# Privacy Policy — [YourBrand] Online Gaming Platform **Effective Date:** 1 September 2026 **Version:** 2026-09-01 **Last Updated:** 1 September 2026 --- ## 1. Introduction 1.1. This Privacy Policy describes how [YourBrand] ("the Company", "we", "our", "us") collects, uses, stores, shares, and protects your personal data when you use our online gaming platform ("the Platform"). 1.2. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018, and all applicable data protection laws in the jurisdictions where we operate. 1.3. This Privacy Policy should be read together with our Terms of Service, our Anti-Money Laundering Policy, and our Responsible Gambling Policy. 1.4. By using the Platform, you acknowledge that you have read and understood this Privacy Policy. --- ## 2. Data Controller 2.1. The data controller responsible for your personal data is: **[YourBrand]** Registered Address: [Address] Email: [privacy-email] Data Protection Officer: [dpo-email] 2.2. For the purposes of the GDPR, the Company is the data controller for all personal data collected through the Platform. --- ## 3. Personal Data We Collect 3.1. **Registration Data** (collected at account creation): - Full legal name - Email address - Date of birth - Password (stored as a salted hash; we cannot recover your password) - Email verification status 3.2. **Identity and KYC Data** (collected during verification): - Government-issued identification documents (passport, national ID, driver's licence) - Proof of residential address (utility bill, bank statement, dated within 3 months) - Selfie or biometric verification images - Identity hash (derived from name, date of birth, and document number for fraud prevention) - KYC tier and verification status 3.3. **Financial Data** (collected during transactions): - Cryptocurrency wallet addresses (deposit and withdrawal) - Blockchain transaction hashes - Transaction history (deposits, withdrawals, wagers, settlements, bonuses) - Double-entry ledger records (all money movements, by law) - Payment event logs 3.4. **Technical and Usage Data** (collected automatically): - IP address (at registration, login, game launch, and Rain claims) - Device fingerprint and device identifier - Browser type and version - Operating system - Language preference - Session timestamps and duration - Pages visited and actions taken on the Platform - Referral source 3.5. **Gameplay Data** (collected during use): - Game sessions (game, provider, start time, end time, close reason) - Wager history (game, stake, payout, result) - Provably fair parameters (server seed hash, client seed, nonce) - Chat messages (stored for moderation and regulatory purposes) - Rain claim history (wager amounts, device/IP clustering data) 3.6. **Responsible Gambling Data:** - Self-exclusion records (kind, source, start/end dates) - Deposit, loss, and wager limits (set, change history, cooling-off periods) - Reality check records - At-risk behavioural signals and intervention case records 3.7. **Communications Data:** - Customer support correspondence - Complaint and dispute records - Marketing preferences and opt-in/out records --- ## 4. Legal Basis for Processing 4.1. We process your personal data on the following legal bases under the GDPR: | Processing Activity | Legal Basis (GDPR) | Article | |---|---|---| | Account registration and authentication | Performance of a contract | Art. 6(1)(b) | | KYC verification | Legal obligation (AML/KYC regulations) | Art. 6(1)(c) | | Transaction processing and ledger maintenance | Performance of a contract + Legal obligation | Art. 6(1)(b)(c) | | Responsible gambling monitoring | Vital interests + Legal obligation | Art. 6(1)(c)(d) | | AML monitoring and SAR filing | Legal obligation | Art. 6(1)(c) | | Fraud detection and prevention | Legitimate interest | Art. 6(1)(f) | | Game session management | Performance of a contract | Art. 6(1)(b) | | Chat moderation and abuse prevention | Legitimate interest | Art. 6(1)(f) | | Marketing communications | Consent | Art. 6(1)(a) | | Legal and regulatory compliance | Legal obligation | Art. 6(1)(c) | | Analytics and Platform improvement | Legitimate interest | Art. 6(1)(f) | 4.2. Where we rely on consent as the legal basis, you may withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal. 4.3. Where we rely on legitimate interest, we have conducted a balancing test to ensure your rights and freedoms are not overridden. --- ## 5. How We Use Your Data 5.1. We use your personal data for the following purposes: (a) **Service delivery:** Providing gaming services, processing transactions, managing your account, and verifying your identity. (b) **Legal compliance:** Complying with anti-money laundering laws, responsible gambling regulations, tax reporting obligations, and responding to lawful requests from regulators and law enforcement. (c) **Security:** Protecting against fraud, unauthorised access, multi-accounting, and other malicious activities. This includes device fingerprinting, IP clustering, and behavioural analysis for multi-accounting detection. (d) **Responsible gambling:** Monitoring for at-risk gambling behaviour, enforcing self-exclusion and limit settings, and providing reality checks. (e) **Platform improvement:** Analysing aggregated, anonymised usage data to improve our services, game offerings, and user experience. (f) **Communication:** Sending account-related notifications, security alerts, legal notices, and (with your consent) marketing communications. --- ## 6. Data Sharing and Disclosure 6.1. We may share your personal data with the following categories of recipients: (a) **Game Providers:** Your player identifier (external reference, not your name or email) and session data are shared with game providers to deliver gameplay. Providers do not receive your personal identity. (b) **Payment Processors / Blockchain Networks:** Transaction data (addresses, amounts, hashes) is processed on public blockchain networks as required for cryptocurrency transactions. (c) **Identity Verification Providers:** KYC documents may be shared with third-party identity verification services (e.g., Sumsub, Veriff, Jumio, Onfido) solely for verification purposes. (d) **Regulators and Financial Intelligence Units:** We are legally required to share data with gambling regulators, Financial Intelligence Units (FIUs), and law enforcement authorities. This includes Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), and any data requested under lawful authority. (e) **ADR Providers:** In the event of a dispute, relevant data may be shared with the independent Alternative Dispute Resolution provider. (f) **Legal Advisors:** Data may be shared with our legal advisors on a confidential basis in connection with legal proceedings or regulatory inquiries. (g) **Service Providers:** Infrastructure, hosting, and analytics providers who process data on our behalf under data processing agreements. 6.2. We do **not** sell your personal data to third parties. 6.3. All third-party processors are contractually bound to process your data only on our instructions and in accordance with this Privacy Policy and applicable law. --- ## 7. International Data Transfers 7.1. Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including: (a) Standard Contractual Clauses (SCCs) approved by the European Commission. (b) Binding Corporate Rules where applicable. (c) Adequacy decisions for recipient countries. 7.2. You may request a copy of the applicable transfer safeguards by contacting our Data Protection Officer. --- ## 8. Data Retention 8.1. We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following mandatory retention periods: | Data Category | Minimum Retention | Legal Basis | |---|---|---| | Financial ledger (all money movements) | 5–7 years from last transaction | AML regulations | | KYC documents and verification records | 5 years from account closure | AML regulations | | SAR/STR filings | 5 years from filing date | AML regulations | | Player account records | 5 years from account closure | AML/regulatory | | Chat messages | 3 years from creation | Regulatory retention | | Responsible gambling records | 5 years from last activity | RG regulations | | Marketing consent records | Duration of consent + 3 years | GDPR accountability | | Server logs (IP, session data) | 12 months from creation | Security + Legitimate interest | | Gameplay data | 3 years from game session | Regulatory retention | 8.2. **Anonymisation and Data Erasure (GDPR Article 17):** (a) Upon receiving a valid erasure request, we will anonymise all personal identifiers (name, email, IP addresses, device fingerprints) by replacing them with irreversible pseudonymous tokens. (b) Financial ledger records and transaction data will be retained in anonymised form for the legally required retention period. The double-entry ledger is an immutable financial record required by anti-money laundering law and cannot be deleted. (c) KYC documents will be securely deleted after the retention period, or anonymised if required for ledger integrity. (d) The account will be tombstoned (permanently blocked from future use) to prevent re-registration under the same identity. (e) Anonymisation is irreversible — there is no key, no mapping, and no way to re-identify the data subject from the anonymised records. 8.3. At the end of the retention period, data is securely deleted or irreversibly anonymised in accordance with our data retention schedule. --- ## 9. Your Rights 9.1. Under the GDPR, you have the following rights regarding your personal data: (a) **Right of Access (Article 15):** You may request a copy of the personal data we hold about you. (b) **Right to Rectification (Article 16):** You may request correction of inaccurate personal data. (c) **Right to Erasure (Article 17):** You may request deletion of your personal data, subject to the legal retention obligations described in Section 8. (d) **Right to Restrict Processing (Article 18):** You may request that we restrict the processing of your data in certain circumstances. (e) **Right to Data Portability (Article 20):** You may request a machine-readable copy of your data to transfer to another service. (f) **Right to Object (Article 21):** You may object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. (g) **Right to Withdraw Consent (Article 7(3)):** Where processing is based on consent, you may withdraw consent at any time. (h) **Right to Lodge a Complaint:** You may file a complaint with your local Data Protection Authority. 9.2. To exercise any of these rights, contact our Data Protection Officer at [dpo-email]. We will respond to your request within 30 days. 9.3. We may need to verify your identity before processing your request. --- ## 10. Data Security 10.1. We implement appropriate technical and organisational measures to protect your personal data, including: (a) **Encryption:** All data in transit is encrypted via TLS 1.3. Sensitive data at rest (passwords, seed encryption keys) is encrypted using industry-standard algorithms (scrypt for passwords, AES-256-GCM for seed ciphers). (b) **Access Controls:** Strict role-based access controls. The SAR/AML reporting table (`aml_reports`) is protected by row-level security, accessible only to the Money Laundering Reporting Officer (MLRO). (c) **Immutable Ledger:** The double-entry ledger is append-only. UPDATE and DELETE operations are blocked by database triggers. This prevents tampering with financial records. (d) **Audit Trail:** All significant system actions are logged in a tamper-evident audit event table with hash-chain integrity. (e) **Incident Response:** We maintain a data breach notification procedure. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected data subjects without undue delay where the breach poses a high risk to their rights and freedoms. 10.2. While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. --- ## 11. Cookies and Tracking 11.1. The Platform uses essential cookies for session management and authentication. These cookies are strictly necessary for the Platform to function and do not require consent. 11.2. The Platform uses Cloudflare Turnstile for bot protection during registration. Turnstile's privacy policy governs its data collection. 11.3. The Platform does not use third-party advertising cookies or cross-site tracking technologies. --- ## 12. Children's Privacy 12.1. The Platform is not intended for persons under 18 years of age (or the minimum legal gambling age in their jurisdiction). We do not knowingly collect personal data from minors. 12.2. If we become aware that a minor has provided us with personal data, we will take steps to delete that information immediately. --- ## 13. Changes to This Privacy Policy 13.1. We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or prominent notice on the Platform. 13.2. When the Privacy Policy is updated, you will be required to review and re-accept the updated version before placing your next wager, in accordance with our Terms of Service. 13.3. The version history of this Privacy Policy is maintained in the Platform's legal terms registry with timestamps and content hashes for integrity verification. --- ## 14. Contact Information **Data Protection Officer:** Email: [dpo-email] Postal Address: [Address] **General Privacy Inquiries:** Email: [privacy-email] **Supervisory Authority:** [Name of relevant DPA] [Website] --- *This document is version 2026-09-01. The cryptographic hash of this document is recorded in the Platform's legal terms registry.*