Data Protection & Privacy

Data We Collect

NovaForge LTD, operating the online gaming platform accessible at boomerangbet.ie and licensed under the Gaming Board of Anjouan under license reference ALSI-152406028-FI2, processes personal data in accordance with applicable data protection legislation. The following categories of personal data are subject to collection and processing:

Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identification documents, including passports, national identity cards, and driving licences, as required for identity verification and age verification purposes.
Contact Data: Electronic mail address, residential address, postal code, country of residence, and telephone number, as provided by the data subject during the account registration process or subsequent account management activities.
Financial Data: Payment instrument details, including partial card numbers, bank account identifiers, transaction histories, deposit records, withdrawal records, and documentation submitted in connection with financial verification procedures.
Account Data: Username, account credentials (stored in encrypted form), account preferences, gaming history, wagering activity, session data, bonus utilisation records, and responsible gambling settings as configured by the data subject.
Technical Data: Internet Protocol (IP) addresses, browser type and version, operating system, device identifiers, geographic location data derived from IP resolution, cookie identifiers, session tokens, and access timestamps collected through automated means during interaction with the platform.
Behavioural Data: Clickstream data, navigation patterns, game selection records, frequency and duration of platform sessions, and interaction logs generated through the use of platform services.
Communications Data: Records of correspondence exchanged between the data subject and customer support personnel, including electronic mail communications, live chat transcripts, and submitted support tickets.
Compliance Data: Information collected in fulfilment of obligations under anti-money laundering regulations, counter-terrorism financing requirements, and responsible gambling frameworks, including source of funds declarations, self-exclusion records, and enhanced due diligence documentation.

Personal data is collected directly from the data subject at the point of account registration, through subsequent interactions with the platform, and, where legally permissible, from third-party identity verification providers, credit reference agencies, and fraud prevention databases.

How We Use Data

Personal data collected by NovaForge LTD is processed for specified, explicit, and legitimate purposes as described herein. Processing activities are conducted on the basis of one or more lawful grounds, including contractual necessity, compliance with legal obligations, legitimate interests pursued by the controller, and, where applicable, the consent of the data subject.

Account Registration and Management: Personal data is processed for the purpose of establishing and maintaining user accounts, verifying the identity and eligibility of applicants, and providing access to the gaming services offered through boomerangbet.ie. Such processing is necessary for the performance of the contractual relationship between NovaForge LTD and the data subject.
Service Provision and Platform Operation: Data relating to gaming activity, account preferences, and session behaviour is processed to facilitate the delivery of gaming services, to ensure the correct crediting of winnings and processing of withdrawals, and to maintain the technical functionality and integrity of the platform.
Legal and Regulatory Compliance: NovaForge LTD is subject to obligations arising from its gaming licence issued by the Gaming Board of Anjouan, as well as applicable anti-money laundering and counter-terrorism financing legislation. Personal data is processed to fulfil know-your-customer (KYC) obligations, conduct source of funds assessments, report suspicious transactions to competent authorities where required, and maintain mandatory records for the periods prescribed by law.
Financial Transaction Processing: Payment data is processed for the purpose of executing deposits, withdrawals, and refunds, verifying the ownership of payment instruments, and preventing fraudulent financial activity. Such processing may involve the transmission of relevant data to authorised payment processing partners.
Fraud Prevention and Security: Technical and behavioural data is processed to detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other conduct that constitutes a breach of the platform's terms and conditions or applicable law. Processing for this purpose is carried out on the basis of legitimate interests.
Responsible Gambling: Data relating to gaming behaviour, session frequency, and wagering patterns is processed to monitor compliance with responsible gambling obligations, to identify indicators of problem gambling behaviour, and to implement protective measures such as deposit limits, session limits, and self-exclusion in accordance with regulatory requirements and the data subject's expressed preferences.
Customer Support: Communications data and account data are processed to address enquiries, resolve disputes, and provide technical assistance to data subjects. Records of such communications are retained for quality assurance and audit purposes.
Electronic Communications: Where the data subject has provided consent, or where such communications are necessary for the performance of the contract, contact data may be used for the purpose of transmitting transactional notifications, account alerts, and service-related communications. Marketing communications shall only be transmitted where a valid legal basis for such processing has been established.
Platform Improvement and Analytics: Aggregated and pseudonymised behavioural and technical data may be processed for the purpose of analysing platform performance, identifying technical deficiencies, and informing decisions regarding the development and enhancement of the services provided.

Security Measures

NovaForge LTD has implemented a comprehensive framework of technical and organisational measures designed to ensure a level of security appropriate to the risk presented by the processing activities conducted. These measures are subject to periodic review and revision in response to evolving threats and technological developments.

Encryption: All personal data transmitted between the data subject's device and the platform's servers is protected through the application of Transport Layer Security (TLS) encryption protocols. Sensitive data at rest, including authentication credentials and financial information, is stored in encrypted form using industry-standard encryption algorithms.
Access Controls: Access to systems and databases containing personal data is restricted on a need-to-know basis. Role-based access control mechanisms are implemented to ensure that personnel are granted access only to the data necessary for the performance of their designated functions. Access privileges are subject to periodic review and are revoked upon the termination of employment or change of role.
Authentication Protocols: Systems containing personal data are protected by robust authentication mechanisms. Multi-factor authentication is required for access to administrative systems and sensitive data repositories.
Data Minimisation: Personal data is collected and retained only to the extent necessary for the fulfilment of the purposes for which it was collected. Data that is no longer required for processing purposes is subject to secure deletion or anonymisation in accordance with documented retention schedules.
Third-Party Processor Management: Where personal data is disclosed to third-party processors, including payment service providers, identity verification agencies, and technology infrastructure providers, appropriate contractual safeguards are imposed to ensure that such processors maintain standards of data protection commensurate with those applied by NovaForge LTD. Data processing agreements are established with all third-party processors prior to the commencement of processing activities.
Incident Response: Documented procedures for the detection, reporting, and management of personal data breaches are maintained. In the event of a breach that is likely to result in a risk to the rights and freedoms of natural persons, notification procedures shall be followed in accordance with applicable legal requirements.
Employee Training: Personnel with access to personal data are required to undergo training in data protection principles and security practices. Confidentiality obligations are imposed upon all relevant personnel through contractual arrangements.
Vulnerability Management: Technical infrastructure is subject to regular vulnerability assessments and security testing. Security patches and updates are applied in a timely manner to mitigate identified risks.
Physical Security: Where personal data is processed on physical infrastructure, appropriate physical security controls are maintained to prevent unauthorised access to data processing facilities.

Privacy Rights

Data subjects whose personal data is processed by NovaForge LTD are entitled to exercise the following rights in relation to their personal data, subject to the conditions and limitations prescribed by applicable data protection legislation. Requests for the exercise of data subject rights shall be assessed individually, and a response shall be provided within the timeframe required by law.

Right of Access: Data subjects are entitled to request confirmation as to whether personal data relating to them is being processed, and, where such processing is taking place, to obtain access to the personal data concerned together with information regarding the purposes of processing, the categories of data processed, recipients or categories of recipients to whom data has been or will be disclosed, and the envisaged retention period.
Right to Rectification: Where personal data held by NovaForge LTD is inaccurate or incomplete, the data subject is entitled to request that such data be corrected or supplemented without undue delay. Data subjects are encouraged to maintain the accuracy of account information through the account management functionality available on the platform.
Right to Erasure: Data subjects may request the deletion of personal data concerning them in circumstances where the data is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and no other legal basis for processing exists, or where the data has been unlawfully processed. This right is subject to exceptions, including where retention of the data is required for compliance with legal obligations or for the establishment, exercise, or defence of legal claims.
Right to Restriction of Processing: Data subjects are entitled to request that processing of their personal data be restricted in certain circumstances, including where the accuracy of the data is contested, where processing is unlawful and the data subject opposes erasure, or where the data is no longer required for processing purposes but is retained for legal claims purposes.
Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, data subjects are entitled to receive personal data concerning them in a structured, commonly used, and machine-readable format, and to request the transmission of such data to another controller where technically feasible.
Right to Object: Data subjects are entitled to object to the processing of personal data concerning them where such processing is carried out on the basis of legitimate interests. In the event of such an objection, processing shall cease unless compelling legitimate grounds for the processing can be demonstrated that override the interests, rights, and freedoms of the data subject, or where processing is necessary for the establishment, exercise, or defence of legal claims.
Right to Withdraw Consent: Where processing is based upon the consent of the data subject, such consent may be withdrawn at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
Rights in Relation to Automated Decision-Making: Data subjects are entitled not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects, except where such processing is necessary for the performance of a contract, is authorised by applicable law, or is based on explicit consent.

The exercise of any of the above rights is subject to verification of the identity of the requesting party. Requests that cannot be fulfilled due to applicable legal obligations or other legitimate grounds shall be communicated to the data subject together with an explanation of the reasons for the refusal. Data subjects who are not satisfied with the response received retain the right to lodge a complaint with the competent supervisory authority.

Get in Touch

All enquiries, requests, and correspondence relating to the processing of personal data by NovaForge LTD, including the exercise of data subject rights as described in this document, should be directed to the following contact point:

Electronic correspondence: [email protected]

Requests submitted via electronic mail shall be acknowledged upon receipt, and a substantive response shall be provided within the period prescribed by applicable data protection legislation. Data subjects are advised to clearly identify the nature of their request in correspondence to facilitate prompt and accurate processing. Verification of identity may be required prior to the fulfilment of any data subject rights request.