Privacy Policy

We collect the following categories of personal data:

• Account data — name, email address, and hashed password when you register.
• Usage data — pages visited, features used, timestamps, and actions taken within the platform.
• Technical data — IP address, browser type, device type, operating system, and session identifiers.
• Preferences — your timezone, currency, and notification settings stored in our database.
• Cookies — session and preference cookies as described in our Cookie Policy.

We use your data exclusively to provide, maintain, and improve our service:

• To authenticate you and manage your account.
• To display personalised top bets and statistics on your dashboard.
• To send transactional emails (password reset, account notifications).
• To detect and prevent fraud or abuse of the platform.
• To analyse aggregated, anonymised usage patterns and improve the product.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We process your data on the following legal bases under the GDPR:

• Contract — processing necessary to provide the services you signed up for.
• Legitimate interests — platform security, fraud prevention, and service analytics.
• Consent — for non-essential cookies and optional marketing communications.
• Legal obligation — compliance with applicable Bulgarian and EU law.

Account data is retained for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g. financial records may be retained for up to 5 years). Anonymised analytics data may be kept indefinitely.

We share your data only with the following categories of recipients:

• Infrastructure providers — cloud hosting and database services that process data on our behalf under data processing agreements.
• Authentication services — NextAuth.js session management running on our own infrastructure.
• Law enforcement — where required by a valid legal request or court order.

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing activities.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, contact us at privacy@topzalog.com.

We implement industry-standard security measures including HTTPS encryption, hashed password storage (bcrypt), and access controls on all systems. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we take all reasonable precautions to protect your data.

Bank-card payments are handled entirely by our payment service provider ePay.bg (Ipay AD) and the BORICA card network via the secure 3-D Secure protocol (Verified by Visa, Mastercard Identity Check). Your card details are entered directly on ePay.bg's secure server — TopZalog.com never receives, processes or stores your full card number, expiry date or security code (CVV/CVC).

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests, contact our Data Protection team at privacy@topzalog.com or write to us at TopZalog.com, Sofia, Bulgaria.