Valid as of 20 September, 2026.

The Hellenic Basketball Clubs Association, E.S.A.K.E. (Hellenic Basketball Clubs Association), operating under the trade name GBL (Greek Basketball League), takes your privacy seriously. Please read this Privacy Policy to learn more about how we collect, handle and use personal data collected from users or visitors to the website https://www.fantasygbl.com and all websites and sub-pages linked to it, hereinafter collectively referred to as the “Website” or “Platform”,and Services.

INFORMATION ABOUT US

For the different data processing activities included in this Privacy Policy, the following entity shall be considered as controller, unless otherwise indicated in a section of this Policy:Hellenic Basketball Clubs Association, E.S.A.K.E. (Hellenic Basketball Clubs Association), operating under the trade name GBL (Greek Basketball League), hereinafter collectively referred to as the “Controller” Postal address: Kleisthenous 338,15344, GerakasVat Number: 090055775If you be asked to provide consent for your personal data to be used by Fantaking Interactive S.r.l. (hereinafter “Fantaking Interactive”), with registered office in Corsica 14/A, 25125, Brescia (BS) VAT n. 03549330987, email address info@fantaking.it for commercial purpose, Fantaking Interactive shall be considered an individual controller and will be solely responsible for the procession undertaken, under its specific user information for personal data provided by Fantaking Interactive.

Our data protection officer can be contacted at dpo@gbl.com.gr

Greek Basketball League ensures that the processing of the personal data you provide takes place according to this Privacy Policy and in compliance with the provisions of current legislation on data protection and in the context of the new regulatory framework established by virtue of the provisions of the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

A. PERSONAL DATA COLLECTION- Account Registration, Management and Use of the Platform

The Controller may process the following personal data:

• First name and last name
• Email address
• Username/nickname
• Country of residence
• Age or confirmation that the User is an adult
• Preferred competition teams
• Telephone number, where voluntarily provided

The above data may be processed for the purposes of:

• creating, registering and managing the User’s account;
• verifying the User’s eligibility to participate in the Fantasy Game;
• providing, operating and administering the Platform and its functionalities;
• enabling the User to participate in and interact with the Fantasy Game;
• displaying the User’s username/nickname and relevant game-related information, including rankings and results;
• communicating with the User in relation to the Platform, the User’s account and participation;
• administering the Fantasy Game and its results.
• communicating with the User in relation with Prizes and Gifts

The legal basis for such processing is Article 6(1)(b) GDPR (performance of a contract), to the extent that the processing is necessary for the provision and administration of the Platform and the User’s participation in the Fantasy Game. Where the processing is necessary for compliance with a legal obligation applicable to the Controller, the legal basis shall be Article 6(1)(c) GDPR (compliance with a legal obligation).

Where the telephone number is optional and is not necessary for the provision of the Platform, its processing shall be based on Article 6(1)(a) GDPR (consent).

COMMUNICATION FOR THE AWARD OF GIFTS, PRIZES AND AWARDS

The Data Controller, for the purpose of awarding gifts, prizes and awards (monetary or otherwise), will process the User's contact details (name, e-mail) in order to contact the User regarding the award of the relevant gift/prize/award. The processing is based on the performance of this contract for communicating with winner and consent for sending their personal data to SNAPPI BANK S.A.,

In its communication with the User, the User's consent will be requested for the transmission of their details to a third party, the banking company SNAPPI BANK S.A., which has its registered seat in Ioannina, 7A Krystalli Street, P.C. 45444, with General Commercial Registry (G.E.MI.) number 164679129000 and Tax Identification Number (VAT No.) 801858330 [competent Greek supervisory authority: Bank of Greece ("BoG"), 21 Eleftheriou Venizelou Street, P.C. 102 50], for the purpose of verifying the identity of the winner and recipient of the gift/prize and of awarding the gift/prize, which will be paid exclusively by the aforementioned company by bank transfer to an account that the players must hold with it, and by no other means (as provided in the terms of use).

In the case of a minor User who wins gifts, prizes or awards (monetary or otherwise), the award shall be made exclusively to their legal guardians, who must make contact on behalf of their child and provide the above personal data (name, e-mail) of both themselves and their child, the User, for the purpose of awarding the gift/prize/award and of identifying them. The processing will be based on the performance of this contract for communicating with winner and consent for sending their personal data to SNAPPI BANK S.A.,

2. User Photograph and Publication of Winners

The Controller may process the User’s photograph, where voluntarily provided, for the purposes of enabling the User to use a profile photograph on the Platform and, where applicable, for the identification and announcement of winners.

The processing of the User’s photograph for optional purposes shall be based on Article 6(1)(a) GDPR (consent).

Where the User is a winner of the Fantasy Game, the Controller may publish the winner’s name and photograph on the Controller’s official social media accounts and/or other official communication channels for the purposes of announcing and communicating the winners and results of the Fantasy Game.

Such publication shall be carried out on the basis of the User’s specific and freely given consent pursuant to Article 6(1)(a) GDPR. The provision of such consent shall not be a condition for registration or participation in the Fantasy Game where such publication is not necessary for the provision of the Platform.

3. Data Not Required for the Free Fantasy Game

Given that the Fantasy Game is provided free of charge and does not involve purchases, paid services, monetary prizes or betting, the Controller does not intend to collect or process financial or economic information for the purposes of registration, participation in or use of the Platform.

Likewise, the Controller shall not collect the User’s identification number (ID number) as part of the ordinary registration or use of the Platform, unless and to the extent that its collection is strictly necessary for compliance with a specific legal obligation applicable to the Controller. In such circumstances, the relevant identification data shall be processed solely for the specific purpose and to the extent required by the applicable legal obligation, pursuant to Article 6(1)(c) GDPR.

In all cases, the Controller shall ensure that personal data are processed in accordance with the principles set out in Article 5 GDPR, including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.Greek Basketball League collects personal data when you visit or use the GBL Platforms or GBL Services for purposes that are consistent with those described in this Privacy Policy.

When using the GBL Platforms (and any related applications and services) or registering we may ask you to provide all or some of the following information:

• Name
• Last name
• E-mail address
• User nickname
• Telephone number (optional)
• Country

Commercial Communications, Draws, Competitions and Promotional Events of GBL

a. Users with an active account on the GBL Platforms – Service-related communications

Within the scope of the Services, GBL may use the User’s contact details to communicate with the User regarding the operation and administration of the GBL Platforms and Services, including information concerning draws, competitions, promotions, events, activities and other experiences directly related to the User’s participation in the Services.

Such communications shall be limited to information that is necessary or otherwise directly related to the provision, administration and proper functioning of the Services and the User’s participation therein.

To the extent that such processing is objectively necessary for the performance of the agreement between the User and GBL, the legal basis shall be Article 6(1)(b) GDPR (performance of a contract).

b. Users who have provided consent to receive commercial and promotional communications from GBL

Subject to the User’s consent and applicable rules governing electronic communications, GBL may process the User’s contact details for the purposes of sending commercial, promotional and marketing communications concerning GBL Platforms, Services, products, competitions, draws, promotions, events, activities, offers and other relevant initiatives of GBL and/or the Greek Basketball League.

Such communications may include information about new or existing Services, promotional activities, competitions, draws, events and other marketing initiatives that may be of interest to the User.

Where prior consent is required under applicable law, including Article 11 of Greek Law 3471/2006 in respect of electronic direct marketing communications, the legal basis for the processing shall be **Article 6(1)(a) GDPR (consent)**, in conjunction with the applicable provisions of Greek Law 3471/2006.

The User may withdraw their consent at any time and may also object to the processing of their personal data for direct marketing purposes, without affecting the lawfulness of processing carried out prior to such withdrawal or objection.

Where applicable, GBL may rely on the exception provided under Article 11(3) of Greek Law 3471/2006 for the use of electronic contact details obtained lawfully in the context of a sale or other transaction for the promotion of similar products or services, provided that all statutory requirements are met, including the provision of a clear, easy and free means of opting out both when the contact details are collected and in each subsequent communication.

Sending newsletters and magazines:

• GBL will send you on a weekly basis any type of information about the development of the Competitions and other important events of the Competitions as part of the Services provided through the GBL Platforms.
• The Contractual relationship between you and Greek Basketball League, in accordance with article 6.1 b) of the GDPR is the legal basis for this processing.

Organization of services and events in the GBL Platforms:

• GBL organizes draws, competitions and promotional events. In these cases, the fans who wants to participate, will sign up voluntarily by completing the forms included in the GBL Platforms for this purpose. GBL will process the data in order to be able to manage fans participation in the draws and events, as well as the publication of the winners and the delivery of the prize, or any additional information that may be necessary (postal address or ID number), in the event that it occurs.
• The Contractual relationship between you and Greek Basketball League, in accordance with article 6.1 b) of the GDPR is the legal basis for this processing.

Conducting surveys:

• In order to verify the quality of the GBL Platforms and Services we provide, as well as your opinion about the Competitions, your participation in the Competitions or your relationship with GBL. Please be informed that the results of this surveys may be shared on an aggregate basis with our Digital Partners
• GBLlegitimate interest, in accordance with article 6.1 f) of the GDPR is the legal basis for this processing, as with this information GBL will be able to understand and improve the Competitions, GBL Platforms users experience and optimize the communications campaigns with the different users’ segments.

Internal reporting:

• GBL will process on an aggregate basis information about fans preferred Competitions team, gender, age, Country and other information about the devices you use when interacting with GBL Platforms for the elaboration of relevant metrics and statistics that allow GBL to analyze the use of the GBL Platforms by the different user segments generated and the impact of its campaigns, evaluating the interest that these campaigns have aroused among the aforementioned segments based on the data analyzed.
• GBL legitimate interest, in accordance with article 6.1 f) of the GDPR is the legal basis for this processing, as with this information GBL will be able to understand and improve GBL Platforms users experience and optimize the communications campaigns with the different users’ segments.

Commercial communications, draws, competitions and promotional events of GBL:

a. User with an active account in theGBL Platforms (not including commercial communications of GBL):

• Within the scope of the Services, GBLwill inform you of the development of any draws competitions, promotions and other actions or experiences conducted directly by GBL about GBL Platforms, Services and other relevant products of Greek Basketball League.
• The Contractual relationship between you and Greek Basketball League, in accordance with article 6.1 b) of the GDPR is the legal basis for this processing.

b. User with an active account in the GBL Platforms (including commercial communications of GBL):

• Within the scope of the Services, GBL will inform you of the development of any draws competitions, promotions and other actions or experiences conducted directly by GBL about GBL Platforms, Services and other relevant products of Greek Basketball League.
• GBL legitimate interest, in accordance with article 6.1 f) of the GDPR is the legal basis for this processing, as with this information GBL will be able to send your other relevant information about GBL.

c. Users without an active account in the GBL Platforms:

• GBL will inform you of the development of any draws competitions, promotions and commercial actions conducted directly by GBL about GBL Platforms and Services and other relevant products of Greek Basketball League. about their own products or special products created in collaboration with GBL.
• In accordance with article 6.1 a) of the GDPR, users’ consent is the legal basis for this processing.

If you do not wish to receive promotional communications from us or our Digital Partners you can choose to opt-out when providing your personal data to us or anytime by clicking the option “Unsubscribe” available in all our commercial communications.

Commercial communications, draws, competitions and promotional events of our business partners, media and our participating teams (Digital Partners):

• GBL will inform you of the development of any draws competitions, promotions and commercial actions conducted directly by GBL about products of our Digital Partners or special products created in collaboration with GBL. The list of the Digital Partners may change during your relationship with GBL and you will always be contacted directly by us.
• In accordance with article 6.1 a) of the GDPR, users’ consent is the legal basis for this processing.

If you do not wish to receive promotional communications from us about our Digital Partners you can choose to opt-out when providing your personal data to us or anytime by clicking the option “Unsubscribe” available in all our commercial communications.

Image recording of fans attending the Competitions:

• With due regard to the state of the art and given the particularities of the Competitions and the international broadcast of the same, the images, likeness and/or voice of the fans who attend any phase of the Competitions and enter the arena where the Competitions are held may be captured, recorded and broadcasted by GBL. This includes but is not limited to television broadcasts, online streaming, promotional content and in-event signage. Fans are informed that the content created may be used by GBL and its sponsors, partners and accredited media organizations for the mentioned purposes.
• Considering that the Fans’ entry in the Arenas of the Competitions constitutes consent to such uses, this is the legal basis for this processing, pursuant article 6.1 a) of the GDPR.

Request for contact and information about GBL Platforms or Services:

• GBL will process the personal data you submit in order to fulfill your request about GBL Platforms and Services.
• GBL legitimate interest, in accordance with article 6.1 f) of the GDPR is the legal basis for this processing, as with this information GBL will be able to manage your request.

Basic user Profiling:

• GBL may send you commercial communications and offers based on a basic profile of you, about the GBL Platforms and Services. These commercial communications will be made only considering the information you have provided us through any GBL Platform or form (i.e. Country, Age, Preferred Competitions teams), with very simple information about you without using information collected through third parties.
• GBL legitimate interest, in accordance with article 6.1 f) of the GDPR is the legal basis for this processing, as with this information GBL will be able to optimize the success of the communications campaigns and the interactions with the users’.

Cookies:

Processing of data relating to first and third-party cookies in order to analyze your browsing habits and improve services. Please visit our Cookies Policy for further information.

RECIPIENTS AND INTERNATIONAL TRANSFERS OF PERSONAL DATA

We may disclose or otherwise make your personal data available to public authorities, regulatory bodies, law enforcement authorities, courts, judges and other competent authorities where this is necessary to comply with a legal obligation applicable to GBL, to respond to a lawful request or order, or to establish, exercise or defend legal claims.

We may also share your personal data with selected third-party service providers that provide services to or on behalf of GBL and that are necessary for the operation and provision of the GBL Platforms and Services. Such service providers may include, depending on the services provided, providers of information technology and hosting services, platform and infrastructure services, customer support services, fraud prevention and security services, analytics services, marketing and advertising services and other professional or technical service providers.

Where such third parties process personal data on behalf of GBL, GBL will select them based on appropriate data protection and security criteria and will enter into appropriate data processing agreements, where required by applicable law. Such agreements will require the service providers to process personal data only for the agreed purposes and in accordance with GBL’s documented instructions, to implement appropriate technical and organisational measures to ensure an appropriate level of security, to ensure the confidentiality of persons authorised to process personal data, and to return or securely delete the personal data upon termination of the relevant services, unless retention is required by applicable law.

Some of our service providers may be located outside the European Economic Area (“EEA”), or may process personal data from countries outside the EEA. Where personal data are transferred outside the EEA, GBL will ensure that such transfers are carried out in compliance with Chapter V of the GDPR and on the basis of an applicable transfer mechanism, including, where appropriate, an Adequacy Decision adopted by the European Commission, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism recognised under applicable data protection law. Where required, GBL will also implement appropriate supplementary measures to ensure that personal data receive a level of protection essentially equivalent to that guaranteed within the European Union.

GBL will take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, taking into account the risks associated with the processing and the requirements of the GDPR.

HOW LONG WILL WE KEEP YOUR DATA?

Your personal data will be processed for as long as necessary to fulfill the purposes we collected it for (as outlined at ‘Specific Purposes and Applicable Legal Basis’ above), unless a longer retention period is required or permitted by applicable law.

For the purpose of sending you any type of communication (including but not limited to commercial communications) based on your consent, your personal data will be kept as long as you have not withdrawn your consent for this purposes. See ‘Specific Purposes and Applicable Legal Basis’ above, for further information in relation to how you can opt-out of receiving such communications.

Upon termination of the purposes that legitimize GBL to process your personal data as described in this Policy, your data will be stored and properly blocked to the only effects of fulfilling the legal or contractual obligations that are of application and during the limitation period of the actions that may arise from our relationship.

Winners’ names and photographs

Where you have consented to the publication of your name and photograph as a winner of the Fantasy Game on GBL’s official social media accounts and/or other official communication channels, such data will be retained and publicly displayed only for as long as necessary for the purpose for which the publication was authorised and, in any event, subject to the withdrawal of your consent. Following withdrawal of consent, GBL will take reasonable steps to cease further use and, where technically and legally feasible, remove the relevant content from channels under its control. This will not necessarily extend to copies, reposts or content independently reproduced or shared by third parties outside GBL’s control.

WEB BROWSER COOKIES

GBL uses cookies in order to ensure the GBL Platforms function properly and to improve your user experience. Cookies are usually a string of numbers and/or letters that a website transfers to your hard drive. Cookies enable us to remember you and to provide you with personalized visits to theGBL Platforms user-friendly navigation experience, customized advertising and content you see and recommend goods, services or promotions which may be of interest to you.

You may also set your browser to block all cookies, including cookies associated with our services, or to indicate when a cookie is being set by us.

We recommend that you visit our Cookies Policy.

WHAT IF I AM A CHILD?

Greek Basketball League will not collect or process personal data for children (such age to be established under applicable EU and national data protection law) without fully complying with the requirements established in the applicable data protection regulations, regarding compliance with the duty to inform and obtain those consents that they are necessary.

YOUR RIGHTS UNDER CURRENT LAW

Under the GDPR you may have the following rights: right of access, rectification or deletion of data, request the processing to be restricted, oppose it (including basic profiling) or request data portability.  If you wish to exercise these rights, please send a written notice to Greek Basketball League to any of the postal addresses indicated in the first section of this Policy (INFORMATION ABOUT US), or send an email to dpo.gbl.com.gr, clearly indicating the right you wish to exercise.

If you are located in the EEA, you have the right to lodge a complaint about how we process your personal data with the data protection supervisory authority of the region in which you reside or in which the controller has its registered office. As a reference of the information included in this Policy, you can file a complaint before the Hellenic Data Protection Authority, 1-3, Kifisias, Athens (https://www.dpa.gr/).

We would, however, appreciate the chance to deal with your concerns before you approach your local supervisory authority so please contact us in the first instance.

QUESTIONS AND SUGGESTIONS

If you have questions or suggestions concerning this Privacy Policy, including the treatment of your personal data and/or use of cookies and other technologies, you can contact us at:  dpo@gbl.com.gr . We are happy to help and we will do our best to respond in a timely manner.