Privacy Policy

RaseBox is operated by PYRENEI LTD, a company registered in Cyprus under number HE 462117, with its registered office at Vrysoudion, 132, PRESIDENTIAL VILLAS, HOUSE 1, Paralimni, 5295, Famagusta, Cyprus. PYRENEI LTD is the controller of the personal data described in this policy: it determines why and how that information is used.

This policy covers visitors, account holders, recipients of item deliveries, participants in our affiliate features and people contacting support. It applies to the RaseBox website and associated services. Read it together with our Terms of Service and Cookies Policy. Accepting a contract or reading this policy is not consent to unrelated processing.

• Terms of Service
• Cookies Policy

• Account information: email address, name, username, avatar, account identifiers, registration provider, linked accounts, authentication and recovery information, session details and security settings.
• Service activity: box openings, battles, upgrades, results, fairness verification records, inventory, favourites, balances, deposits, withdrawals, tips, rewards, loyalty progress, referral relationships and commissions, including amounts, references and dates.
• Delivery information: recipient name, postal address, country, address validation results, selected items and delivery or tracking references.
• Verification information: identity and document details, verification references, status, decisions, relevant risk indicators and protected identifiers used to identify duplicate accounts, as explained below.
• Technical and communication information: IP address, browser and session information, language and interface preferences, connection and security events, public chat messages and information supplied in support requests.

We receive information directly when you register, use a feature, enter a delivery address, write a message or contact us. Other information is generated by your transactions, authentication sessions and use of the site. If someone requests delivery to you, we receive your recipient details from that account holder.

When you choose an external sign-in or account connection, the provider supplies the identifiers and profile information permitted for that connection. Verification providers return identity checks and decisions; payment providers return transaction information; address services return suggested or validated addresses. Blockchain transaction records may also be obtained from public networks when the relevant functionality is available.

Under the General Data Protection Regulation, we distinguish the following purposes and legal bases. We use information only to the extent relevant to the purpose; one record may support more than one necessary purpose.

• Performance of a contract or steps you request before a contract: creating and managing your account, providing openings and other selected features, recording results and balances, processing payments, fulfilling item deliveries, administering rewards and answering service requests.
• Legitimate interests: protecting accounts and transactions, detecting duplicate identities and misuse, maintaining fair participation, investigating errors, securing our systems and establishing or defending claims. We consider the impact on your rights and whether less intrusive measures can achieve these purposes.
• Legal obligations: records, disclosures and checks required by laws that actually apply to our activities, including applicable accounting, tax and lawful authority requests. A general reference to compliance does not make every identity check a legal requirement.
• Consent: optional processing for which consent is required, including non-essential tracking or electronic marketing if introduced. Where used, that consent must be separate and can be withdrawn without affecting earlier lawful processing.

RaseBox integrates Veriff for identity verification. Depending on the verification performed, you may be asked to provide a document, photographs or other evidence directly in its verification flow. We receive relevant identity and document attributes, such as name, date of birth, nationality and document references, together with verification outcomes. We store protected identity records and derived identifiers to detect reuse of an identity across accounts.

Where a verification process uses biometric data to uniquely identify you, an applicable condition under Article 9 GDPR is required in addition to an Article 6 basis. Explicit consent, where relied upon, must be requested separately; acceptance of this policy or our Terms does not provide it. Read the notices presented during verification and Veriff’s notice. Contact us before continuing if you need clarification about a requested check or possible alternatives.

• Veriff Privacy Notice

You may browse public pages without an account. Authentication information is necessary for an account, transaction details for payments and recipient details for delivery. Optional preferences and account connections can be left unused. If a necessary verification is incomplete, access to the affected feature may be restricted. We explain the relevant requirement in the feature or through support. Please provide accurate information and only share another person’s details when entitled to do so.

Authorised personnel and suppliers may access information needed for their functions. The services integrated into RaseBox include the following, depending on which features are configured and used:

• Veriff for identity checks; LiveAgent for support conversations; Brevo for transactional email such as password recovery.
• Google and Discord for sign-in, and supported social providers such as Twitch and Kick for account connections; Google Places and Address Validation for address assistance.
• TSPay/Tipster Page for supported payment methods and Fireblocks for digital asset infrastructure where available; fulfilment and delivery providers for item orders.
• Hosting, database, communications and security suppliers; professional advisers, competent authorities and other recipients where a lawful disclosure is necessary.

Suppliers acting as processors must handle data under appropriate instructions and contractual safeguards. Some providers act independently for their own obligations and describe that processing in their notices. Opening an external provider’s page may involve its own cookies and data collection. Payment card credentials are entered in the provider’s payment flow; RaseBox retains transaction records needed to reconcile payments.

For authenticated users, the support integration can initialise before a conversation starts and associates support with your display name and account identifier. Messages you submit are handled by the support provider. A lawful business transfer may also require limited disclosure to advisers or a successor, subject to applicable protections.

Chat messages, display names and avatars may be visible to other visitors. Participating in battles, leaderboards or public activity feeds can also display your account identity, participation, results and item information. Tips and affiliate features require records relating the participating accounts and the relevant transactions. Choose your public name carefully and keep identity documents, contact details and payment credentials out of public chat.

A blockchain transfer, where supported, can publish wallet addresses, amounts and transaction identifiers to a public network. Public network records and copies made by other users are outside our direct control and may remain available after account closure.

Our suppliers and their support or infrastructure operations may involve access from outside the European Economic Area. Where such access constitutes a restricted transfer, an appropriate mechanism is required, such as an applicable adequacy decision or the European Commission’s standard contractual clauses together with any necessary supplementary measures. The applicable arrangement depends on the recipient and service. You can request information about relevant destinations and safeguards, including a copy or description of those safeguards, using the contact details below.

Retention depends on the purpose, the data involved, account activity, unresolved orders or disputes and applicable legal requirements. Account records support the account relationship; transaction and delivery records support fulfilment, reconciliation, accounting and claims. Verification and fraud-prevention records require a separate assessment of continuing necessity, including prevention of identity reuse. Support records are assessed against the request and any resulting dispute.

Closing an account does not necessarily erase every record immediately. Information still needed for a lawful purpose may be restricted and retained for that purpose. Backups and provider records may follow separate retention cycles. Ask us for the criteria applicable to your records; cookie and browser-storage durations are described in our Cookies Policy.

When information is no longer needed for its purposes and no legal retention requirement applies, it must be erased or irreversibly anonymised.

We use measures appropriate to the information and risks, including access controls, authentication safeguards, encrypted identity records and validation of sensitive transactions and provider communications. No system can guarantee absolute security. Protect your credentials, use the available two-factor authentication and contact support promptly if you suspect unauthorised account activity. Do not send passwords, recovery codes or complete card details in a support message.

Our systems calculate results, rewards and transaction eligibility and process identity-verification outcomes. Identity matching and risk checks can identify duplicates or require further review, affecting access to verification-dependent features. If you believe an automated check has produced an incorrect result, contact support to explain the circumstances and request review. Where Article 22 GDPR applies to a solely automated decision with legal or similarly significant effects, you have the protections it provides, including applicable rights to human intervention and to contest the decision.

Rights are subject to their legal conditions and the rights of others. We may request proportionate information to confirm your identity. We normally respond within one month; where a permitted extension is necessary, we explain it within that period. Requests are normally free. You may also complain to the Cyprus Commissioner for Personal Data Protection or the authority in your habitual residence, workplace or place of the alleged infringement.

• Request access to your personal data and a copy, correction of inaccurate information, or completion of incomplete information.
• Request erasure or restriction where the relevant conditions apply, and receive eligible data in a portable format.
• Object to processing based on legitimate interests because of your particular situation, and object at any time to direct marketing.
• Withdraw consent where processing relies on it. Withdrawal does not affect processing already lawfully undertaken.

• Lodge a complaint with the Cyprus data protection authority

RaseBox is intended for people aged 18 or over. Contact us if you believe a minor has provided personal data or opened an account so that we can investigate and take appropriate action. We may update this policy as the service or applicable requirements change. The date above identifies this version; material changes will be communicated as appropriate, and new consent will be requested where required.

Use the RaseBox support contact available on this website and identify your message as a privacy or data-rights request. You can also write to PYRENEI LTD, Privacy requests, Vrysoudion, 132, PRESIDENTIAL VILLAS, HOUSE 1, Paralimni, 5295, Famagusta, Cyprus. Include enough information to locate the relevant account or interaction and a way to reply. Postal contact remains available if you cannot access your account.