Last updated: March 2026 | UK GDPR compliant
This Privacy Policy explains how Bettom Casino collects, uses, stores, and protects your personal data. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our platform, you acknowledge the practices described in this policy. The Information Commissioner's Office (ICO) oversees data protection compliance in the UK — learn more at ico.org.uk.
We collect personal data that you provide directly: name, email address, date of birth, phone number, residential address, payment information, and identity documents submitted for KYC purposes. We collect this data at registration, during account verification, and when you contact our support team. We do not collect more data than is necessary for our legitimate business purposes and legal obligations as a UKGC-licensed operator.
We also collect usage data automatically: pages visited, games played, session duration, device type, browser information, and IP address. This data helps us improve our platform, detect fraud, and comply with regulatory reporting requirements. We use cookies and similar tracking technologies — our Cookie Policy provides full details accessible from the footer.
Your data is used to: provide and operate our casino services, verify your identity and age as required by UKGC licence conditions, process deposits and withdrawals, communicate about your account and relevant promotions (with your consent where required), detect and prevent fraud and money laundering, comply with legal and regulatory obligations, and operate our responsible gambling programmes.
We rely on the following legal bases for processing: contractual necessity (to provide the service you signed up for), legal obligation (UKGC compliance requirements, AML regulations), legitimate interests (fraud prevention, security), and consent (marketing communications). You can withdraw consent for marketing communications at any time via account settings or by emailing our data protection team.
We do not sell your personal data to third parties. We share data only where necessary: with payment processors to handle transactions, with identity verification providers for KYC, with GAMSTOP for self-exclusion checking, and with regulatory authorities (UKGC) as required by our licence. All third-party processors are bound by data processing agreements and comply with applicable data protection law.
We protect your data using 256-bit SSL encryption for all data in transit, encrypted storage for sensitive personal data, access controls restricting data access to authorised personnel, and regular security audits. We retain your data for as long as your account is active plus 5 years following account closure, in line with UK AML requirements. You have the right to request data deletion subject to our legal retention obligations — contact our data protection team to exercise this right.
Under UK GDPR, you have rights to: access your personal data, correct inaccurate data, request deletion of your data (where legally permissible), restrict processing of your data, portability of data provided to us, and object to processing based on legitimate interests. To exercise any of these rights, contact our data protection team via the email address in your account settings. We respond to all data subject requests within 30 days.
If you have concerns about our data practices that we cannot resolve, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO is the UK's independent data protection authority — contact details are available at ico.org.uk. We take all data protection complaints seriously and will work to resolve any concerns promptly.
For data protection queries, contact our Data Protection Officer via the support email in your account settings. We aim to respond within 5 business days. This policy was last reviewed and updated in March 2026.
The Bettom Privacy Policy explains why personal information is needed to create and protect a regulated gambling account. Bettom UK GDPR duties sit alongside identity, anti-money-laundering and safer-gambling obligations. Some processing is necessary to perform the account contract, some follows a legal duty, and some optional activity, such as certain marketing, depends on consent. Withdrawing marketing consent does not remove information that must be retained to meet a legal obligation.
Contract
Operate the account and requested service.
Legal duty
Age, identity, AML and regulation.
Consent
Optional communications and choices.
Bettom personal data should be collected for stated purposes and limited to what those purposes require. The account holder should be told which fields are mandatory, what can happen if the information is missing, which organisations receive it and how long it is kept. Questions about a specific record should be directed through the authenticated support or privacy route, with enough detail to identify the request but no password.
Bettom account data can include name, date of birth, address, contact information, login records, device details, promotion history, deposits, withdrawals, bets and game activity. Bettom payment data may include the selected method, masked instrument details, transaction references and source-of-funds evidence. Full card security data should remain with the payment processor and must never be sent casually through chat.
| Data group | Why it may be used | Safer handling |
|---|---|---|
| Account details | Registration and contact | Edit only in the account |
| Payment records | Deposits, withdrawals and checks | Use a method in your name |
| Identity files | Age, KYC and AML | Upload through a private route |
Bettom identity verification data can include a passport or driving licence, proof of address and a payment-method statement. Upload a clear current copy only when the request appears inside the verified account or an authenticated support conversation. Cover information that the instructions do not require where permitted, and keep your own record of what was sent and when. An unsolicited request for a password, PIN or full security code should be treated as suspicious.
The Bettom Cookie Policy distinguishes storage needed for the service from optional analytics or marketing technologies. Necessary cookies can keep a user signed in, preserve a bet slip or protect a session. Preference cookies remember choices, while analytics can show how the site performs. Marketing technologies should follow the consent state shown in the cookie control. Clearing cookies can sign the user out and remove an unfinished slip.
Necessary
Security and requested functions.
Preferences
Saved choices and display state.
Optional
Analytics or marketing consent.
Bettom marketing preferences should be changeable without closing the gambling account. A customer can normally turn off promotional email, SMS or push messages while still receiving essential account, security, transaction and safer-gambling communications. Allow time for systems to update, then keep a copy of the preference change if messages continue. A self-excluded customer should not receive gambling marketing and should report any failure promptly.
Bettom privacy rights can include access, correction, restriction, portability and objection, depending on the legal basis and circumstances. A Bettom subject access request asks for a copy of personal information and supporting details about its use. The request should specify the account and the date range or subject when possible. The operator can verify identity before releasing information so that a third party cannot obtain it.
Privacy request sequence
Identify, verify, scope, receive, correct if needed
Bettom data deletion is not an automatic erasure of every gambling record. Information needed for anti-money-laundering, fraud prevention, disputes, self-exclusion and regulatory reporting may need to remain for a defined retention period. Bettom data protection staff should explain what can be deleted, what must be retained and why. If a concern is not resolved, a UK resident can complain to the Information Commissioner's Office. Account security should be handled separately and immediately if the issue involves unauthorised access.
A useful privacy request names the account, the information or decision being questioned, the relevant dates and the preferred reply channel. Keep the acknowledgement and reference number, but do not email an unredacted identity document unless an authenticated instruction specifically requires it. If the issue concerns a suspicious login or payment, secure the account and payment method first; the longer data-rights process can follow. This distinction helps the operator route an urgent security case immediately while still keeping the formal access, correction or objection request complete and traceable.
