The Data Controller processes users' personal data in compliance with Regulation (EU) 2016/679 («GDPR») and the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).
The Prioregroup.com website does not collect users' personal data: it contains no registration forms, profiling cookies, or tracking systems.
The Superstar Lotto iOS app, available on the App Store, does collect some data for its own operation and for the purposes described below. This notice therefore applies mainly to the app.
01Data We Collect
- Device technical identifiers – advertising identifier (IDFA, if authorized by the user), app installation identifier.
- Usage and diagnostic data – interaction events within the app (screens visited, features used, methods viewed), collected in aggregated/pseudonymized form via Firebase Analytics.
- In-app purchase data – purchase history (Premium subscriptions, Coins top-ups), managed via Apple StoreKit. Payment information does not pass through nor is it stored on the Data Controller's servers: it is handled directly by Apple.
- Local preferences and data – favorite numbers and methods, app settings, stored locally on the device.
- Minimal network data – IP address, automatically collected by the servers during requests to the backend infrastructure, for security and operational purposes (legitimate interest, art. 6.1.f GDPR).
Not collected. The app does not request or collect first name, last name, email, phone number, precise geolocation, address book contacts, photos, or biometric data.
02Purposes & Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Service delivery (draws, methods, Premium features) | Performance of a contract — Art. 6(1)(b) |
| Managing in-app purchases and subscriptions | Performance of a contract — Art. 6(1)(b) |
| Usage statistics analysis (Firebase Analytics) | User consent — Art. 6(1)(a) |
| Personalized/non-personalized advertising (Google AdMob) | Consent via Google UMP — Art. 6(1)(a) |
| Security, fraud prevention, technical diagnostics | Legitimate interest — Art. 6(1)(f) |
03Third-Party Services
The app relies on the following services, each governed by its own privacy policy:
- Google Firebase Analytics (Google Ireland Ltd.) – anonymous/aggregated statistical analysis of app usage.
- Google AdMob (Google Ireland Ltd.) – delivery of advertising banners, with a consent request on first launch via Google User Messaging Platform (UMP), compliant with the IAB TCF framework.
- Apple StoreKit / App Store (Apple Inc.) – management of in-app purchases and subscriptions; payment data is handled exclusively by Apple.
The Data Controller does not sell or transfer personal data to third parties for its own marketing purposes.
04Data Retention
- Analytics data – retained for up to 14 months from collection (standard Google Analytics for Firebase setting), then automatically deleted.
- Data stored locally on the device – retained until the app is uninstalled or manually cleared.
- Purchase data – retained for the period required by applicable tax/accounting regulations (typically 10 years), managed by Apple as the reseller.
- Account data under the Data Controller's direct control (Coins, Favorites, scores) – retained until the user's last activity is more than 6 months old, then automatically deleted (see Section 6).
Upon a user's deletion request, data under the Data Controller's direct control is deleted within 30 days, subject to any legal obligation requiring longer retention.
05International Transfers
Some providers (Google, Apple) may transfer data to servers located in the United States. Such transfers rely on the Standard Contractual Clauses approved by the European Commission and on the safeguards adopted under the EU-U.S. Data Privacy Framework.
06User Rights
Under Articles 15-22 GDPR, users have the right, at any time, to:
Art. 22
No automated decisions
The rights of access/portability and erasure can be exercised directly in-app, independently and without contacting the Data Controller: the «Profile» menu offers an «Export my data» option, which generates a file with all data (Coins, Favorites, scores) associated with the user across all games, and a «Delete my data» option, which erases it immediately and permanently after a two-step confirmation. For the other rights (rectification, restriction, objection), requests can be submitted by contacting the Data Controller, who responds within 30 days, extendable by a further 60 days in cases of particular complexity.
If a user does not use the app for more than 6 months, data under the Data Controller's direct control (Coins, Favorites, scores) is automatically deleted due to inactivity, in line with the storage limitation principle (art. 5.1.e GDPR).
Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it) if they believe the processing violates the GDPR.
No Data Protection Officer (DPO) has been appointed, as the conditions under Art. 37 GDPR requiring a mandatory appointment are not met.
07Withdrawing Consent
Consent to optional processing (analytics, personalized advertising) can be withdrawn at any time:
- In-app – via the Privacy Settings / Consents section, which re-opens the Google UMP panel.
- At iOS system level – from Settings > Privacy & Security > Apple Advertising / Tracking.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, nor does it prevent use of the app's core features, which do not require consent.
08Minors
The Services are not intended for users under 18, given the nature of the content (information about lottery and draw-based games). The Data Controller does not knowingly collect data from minors.
09Data Security
The Data Controller adopts appropriate technical and organizational measures — encrypted HTTPS/TLS connections, restricted system access, data minimization — to protect data against unauthorized access, loss, or disclosure.
10Policy Changes
The Data Controller reserves the right to update this notice. Changes will be published on this page along with the date of the last update. Material changes will be communicated appropriately within the app.