Privacy Notice
Table of Contents
Privacy Notice
1 When does this Privacy Notice apply?
This Privacy Notice explains how we process your personal data at Kindred. It applies to, for instance:
- Your use of our services on any of Kindred’s website including our mobile apps.
- The personalisation of your experience on our platforms
- The infrastructure that we need to offer our services.
This notice is not:
- Kindred’s Terms and Conditions, these will be a different document which you can find on our different brand webpages.
Cookie Notice: Our cookie notice can be found here. It describes how we use cookies and other trackers and how you can manage your cookie settings.
This Privacy Notice may be updated from time to time to reflect changes in the way we work or the way our work is regulated. If significant changes are made to the Privacy Notice we will notify you.
2 Who are we?
Kindred is Kserol P.L.C., a company duly registered under the laws of Malta, with Company Registration No. C 88882, and having its registered office and business address at Level 6 - The Centre, Tigne Point - Sliema, TPO 0001 – Malta. Kindred belongs to Kindred Group plc (“Kindred”).
Kindred Group is a leading online gambling operator comprising nine brands, including Unibet, Maria Casino, 32Red, Bingo.com, Casinohuone, Kolikkopelit, Highrolling, Vlad Cazino, and Ottokasino. We offer a range of products such as online casino, poker, bingo, and sports betting.
For the purposes of this privacy notice, "Kindred " refers to any company within the Kindred Group, duly registered under the relevant local laws. Kindred Group plc (“Kindred Group”) ensures that all our entities adhere to a consistent level of privacy protection.
This privacy notice applies to all companies and brands within the Kindred Group. We are committed to providing a consistent level of privacy protection across all our entities and brands, ensuring your personal data is handled with care and in compliance with applicable data protection laws.
You can find more information on who we are at www.kindredgroup.com
3 How can you get in touch?
There are various ways you can contact us.
For general queries do not hesitate to get in touch with our Customer Service team via phone, email or live chat - please see our Contact us page.
For general questions on this privacy notice, please contact our Data Protection Officer at dpo@kindredgroup.com
You can exercise your data subject rights by completing our online Privacy Web form. For further information on these rights, please see Section 10 of this notice.
4 Definitions of Categories of Personal Data
Please see the table below for detailed information regarding what personal data we process.
Category of personal data:
Contact Details
- Address
- Email address
- Phone number
- Other related contact information
Geolocation data
- Location data from your unit e.g., collected via cookies
- Log data (e.g., in connection with your use of our mobile application or when you visit our website)
- IP address
- Other related geolocation data
Financial data
- Information regarding credit card or other payment methods, including vouchers and account balance of your user account
- Transaction ID
- Date and time of payment
- Amount
- Name
- Credit card number
- Bank account number
- Transaction status
- IP address
- Browser
- Type of device
- Pay and rewards
- Bank details
- Transactions
- Other related financial information
Special Category Data
- Data concerning health, such as information concerning gambling addiction or suspicions thereof
Background Data
- Background Checks (Criminal records, sanctioned Person, PEP, RCA, SIP)
Behaviour Data
- Information about subscription and purchases
- Online activity
- Gameplay
- Preferences
- Online behaviour
- Other related behaviour data
Commercial Data
- Promotional bonus data
- Blocks
- Media partner data
- Other Related Commercial Data
Communications Data
- Chat
- Emails
- Phone
- Phone call recordings
- Other related Communication Data
Identification Data
- Name
- Surname
- DOB
- Home address
- ID
- Passport Number
- Place of Residence/Registration/Birth
- Player Number/ID
- Username – now only email for logging in and internally we have user ID (number)
- Voice Data
- Personal identity number and/or coordination number (if specified)
- Membership number
- Other related Identification Data
Publicly available data
- Images provided by you to us
- Social media data
- Publicly available registers
System & Equipment Usage Data
- Device type, name, number, ID
- IP address
- Type of phone / PC/ OS used
- Logs (Audit trail)
- Other relevant system & equipment Usage Data
5 What Personal Data do we collect, and for what purpose?
Opening an account
Categories of personal data:
- Contact data
- System & Equipment Usage Data
- Background Data
- Identification data
- Financial data
- Geolocation data
- Equipment Usage Data
Legal Basis
Necessary for the performance of a contract (Art. 6(1)(b) GDPR) as described in our Terms and Conditions, in particular to manage service-related tasks such as password reminders and service messages (e.g., site maintenance)Using the product
Categories of personal data:
- Behaviour Data
- Financial Data
Legal Basis
Necessary for the performance of a contract (Article(6)(1)(b) GDPR) as indicated in our Terms and Conditions and legal obligation (Article(6)(1)(c) GDPR), such as applicable gambling regulations to register you in our systems and ensure eligibility for our servicesService Administration
Categories of personal data:
- Behaviour Data
- Financial Data
Legal Basis
Necessary for the performance of a contract (Art. 6(1)(b) GDPR) as described in our Terms and Conditions. We collect and process this data to provide essential services such as password reminders, service messages (including site maintenance notifications, updates to our Privacy and Cookies Policies, and Terms and Conditions), and to inform you if your Kindred account has become inactive and inquire whether you would like to reactivate it before we close it.Financial administration
Categories of personal data:
- Financial Data
- Contact Data
- Identification Data
Legal Basis
Performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Article(6)(1)(c) GDPR) such as our bookkeeping obligations and managing any financial requests (withdrawal, deposit or refund).Direct Marketing
Categories of personal data:
- Behaviour Data
- Contact Data
- Geolocation data
Legal Basis
Your consent (Art. 6(1)(a) GDPR) in order to offer you a tailored experience based on your interest’s.Customer Service Interaction
Categories of personal data:
- Financial Data
- Contact Data
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) and performance of a contract. The processing is necessary to fulfil our legitimate interest of responding to your inquiries as effectively as possible and providing you with the assistance you need but also based on performance of a contract (Art. 6(1)(b) GDPR) as described in our Terms and Conditions.Call recordings for quality and training purposes
Categories of personal data:
- Contact Data
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR). The processing is necessary to ensure fair gaming with our customers and to handle any complaints and disputes and litigationsTo deter, prevent or detect the use of third-party software in peer-to-peer gambling
Categories of personal data:
- Behaviour Data
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR). The processing is necessary to ensure fair gaming with our customers.
To deter, prevent, or detect any activities conducted in breach of our Terms and Conditions
Categories of personal data:
- Behaviour Data
- Financial Data
- Identification Data
- Contact data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR). The processing is necessary to prevent and deter breaches of our Terms and Conditions, this can be done through phone calls.
Location-Based Redirection and License Compliance
Categories of personal data:
- Geolocation data
Legal Basis
Compliance with legal obligations (Article (6)(1)( c) GDPR) to make sure our customers are redirected to the appropriate country site in adherence to our license conditions.Conducting an Affordability Review
Categories of personal data:
- Background Data
- Behaviour Data
- Commercial data
- Communication Data
- Contact Data
- Financial Data
- Special Category Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to ensure that our customers have the funds to use our services safely.
Where applicable: Compliance with legal obligations (Article (6)(1)( c) GDPR) to comply with legal obligation from gambling authorities.
Prevention of gambling addiction: to deter, assess risk and prevent gambling problem
Categories of personal data:
- Behaviour Data
- Special Category Data
- Identification Data
- Geolocation data
- Financial data
- Background data
- Communication data
- Contact data
- publicly available data
- Commercial data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to ensure that our customers do not become exposed to problem gaming, but this is also in compliance with legal obligations (Article (6)(1)( c) GDPR) such as from the gambling authorities, where applicable.
Special Category Data may be processed to determine whether there is of gambling addiction, such as health data. This category of personal data are being collected to comply with legal obligation. This is done under our duty of care, in accordance with Art. 6(1)(e)GDPR and Art. 9(2)(g) GDPR.
Gameplay Monitoring
Categories of personal data:
- Behaviour Data
- Financial data
- Identification Data
Legal Basis
Necessary for the performance of a contract (Article(6)(1)(b) GDPR) as described in our Terms and Conditions.
We conduct regular reviews of customer accounts to oversee gameplay, ensuring both its safety and accuracy. This monitoring is implemented to prevent any form of cheating or misuse of our services, promoting fair and secure gaming experiences for all users.
To monitor and prevent fraudulent activities related to our online advertising
Categories of personal data:
- Behaviour Data
- System & Equipment Usage Data (including IP address)
- Geolocation Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) in preventing fraud and ensuring that our advertising campaigns are directed towards legitimate customers. The data collected through our third-party provider, TrafficGuard, is used to detect and block fraudulent clicks.Ensure network security
Categories of personal data:
- System & Equipment Usage Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to ensure security while using our products.Conducting Anti-Money Laundering and Anti-Fraud Checks
Categories of personal data:
- Contact data
- Identification Data
- Background data
- Geolocation data
- Behaviour Data
- Communication data
- Financial data
- System & Equipment Usage Data
Legal Basis
Compliance with legal obligations (Article (6)(1)( c) GDPR) to ensure we are identifying, mitigating, reporting any AML or Fraud activity and risk rating customer’s appropriately.
Promotions and Competitions
Categories of personal data:
- Identification Data
Legal Basis
With your consent (Art. 6(1)(a) GDPR) to administrate promotion and competitions in which you consent to participate.Market Research
Categories of personal data:
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to conduct internal and third-party collaborative market research and surveysUse of Cookies
Categories of personal data:
- System & Equipment Usage Data
Legal Basis
For any non-essential cookies: we rely on Your consent (Art. 6(1)(a) GDPR) .
For essential cookies our legal ground is legitimate interest (Art. 6(1)(f) GDPR) to ensure that our website function.
For more detailed information on our use of cookies, please see our cookie notice.
Personalization
Categories of personal data:
- Behaviour Data
- Commercial Data
- Geolocation Data
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to personalise your experience while using our product and service which are accurate with your interests.Profiling
Categories of personal data:
- Contact data
- Identification Data
- Behaviour Data
- Financial Data
- Geolocation data
- System and equipment usage data
- Publicly available data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to conduct profiling activities for personalized services, marketing, and enhancing user experience, and consent (Art. 6(1)(a) GDPR) where necessary.Analytics
Categories of personal data:
- Contact data
- Identification Data
- Behaviour Data
- Financial Data
- Geolocation data
- System and equipment usage data
- Communication data
- Commercial Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to conduct data analytics for improving our services, understanding user behaviour, and optimizing our business operations.Defending our rights
Categories of personal data:
- Contact Data
- Background Data
- Behaviour Data
- Commercial data
- Communication Data
- Financial Data
- Identification Data
Legal Basis
Our legitimate interest (Art. 6(1)(f) GDPR) to resolve a dispute or litigation.Special Category Data
We may collect personal data which is referred to as "special categories of data," such as information related to health. This most often specifically in the context of responsible gambling, which is a legal requirement. This data may be collected from your, or in some instances from third parties.
We will only process such data if:
- you have given us your explicit consent;
- it relates to personal data which you have made public;
- it is necessary for the establishment, exercise or defence of legal claims;
- is necessary for reasons of substantial public interest, on the basis of European Union or Member State law.
We may also process data relating to criminal activities or suspected criminal activities, specifically in the context of fulfilling our legal obligations under anti-money laundering regulation. We will only process such data to the extent necessary to fulfil our legal obligations, or to the extent necessary to fulfil our legitimate interest of establishing, exercising, or defending legal claims.
We may process sensitive data such as health information. Health information is sensitive, so we only process the personal data necessary to fulfil our duty of care. If your gambling behaviour and financial information, along with any health details you provide, raise concerns about your well-being, we are required to take appropriate measures. The collection of such special category data falls under the public interest as indicated in article 6 (1)(e) of GDPR and in accordance with article 9 (2) (g) of GDPR to allow us to process special category data.
6 Where do we get your Data from?
We collect personal data when you interact with us and use our services. Sometimes, this information is provided to us by you – such as when you register for the first time and when you make use of our products or get in touch with us. Sometimes third parties or publicly available sources provide us information about you.
Information you provide
At registration:
- Identification data
- Financial data
Through your use of Kindred services:
- Geolocation data (please refer to our cookie notice for more information);
- Behaviour Data
- System & Equipment Usage Data
- Communications Data
- publicly available data
Other sources of personal data
At registration:
- We may collect personal data on you that are publicly available (for example social media data) for responsible gambling purpose (category of data : publicly available data).
- Data received from our business partners and from other organisations, such as specialist companies providing verification services, credit reference agencies, and fraud prevention agencies, when applicable (category of data background data);
- In addition to the above, please note that if you give us personal data about someone else (for example via a Refer a Friend scheme) then you should not do so without their permission (category of data: contact details). Please note that where information is provided by you about someone else, or someone else discloses information about you, it may be added to any personal data that is already held by us and it will be used in the ways described in this Privacy Notice.
7 Cookies and similar tracking technologies
Kindred’s websites and apps use cookies for various purposes.
We use cookies for the following purposes, amongst others:
- to identify the account holder's (as defined in our Terms and Conditions) preferred language, so it can be automatically selected when the account holder returns to the website;
- to ensure that bets placed by the account holder are associated with the account holder's betting coupon and account;
- to ensure that the account holder receives any bonuses for which they are eligible, and
- for analysis of the Website traffic, to allow Kindred to make suitable improvements.
More information can be found in our Cookies Notice.
8 When and with whom do we share your Personal Data?
In certain circumstances, we share your personal data with other companies within the Kindred Group, with third parties that provide services on our behalf, and with other third parties to comply with our legal obligations. These third parties include companies such as Evolution, which provides live casino products; Microgaming, a gaming platform specializing in slots; Trustly, a payment provider; Oracle, which offers database software; Microsoft; Amazon Web Services; and Pragmatic, known for its casino products, including slot games and live casino offerings. We do not sell your personal data to marketing companies. When we use third parties for marketing services, your consent is required before your data can be processed. Other examples of when we might share your personal data include when we enter any kind of merger or business sale, as customers’ personal data is likely to be included in the sale/transfer. We will inform you prior to affecting such transfer of personal data. Even when it is shared, we ensure that your personal data will only be used for the purposes outlined in this Privacy Notice.
Within Kindred Group
We may share the personal data we collect with other companies in the Kindred Group for purposes such as:
- Providing products and services, and keeping you informed about important changes or developments related to them;
- responding to your enquiries and complaints;
- administering offers, competitions, and promotions;
- facilitating the secure access to online platforms
- updating, consolidating, and improving the accuracy of our records
- undertaking transactional analysis;
- testing new systems and checking upgrades to existing systems;
- crime detection, prevention, and prosecution, as well as complying with regulatory requirements;
- evaluating the effectiveness of marketing, and for market research and training;
- customer modelling, statistical and trend analysis, with the aim of developing and improving products and services.
- Under your consent, to receive promotional content, sending you promotional content from our others brands (32Red, Bingo, CasinoHuone, Kolikkopelit, Maria Casino, High Roller, Vlad Cazino, Ottokasino)
With third parties
We may share personal data with third parties in the following circumstances:
- Providing Products and Services:
- Keeping you informed about important changes or developments in the features and operation of our products and services.
- If you use our sports betting services, your personal data usage is also governed by the Kambi Player Fair Processing Notice.
- Regulatory Compliance and Legal Requirements:
- Compliance with orders from regulatory bodies or legal provisions in the governing law.
- Instructing and authorizing the Financial Institution to disclose requested information to the Regulator in line with legal requirements.
- Legal Rights and Fraud Detection:
- Establishing, exercising, or defending our legal rights.
- Transferring personal data to third parties for fraud detection and control, including Address Verification System service providers, Sports Governing Bodies, Payment Service Providers, and Financial Institutions.
- Service Providers and Auditors:
- Sharing data with service providers for Services delivery, technology support, data storage, payment processing, and online advertising.
- Sharing with external auditors conducting independent checks for accreditations.
- Business Transfers:
- Disclosing data to organizations during the sale or transfer of our businesses, rights, or obligations. The receiving organization can use the data similarly.
- Successors and Network Security:
- Sharing data with successors in title to our business.
- Sharing with security supplier to ensure the network security
- Fraud Prevention and Advertising Efficiency:
- We may share data related to fraudulent detection and prevention with third parties such as TrafficGuard. This includes data collected through login events on our website, which helps us identify and prevent fraudulent activities related to our online advertising efforts.
9 Do we transfer your Data outside the EEA?
The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by companies operating outside the EEA who work for us or for one of our service providers: such as United States of America (USA), Australia, India. This can be the case for instance if we provide services globally, your data may in a few instances be processed in countries where we have operations or services providers. Further, for efficiency and reliability, we may use cloud services hosted in different countries. In certain cases, we might need to transfer data to comply with international legal obligations.
To ensure your personal data remains safe when transferred in this manner, we will take all reasonable steps to maintain a suitable level of protection in line with this notice.
Any transfer of your personal data to a location outside the EEA will processed/performed in accordance with applicable data protection laws, including the GDPR, and will be based on:
- the Standard Contractual Clauses adopted by the European Commission which you can access here or a relevant data protection authority; or
- an adequacy decision from the European Commission, confirming that the third country provides adequate protection for your personal data; or
- Your consent, or another legal basis on which we are entitled to make the transfer.
Should you have any questions regarding our transfers of personal data to countries outside the EU/EEA area, please contact us by using the contact details provided at the beginning of this Privacy Notice.
10 How long will we keep your Data?
We will only retain your information for as long as needed to fulfil the purposes for which they are collected.
While you are a customer, we will need to retain your information to meet our legal and contractual requirements. However, when you cease using Kindred's Services, we may still retain your personal data for a period of time. There are several reasons why we retain your information, these include:
- To comply with legal obligations under EU/local laws (for example, anti-money laundering regulations, or licensing regulations). Those data may be stored for up to 10 years from the date of the closure of your account.
- To establish or defend legal claims (for example negligence claims) which could be made against us;
- To comply with our contractual obligations and rights in relation to the information involved;
- Our legitimate interests where we have carried out balancing tests;
- To comply with guidelines issued by relevant data protection authorities.
If you ever request to have your data erased, we will promptly remove any marketing materials you may have previously consented to receive but some other type of personal data will be kept to meet our legal requirements as indicated above.
11 Your rights and choices over your Personal Data
Under the GDPR, you have a number of rights concerning the personal data we hold about you. If you wish to exercise these rights, you should contact our Customer service team or use our GDPR Online Form. You also have the right to complain to your local data protection authority if you are concerned with how we process your information
Further information and advice about your rights can be obtained from Information Commissioner's Office. We have also designated a lead data protection authority, the Office of the Information and Data Protection Commissioner (“IDPC”) in Malta which you can also contact for further information For Individuals - IDPC
You have, under certain circumstances, the right to exercise the following rights:
Your right to:
Be informed
>What is your right?
Be informed of the personal data we process about you and how we process it.
>How to exercise
By accessing this Privacy Notice we are informing you of your rights and the principles. Information may also be provided by us in connection with your provision of your personal information and/or in connection with your use of our services. More information can be found in our Help Centre
Access
>What is your right?
You may request confirmation whether personal data about you is processed by us and, if that is the case you have a right to request a copy of the personal data we hold about you, known as a data subject access request.
>How to exercise
These requests can be made in our Help Centre
Rectification
>What is your right?
You have a right to request that we amend or update your personal data where it’s inaccurate or incomplete.
>How to exercise
These requests can be made in our Help Centre
Erasure
>What is your right?
In some circumstances, you can ask us to erase personal data we hold about you (‘the right to be forgotten’). This includes when:
- the information is no longer necessary in relation to the purpose for which it was collected.
- if you withdraw consent and we cannot justify another legal ground for using it;
- if you withdraw consent and we cannot demonstrate overriding legitimate grounds to continue processing the information;
- we don’t have a lawful ground under data protection laws to process your information;
- the data has to be erased to comply with a legal requirement.
>How to exercise
These requests can be made in our Help Centre
Restrict / Object
>What is your right?
You have the right to ask us to restrict (‘block’ or ‘suppress’) the processing of your personal data. When processing is restricted, we can still store your information, but will not process it further. This right is available to you when:
You can object to the processing of your personal data, that is:
- You think there might be a mistake in your personal data;
- You think the use of your personal data is against the law, and you want us to limit its use instead of deleting it;
- we no longer need the data, but you require it to establish, exercise or defend a legal claim; and
- we process your information for our legitimate business interests but you object and while we verify the grounds for continued processing.
You can object to the processing of your personal data, that is:
- based on our legitimate business interests (including profiling); or
- For research and statistics
>How to exercise
These requests can be made in our Help Centre
If you would like to not receive marketing emails, you can also unsubscribe / opt out of receiving them.
Withdrawal of consent
>What is your right?
You have the right to at any time withdraw your consent to the processing of personal data to the extent the processing is based on your consent.
>How to exercise
These requests can be made in our Help Centre
Data Portability
>What is your right?
This allows you to request and reuse your information for your own purposes across different services. For example, if you decide to switch to a different provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability. This is not a general right however, and only arises when the processing of your information is:
- based on your consent or where it is necessary for the performance of a contract, and
- when the information is processed by solely by automated means
>How to exercise
These requests can be made in our Help Centre
If you would like to not receive marketing emails, you can also unsubscribe / opt out of receiving them.
Restriction on data subject’s rights:
In certain circumstances, your rights as a data subject under GDPR, particularly your right to access personal data and the right to request the erasure of data, may be restricted or limited. Such restrictions may be necessary and proportionate for reasons such as ensuring compliance with legal obligations or to protect the rights and freedoms of others.
We will ensure that any restrictions on your rights are clearly justified.
12 Automated decision making
Data protection laws aim to protect individuals from potential harm caused by automated decision-making, including profiling, without human intervention. You have the right not to be subjected to decisions that have a legal or similarly significant effect on you. if they are based solely on automated processing of your personal data.
Detecting Fraud:
Your personal data is used to identify and prevent potential fraud or money laundering activities. If we suspect any risk, we may take actions like blocking or suspending the account.
Opening an Account:
When you create an account, we ensure that the product or service is suitable for you based on our knowledge. We also verify that you meet necessary conditions, such as age, residency, nationality, or financial status.
Use of AI technology:
We may use AI technology as part of our processing activities; however, we do ensure that when we use these tools, it is in accordance with Data Protection regulations and security requirements.
13 Security of your Data and Confidentiality
We are committed to protecting the personal data you entrust to us. We take all reasonable steps to ensure that all information collected through our website is treated securely and in line with this Privacy Notice and strict data protection standards. Accordingly, we have adopted robust procedures and technologies to protect your data from unauthorised access and improper use.
After logging in all information sent to and from the |Website is encrypted using 128-bit Secure Socket Layer (SSL) technology. The SSL certificate used is issued and verified by Trustwave, click on the image for more information.
Your credit card details are encrypted and sent only once over the internet to Kindred. It is then stored encrypted in our secure systems. We are dedicated to protecting our customers’ confidential information and, as part of doing so, we are certified towards the Payment Card Industries Data Security Standard.
The security of our systems and applications are tested several times per year by third-party security experts. Furthermore, we have an Intrusion Detection System that monitors all network traffic 24/7 for signs of attacks or intrusions.
We have a dedicated fraud department and advanced systems in place to detect and prevent suspicious activity, to ensure that our websites remain a secure playing-field. Any account involved in suspicious activity will be suspended and investigated to the fullest extent. Should you as user have any doubts about the activity on your account, such as unrecognized transactions in the transaction history or surprising changes in the balance, please contact us immediately.
14 Complaints
If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated by emailing our Data Protection team at: dpo@kindredgroup.com
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complaint to our lead data protection authority, the Office of the Information and Data Protection Commissioner (IDPC).