | Examples |
|---|---|
| Identity and account data | Full name; username; date of birth; nationality; country of residence; job title; the name of the company you represent; account ID within the Affiliate Programme |
| Contact data | Email address; postal address; telephone number; messenger identifiers (Telegram, WhatsApp, Skype, Microsoft Teams); the messaging channel you prefer |
| Application and business data | Traffic types and sources you operate; URLs of your affiliate websites and channels; geographical markets targeted; expected volumes; referral source and promo code; details of any prior affiliate programmes |
| Verification and compliance data | Copies of identity documents, proof of address, company incorporation documents, ownership and control information, tax identification numbers, sanctions, PEP and adverse media screening results, licence and self-declaration information |
| Financial and payment data | Bank account and IBAN details, e-wallet and cryptocurrency wallet addresses, payment instructions, invoices, payment history, commission balances, deductions and adjustments, tax documentation |
| Performance and tracking data | Tracking links and identifiers issued to you; clicks, registrations, deposits, conversions and other events attributed to you; commission calculations; chargebacks, reversals and negative carryover |
| Technical and usage data | IP address; approximate location derived from IP; device type, operating system and browser; browser language; referring and exit URLs; pages viewed and time spent; log-in times and session identifiers; cookie and similar identifiers |
| Communications data | Emails, messenger correspondence, support tickets, call and meeting notes, and records of complaints and disputes |
| Marketing data | Your marketing preferences, consents and objections; engagement with our newsletters and campaigns |
| Recruitment data | CV, employment history, qualifications and any information you provide when applying for a role with us |
4.2. Sources. We obtain personal data:
(a) directly from you — when you complete the sign-up or contact form, correspond with us, use your partner account, submit invoices or verification documents, or attend industry events;
(b) automatically — through cookies, server logs, tracking pixels and similar technologies, as described in section 6;
(c) from third parties — including our affiliate tracking platform provider, operators and advertisers whose brands you promote, payment and banking providers, fraud-prevention and traffic-quality providers, identity-verification, sanctions and PEP screening providers, public registries and company databases, publicly available sources including your own websites and social media profiles, and the partner who referred you.
4.3. Special category data. We do not seek to collect special category personal data (Article 9 UK/EU GDPR) or data relating to criminal convictions and offences (Article 10) other than where this is unavoidable in the course of identity verification, sanctions screening or adverse media checks. Where such data is processed, we do so on the basis of substantial public interest in preventing and detecting unlawful acts and in complying with regulatory requirements applicable to the gambling and advertising sectors, and, where required, on the basis of an appropriate policy document.
4.4. Data you provide about other people. If you provide us with personal data relating to another individual (for example a colleague, a director or a beneficial owner of your company), you confirm that you are entitled to do so and that you have informed that individual of this Privacy Policy.
5. Why we process personal data and our legal bases
5.1. We process personal data only where we have a lawful basis. The table below sets out our purposes and the corresponding legal bases under Article 6 of the UK GDPR and the EU GDPR.
| Purpose | Main categories used | Legal basis |
|---|---|---|
| Assessing and deciding on applications to join the Affiliate Programme | Identity, contact, application and business data | Steps at your request prior to entering a contract (Art. 6(1)(b)); our legitimate interests in assessing the suitability and quality of partners (Art. 6(1)(f)) |
| Creating and administering your partner account, granting access to the portal and providing tracking links and promotional materials | Identity, account, contact, performance data | Performance of a contract (Art. 6(1)(b)) |
| Attributing traffic, calculating and verifying commission, and resolving commission disputes | Performance and tracking data, technical data | Performance of a contract (Art. 6(1)(b)); legitimate interests in the accurate settlement of amounts due (Art. 6(1)(f)) |
| Processing invoices and making payments | Identity, financial and payment data | Performance of a contract (Art. 6(1)(b)); compliance with a legal obligation, including accounting and tax obligations (Art. 6(1)(c)) |
| Preventing, detecting and investigating fraud, traffic manipulation, incentivised or non-compliant traffic, bonus abuse, multi-accounting and breaches of the Terms and Conditions | All categories | Legitimate interests in protecting our business, our operators and the integrity of the Affiliate Programme (Art. 6(1)(f)) |
| Customer and partner due diligence, identity verification, sanctions, PEP and adverse media screening, and anti-money laundering and counter-terrorist financing measures | Identity, verification, financial data | Compliance with a legal obligation (Art. 6(1)(c)); legitimate interests and substantial public interest in preventing financial crime (Art. 6(1)(f), Art. 9(2)(g) where applicable) |
| Monitoring compliance with responsible gambling requirements, advertising codes and marketing restrictions applicable in the markets you target | Application, business, performance data | Compliance with a legal obligation (Art. 6(1)(c)); legitimate interests in lawful and responsible advertising (Art. 6(1)(f)) |
| Communicating with you, providing support and managing our relationship | Contact, communications data | Performance of a contract (Art. 6(1)(b)); legitimate interests in managing our business relationships (Art. 6(1)(f)) |
| Sending marketing communications about the Affiliate Programme, campaigns, offers and industry events | Contact, marketing data | Your consent (Art. 6(1)(a)) where consent is required; otherwise our legitimate interests in business-to-business marketing to existing partners (Art. 6(1)(f)) |
| Operating, securing and maintaining the Website, log-in area and IT systems, including access control, logging and back-ups | Technical and usage data | Legitimate interests in the security and availability of our systems (Art. 6(1)(f)); compliance with a legal obligation (Art. 6(1)(c)) |
| Analysing use of the Website and improving our services and promotional materials | Technical and usage data | Your consent where analytics cookies or similar technologies are used (Art. 6(1)(a)); otherwise legitimate interests in improving our services (Art. 6(1)(f)) |
| Establishing, exercising and defending legal claims, responding to regulators, courts and law enforcement, and conducting audits | All categories | Compliance with a legal obligation (Art. 6(1)(c)); legitimate interests in protecting our legal position (Art. 6(1)(f)) |
| Evaluating job applications | Recruitment data | Steps at your request prior to entering a contract (Art. 6(1)(b)); legitimate interests in recruitment (Art. 6(1)(f)) |
| Corporate transactions, including any sale, merger, restructuring or financing of our business | All categories | Legitimate interests in conducting corporate transactions (Art. 6(1)(f)) |
5.2. Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests are not overridden by your interests, rights and freedoms. You may request a summary of the relevant assessment by contacting us using the details in section 2.
5.3. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5.4. If you do not provide personal data that we require in order to enter into or perform our contract with you — in particular identity, verification and payment data — we may be unable to approve your application, to operate your account or to pay commission.
6. Cookies and similar technologies
6.1. The Website uses cookies, pixels, local storage and similar technologies. We use them in the following categories:
(a) Strictly necessary — required to operate the Website, maintain your session, secure the log-in area and balance load. These do not require consent.
(b) Functional — remember your preferences, such as language and interface settings.
(c) Analytics and performance — help us understand how the Website is used so that we can improve it.
(d) Affiliate tracking — record referrals from and to partner websites so that traffic can be attributed and commission calculated.
6.2. We place cookies and similar technologies that are not strictly necessary only with your consent, obtained through the cookie banner presented when you first visit the Website, in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the ePrivacy Directive as implemented in the relevant EEA member state.
6.3. You may change or withdraw your cookie preferences at any time via through your browser settings. Blocking strictly necessary cookies may prevent parts of the Website from working.
6.4. Affiliates’ own obligations. If you are an affiliate, you are required under our Terms and Conditions to inform visitors to your website, by means of your own privacy and cookie notices, that tracking technology will be set on their device, to obtain valid consent where the law requires it, and to give them the opportunity to reject it. You remain the controller in respect of the personal data of your own site visitors and are responsible for your own compliance with data protection and e-privacy law.
6.5. We do not currently respond to “Do Not Track” browser signals. Where the law requires us to honour an opt-out preference signal, we do so.
7. Marketing communications
7.1. We may send you information about the Affiliate Programme, commercial offers, campaigns, new brands and industry events by email and messenger.
7.2. Where consent is required, we will obtain it before sending. Where we contact business partners on the basis of legitimate interests, we do so only in respect of services similar to those you already receive from us.
7.3. You may opt out at any time, free of charge, by using the unsubscribe link in any message or by contacting us at privacy@ggrpartners.com. Opting out of marketing does not stop service and administrative messages relating to your account, commission or legal obligations.
7.4. We do not use your personal data to advertise gambling products to you as a consumer.
8. Who we share personal data with
8.1. We disclose personal data to the following categories of recipient:
(a) Operators, advertisers and brand owners whose products you promote — for the purposes of attribution, commission verification, fraud prevention, compliance and regulatory reporting. These recipients act as independent controllers or, in some cases, as joint controllers with us in respect of traffic attribution data;
(b) Affiliate tracking and reporting platform providers — acting as our processors;
(c) Payment service providers, banks, e-money institutions and cryptocurrency service providers — to make payments to you and to meet their own regulatory obligations;
(d) IT, hosting, cloud, communications, CRM and email service providers — acting as our processors;
(e) Analytics, fraud-prevention and traffic-quality providers;
(f) Identity verification, sanctions, PEP and adverse media screening providers;
(g) Professional advisers — lawyers, auditors, accountants and insurers, bound by professional confidentiality;
(h) Regulators, tax authorities, law enforcement, courts and other public authorities — where we are required to do so by law or where disclosure is necessary to establish, exercise or defend legal claims;
(i) Companies within our corporate group, where applicable, for administration and shared services; and
(j) A purchaser or prospective purchaser of our business or assets, and their advisers, in connection with a sale, merger, reorganisation or financing.
8.2. We do not sell personal data, and we do not share personal data with third parties for their own independent direct marketing purposes.
8.3. Where a recipient acts as our processor, we have in place a written agreement meeting the requirements of Article 28 of the UK/EU GDPR, requiring the recipient to process personal data only on our documented instructions and to apply appropriate security measures.
8.4. A current list of our principal processors and sub-processors is available on request.
9. International transfers of personal data
9.1. We are established in Hong Kong, and our service providers and the operators we work with are located in a number of countries, including within and outside the EEA and the United Kingdom.
9.2. Hong Kong is not the subject of an adequacy decision of the European Commission or of adequacy regulations of the United Kingdom. Accordingly, where personal data is transferred from the EEA or the United Kingdom to us or to any other recipient in a country without an adequacy decision, we rely on one or more of the following safeguards:
(a) the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) for transfers from the EEA;
(b) the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner, for transfers from the United Kingdom;
(c) where applicable, a derogation under Article 49 of the UK/EU GDPR, including where the transfer is necessary for the performance of a contract with you.
9.3. We carry out transfer risk assessments and apply supplementary technical, organisational and contractual measures where necessary.
9.4. You may request a copy of the safeguards we rely on by contacting us using the details in section 2. We may redact commercially confidential information.
10. How long we keep personal data
10.1. We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax or reporting requirements.
| Data | Retention period | Rationale |
|---|---|---|
| Applications that are rejected or withdrawn | 12 months from the decision | Handling re-applications and demonstrating the basis of the decision |
| Partner account and contract data, including correspondence | Duration of the relationship plus 6 years from termination | Limitation period for contractual claims under the law of England and Wales |
| Invoices, payment records and accounting data | 7 years from the end of the relevant financial year | Accounting and tax obligations |
| Customer due diligence, identity verification and screening records | 5 years from the end of the business relationship, unless a longer period is required | Anti-money laundering requirements |
| Tracking, conversion and commission calculation data | 24 months from the event, after which retained in aggregated or pseudonymised form | Dispute resolution and reporting |
| Fraud and abuse investigation records | 6 years from the conclusion of the investigation | Defence of legal claims and prevention of repeat abuse |
| Marketing preferences and suppression lists | Until withdrawal of consent, and thereafter indefinitely in a suppression list | Demonstrating that an objection has been honoured |
| Website server logs | 12 months | Security and troubleshooting |
| Cookies and similar identifiers | As set out in the Cookie Policy | — |
| Unsuccessful job applications | 6 months from the decision, or longer with your consent | Recruitment record-keeping |
10.2. Where the periods above conflict with a mandatory retention requirement or a litigation hold, the longer period applies. At the end of the applicable period we securely delete or irreversibly anonymise the data.
11. How we protect personal data
11.1. We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include encryption of data in transit, access control on a need-to-know basis, multi-factor authentication for administrative access, logging and monitoring, segregation of environments, secure back-ups, staff confidentiality undertakings and training, and vendor due diligence.
11.2. You are responsible for keeping your account credentials confidential and for all activity carried out under your account. Please notify us immediately at privacy@ggrpartners.com if you believe your account has been compromised.
11.3. No transmission over the internet is entirely secure. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority within 72 hours where required, and will notify affected individuals where the breach is likely to result in a high risk to them.
12. Your rights
12.1. Subject to the conditions and exemptions in the UK GDPR and the EU GDPR, you have the right to:
(a) be informed about how we process your personal data — this Privacy Policy serves that purpose;
(b) access your personal data and obtain a copy of it;
(c) rectification of inaccurate personal data and completion of incomplete data;
(d) erasure of your personal data in certain circumstances (the “right to be forgotten”);
(e) restrict processing in certain circumstances;
(f) data portability — to receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
(g) object to processing based on our legitimate interests, on grounds relating to your particular situation;
(h) object to direct marketing at any time — this right is absolute and we will always comply;
(i) withdraw consent at any time, where processing is based on consent;
(j) not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; and
(k) lodge a complaint with a supervisory authority.
12.2. How to exercise your rights. Contact us at privacy@ggrpartners.com or through our representative identified in section 2. We may ask you for information to verify your identity. We will respond within one month; where the request is complex or where we have received a number of requests, we may extend this by up to two further months and will inform you of the extension and the reasons for it. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
12.3. Complaints. If you are not satisfied with how we have handled your personal data, you may complain to:
(a) in the United Kingdom, the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — https://ico.org.uk;
(b) in the EEA, the supervisory authority of the member state of your habitual residence, place of work or place of the alleged infringement — a list is available at https://edpb.europa.eu;
(c) in Hong Kong, the Office of the Privacy Commissioner for Personal Data — https://www.pcpd.org.hk.
We would appreciate the opportunity to address your concerns before you approach a supervisory authority.
13. Automated decision-making and profiling
13.1. We use automated tools to score traffic quality and to flag suspected fraud, incentivised traffic and breaches of the Terms and Conditions. This constitutes profiling.
13.2. Where an automated assessment could lead to a decision producing legal effects concerning you or similarly significantly affecting you — for example the rejection of an application, the withholding or forfeiture of commission, or the suspension or termination of your account — that decision is subject to human review before it takes effect, save where the decision is necessary for entering into or performing a contract with you or is authorised by law. In all such cases you have the right to obtain human intervention, to express your point of view and to contest the decision, by contacting us at privacy@ggrpartners.com.
14. Children and age restrictions
14.1. The Website and the Affiliate Programme are intended exclusively for persons aged 18 or over (or the higher minimum age applicable in the relevant jurisdiction) acting in a professional or business capacity.
14.2. We do not knowingly collect personal data from children. Marketing and promotional materials supplied by us must not be directed at, or be capable of appealing particularly to, persons under the legal gambling age in the target market.
14.3. If you believe that we hold personal data relating to a child, please contact us at privacy@ggrpartners.com and we will delete it without undue delay.
15. Third-party websites and operators
15.1. The Website, our promotional materials and our tracking links contain links to websites operated by third parties, including gambling operators and affiliate websites. We do not control those websites and are not responsible for their content or their privacy practices.
15.2. When you follow a link to an operator’s website, that operator collects and processes your personal data as an independent controller under its own privacy policy and under the gambling licence that applies to it. We encourage you to read those policies before providing personal data.
16. Changes to this Privacy Policy
16.1. We may update this Privacy Policy from time to time to reflect changes to our practices, our services or applicable law. The current version and its effective date are always published on this page.
16.2. Where a change is material — for example a new purpose of processing or a new category of recipient — we will notify registered partners by email or through the partner portal a reasonable period before the change takes effect. Where the change requires your consent, we will obtain it.
16.3. Previous versions are available on request.
17. Contact us
Questions, requests and complaints relating to this Privacy Policy or to our processing of personal data should be addressed to:
Mosaik Innovations Limited (GGR Partners)
Unit G, 15/F., Tal Building, 49 Austin Road, Kowloon, Hong Kong
Company registration number 76828442
Email: privacy@ggrpartners.com