Pelea is a peer-to-peer (P2P) betting application operated by Pelea ApS ("Pelea", "we", "us" or "our"). We are committed to protecting the privacy and personal data of our users ("Players") and community leaders ("Game Creators"). This privacy policy explains how we collect, use and protect your data in accordance with the General Data Protection Regulation (GDPR), the Danish Data Protection Act, the Danish Gambling Act and the Danish Anti-Money Laundering Act.
Contact Details: Pelea ApS · H. C. Andersens Blvd. 33, 4th · 1553 Copenhagen, Denmark · CVR: 44703122
In order to offer our P2P betting services and fulfil our obligations as a licence holder in Denmark, we collect the following categories of data:
2.1 Identity and Verification Data
- Full name, date of birth and CPR number: Collected and verified via MitID and synchronised with the Civil Registration System (CPR register). This is a statutory requirement for identification and age verification (minimum 18 years).
- Authentication Data: Session IDs and log files from MitID validation.
- Address: Collected together with your other identity data and used, among other things, if we investigate match-fixing or notify the Danish Gambling Authority of it.
- Verification Documentation: If required, copies of ID documents (e.g. passport) and proof of address for manual verification in high-risk assessments.
2.2 Financial Data and Transaction Data
- Payment Information: Information related to deposits and withdrawals, including details of the payment card you use via our payment provider Viva Wallet, and the account number of a bank account in your own name if a withdrawal is made to a bank account.
- Betting History: Details of stakes, winnings, losses and participation in "Game Cards".
- Influencer Payouts: Any commission statements and tax information for Game Creators.
2.3 Geolocation and Technical Data
- Geolocation Data: Your device's GPS location and your IP address are used when you open and use the app, to confirm that you are physically located in Denmark and to detect the use of a VPN. We do this because Apple and Google require real-money gambling apps to be restricted to the countries where the operator is licensed, and because our terms require you to be in Denmark when you play. The check is not a requirement of Danish gambling legislation.
- Device Identifiers: IP address, device type, operating system and unique app ID.
- Behavioural Data: Usage patterns in the app, time spent and clicked links.
2.4 Social Data and Interaction Data
- Chat Logs: Transcripts of communication in Game Card chat rooms.
- Game Performance: Leaderboards, historical results and answers to P2P questions.
- Social Connections: Friend lists and group memberships.
2.5 Club Affiliation Data
- Club Affiliation: Information that you or your close relatives have a role in a football club (e.g. as player, coach, referee, official, technical or medical staff, agent or in the club's management), and any tipster, affiliate or sponsorship agreements. We record this in an internal register when you, as a host (Game Creator), submit a club-affiliation declaration, or when we otherwise become aware of it. The purpose is to prevent match-fixing, see section 3.2.
3.1 Performance of a Contract: We process your identity, financial and gameplay data in order to provide the betting services you request, settle "Game Card" pools, and facilitate withdrawals.
3.2 Compliance with Legal Obligations: As the holder of a betting licence, we are legally required to check your CPR number against ROFUS when creating an account and at every login; monitor transactions to prevent money laundering and terrorist financing; screen users against the EU's sanctions lists and lists of politically exposed persons (PEPs); prevent and investigate match-fixing and notify the Danish Gambling Authority of any knowledge, suspicion or reasonable grounds to suspect match-fixing, under the Danish executive order on the prevention of match-fixing and section 12 of the Danish Gambling Act; and report suspicious patterns to the Money Laundering Secretariat (Hvidvasksekretariatet) and report taxable B-income for any influencer commission to the Danish Tax Agency (Skattestyrelsen).
3.3 Legitimate Interests: Fraud prevention (monitoring chat logs and betting patterns to identify cheating and collusion between players to manipulate pools) and security (protecting the platform against account takeover and technical threats). The check of your location and IP address (section 2.3) is based on our agreement with you and our legitimate interest in being able to offer the app on the Apple App Store and Google Play, cf. Article 6(1)(b) and (f) of the GDPR.
3.4 Consent: We obtain explicit consent for direct marketing (newsletters, SMS) or the sharing of data with specific Game Creators for their own community engagement.
We only share your information when necessary:
- Public Authorities: Including the Danish Gambling Authority, the Money Laundering Secretariat (Hvidvasksekretariatet) and the Danish Tax Agency (Skattestyrelsen).
- Prohibition on Disclosure (no tipping off): Under the Anti-Money Laundering Act, we are prohibited from informing you if a report of suspicious activity concerning your account has been submitted.
- Reporting of Match-fixing: We are required to notify the Danish Gambling Authority of any knowledge, suspicion or reasonable grounds to suspect match-fixing, and to disclose information about games and players. The rights to information and access under Articles 13-15 of the GDPR do not apply to information disclosed in this context (section 12(3) of the Danish Gambling Act).
- Other Players: In P2P games, your username and your ranking on the leaderboard are visible to other participants in your specific Game Card.
- Payment Providers: Transaction information is shared with our payment provider Viva Wallet and, for withdrawals to a bank account, with your bank in order to carry out transfers.
- Anti-Money Laundering and KYC Data: Identity information and transaction logs are retained for 5 years after the end of the customer relationship, cf. section 30 of the Anti-Money Laundering Act.
- Match-fixing Investigations: Records of investigations and reports concerning match-fixing are retained for 5 years, cf. sections 11 and 13 of the Danish executive order on the prevention of match-fixing.
- Active Account History: Your transaction history (stakes, winnings, losses) is available to you for at least 90 days in the app.
- Club Affiliation: Kept for as long as you hold an account or are a host at Pelea, and deleted no later than 5 years after the customer relationship ends.
- Marketing Data: Retained until you withdraw your consent.
- Right of Access: Request a copy of your personal data. This right does not cover information disclosed to the Danish Gambling Authority concerning match-fixing, cf. section 4.
- Right to Rectification: Have outdated or incorrect information corrected.
- Right to Erasure: Request erasure. Please note: statutory retention requirements under the Anti-Money Laundering Act (5 years) take precedence over the right to erasure for identity and transaction data.
- Account Closure: You may close your account at any time. Any remaining balance will be paid out as soon as possible and no later than within 5 business days.
Security: All data is encrypted at rest and in transit via TLS. Internal access to CPR data is strictly restricted and audited.
Cookies/tracking: We use necessary cookies for login sessions and security, as well as geolocation (GPS and IP address) to confirm that the app is used in Denmark, cf. section 2.3.
Your data is processed primarily within the European Economic Area (EEA). If a provider operates outside the EEA, we ensure that the EU's Standard Contractual Clauses (SCCs) are applied.
If you have questions or concerns, you can contact us. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).