Privacy Policy

Version: 1.0  |  Last Updated: 12 November 2026

This Privacy Policy applies to all services offered by Bwin through the website bwin.gb.net (the "Platform"). Please read it carefully alongside our Terms & Conditions and Responsible Gaming Policy.

1. Introduction

At Bwin, we are committed to safeguarding the privacy and personal data of every individual who interacts with our Platform. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you hold over it under applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By registering an account, browsing the Platform, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this document, you should discontinue your use of the Platform immediately and contact us using the details provided in Section 13.

We may update this Policy periodically. The version number and date shown at the top of this document will always reflect the most current iteration. Continued use of the Platform after any update constitutes your acceptance of the revised terms.

2. Data We Collect

We collect and process a range of personal data depending on how you interact with the Platform. The categories of data we may collect include, but are not limited to, the following:

2.1. Identity & Contact Data

• Full name, date of birth, and gender
• Residential address, email address, and telephone number
• Username and account credentials (passwords are stored in encrypted form)
• Copies of identity documents (e.g., passport, driving licence) provided for Know Your Customer (KYC) verification
• Proof of address documentation submitted during verification

2.2. Financial Data

• Payment method details, including debit card information (Visa, Mastercard, Maestro), e-wallet identifiers (PayPal, Skrill, Neteller, MuchBetter), bank account numbers used for bank transfers or Open Banking via Trustly, Paysafecard voucher references, Apple Pay and Google Pay tokens, and PayByPhone references
• Transaction history, including deposit and withdrawal amounts, dates, and processing times
• Currency preferences (GBP / British Pounds Sterling)
• Chargeback and dispute records

2.3. Technical & Usage Data

• IP address, device type, operating system, and browser type
• Unique device identifiers and mobile advertising IDs
• Pages visited, features used, games played, session duration, and click-path data
• Log files and error reports generated during your sessions

2.4. Responsible Gaming Data

• Self-exclusion requests, deposit limits, session-time limits, and cool-off periods set through our Responsible Gaming tools
• Records of any affordability assessments or enhanced due diligence checks carried out in connection with your account
• Interactions with our safer gambling support team

2.5. Communications Data

• Records of correspondence sent or received via email, live chat, or telephone
• Preferences regarding marketing communications and the channels through which you have opted in or opted out
• Feedback, complaints, and survey responses submitted through the Platform

2.6. Special Category Data

In limited circumstances we may process data that qualifies as a special category under UK GDPR — for example, health-related information voluntarily provided in connection with a responsible gaming self-referral. We will only process such data where you have given explicit consent or where processing is otherwise permitted by law.

3. How We Use Your Data

We use the personal data we collect for clearly defined, lawful purposes. We do not use your data in ways that are incompatible with those purposes without notifying you.

3.1. Account Management & Service Delivery

We process your identity, contact, and financial data to register and maintain your account, verify your identity in accordance with anti-money laundering obligations, process deposits and withdrawals, and ensure the Platform operates correctly for you.

3.2. Legal & Regulatory Compliance

We are required by law to verify the age and identity of all customers. The minimum age to use our Platform is 18 years old. We use your data to fulfil our obligations under UK data protection law, anti-money laundering legislation, and applicable gambling regulations, including conducting enhanced due diligence where required and reporting suspicious activity.

3.3. Responsible Gaming & Harm Prevention

We use behavioural, transactional, and usage data to monitor for indicators of problem gambling, enforce self-exclusion requests and account limits, and proactively contact players who may be experiencing gambling-related harm. Full details of our safer gambling measures are set out in our Responsible Gaming Policy.

3.4. Fraud Detection & Security

Technical, financial, and identity data is used to detect, investigate, and prevent fraudulent activity, money laundering, collusion, and any other conduct that may be unlawful or in breach of our Terms & Conditions.

3.5. Marketing Communications

Where you have provided your consent, or where we have a legitimate interest in doing so subject to your right to object, we may contact you with information about promotions, bonuses, and updates to our services. You may withdraw consent or exercise your right to object at any time by updating your preferences in your account settings or by contacting us at [email protected].

3.6. Analytics & Platform Improvement

Aggregated and pseudonymised usage data helps us analyse Platform performance, understand player behaviour, and improve the quality of our products and services. Where possible, we rely on anonymised data sets that cannot be used to re-identify individuals.

4. Legal Bases for Processing

Under UK GDPR, every act of personal data processing must be grounded in a valid legal basis. We rely on the following bases, as applicable to each processing activity:

Where we rely on legitimate interests, we conduct a balancing test to ensure that our interests do not override your fundamental rights and freedoms. Where you have provided consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third Parties

We do not sell your personal data. We may, however, share it with carefully selected third parties where necessary and lawful. All third-party recipients are required to handle your data in accordance with applicable data protection law and our data processing agreements.

5.1. Categories of Third-Party Recipients

• Payment processors & financial institutions: Including providers of debit card processing, e-wallet services (PayPal, Skrill, Neteller, MuchBetter, Paysafecard), Open Banking providers (Trustly), Apple Pay and Google Pay platforms, and bank transfer intermediaries — solely for the purpose of executing financial transactions.
• Identity verification & KYC providers: Third-party services that assist with document verification, age confirmation, and anti-fraud screening.
• IT service providers & cloud infrastructure: Hosting, database management, and security services that support Platform operations under strict contractual and technical safeguards.
• Analytics & marketing technology providers: Where you have consented to marketing communications, we may use third-party platforms to deliver and measure campaigns. These providers process data on our behalf and do not use it for their own purposes.
• Responsible gaming service providers: Including self-exclusion scheme operators and third-party assessment tools used to identify gambling-related harm.
• Legal, regulatory, and law enforcement authorities: Where we are required or permitted by law to disclose data to government bodies, courts, regulators, or law enforcement agencies.
• Professional advisers: Lawyers, auditors, and insurers operating under strict confidentiality obligations.

5.2. No Sale of Data

We will never sell, rent, or trade your personal data to any third party for their own commercial purposes. Any data sharing is carried out strictly in accordance with our internal policies and applicable law.

6. Cookies & Tracking Technologies

Bwin uses cookies and similar tracking technologies on the Platform to enhance your user experience, analyse site performance, and, where you have consented, to deliver relevant advertising.

6.1. Types of Cookies We Use

• Strictly necessary cookies: Essential to the functioning of the Platform, including session management, login persistence, and security. These cookies cannot be disabled without materially affecting your experience.
• Performance & analytics cookies: These collect anonymous information about how visitors use the Platform, helping us identify and resolve performance issues and improve navigation. We obtain your consent before placing these cookies.
• Functional cookies: These remember your preferences (such as language and display settings) to deliver a personalised experience across sessions.
• Targeting & advertising cookies: Used, with your consent, to deliver advertisements relevant to your interests and to measure the effectiveness of marketing campaigns. These may be placed by trusted third-party advertising networks.

6.2. Managing Your Cookie Preferences

When you first visit the Platform, you will be presented with our cookie consent banner, through which you can accept or decline non-essential cookie categories. You may update your preferences at any time using the cookie management tool accessible in the footer of every page. Additionally, most browsers allow you to control cookies through their settings. Please note that restricting certain cookies may affect the functionality of some Platform features.

7. Data Security

We take the security of your personal data seriously and have implemented a comprehensive range of technical and organisational measures designed to protect your information against unauthorised access, loss, alteration, disclosure, or destruction.

7.1. Technical Safeguards

• Encryption: All data transmitted between your device and our servers is protected using industry-standard Transport Layer Security (TLS) encryption. Sensitive data stored on our systems, including passwords and financial identifiers, is encrypted at rest.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training.
• Firewalls & intrusion detection: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and regular penetration testing.
• Secure payment processing: Financial transactions are processed through PCI-DSS compliant payment gateways. We do not store full card numbers on our own systems.

7.2. Organisational Measures

We maintain data protection policies, conduct regular staff training, and appoint a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable law. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where appropriate, inform affected individuals without undue delay.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

Once a retention period expires, data is securely deleted or anonymised. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical or analytical purposes, as it no longer constitutes personal data.

9. Your Rights

Under UK GDPR, you have a comprehensive set of rights in relation to your personal data. We are committed to honouring these rights promptly and transparently. You may exercise any of the rights described below by contacting our Data Protection Officer at [email protected].

9.1. Right of Access (Subject Access Request)

You have the right to request a copy of the personal data we hold about you, together with information about how and why we process it. We will respond to verified subject access requests within one calendar month of receipt. Where a request is complex or numerous, we may extend this period by a further two months, in which case we will notify you of the extension and the reason for it within the initial one-month window. We do not charge a fee for subject access requests unless they are manifestly unfounded or excessive.

9.2. Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay. You can update many details directly within your account settings, or contact us for assistance with information that cannot be changed through self-service.

9.3. Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent on which processing was based, or where you believe processing is unlawful. This right is not absolute — we may be required to retain certain data to comply with legal obligations, such as anti-money laundering record-keeping requirements. Where we cannot fulfil an erasure request in full, we will explain the reasons why.

9.4. Right to Restriction of Processing

You have the right to request that we restrict how we use your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing based on legitimate interests and we are verifying whether our grounds override yours. While processing is restricted, we will continue to store your data but will not use it for other purposes without your consent.

9.5. Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that we transmit it directly to another data controller where technically feasible.

9.6. Right to Object

You have the right to object at any time to processing of your personal data where we rely on legitimate interests or the performance of a task in the public interest as our legal basis. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes, including profiling carried out for direct marketing. We will cease such processing immediately upon receipt of a valid objection.

9.7. Rights Related to Automated Decision-Making & Profiling

Where we make decisions about you solely through automated processing (including profiling) that produce legal or similarly significant effects, you have the right to request human review of that decision, to express your point of view, and to contest the outcome. We will inform you when such automated decisions are made and explain the logic involved.

9.8. Right to Lodge a Complaint

If you believe that we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113. We encourage you to contact us first so that we have the opportunity to address your concerns directly.

10. International Data Transfers

Bwin is committed to ensuring that your personal data receives the same level of protection wherever in the world it is processed. Where we transfer personal data outside the United Kingdom to countries that are not covered by an adequacy decision issued by the UK Secretary of State, we implement appropriate safeguards to protect your information.

10.1. Transfer Mechanisms

International transfers are carried out using one or more of the following mechanisms:

• UK International Data Transfer Agreements (IDTAs): Standard contractual clauses approved under UK law, binding the recipient to process your data in a manner that provides protections equivalent to those afforded under UK GDPR.
• Addendum to EU Standard Contractual Clauses: Where applicable, the UK Addendum to the EU SCCs may be used for transfers to recipients in countries covered by equivalent EU-level mechanisms.
• Adequacy decisions: Where the UK Secretary of State has recognised a third country as providing an adequate level of data protection, transfers may proceed on that basis without additional safeguards.
• Binding Corporate Rules: For intra-group transfers within multinational corporate structures that have obtained ICO approval for binding corporate rules.

You may request information about the specific transfer mechanisms we apply to any particular processing activity by contacting our DPO at [email protected].

11. Minors

Our Platform is strictly intended for individuals who are 18 years of age or older. We do not knowingly collect, process, or retain personal data from persons under the age of 18. We employ age verification procedures at the point of registration and throughout the customer lifecycle to prevent underage access to our services, as described in our Responsible Gaming Policy.

If we become aware that personal data has been collected from a person under the age of 18, we will promptly close the relevant account, refund any deposits held, and delete the associated personal data to the extent permitted by law. If you believe a minor has registered on our Platform, please notify us immediately at [email protected] so that we can take appropriate action without delay.

12. Changes to This Policy

We reserve the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing activities, or the services we offer. When we make material changes, we will update the version number and date displayed at the top of this document. Where required by law or where changes are significant, we will notify registered account holders by email or by displaying a prominent notice on the Platform prior to the changes taking effect.

We encourage you to review this Policy periodically to remain informed about how we protect your data. The most current version of this document will always be available at bwin.gb.net/privacy-policy. Your continued use of the Platform following notification of any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please use the contact details below. We aim to acknowledge all enquiries within two working days and to resolve them fully within one calendar month.

13.1. General Support

For account-related queries, general support, and responsible gaming assistance:

• Email: [email protected]

13.2. Data Protection Officer (DPO)

For all matters relating to data privacy, subject access requests, the exercise of data subject rights, or complaints about our data handling practices:

• Email: [email protected]

13.3. Responsible Gaming Support Organisations

If you or someone you know may be experiencing difficulties related to gambling, the following free, independent organisations offer confidential support in the United Kingdom: