1. Controller and contact details
- Controller
- Vaste Analytics
- Business ID
- 2448115-2
- Privacy contact
- contact@vasteanalytics.com
2. Scope of this notice
This notice applies to the Vaste Analytics website, customer accounts, paid access, customer support and notification services. Vaste Analytics provides sports-data-based analysis and does not accept stakes, place bets for customers or pay winnings.
3. Personal data categories
- Account data: email address, first and last name, language, password hash, account creation time and requested plan.
- Access and payment data: plan, entitlement status and period, access period and expiry status, payment-provider references and legally required transaction records.
- Session and security data: session token hash, session expiry, user agent, hashed network identifier, security events and technical logs.
- Notification data: email notification preference, Telegram linkage identifier and Telegram notification preference.
- Support communications: messages, attachments and information needed to resolve the request.
- Privacy choices: cookie-consent version, selected categories and timestamp.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and administer an account and provide paid access | Performance of a contract and steps requested before entering into a contract |
| Process payments, accounting and statutory records | Contract and legal obligation |
| Authenticate users, prevent abuse and maintain security | Contract and legitimate interests in protecting the service and users |
| Deliver requested email or Telegram notifications | Contract or consent, depending on the message |
| Customer support, service development and fault investigation | Contract and legitimate interests |
| Optional analytics or marketing technologies | Consent. These categories are disabled until consent is given. |
Where legitimate interests are used, Vaste Analytics assesses necessity, proportionality and the effect on users before processing.
5. Sources of personal data
Data is received from you when you register, purchase access, manage notification choices, contact support or choose cookie settings. Technical data is generated when you use the service. Payment and messaging providers may return status and reference data needed to complete the service.
6. Recipients and processors
Personal data may be processed by service providers that are necessary for hosting, databases, authentication, payments, email delivery, Telegram notifications, customer support, security and—only after consent—analytics or marketing. Providers may process data only under documented instructions and appropriate agreements.
The current production providers and applicable transfer safeguards must be verified before paid production launch and kept up to date when providers change.
7. Transfers outside the EEA
Vaste Analytics aims to use processing within the EEA where practical. If a provider processes data outside the EEA, the transfer must rely on an adequacy decision or another lawful safeguard such as the European Commission’s standard contractual clauses, together with any supplementary measures required by the circumstances.
8. Retention
- Account data: while the account is active and normally no longer than 24 months after closure, unless a legal obligation or dispute requires longer retention.
- Authentication session: normally 30 days and configurable between 1 and 90 days.
- Security logs: normally 12 months, or longer when needed to investigate an incident or legal claim.
- Support communications: normally 24 months after the matter is closed.
- Payment and accounting records: for the statutory accounting and tax retention period.
- Consent record: while the choice is current and normally 24 months after it is replaced or withdrawn, for demonstrating the choice.
- Direct-marketing preferences: until withdrawal and a suppression record thereafter when needed to honour the opt-out.
9. Automated decision-making
The sports-analysis models evaluate matches and markets, not customers. Vaste Analytics does not currently make decisions about users that produce legal or similarly significant effects solely through automated processing.
10. Your rights
Depending on the processing, you may have the right to access, rectify or erase data; restrict or object to processing; receive data in a portable format; and withdraw consent at any time without affecting earlier lawful processing. You may also lodge a complaint with the Office of the Data Protection Ombudsman in Finland.
Submit a rights request to contact@vasteanalytics.com. We may need to verify your identity before fulfilling the request.
11. Age restriction
Paid customer accounts are intended for adults as described in the Terms of Service. Vaste Analytics does not knowingly create paid customer accounts for children.
12. Security
Vaste Analytics uses technical and organisational measures appropriate to the risk, including access controls, protection of credentials, encrypted connections, logging and backups where applicable. No information system is completely secure.
13. Changes and contact
This notice is updated when processing, providers or legal requirements change. Material changes will be communicated through the service or by another appropriate channel.