Privacy Policy

This Privacy Policy governs the collection, processing, and protection of personal data by our online gaming platform operating within the United Kingdom. We are committed to maintaining the highest standards of data protection in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy outlines how we collect, use, store, and safeguard your personal information when you access our gaming services, create an account, or engage with our platform. By using our services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. Last updated: December 15, 2024.

Information Collection and Processing

We collect various types of personal data necessary for providing secure and compliant gaming services. The information we gather enables us to verify your identity, process transactions, ensure responsible gambling practices, and comply with UK regulatory requirements including anti-money laundering regulations and the Gambling Commission’s licensing conditions.

Data Category	Information Types	Collection Method
Personal Identification	Full name, date of birth, address, phone number, email address	Registration forms, account verification
Financial Data	Payment card details, bank account information, transaction history	Deposit/withdrawal processes, secure payment gateways
Gaming Activity	Game preferences, betting patterns, session duration, winnings/losses	Platform interactions, automated tracking systems
Technical Information	IP address, device identifiers, browser type, operating system	Cookies, server logs, analytics tools
Verification Documents	Passport, driving licence, utility bills, bank statements	Know Your Customer (KYC) procedures

We employ automated systems and manual processes to collect this information. Automated data collection occurs through cookies, web beacons, and analytics tools that monitor your interactions with our platform. Manual collection happens during registration, verification procedures, and customer support interactions. All data collection is conducted with appropriate legal basis under UK GDPR, primarily for contract performance, legal compliance, and legitimate business interests.

Purposes of Data Processing

Your personal data is processed for specific, legitimate purposes that are essential for operating a regulated online gaming platform in the United Kingdom. We ensure that all processing activities align with UK GDPR principles and are proportionate to the intended purposes.

Account Management: Creating and maintaining user accounts, authenticating logins, managing user preferences, and providing personalised gaming experiences tailored to individual player behaviour and preferences.
Regulatory Compliance: Meeting obligations under UK gambling laws, conducting Know Your Customer checks, implementing anti-money laundering procedures, and maintaining records required by the Gambling Commission.
Payment Processing: Facilitating secure deposits and withdrawals, preventing fraudulent transactions, maintaining financial records, and ensuring compliance with payment card industry standards and banking regulations.
Responsible Gambling: Monitoring gaming patterns to identify potential problem gambling behaviour, implementing deposit limits and self-exclusion tools, and providing appropriate support resources and interventions.
Platform Security: Protecting against unauthorised access, preventing fraud and money laundering, maintaining system integrity, and ensuring the safety and security of all users and their data.
Customer Service: Responding to inquiries and complaints, providing technical support, resolving disputes, and maintaining communication records for quality assurance and training purposes.
Marketing Communications: Sending promotional materials, bonuses, and updates about new games or services, provided you have given explicit consent or where we have legitimate business interests.
Analytics and Improvement: Analysing user behaviour to improve platform functionality, developing new features, enhancing user experience, and conducting market research for business development purposes.

We conduct regular reviews to ensure that all processing activities remain necessary and proportionate. Data minimisation principles are applied throughout our operations, ensuring we only collect and retain information that is directly relevant to these stated purposes.

Data Sharing and Third-Party Disclosure

We may share your personal data with carefully selected third parties under specific circumstances and with appropriate safeguards in place. All data sharing arrangements are governed by comprehensive data processing agreements that ensure recipients maintain equivalent levels of data protection.

Regulatory authorities may receive your information when required by law or regulation. This includes the Gambling Commission, HM Revenue and Customs, the Financial Conduct Authority, and law enforcement agencies investigating potential criminal activity. We cooperate fully with legitimate regulatory requests while ensuring compliance with data protection requirements.

Payment processors and financial institutions receive necessary information to facilitate transactions. These include banks, credit card companies, e-wallet providers, and other payment service providers. We only share the minimum information required for transaction processing and ensure all partners maintain PCI DSS compliance standards.

Technology service providers supporting our platform operations may access personal data in their capacity as data processors. These include cloud hosting providers, cybersecurity firms, software developers, and IT support services. All such arrangements are governed by strict contractual obligations ensuring data protection compliance.

Age and identity verification services receive relevant personal information to conduct mandatory checks required under UK gambling regulations. These specialised providers help ensure that only eligible individuals access our services and that all regulatory requirements are met.

We do not sell personal data to third parties for commercial purposes. Marketing communications are managed internally or through carefully vetted partners operating under strict data protection agreements. You maintain full control over marketing preferences and can opt out at any time.

Data Security and Protection Measures

We implement comprehensive technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security framework is regularly reviewed and updated to address evolving threats and maintain compliance with industry best practices.

Encryption Technologies: All sensitive data is encrypted using advanced encryption standards both in transit and at rest. SSL/TLS protocols secure data transmission, while AES encryption protects stored information across our systems and databases.
Access Controls: Strict access controls ensure only authorised personnel can access personal data on a need-to-know basis. Multi-factor authentication, role-based permissions, and regular access reviews maintain system integrity and prevent unauthorised access.
Network Security: Firewalls, intrusion detection systems, and continuous monitoring protect our infrastructure from external threats. Regular penetration testing and vulnerability assessments identify and address potential security weaknesses.
Data Backup and Recovery: Secure backup procedures ensure data availability and integrity. Regular backup testing and comprehensive disaster recovery plans minimise potential data loss and enable rapid system restoration if required.
Employee Training: All staff receive comprehensive data protection training covering UK GDPR requirements, security procedures, and incident response protocols. Regular updates ensure awareness of evolving threats and regulatory changes.
Vendor Management: Third-party service providers undergo rigorous security assessments before engagement. Ongoing monitoring and regular audits ensure continued compliance with our security standards and contractual obligations.
Incident Response: Comprehensive incident response procedures enable rapid detection, containment, and resolution of security breaches. We maintain detailed response plans and conduct regular testing to ensure effectiveness.

Despite our robust security measures, no system is completely immune to threats. We continuously monitor emerging security risks and adapt our protection strategies accordingly. In the unlikely event of a data breach, we have established procedures to assess the impact, contain the incident, and notify relevant authorities and affected individuals as required by UK GDPR.

Your Rights and Data Control

Under UK GDPR, you possess comprehensive rights regarding your personal data. We are committed to facilitating the exercise of these rights and provide clear mechanisms for managing your data preferences and controlling how your information is processed.

Right of Access: You can request copies of personal data we hold about you, including information about processing purposes, data categories, recipients, and retention periods. We respond to access requests within one month and provide information in a clear, accessible format.
Right to Rectification: You can request correction of inaccurate or incomplete personal data. We facilitate updates to account information and maintain procedures for verifying and implementing data corrections across all relevant systems.
Right to Erasure: You may request deletion of personal data in specific circumstances, such as when data is no longer necessary for original purposes or when consent is withdrawn. However, certain information must be retained for regulatory compliance purposes.
Right to Restrict Processing: You can request limitation of data processing in specific situations, such as when disputing data accuracy or objecting to processing. We implement appropriate measures to restrict processing while maintaining essential compliance functions.
Right to Data Portability: You can request transfer of personal data in a structured, commonly used format. This enables you to move your data to another service provider where technically feasible and legally permissible.
Right to Object: You can object to processing based on legitimate interests, including marketing communications. We respect objections unless compelling legitimate grounds override your interests or legal claims require continued processing.
Rights Related to Automated Decision-Making: You have rights regarding automated decision-making and profiling activities, including the right to human intervention in significant automated decisions affecting your account or gaming experience.

To exercise any of these rights, contact our Data Protection Officer using the details provided below. We verify identity before processing requests to protect against unauthorised access. Most requests are fulfilled free of charge, though reasonable fees may apply for excessive or repetitive requests.

Retention and International Transfers

We retain personal data only as long as necessary for the purposes outlined in this policy or as required by UK law and regulatory obligations. Our retention schedule balances operational needs, regulatory requirements, and individual privacy rights while ensuring data minimisation principles are observed.

Account information and transaction records are typically retained for seven years following account closure to comply with financial regulations and anti-money laundering requirements. Marketing data is retained until you withdraw consent or for three years from last contact, whichever occurs first. Technical logs and analytics data are generally retained for shorter periods unless required for security investigations.

When retention periods expire, we securely delete or anonymise personal data using approved destruction methods. Regular reviews ensure compliance with retention schedules and identify opportunities for early deletion when legal obligations no longer apply.

Some personal data may be transferred to countries outside the United Kingdom where our service providers operate facilities. All international transfers are protected by appropriate safeguards, including adequacy decisions, standard contractual clauses, or other mechanisms approved under UK GDPR.

We regularly monitor the data protection standards of destination countries and adjust transfer mechanisms as necessary to maintain equivalent protection levels. Transfer impact assessments evaluate specific risks and implement additional safeguards where required.

For questions about this Privacy Policy, to exercise your data protection rights, or to contact our Data Protection Officer, please email us at [email protected] or write to our registered address. We are committed to addressing your concerns promptly and maintaining the highest standards of data protection in all our operations.