Privacy Policy

Last updated on: 02 Jan 2025

Please read this Privacy Statement carefully. By subscribing to, accessing, or using our website and services, you acknowledge that you have read and understood this Privacy Statement. If you do not agree with the terms outlined in this Privacy Statement, please refrain from using this website. Users are encouraged to exercise their rights as described in this Privacy Statement, including the right to access, rectify, or delete their personal data.

"Ghitloot" ("Ghit Media B.V.") values your privacy and is committed to protecting your rights under applicable data protection laws. This Privacy Statement explains our policies and procedures regarding the collection, use, and disclosure of personal data provided by users and subscribers ("Users") of our website and services. Ghit Media B.V. may amend this Statement from time to time. Any updates will be published on this privacy page, and where appropriate, Users will be notified. We encourage you to review this Statement periodically to stay informed about how we protect your personal data."

1 - Information Collection

Categories of Personal Data Collected

Depending on the functionalities or services a User is using on our website (such as creating an account), and the information a User provides, Ghitloot ("Ghit Media B.V.") may process the following categories of personal data, as required for the purposes outlined in this Privacy Statement:

• Identity Data
  • Full Name
  • Date of Birth
  • Social Media Account Information
• Contact Data
  • Email Address
  • Billing Address (if applicable)
  • Phone Number (if applicable)
• Technical Data
  • Internet Protocol (IP) Address
  • Browser Type and Version
  • Operating System
  • Device Type and Model
  • Unique Device Identifiers (e.g., UUID)
  • Referring URL (the webpage visited before accessing Ghitloot)
• Usage Data
  • Date and Time of Access
  • Pages Visited on the Website
  • Time Spent on Pages
  • Clickstream Data (interaction with links or buttons)
• Cookies and Tracking Technologies
  • Session Cookies (to manage User sessions)
  • Persistent Cookies (to store login credentials or User preferences)
  • Analytics Cookies (to understand site traffic and usage patterns)
  • Tracking Pixels or Beacons (to measure engagement with emails or marketing content)
• Transactional Data (if applicable)
  • Payment Details (e.g., card type and last four digits, processed through secure third-party payment providers)
  • Order History
• Marketing Data
  • Newsletter Subscriptions
  • Marketing and Communication Preferences
• Voluntarily Provided Data
  • Feedback, Comments, or Survey Responses submitted by Users via the Website
  • Additional Information shared during Customer Support Interactions

2 - How We Use Personal Data

Ghit Media B.V. processes personal data only for specific purposes and in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). Below, we outline the purposes for processing personal data and the corresponding legal bases under the GDPR:

Purposes for Processing Personal Data;

• Providing and Improving Services
  • To operate, maintain, and improve our website, services, features, and content.
  • Legal Basis: Performance of a Contract; Legitimate Interests.
• Account Administration
  • To create and manage User accounts or memberships and facilitate access to and use of the website.
  • Legal Basis: Performance of a Contract.
• Navigation and User Experience
  • To enable Users to enjoy and navigate our site easily.
  • To personalize the User experience based on preferences and interactions.
  • Legal Basis: Legitimate Interests; Consent (for personalization where applicable).
• Understanding User Needs and Interests
  • To analyze User behavior and interests to better tailor our services to individual needs.
  • Legal Basis: Legitimate Interests.
• Fulfilling User Requests
  • To process and respond to specific User requests, such as inquiries or support tickets.
  • Legal Basis: Performance of a Contract.
• Communication and Updates
  • To provide Users with software updates, service notifications, or product announcements.
  • Legal Basis: Legitimate Interests; Consent (where required for marketing communications).
• Marketing and Promotions
  • To send newsletters, marketing or promotional materials, and other relevant information about Ghit Media B.V. or authorized third-party services or products.
  • Legal Basis: Consent.
• Ensuring Compliance and Legal Obligations
  • To comply with applicable laws, regulations, and legal processes, including fraud prevention and ensuring the security of our services.
  • Legal Basis: Legal Obligation; Legitimate Interests.

Data Minimization and Necessity

We only process personal data that is necessary to achieve the purposes described above and ensure compliance with legal requirements. If you disagree with any processing activity based on legitimate interests, you have the right to object to such processing. Additionally, you may exercise your other rights as outlined in this Privacy Statement, such as accessing, rectifying, or deleting your personal data. For more details on how to exercise your rights, please refer to the "Your Rights Under the GDPR" section and contact us using the details provided in the "Contact Us" section.

Consent and Restrictions for Minors

The Ghitloot platform is not intended for individuals under the age of 16. We do not knowingly collect personal data from minors without the explicit consent of a parent or legal guardian, as required by the GDPR.

• Users under the age of 16 are not permitted to register an account without verified parental or guardian consent.
• If we become aware that personal data has been provided by a minor without proper consent, we will take immediate steps to delete this data.

Parents or legal guardians are encouraged to contact us at [email protected] if they believe personal data of a minor has been processed without their consent.

3 - Service Providers, Business Partners, and Others

Ghit Media B.V. collaborates with third-party providers and community clients (such as organizations or businesses that use Ghitloot as a SaaS platform) to deliver and improve our services. Below, we explain how your personal data may be shared and processed:

Third-Party Service Providers

• Ghit Media B.V. engages third-party companies and individuals to facilitate the operation of the Ghitloot platform and services. These providers perform tasks on our behalf, including but not limited to:
• Website maintenance and hosting.
• Database management and storage.
• Web analytics and usage monitoring.
• Payment processing.
• Customer support services.

These service providers have access to your personal data only to the extent necessary to perform their specific tasks. All providers are contractually obligated to process your data securely and in compliance with applicable data protection laws.

Community Clients

Ghitloot enables communities (such as organizations managing giveaways) to access certain personal data of their Users, such as account details and participation data. This access is strictly necessary for the community to execute and manage their giveaways effectively.

To ensure compliance with the GDPR, Ghit Media B.V. enters into a Data Processing Agreement (DPA) with these community clients. This agreement specifies the responsibilities and obligations of both parties, ensuring the secure and lawful handling of personal data.

Sharing with Specific Third Parties

In addition to the above, Ghit Media B.V. may share personal data with the following third parties:

• Google and Other Authentication Providers
  If you choose to register using Google, X, Discord, Twitch, or Facebook, these platforms will process your login data in accordance with their respective privacy policies. Ghitloot ensures that such data sharing is based on your explicit consent during the authentication process.
  • Special Safeguards: Data transfers to non-EU countries, such as the United States (where some providers like Google are located), are protected through Standard Contractual Clauses (SCCs) or equivalent safeguards approved by the European Commission.
• Web Analytics and Tracking Providers
  Providers such as Google Analytics help us understand how Users interact with our platform. This data is aggregated and anonymized wherever possible to minimize privacy risks.
• Payment Processors
  For processing payments, we may share your data (e.g., name and billing details) with secure payment platforms. These processors comply with strict data protection standards and do not store sensitive financial data longer than necessary.
• Legal Obligations and Compliance
  We may disclose personal data to government authorities or other parties if required by law or to protect our legal rights.

Security and Minimization

Ghit Media B.V. ensures that all personal data shared with third parties is limited to what is strictly necessary for the purposes described above. All third-party relationships are governed by contracts that require data protection measures, including encryption and access controls.

4 - Creating an User-Account

When you create an account on the Ghitloot platform to participate in giveaways or access additional features, you may choose to register using your email address or through third-party login providers, such as Google, X (formerly Twitter), Discord, Twitch, or Facebook.

Personal Data Processed

Depending on the method you select to create your account, we may process the following data:

• Email Registration: Name, email address, and password (encrypted).
• Third-Party Login Providers: Name, email address, profile picture, and any other information you authorize the third-party platform to share with us during the registration process.

Data Sharing with Third Parties

If you register through a third-party provider, certain data will also be shared with the respective provider to facilitate authentication and account creation. Ghitloot and the third-party platform act as independent data controllers for the data exchanged during this process.

• Example: If you log in with Google, Google will process your login data in accordance with its own privacy policy, which can be reviewed at Google Privacy Policy.

Ghitloot only processes the data necessary for authentication and account creation.

Legal Basis for Processing

The processing of your personal data during account creation is based on:

• Performance of a Contract: To provide the User account and enable participation in giveaways.
• Consent: When you choose to register via a third-party provider, your consent is required for data sharing during the authentication process.

Rights and Security Measures

You may revoke your consent at any time for third-party login data sharing by disconnecting the integration in your account settings or by contacting us. For more information about exercising your rights, please refer to the "Your Rights Under the GDPR" section of this Privacy Statement. All passwords are stored in encrypted form, and authentication data is transmitted securely. We recommend reviewing the privacy policies of the third-party providers you use to understand how they process your data.

5 - Your Rights Under the General Data Protection Regulation (GDPR)

As a User of Ghitloot’s services, you have the following rights regarding your personal data under the General Data Protection Regulation (GDPR):

• Right of Access
  You have the right to request confirmation of whether your personal data is being processed, and if so, to access the data and relevant information about its processing.
• Right to Rectification
  You may request that we correct or update inaccurate or incomplete personal data about you.
• Right to Erasure (“Right to be Forgotten”)
  You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when processing is based on your consent and you withdraw it.
• Right to Restriction of Processing
  You may request that we limit the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to its processing.
• Right to Data Portability
  You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another data controller where technically feasible.
• Right to Object
  You may object to the processing of your personal data for reasons relating to your particular situation, including for direct marketing purposes.
• Right to Withdraw Consent
  Where processing is based on your consent, you may withdraw this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint
  If you believe your rights under the GDPR have been violated, you have the right to lodge a complaint with a supervisory authority, such as the Dutch Data Protection Authority (‘’Autoriteit Persoonsgegevens’’).

How to Exercise Your Rights?

To exercise any of the rights outlined above, please contact us using the information provided in the "Contact Us" section at the end of this Privacy Statement. We will respond to your request as required under applicable data protection laws.

6 - Changing or Deleting Your Information

Unsubscribing from (Marketing) Communications

Users may choose to unsubscribe from our email alerts and marketing communications at any time. Every automated marketing email includes a clear opt-out link that allows Users to stop receiving such communications. This does not apply to emails that are essential for our services, such as notifications about your account, transactional emails, or communications necessary to announce giveaway winners.

Deleting Your Account

A request to delete your User account is distinct from unsubscribing from emails and marketing communications. To delete your account entirely from Ghit Media B.V., you must send an email to [email protected] with the subject line "delete account." Please note that account deletion may result in the permanent loss of access to the platform and associated data.

Retention of Data After Deletion

Upon receiving a request to delete your account, Ghit Media B.V. will:

• Delete Your Data: Most personal data will be deleted within 30 days of the request being processed.
• Retain Data for Legal Obligations: Certain data may be retained for the following purposes and durations:
  • Tax Records: Retained for up to 7 years to comply with tax and financial reporting obligations (e.g., invoices and payment records, as required under Dutch tax law).
  • Dispute Resolution: Retained for up to 5 years after account deletion to handle potential legal claims, in line with statutory limitation periods under Dutch law.
  • Transaction Data: Retained for up to 2 years to ensure compliance with service-level agreements and for record-keeping purposes.

Any retained data will be minimized and securely stored until the retention period expires. After this time, the data will be securely deleted or anonymized.

Retention of Data After Deletion

7. Security

Ghit Media B.V. prioritizes the security of your personal data and implements robust measures to protect it from unauthorized access, misuse, or disclosure. Our security practices comply with applicable data protection laws, including the GDPR, and follow industry best practices.

Security Measures

To ensure the confidentiality and integrity of your data, we employ:

• Encryption: All sensitive personal data, including payment-related information, is encrypted during transmission using Secure Sockets Layer (SSL) technology or equivalent protocols.
• Access Controls: Access to personal data is restricted to authorized personnel who are bound by confidentiality agreements.
• Data Minimization: We collect and store only the data necessary for the purposes outlined in this Privacy Statement.
• Firewalls and Monitoring: Our systems are protected by firewalls and monitored for suspicious activity to prevent data breaches.

Credit card numbers and other sensitive payment information are not stored on our servers. All payment transactions are securely processed through third-party providers that comply with the Payment Card Industry Data Security Standard (PCI DSS).

Ghit Media B.V. conducts regular security audits and risk assessments to identify potential vulnerabilities and ensure that our systems remain secure. We encourage Users to take precautions to protect their account credentials, such as using strong passwords and logging out of accounts when using shared devices. In the unlikely event of a data breach that affects your personal data, we will notify affected Users and the relevant data protection authority in accordance with GDPR requirements.

8 - Contact Us

If you have any questions about this Privacy Statement, or if you wish to exercise any of your rights as outlined in Section 5 of this Privacy Statement, please contact us:

Business Name: Ghitloot (Ghit Media B.V.), established in The Netherlands;

Registered Address: Claudius Prinsenlaan 12, 4811DK Breda, The Netherlands;

Email: [email protected] ;

Chamber of Commerce Registration Number: 86158031.

To ensure we process your request efficiently, please include specific details about your inquiry or the rights you wish to exercise. We aim to respond to all requests in accordance with applicable data protection laws.