Privacy Policy

The controller for the personal data described here is JOISPOI, Giveawaystr. 67, 676767 GOFAST, Iceland.

You can reach us by email at contact@golosefast.fans. For anything about your data, write to privacy@golosefast.fans.

Iceland is a member of the European Economic Area, so the GDPR applies to this website.

This website is hosted by Njalla in a data centre in the Netherlands. The provider processes the data only on our instructions as a processor under a contract that meets Article 28 GDPR. The Netherlands is a member state of the European Economic Area, so this is not a transfer to a third country.

We do not currently keep off-site backups of the database. Your data therefore exists only on the server described above. We say this plainly rather than describe a backup arrangement that is not in place. If that changes, this section will name the provider, its country and the legal basis for the transfer before the first backup is taken.

The server writes a log line for each request: a shortened IP address, the time in UTC, the path, the referrer and the browser identification. We use it to keep the site running and to notice attacks. The legal basis is our legitimate interest in a working, secure website (Article 6(1)(f) GDPR). Log lines are deleted after 7 days.

When you enter a giveaway we store the list below, and nothing else. Only the email address is required; every other line happens because you did something extra — you linked your Discord account, used an invitation link, watched a video, or came through a partner link. There is no full IP address, no date of birth and no country of residence.

Giving us your email address is not a legal or contractual requirement. Without it we cannot run the giveaway for you, so we cannot accept an entry — that is the only consequence.

You can sign in with Discord to see your own entries in one place and to link your Discord account to an entry. You never have to. Entering a giveaway works with an email address alone, and nothing on this site is closed to you if you stay signed out.

When you sign in, Discord tells us three things about your account: its user id, the name it shows, and the reference to your profile picture. We do not ask Discord for your email address, your friends, your servers or your messages, and Discord does not give them to us.

We then keep a session: a random key that is stored in a cookie in your browser and, in hashed form, on our server together with your Discord user id and display name. The session ends after 30 days without use, and in any case 90 days after you signed in. Signing out deletes it immediately. Legal basis: Article 6(1)(b) GDPR — without a session we cannot show you your own entries.

Your profile picture is copied to our server. We fetch it once from Discord when you sign in, recompute it to a small square image and store it for at most 30 days. Your browser then loads it from us, never from Discord. That is deliberate: an image loaded straight from Discord would tell Discord, on every single page you open here, that you are on this website right now. After 30 days the copy is deleted; the next time you sign in it is fetched again. Until then, and if your Discord account has no picture of its own, you see the first letter of your name instead. Legal basis: Article 6(1)(f) GDPR — showing you which account you are signed in as, without handing Discord a record of your visits.

A giveaway may carry a task that asks you to be a member of the Discord server, and a prize may be handed over there. For both we have to know whether you are actually on that server. If you link your account, our bot asks Discord that one question and stores the answer: whether you are a member, which roles you hold there, and when we last asked. Legal basis: Article 6(1)(b) GDPR — checking a task you chose to do.

We never read messages, and we never ask about servers other than the one that belongs to this giveaway. The answer is stored per server and account and is refreshed when it is needed again. It is deleted with your entry.

• Discord Inc., San Francisco, United States

  Processor under a contract that meets Article 28 GDPR. Discord is outside the European Economic Area. The transfer relies on the EU–US Data Privacy Framework where that framework has been taken into the EEA Agreement, and otherwise on Standard Contractual Clauses under Article 46 GDPR. Discord keeps its own records; we keep the answer until your entry is deleted.

  Legal review pending: The transfer basis for asking Discord about a member has to be confirmed.

One entry is one ticket in the draw. There are three ways to get more, and each of them stores something about you. All of it is deleted with your entry, and all of it rests on Article 6(1)(b) GDPR — it is part of the giveaway you entered.

• Inviting someone. Your entry carries a code. If someone enters through your link, their entry records that code, and yours records the extra ticket. Opening such a link stores the code in a cookie in your browser for 30 days, so that the credit still works if the person enters later. The first link wins; a second one does not overwrite it.
• Watching a video. If you open the video and it stays open long enough, we record which video it was and when — so the ticket is given once per video and not twice.
• Coming through a partner link. A partner promotes a giveaway with their own short link. Opening it stores which partner it was in a separate cookie for 30 days; if you then enter, your entry records the partner so their reach can be counted and their extra ticket given. This cookie is separate from the invitation one, so that coming through both does not cancel one of them out.

At the moment of the draw your ticket count is written down as a number, so the result can be recalculated afterwards with exactly the figures it used. If an extra ticket is voided — for example because the invited entry turned out to be a duplicate — that fact and its reason are stored so it can be explained.

We use Google reCAPTCHA v3 to keep automated entries out. Its script is loaded only when you focus a field of the entry form or press “Enter giveaway” — not when you merely open the page, and never on this page or on the Official Rules. It shows nothing and asks you nothing.

When it loads, your IP address, characteristics of your browser and how you interact with the form are sent to Google, and Google may set a cookie in its own domain. Google returns a score for the entry; entries with a very low score are rejected, and we store the score with your entry so we can tune the threshold. The legal basis is our legitimate interest in a giveaway that is not decided by bots (Article 6(1)(f) GDPR).

Legal review pending: reCAPTCHA sets a cookie and reads device characteristics. Whether that needs consent under Article 5(3) of the ePrivacy Directive 2002/58/EC as implemented in Iceland has to be confirmed before the first giveaway — several EEA authorities say it does.

• Google Ireland Limited, Dublin, Ireland

  Processor under a contract that meets Article 28 GDPR. That company is in the European Economic Area, so entrusting it with the data is not itself a transfer to a third country. Google may pass the data on to Google LLC in the United States. That onward transfer relies on the EU–US Data Privacy Framework where that framework has been taken into the EEA Agreement, and otherwise on Standard Contractual Clauses under Article 46 GDPR. Google keeps the data for its own security purposes for as long as its own policy says.

  Legal review pending: Which of the two transfer mechanisms applies for a controller established in Iceland has to be confirmed.

We count visits in two ways: with Google Analytics, and with our own counting on our own server. Both are there to answer one question — whether a giveaway is being found at all, and which pages people reach. Neither builds a profile of you, and neither has any say in who wins.

Google Analytics. This site uses Google Analytics 4. It loads on every page of this site, including this one and the Official Rules, and it is the only part of the statistics that involves another company.

Google Analytics sets cookies in your browser and sends Google your IP address, the page you are on, the page you came from, and characteristics of your browser and device. Google shortens the IP address before storing it. We do not send Google your email address, your entry, or anything you type into the entry form. The legal basis is our legitimate interest in knowing whether this site reaches anyone (Article 6(1)(f) GDPR).

You can stop it: browsers with tracking protection block it, and Google offers an opt-out add-on. You can also object under Article 21 GDPR using the address in section 1.

Our own counting. Every page of this site is also counted on our own server, and that count stays there: it is never sent to another company. It happens after the page has been sent to you, so it cannot slow the page down. It runs in two layers, and the difference between them is the whole point.

Layer one runs for everyone, without consent. For each page view we store the time, which page it was, which website you came from (the domain only, never the full address), the label on the link if you came through one of our own short links, whether your device is a phone, a tablet or a computer, and the main language your browser asks for. That is all of it. There is no identifier and nothing that lets us recognise you again — two visits from you are two rows that nothing connects. Nothing is stored in your browser and nothing is read from it, which is why this layer needs no consent under Article 5(3) of the ePrivacy Directive; the legal basis is our legitimate interest in knowing whether this site reaches anyone (Article 6(1)(f) GDPR). We do not store your IP address. Visits from crawlers and link previews are marked as such rather than thrown away. The administration area is not counted at all.

The page address is stored as a pattern, not literally. Any part of a link that identifies you personally — the key in a confirmation link, an unsubscribe link, your own entry page, an invitation code — is replaced by a placeholder before anything is written down, so it cannot end up in the statistics at all. The short link of a giveaway is kept, because it is public anyway and the number would say nothing without it.

Layer two runs only if you agree. If you accept statistics in the consent banner, two random keys are stored in your browser: one that stays (so we can tell a returning visitor from a new one) and one that lasts until you close the tab. They are random numbers and hold nothing about you; section 11 lists them. With them we store, for each visit: everything from layer one, plus how long you stayed, how far you scrolled, how fast the page actually loaded for you, the size of your window, your time zone, the type of your connection, your browser and its version, and how many scripts or images failed. We also store which steps you took on the way into a giveaway — that you saw the entry form, started typing, submitted it, opened a task. Those steps are recorded as fixed labels we defined; nothing you type is ever among them, and your email address is not either.

This is not connected to your entry. The visitor key and the entry are kept apart on purpose: nothing in the statistics says who entered, and nothing in an entry says which visits belonged to it. You can clear both keys at any time by clearing site data for this website, and withdrawing your consent in the banner stops the second layer from that moment on.

Raw rows of both layers are deleted after 12 months. What remains after that is a daily total per page, per source, per device and per language — numbers, with nothing about a person in them; those we keep, so that this year can be compared with last year.

Legal review pending: That layer one needs no consent rests on it storing nothing in your device and reading nothing from it. That reading is the reason it was built this way, and it has to be confirmed before the first giveaway — together with whether a legitimate interest is the right basis for it.

You are asked first. A consent banner from Cookiebot appears on your first visit. It blocks Google Analytics and the second layer of our own counting until you agree; the first layer runs either way, because it stores nothing in your browser. You can change or withdraw your choice at any time through the same banner; withdrawing is as easy as agreeing, and it takes effect from that moment on. There is no second banner for our own counting — the statistics category of this one is the consent.

Legal review pending: Analytics cookies need consent before they are set, under Article 5(3) of the ePrivacy Directive 2002/58/EC as implemented in Iceland. The banner is in place since 9 September 2026. That the automatic blocking really catches every script before it runs has to be confirmed by testing before the first giveaway.

• Cybot A/S (Cookiebot), Copenhagen, Denmark

  Processor under a contract that meets Article 28 GDPR. That company is in the European Economic Area, so entrusting it with the data is not itself a transfer to a third country. Cookiebot stores your choice for 12 months and keeps a record of it as proof that you were asked.

• Google Ireland Limited, Dublin, Ireland

  Processor under a contract that meets Article 28 GDPR. That company is in the European Economic Area, so entrusting it with the data is not itself a transfer to a third country. Google may pass the data on to Google LLC in the United States. That onward transfer relies on the EU–US Data Privacy Framework where that framework has been taken into the EEA Agreement, and otherwise on Standard Contractual Clauses under Article 46 GDPR. Google keeps the statistics for up to 14 months by default.

  Legal review pending: Whether legitimate interest is enough here, or whether consent is required first, has to be confirmed before the first giveaway.

Apart from the announcement list in the next section, we send exactly three kinds of email, and only to someone who entered a giveaway.

• The immediate “You’re in” confirmation after you enter. Legal basis: Article 6(1)(b) GDPR.
• The message telling you that you won, with the deadline to claim. Legal basis: Article 6(1)(b) GDPR.
• The reply we send back when you ask about your data, to confirm the request came from you. Legal basis: Article 6(1)(c) GDPR.

These emails leave from our own mail server, which runs on the same server as this site at Njalla in the Netherlands. No email service provider is involved, so no one else sees your address for sending. The emails contain no tracking pixels and no links to other domains.

There are two ways your address gets onto this list. Both are described here, because only one of them is obvious.

The form on the home page. Nothing is sent until you confirm. After you fill in the form we send one email with a confirmation link; only when you open that link does the address go on the list. An address that is never confirmed is deleted after 7 days — we do not keep addresses that nobody has agreed to, and anyone can type someone else’s address into a public form. Signing up this way puts you on a list and enters you into nothing.

Entering a giveaway. The box you tick when you enter says so in as many words: your address is used for the confirmation, for telling you if you win, and for news about the next giveaway. That tick is the consent, so there is no second confirmation step — the address goes on the list straight away, and the “You’re in” email carries the unsubscribe link, so you can leave before any news is ever sent. If you had used the form earlier and never confirmed, entering confirms it.

We store your address, the moment you asked, the moment you confirmed, the moment you unsubscribed if you did, a random key for the confirmation and unsubscribe links, and a counter of failed deliveries so that a dead address stops being written to. Nothing else. Legal basis: Article 6(1)(a) GDPR — your consent.

You can withdraw that consent at any time. Every email from the list carries an unsubscribe link that works with one click and needs no password and no reason. You can also write to privacy@golosefast.fans. Withdrawing does not affect anything we sent before, and it has no effect on any giveaway you entered — a win still reaches you.

We use the list for one thing: telling you that a giveaway has started or is about to end. We do not sell it, we do not lend it, and it goes to no one else.

Legal review pending: Whether this counts as direct marketing under Icelandic law implementing the ePrivacy Directive, whether the wording of the consent checkbox on the home page and on the entry form meets Article 7 GDPR, and whether the second way onto the list may rely on that single tick without its own confirmation step, all have to be confirmed.

The task checklist remembers which tasks you ticked. That is stored in your own browser and never sent to us as a separate record; it is part of your entry only when you actually enter. You can clear it at any time by clearing site data for this website.

If you accepted statistics in the consent banner, two more things are stored in your browser for the counting described in section 8: gf_vid, a random key that stays until you clear site data, so that a returning visitor can be told from a new one, and gf_sid, a random key that is gone when you close the tab. Neither is a cookie — they are never sent with a request on their own, only inside the one measurement we send after the page has loaded. Both hold a random number and nothing about you. Decline statistics, or withdraw your choice, and they are not written at all.

We set these cookies of our own. None of them is used to track you across other websites.

None of these needs your consent beforehand: each one is set only because you asked for the thing it does — opening that link, signing in — and none is used for advertising.

Legal review pending: Whether the two 30-day cookies count as strictly necessary under the ePrivacy rules, or need consent, has to be confirmed.

Two other companies set cookies as well. Cookiebot stores the choice you make in the consent banner — that one is needed for the banner to work at all. Google sets cookies for the visitor statistics in section 8, but only after you agree, and the bot check in section 7 may set one when you start entering. Apart from those, this website makes no requests to other companies’ servers. Fonts and images are served from our own domain, and so is the one request that carries our own counting.

The administration area is used by JOISPOI only, and it uses the same Discord sign-in described in section 4 — the same three pieces of information, the same session, the same copy of the profile picture. What is different is what happens afterwards: an account that is not on the operator’s list is turned away at the door and gets no administration session.

• Discord Inc., San Francisco, United States

  Processor under a contract that meets Article 28 GDPR. Discord is outside the European Economic Area. The transfer relies on the EU–US Data Privacy Framework where that framework has been taken into the EEA Agreement, and otherwise on Standard Contractual Clauses under Article 46 GDPR. Discord keeps its own login records; we keep the session for as long as it is valid.

  Legal review pending: Only the operator’s own account is involved here, but the transfer basis still has to be confirmed.

After a draw we publish the winners on the giveaway’s page in masked form, so that anyone who entered can see that a draw actually happened. The legal basis is our legitimate interest in a giveaway that can be checked from the outside (Article 6(1)(f) GDPR).

Masking keeps the first two characters before the @ (only the first if there are three or fewer), then “•••”; after the @ the first character, “•••”, a dot and the last part of the domain. For example ma•••@g•••.com. We never publish more than the masked address.

You can object at any time by emailing privacy@golosefast.fans; we will remove the masked entry.

We ask for delivery details only after you have won, and only what the delivery method needs. Each giveaway names its method on its own page before you enter, so you know beforehand what will be asked of you. A Steam trade needs your Steam trade URL. A code sent by email needs nothing extra. A giveaway may also name a different way — handing the prize over on Discord, for example — and then the giveaway page says in plain words what the winner will have to send. The legal basis is Article 6(1)(b) GDPR.

Whatever is asked for in that last case is typed by the operator when the giveaway is set up, and it is what you will be asked for; there is no hidden extra. Shipping a physical prize by post is not currently offered.

• A postal or parcel carrier, chosen per shipment, named on request

  Processor under a contract that meets Article 28 GDPR. That company is in the European Economic Area, so entrusting it with the data is not itself a transfer to a third country. The carrier keeps its shipment records under its own rules.

  Legal review pending: The carrier is chosen per shipment; the processor contract has to be in place before the first postal prize.

• Valve Corporation, Bellevue, United States

  Processor under a contract that meets Article 28 GDPR. Valve is outside the European Economic Area. A Steam trade happens between your Steam account and ours; we pass your trade URL to no one, and Valve acts as a controller in its own right for what happens on its platform. Valve keeps trade records under its own rules.

  Legal review pending: Whether Valve is a processor or an independent controller for this step has to be confirmed.

If you win a prize and it has actually been handed over, the giveaway appears on our Hall of Fame page. By default your slot shows nothing about you — only “Slot 1 · prize delivered”.

Your name only appears if you ask for it. The email that tells you that you won asks one question: no name, a masked email address, or a display name of your choice, up to 40 characters. Whatever you answer is what appears — and if you answer nothing, nothing appears. Legal basis: Article 6(1)(a) GDPR, your consent.

This entry has no deletion deadline. That is deliberate and it is the one place on this website where we keep something about you indefinitely: a hall of fame that forgets its names after three years is not one. The entry holds the giveaway, the prize, the date, your slot and the name you chose. It holds no email address, no Discord account and no delivery details — those are deleted on the schedule in section 16, and the entry survives that on its own.

You can withdraw at any time, with no reason and no deadline. Write to privacy@golosefast.fans and the name comes off; the row then reads “prize delivered” like any other. Withdrawing costs you nothing — not the prize, not anything else.

A giveaway that is deleted takes its Hall of Fame rows with it. One that is only taken offline keeps them.

Legal review pending: Consent without a time limit, and whether a withdrawal request can still be matched to an entry once the underlying entry data is gone, both have to be confirmed. The entry deliberately carries nothing that could identify you beyond the name you chose yourself.

• If you did not win, everything we stored about your entry is deleted no later than 30 days after the giveaway actually ended.
• If you were drawn as an alternate, your entry stays until every prize is settled, and is then deleted like any other entry that did not win.
• If you won, we keep your email address, the draw result, the delivery details and the proof of delivery until the end of the third year after the year in which the prize was delivered or forfeited. The clock starts at delivery or forfeiture — never at the moment we sent the winner email. Legal basis: Article 6(1)(f) GDPR, to prove that the prize was handled properly and to defend against later claims.

  Legal review pending: The length of this period has to be matched to the limitation periods under Icelandic law and confirmed by a lawyer.

• Server logs: 7 days.
• There are currently no off-site backups, so nothing survives a deletion anywhere else.
• Rate-limit counters: 24 hours.
• A sign-in session: 30 days without use, and in any case 90 days. Signing out deletes it at once.
• The copy of your Discord profile picture: at most 30 days from the moment it was fetched. After that it is deleted and only fetched again if you sign in.
• An address on the announcement list that was never confirmed: 7 days. A confirmed address stays until you unsubscribe.
• The invitation and partner cookies in your browser: 30 days, or until you clear site data.
• The draw record is kept for 3 years. Once the entry data is deleted it contains only numbers and masked winners.
• Visitor statistics of our own (section 8): the individual rows of both layers are deleted after 12 months. The daily totals that remain contain no personal data — only counts per page, source, device and language — and are kept indefinitely.
• The two statistics keys in your browser: gf_sid until you close the tab, gf_vid until you clear site data for this website.
• If you ask us to delete your data, we do it within 30 days of your confirmation.

Deletion runs automatically or is done by hand, but never later than the deadline above.

A confirmed deletion request before the draw counts as withdrawing your entry. A confirmed deletion request from a winner before the prize is delivered counts as giving up the prize; an alternate takes your place, and we keep only your email address, the draw result and the date you gave it up, until the retention period above runs out.

Legal review pending: Keeping that minimum record after a deletion request relies on Article 17(3)(e) GDPR and has to be confirmed.

You have the right to ask what we store about you (Article 15), to have it corrected (Article 16), deleted (Article 17) or restricted (Article 18), to receive it in a portable form (Article 20) and to object to processing based on our legitimate interest (Article 21). Where processing rests on consent, you can withdraw it at any time with effect for the future.

Write to privacy@golosefast.fans. We answer within 30 days.

We reply to the address you wrote from and ask you to confirm. We only act once that confirmation arrives from the same address. Our closing answer is always worded the same way, whether or not we held any data for that address — otherwise the answer itself would reveal who entered.

You can complain to the authority responsible for us: Persónuvernd (Icelandic Data Protection Authority), Laugavegur 166, 105 Reykjavík, Iceland, https://www.personuvernd.is.

If you live or work in the EEA, you can also complain to the supervisory authority of your own country (Article 77 GDPR).

The date above is the version of this policy. Older versions stay available at their own address, so you can check what applied when you entered. Values such as retention periods and the USD currency of a prize value come from one place in the software, so this text and the giveaway pages can never disagree.

The Official Rules of a giveaway are frozen at the moment it is published; changing them later does not change the rules you agreed to. See the Official Rules.

Legal review pending: This document is a draft written by the operator. The binding wording is released by JOISPOI after legal review.