Privacy Notice — European Economic Area
Version 06 September 2026
1. About this notice
This notice explains what personal data we collect when you use the Kolab app, why we use it, who we share it with, how long we keep it and what rights you have. It applies if you are in the European Economic Area.
If you are in the United Kingdom, the UK Privacy Notice applies to you instead.
We have tried to write this plainly. If anything is unclear, contact us using the details in section 17 and we will explain it.
2. Who we are
The Kolab from Veloce app is operated in Europe by Zoku Europe Ltd, trading as Tribe Europe, a company registered in Ireland under company number 822954, whose registered office is at Second Floor, One Stephen Street Upper, Dublin 8, D08 DR9P ("Tribe", "we", "us"). We are the controller of personal data processed for the Kolab app and services described in this notice, except where this notice states that another organisation is an independent controller.
We operate the app on the Fan OS platform provided by Tribe Ltd, a company registered in Jersey under company number 142759, whose registered office is at Beauport House, L’Avenue de la Commune, St Peter, Jersey JE3 7BY. Tribe Ltd processes personal data on our instructions and may not use it for its own purposes. Jersey has been recognised by the European Commission as providing an adequate level of data protection, so no additional safeguards are needed for data we share with Tribe Ltd.
Content in the app is provided by Veloce Esports Limited, a company registered in England and Wales under company number 11135021, whose registered office is at 58a Bronsart Road, London SW6 6AA. Veloce owns the Kolab brand and the content you see in the app.
Banking, card and payment services are provided by Equals Money, which is responsible for the personal data it collects to provide them and has its own privacy notice. Section 3 explains who is responsible for what.
Our Data Protection Officer can be contacted at privacy@tribe.fan or by post at the address above, marked for the attention of the Data Protection Officer.
3. Who else is involved, and who is responsible for what
Kolab brings together several services, and different organisations are responsible for the data behind each. This matters because it determines who you exercise your rights against.
| Service | Provided by | Who controls the data |
|---|---|---|
| Wallet, card, payments, foreign exchange | Equals Money Europe SA (the “Issuer”) |
The Issuer is the independent controller for identity-verification, wallet, account, card and transaction data it processes to provide regulated payment services. Where we access or display that data solely to provide the app, we process it under the applicable documented arrangement. |
| Subscriptions, rewards, Shop, Engage and the app itself | Zoku Europe Ltd, trading as Tribe Europe (using the Fan OS platform supplied by Tribe Ltd) | We are the controller. |
| Content in the app | Veloce Esports Limited | Veloce provides the content. We control the data about how you interact with it. |
| Brand partners featured in the app | The relevant partner | If a partner wants to contact you with its own marketing, it does so under its own privacy notice and only if you have agreed. |
If you are not sure who to contact, contact us and we will point you to the right place or pass your request on. You will not be sent back and forth.
4. What data we collect
You give us
- Account and profile details — name, date of birth, email address, phone number, postal address, username, profile image and preferences.
- Identity information — documents and images used to verify who you are, where the issuer requires them.
- Content you post — comments, reactions, images, lap times and results, and anything else you submit in community features.
- What you tell us — support messages, complaints, survey answers and feedback.
You generate by using Kolab
- Transaction and payment activity through your Kolab Wallet and card.
- Rewards activity — K-Points, X-Points, Cashback, your Level and how you earned it.
- Engagement — what you view, read, watch, react to, share, predict or vote on, and how you appear on leaderboards.
- Purchases in the Shop, including order and delivery details.
- Prize draw and competition entries.
- Technical data — device, operating system, app version, IP address, identifiers, crash and performance logs.
- Where you have connected a third-party game or platform account, the results and identifiers we import from it.
We receive from others
- From the issuer — information needed to show your balance, transactions and card status in the app.
- From fraud-prevention agencies and identity-verification providers — including identity-verification results, fraud-risk indicators and sanctions or politically exposed person screening results.
- From brand partners and third-party suppliers — including offer, participation, redemption, fulfilment and reward-status information where you have engaged with an offer, experience or reward they provide.
We do not intentionally collect special-category personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life or sexual orientation, or biometric data processed to uniquely identify a person. Where identity verification involves biometric processing, the Issuer or its identity-verification provider handles that processing and explains it in the relevant privacy notice.
5. Where we get your data
Mostly from you and from your use of the app. Where we obtain data from a third party, section 4 says who. Where a source is not listed, we will tell you at the time.
6. Why we use your data, and our legal basis
We only use your personal data where the law allows. This table sets out each purpose and the basis we rely on.
| What we use it for | Legal basis | Notes |
|---|---|---|
| Creating and running your account, and providing the app | Performance of a contract | Without this data we cannot provide Kolab. |
| Verifying your identity and running anti-money-laundering checks | Legal obligation | Required of the issuer under applicable anti-money-laundering law. We support that process. |
| Processing payments and card transactions | Performance of a contract; legal obligation | Controlled by the issuer. See section 3. |
| Preventing and detecting fraud and financial crime | Legal obligation; legitimate interests | Our interest is protecting you, us and other members from loss. |
| Running the rewards programme — points, Levels, Cashback, redemptions | Performance of a contract | These are benefits you have signed up for. |
| Running the Shop, orders, returns and refunds | Performance of a contract; legal obligation | Consumer law requires us to keep certain records. |
| Running Engage — polls, predictions, challenges, leaderboards and community features | Performance of a contract | Your Level and results may be visible to other members. See section 8. |
| Running prize draws and competitions | Performance of a contract; legitimate interests | Our interest is running promotions fairly and being able to show that we did. |
| Moderating content and keeping the app safe | Legal obligation; legitimate interests | Required under EU online safety and platform rules, and in our interest in protecting members from harm. |
| Personalising what you see in the app | Legitimate interests | Our interest is making the app useful. You can turn personalisation off — see section 7. |
| Sending you marketing by email, push notification or SMS | Consent | You can withdraw consent at any time. Service and security messages are sent under contract and continue regardless. |
| Measuring and improving the app, analytics, testing | Legitimate interests | Our interest is understanding what works and fixing what does not. |
| Producing aggregated and anonymised statistics | Legitimate interests | Once data is genuinely anonymised it is no longer personal data. See section 8. |
| Handling complaints, disputes and legal claims | Legitimate interests; legal obligation | Our interest is defending and resolving claims properly. |
| Meeting regulatory, tax and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that our use does not override them. You can ask us for that assessment, and you can object — see section 11.
7. Personalisation and automated decisions
We personalise your feed, offers and rewards using information about your profile, what you follow, what you have viewed or engaged with, and your location and device. This is automated.
You can change what you follow, adjust your interests, and turn personalisation off in Profile > Feed. Turning it off does not remove content; it changes the order.
We do not make decisions about you by wholly automated means that produce legal effects or similarly significantly affect you. Where the issuer does so — for example an automated fraud block or an automated decision on eligibility for a product — you have the right to ask for human review, to express your point of view and to challenge the decision. The issuer explains this in its own notice.
Personalisation does not affect your Level, your points, your Cashback rate or any price you pay.
8. Who we share your data with
- The issuer, Equals Money, for anything relating to your Wallet, card or payments.
- Other members — your username, profile image, Level and anything you post publicly are visible in community features and on leaderboards. Your transaction data, balance and contact details are never visible to other members.
- Suppliers acting on our instructions — including hosting, cloud infrastructure, analytics, moderation, customer support, delivery and fulfilment, and marketing platforms. They may use personal data only on our documented instructions.
- Brand partners and prize or reward suppliers, where you have redeemed something or entered a promotion they provide, and only to the extent needed to deliver it.
- Fraud-prevention agencies, identity-verification and age-assurance providers, and financial-crime databases — where they act as independent controllers or process data under the Issuer’s instructions, as explained in their privacy notices.
- Regulators, law enforcement, courts and other authorities, where we are legally required to or where it is necessary to prevent harm or investigate wrongdoing.
- Professional advisers, auditors and insurers.
- A buyer, if we sell or reorganise our business. We will tell you before that happens and your data will remain protected by this notice or one at least as protective.
We do not sell your personal data.
Where we produce insights or statistics for brand partners, we do so only using aggregated and anonymised information that cannot identify you or be linked back to you.
9. Sending data outside the EEA
We are based in Ireland and store your data in the EEA where we can. Some of our suppliers, and some companies in our group, are outside the EEA — including in Jersey, the United Kingdom and the United States.
When we transfer data outside the EEA we rely on one of the following:
- a decision by the European Commission that the country provides adequate protection, which currently includes Jersey and the United Kingdom; or
- the European Commission’s standard contractual clauses, together with additional safeguards where our assessment shows they are needed.
You can ask us for a copy of the safeguards we use by contacting us at privacy@tribe.fan
10. How long we keep your data
We keep data only as long as we need it, then delete it or anonymise it.
| Data | How long | Why |
|---|---|---|
| Account and profile data | While your account is open, then 2 years | To handle any claim or query after you leave. |
| Identity and anti-money-laundering records | 5 years after your relationship with the issuer ends | Required by anti-money-laundering law. |
| Transaction and payment records | For the period set by the issuer’s legal and regulatory obligations (normally at least 5 years after the relationship ends) | The issuer’s privacy notice and retention policy apply to these records. |
| Rewards ledgers — points, Levels, Cashback | While your account is open, then 90 days | So unredeemed value can still be claimed. See the Rewards Service Terms. |
| Content you post, and community activity | Until you delete it, then up to 30 days in backups | |
| Moderation and safety records | 2 years | To investigate abuse, enforce our rules and handle complaints or appeals. |
| Prize draw entries | 6 months after the draw | To show the draw was run properly. |
| Support messages and complaints | 6 years | To handle disputes and meet regulatory record-keeping duties. |
| Marketing consents and withdrawals | While your account is open, then 2 years | To show we had your permission, and that we stopped when you asked. |
| Cookies and similar technologies | As set out in the cookie settings |
11. Your rights
Under the GDPR you have the following rights. They are free to exercise.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and information about how we use it. |
| Rectification | Ask us to correct data that is wrong or incomplete. |
| Erasure | Ask us to delete your data. We cannot always do this — for example where we must keep records by law — and we will explain if that applies. |
| Restriction | Ask us to pause using your data while we look into a concern you have raised. |
| Portability | Ask for personal data that you have provided to us, where processing is automated and based on consent or contract, in a structured, commonly used and machine-readable format. Where technically feasible, you may ask us to transmit it directly to another controller. |
| Objection | Object to processing based on legitimate interests. Where you object to direct marketing we will stop straight away, without exception. |
| Withdraw consent | Withdraw consent at any time, for anything we do on that basis. This does not affect what we did before you withdrew it. |
| Human review | Where we make a solely automated decision that produces legal or similarly significant effects, ask for human intervention, express your point of view and challenge the decision. For an Issuer decision, contact the Issuer using the details in its privacy notice. |
| Complain | Complain to a supervisory authority — see section 18. |
12. How to exercise your rights
The quickest route is in the app: Profile > Privacy, where you can download your data, correct your details, change your marketing preferences and turn personalisation off.
You can also email privacy@tribe.fan or write to the Data Protection Officer at our registered office.
We will respond within one month. If your request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do.
We will normally verify your identity through your account. We will only ask for further proof if we have a genuine reason to doubt who you are, and we will ask for the least we can. You do not need to send us a copy of an identity document unless we specifically ask.
Requests are free. If a request is manifestly unfounded or excessive, particularly where it is repetitive, we may charge a reasonable fee or refuse it, and we will explain why.
13. Cookies and similar technologies
We use cookies and similar technologies on our website and in the app.
- Strictly necessary — needed for the service to work, including signing in, security and remembering your language. These are always on.
- Functional — remember your preferences and settings.
- Analytics — help us understand how the service is used so we can improve it.
- Advertising and third-party — used to measure and target advertising, including cookies set by third parties.
We only set cookies that are not strictly necessary if you consent through our cookie banner. You can change or withdraw your choices at any time in Cookie settings, and it is as easy to refuse as it is to accept. Changing your browser settings is not a substitute for withdrawing consent with us, though you can do that as well.
A full list of the cookies we use, what each does and how long it lasts is in Cookie settings. Ask us at privacy@tribe.fan if you would like it another way.
14. Children
Kolab is for people aged 18 and over. We do not knowingly collect data from anyone under 18, and if we discover that we have, we will delete it.
15. How we keep your data safe
We use technical and organisational measures appropriate to the risk — encryption in transit and at rest, access controls, monitoring, staff training and supplier due diligence. Card data is handled in a PCI DSS compliant environment by the issuer.
No system is completely secure. If a breach happens that is likely to result in a high risk to your rights, we will tell you without undue delay.
16. Changes to this notice
We may update this notice. If a change is significant, we will tell you in the app or by email before it takes effect. The date at the top shows when it was last updated, and previous versions are available on request.
17. How to contact us
Data Protection Officer, Zoku Europe Ltd, trading as Tribe Europe, Second Floor, One Stephen Street Upper, Dublin 8, D08 DR9P, Ireland
Email: privacy@tribe.fan
Or use the contact form in the app.
18. Complaining to a supervisory authority
If you are unhappy with how we have handled your personal data, please tell us first — we would rather put it right. If you are still unhappy, you can complain to the Irish Data Protection Commission:
Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
You can also complain to the supervisory authority in the EEA country where you live or work, or where you think the problem occurred.