Privacy Policy

1. Privacy Statement

1. Overview

At Sky Betting & Gaming, we like to make things easier for our customers and that includes being clear and open about how and why we use your personal data. We know there's nothing more off-putting than the sight of a lot of boring small print, so this privacy statement ("Statement") is designed for you to easily access the information you need, when you need it. It's also written in plain English, to make it clear, simple, and easy to read.

This Statement applies to our websites, application, products or services that link to this Statement or that do not have a separate privacy statement (collectively our "Services").

In this first section of the Statement, we provide an Introduction to Sky Betting & Gaming (including our contact details), we provide information on Privacy and Data Protection at SBG, we explain How to navigate and read this document and we also explain how to stay abreast of Changes to the Statement.

We hope that you find this Statement helpful but if you have any concerns or questions please feel free to share feedback via the contact methods listed in the Contact details, including DPO section below.

1.1. Introduction to Sky Betting & Gaming

1.1.1. Controller Details

References in this document to "us", "our", "we", "Sky Betting & Gaming" or "SBG" are references to the following data controllers:

• SBG Sports Limited, whose trading names include Sky Betting and Gaming and Sky Bet. SBG Sports Limited is a company registered in England & Wales with its place of business at: Spinola Park, Level 2, Triq Mikiel Ang Borg, St Julians, SPK 1000, Malta (Malta registered company number OC 1568). SBG Sports Limited is licensed and regulated by the Gambling Commission of Great Britain (licence number 67370) in respect of customers located in the United Kingdom and the Isle of Man, and the Malta Gaming Authority (licence number: MGA/B2C/1111/2025) in respect of customers located in the Republic of Ireland, Gibraltar and the Channel Islands. SBG Sports Limited is the data controller of personal data processed in relation to the Sky Bet products or Services.
• Bonne Terre Gaming Limited, whose trading names include Sky Bet Games, Sky Vegas, Sky Casino, Sky Bingo and Sky Poker is a company registered in Gibraltar with offices located at 4th Floor, 55 Line Wall Road, Gibraltar, GX11 1AA. Bonne Terre Gaming Limited is licensed and regulated by the Gambling Commission of Great Britain (licence number 065519) in respect of customers located in the United Kingdom and the Isle of Man, and is licensed by HM Government of Gibraltar (Remote Gambling Licence No. 156) and regulated by the Gibraltar Gambling Commissioner. Bonne Terre Gaming Limited is the data controller of personal data processed in relation to the Sky Bet Games, Sky Vegas, Sky Casino, Sky Bingo and Sky Poker products or Services.
• Hestview Limited, trading as Sky Games, of 4 Wellington Place, Leeds, West Yorkshire, LS1 4AP. Hestview Limited is the data controller in relation to personal data processed in relation to the Sky Games, Sky Sports Super6, ITV7 (non-broadcast competitions), Timeform and Sporting Life brands, products or Services.

1.1.2. About the Flutter Group

SBG is a member of the Flutter Group of Companies. Any reference to the "Group" within this Statement includes Flutter Entertainment plc and all or any of its direct or indirect subsidiary undertakings, joint venture partners, and their related companies wherever located in the world as may exist from time to time including, but not limited to, Paddy Power, Betfair, Tombola, Sportsbet, FanDuel, Adjarabet, PokerStars, Sisal, Junglee and MaxBet.

The Flutter Group is split into a number of regional structures, with each one housing a number of the abovementioned Flutter Group brands. SBG is within the UK & Ireland ("UK&I") division, alongside brands such as Paddy Power, Betfair UK&I and Tombola.

Please note that the Flutter Group also operates other gambling companies and your use of those products and services will be subject to privacy statements that may differ to the one contained herein. Any exercise of your privacy or data protection rights in accordance with this Statement will only relate to the personal data being processed by the SBG companies listed in the Controller details section and will not apply in regard to any products or services operated directly by the Flutter Group unless otherwise stated in this Statement.

The Flutter Group operates separate privacy policies for individuals residing in the UK which are available at:

• https://www.pokerstars.uk/privacy/
• https://www.paddypower.com/aboutUs/Privacy.Policy/
• https://www.betfair.com/en/aboutUs/Privacy.Policy/
• https://www.tombola.co.uk/privacy-policy/

1.1.3. Contact details, including DPO

If you have any concerns about how SBG handles your personal data, you can contact our Data Protection Officer (DPO) and Data Protection Team at: [email protected]. If you wish to exercise your Data Protection rights, please see Your Data Subject Rights.

1.2. Privacy and Data Protection at SBG

Data protection is all about keeping your personal data safe and secure, and ensuring that your legal rights in relation to your data are respected. Privacy is a fundamental right, and you are entitled to have your personal data protected, used in a fair and legal way, and made available to you when you ask for a copy.

1.2.1. Our commitment

At SBG, we take the protection of our customers' personal data and privacy very seriously, and we never lose sight of the fact that your personal data is YOUR personal data.

We believe in using your personal data to make things simpler and better for you, and we will always keep your personal data safe using the highest standards of security. We'll be clear and open with you about why we collect your personal data and how we use it, and where you have choices or rights, we'll explain them to you and respect your wishes.

1.2.2. Our key privacy and data protection principles

To meet these commitments, we employ the following 5 principles at SBG. These principles are at the heart of everything we do and ensure that your rights are considered at every step.

1. Keeping your data secure: We recognise that online security and data protection is an area of vital importance for all our customers, so it is important to us that you have confidence in the security of your personal details before you register an account. We are committed to employing best-in-class security measures to protect your information and our technological security solutions are governed by a mature framework.
2. Data protection by design and default: We are committed to implementing technical and organisational measures, at the earliest stages of the design of our Services, in such a way that safeguards your privacy and Data Protection rights from the start ('Data Protection by design'). By default, we ensure that personal data is processed with the highest levels of privacy protection and that data is made accessible only to those who need it. ('Data Protection by default'). We also routinely use pseudonymisation and encryption when processing your data internally and where data is shared externally.
3. Transparency: Transparency is a key principle of data protection, and we believe in being up front and honest with you about how we use your data. Our Privacy Statement provides you with everything you need to know about how your information will be used by SBG, and we embed ad-hoc privacy notices when you are using our sites to let you know when we might be using data in ways you don't expect.
4. Giving you the choice: We believe that respecting your privacy begins with giving you a say in how it is used. Where you have rights in respect of the data we process relating to you, we will do everything we can to make it easy to exercise these choices. We also endeavour to give you real choice over how you hear from us, and how we use cookies and other technologies.
5. Using your data to keep you safe: At SBG we do all we can to proactively protect our customers from harm, and that includes using your data to identify, prevent and react risky behaviour. Using our industry-leading levels of customer insight and our passion to do the right thing by our customers, we are committed to using your data and patterns of play to ensure a safer experience for every person that engages with our brands.

1.3. How to navigate and read this document

• Personal Date Types We Use explains the different types of personal data that you provide to us when you use our Services, that is generated when you use our Services and that we collect from other sources.
• How and why we use your personal data explains what we use your personal data for. It contains different sections for each type of personal data usage, with each section providing information on the purposes and legal basis for using the data, as well as on any sharing of the data that may occur. Our use of personal data is not the same for all types of individuals (e.g. website visitors, customers, etc.), so please see "Who the section applies to" at the beginning of each section to find out the ones that relate to you and your personal data.
• General Processing Information contains information about our personal data processing that is relevant to all individuals who engage with our Services.
• Your Data Subject Rights provides you with information on the rights you have in relation to your personal data and how to exercise those rights.

For information on cookies, please see our onsite Cookie Banners, onsite Cookie Management centre (located at the bottom of our websites) or visit our Cookies Policy.

1.4. Changes to the Statement

It is important to check back often for updates to this Statement. If we make material and important changes, we will let you know by placing a notice on the relevant Service and/or contacting you using other methods such as email.

2. Personal Data Types We Use

2.1. Data provided by you

When using our Services, we collect the following types of information provided by you:

• Registration Information
  When you register an account with us, you are required to provide us with your name, date of birth, postal address, e-mail address, phone number, security questions, marketing preferences and any other details as might be requested from you for the purpose of registration and/or continued use of our Services.
  As a condition to using our Services, we will ask you to share your precise geolocation so we can ensure that we are authorised to provide the Services to you in your location.
• Verification and Know Your Customer ('KYC') Documentation
  In order to verify your identity, you may be required to provide documents such as a copy of your passport or driver's licence, documentation establishing your address such as utility bills, or any other information we deem necessary to confirm your age and/or identity.
• Interactions with Customer Operations
  When you interact with our customer operations via live chat, phone, email or social media platforms we will retain a record of your conversations with our staff, as well as notes relating to these interactions and their outcomes.
  Where you contact us through a social media account we will be provided with a copy of the social media profile details (name, profile photo and other information) you make available to us as well as the content of your messages to us.
• Payment Information
  Information in relation to your chosen payment method such as debit card details, cardholder name, e-wallet details, or information in relation to your alternative payment method. All such information is processed in accordance with the Payment Card Industry Data Security Standard.
• Financial Information
  Payslips or other documents proving your source of wealth including but not limited to proof of earnings, bank statements and evidence of business ownership.
• Safer Gambling Information
  Data your provide to us in relation to concerns you may have about gambling risk, harm or safety, or as part of a vulnerability assessment. Some other Safer Gambling Information is also created while you use our Services - see Data created by using our Services below.
• Forum Posts and In-Game Comments
  Information about the way you contribute to and communicate with, and through, our Services, for example when you post comments via our social media channels or chat functionalities such as forums, chat rooms and message boards, profile comments, in-game challenges and chat messaging with game operators or other users.
• Responses to Surveys and Market Research
  Responses to surveys or market research that we conduct.
• Special Category Data
  Special category data is personal data that needs more protection because it is sensitive. It includes biometric data that may be used for identification purposes, genetic data, data concerning an individual's health, sex life or sexual orientation, or personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs.
  In the course of your contacts with customer operations, if you provide information to us on health conditions that you may have, we may retain this information and use it to add further protections to your account, where appropriate.
  Especially, where you have vulnerabilities which may affect your ability to safely use our Services, we may request further information or may take extra steps to enhance protection for you. This may involve health information.
  We will only ever use special category data when absolutely necessary and where lawful to do so. Where possible, we will always ask for your consent before we proactively request or use this information. In limited circumstances where consent is not possible, we may need to use this information to protect your vital interests or for reasons of substantial public interests in accordance with law.

2.2. Data created by using our Services

Some of the personal data we process relating to you is generated by your use of the Services.

• Betting and Transactional Information
  Your betting, gaming, deposits, payments, and other account transactions.
• Safer Gambling Information
  Safer Gambling controls that you decide to apply through your use of our Services, such as deposit limits, cool off periods, or self exclusions, or controls that we pro-actively decide to apply in order to prevent harm, such as spend limits or enforced exclusions.
• Device Information
  Details relating to your device and communication data, including IP address, browser type, unique device identifier, IDFA, hardware model, operating system and version, software, preferred language, serial numbers, device motion information, mobile network information and location data.
• Server Logs and Traffic Information
  Information such as dates and times of access, the app features or pages you view, app crashes and other system activity, and the third-party site or service you were using immediately before visiting our site.
• Cookie and Tracking Information
  When you access or use our content, products, and Services, we may collect information from your devices through the use of 'cookies' and similar technologies.
  These technologies can collect a wide variety of information about how you interact with our Services, such as your language preferences, pages visited and content viewed, links and buttons clicked, and URLs visited before and after you use our Services.
  For further detail on cookies, please refer to our Cookies Policy. To manage your cookie preferences, please go to our onsite Cookie Management centre (located at the bottom of our websites).
• Information derived from Profiling and Analysis
  We carry out profiling and analysis based upon your name, location data, age, betting and gameplay activity, as well as other relevant data points.

2.3. Data from other sources

Not all the personal data we hold about you will always come directly from you or from your use of our Services. As detailed below, we may also collect information from third parties such as our partners, service providers and publicly available websites (i.e. social media platforms), to comply with our legal and regulatory obligations, offer Services we think may be of interest, to help us maintain data accuracy and to provide and enhance the Services.

• Social media profile details
  Your name, profile photo and other information you make available to us when you connect with or contact us through your social media account.
• Credit Reference Agencies
  Data provided by trusted credit reference agencies who may perform a soft check for verification and affordability purposes which do not affect your credit score. A record of the outcome of these checks is provided back to us.
• Publicly Available Sources
  In accordance with our legal obligations, we may consult publicly available information about you such as your Facebook or other social media pages, property ownership details, the electoral roll, company annual returns for places you have worked, industry bodies of which you may be a member, and insolvency registers.
• From other Flutter brands
  In some circumstances, as detailed in the HOW AND WHY WE USE YOUR PERSONAL DATA and GROUP SHARING sections below, we may receive or get access to some personal data from other brands within our Flutter Group. For example, and as detailed in the Safer Gambling section below, we operate a cross brand self exclusion mechanism between the Flutter Group brands that operate in the UK whereby if you self exclude from Paddy Power, Betfair, Tombola or PokerStars, that data will be shared with us here in SBG so that the exclusion can be applied to SBG as well.
• From your family members or other third party friends or contacts
  Data may be received by us from third party contacts if you ask for a family member to support you with the management of an issue or complaint, if you have legal power of attorney representing you or if someone contacts us to tell us about a customer of ours who they have concerns about. In these instances we will have records of the third party contact details and recordings of the interactions. For the avoidance of doubt, we will also need to obtain and use contact information from these third party family members, friends or contacts in order to manage our communication with them strictly and only for the purposes mentioned above.

3. How and Why We Use Your Personal Data

We only use your personal data where necessary and where it is lawful to do so. Our use of your personal data is needed to enable us to deliver the Services to you, to meet our legal or regulatory obligations, to meet or protect yours, ours, the wider public's or other third parties' interests, and sometimes for other reasons only where we have your explicit consent to do so.

Below, we explain how and why we need to use your personal data, providing you with information on our different uses of your personal data. This includes detailed information on the reasons for using your data, the types of personal data we use and also information on the legal basis for using your data, which may include using your personal data:

• To enter into or perform a contract with you ('Performance of a contract'), such as delivering our Services in accordance with the terms and conditions;
• To meet our legal or regulatory obligations ('Legal and regulatory obligations'), such as our taxation, company or data protection law or our licencing obligations;
• To meet our own legitimate interests or those of a third party ('Legitimate interests'), such as where we use data to protect our business assets or information, to improve our Services or to keep you safe while you use our Services;
• Where you have provided us with consent to do so ('Consent'), such as where you have provided us with consent to provide you with marketing information;
• To perform tasks in the interests of the general public ('Public interests'), such as safeguarding the public from gambling related harms; or
• To protect your or someone else's vital interests ('Vital interests'):

See each different use of personal data below to find out more about how and why we use your personal data.

4. General Processing Information

This section provides you with some other important information you need to be aware of in relation to how we use your personal data, including information on how we share your personal data with the Flutter Group, international transfers of your personal data, how we keep your personal data secure and how long we need to keep your personal data for. Click any of the topics below for more details.

4.1. Group sharing

As explained in the About the Flutter Group section above, SBG is part of the wider Flutter Group and sits within the UK&I division. We have explicitly called out a number of specific situations in this Privacy Statement where the Flutter Group companies may use your information, including where Paddy Power and/or Betfair are providing support to SBG as part of the UK&I division's operations and to other Flutter Group members for marketing purposes, customer services purposes, the prevention of crime, helping to reduce gambling related harm, the provision of betting and gaming services, and to meet legal and regulatory obligations. Additionally, we may share personal data with the Flutter Group as part of our group internal reporting and assurance .in order to facilitate business efficiency and improvements including, but not limited to research across our group, testing of systems and/or suppliers, risk management, the provision of technology, finance or security support, and the development of new products and tools. We may also in the future share personal data with other members of the Flutter Group for purposes that are related to and compatible with those set out in this Statement. Finally, where we are required by law or regulation to share personal data to members of the Flutter Group for reasons beyond those set out in this Statement, we will be required to do this.

4.2. International transfers

Some of the third-party providers we use, as well as companies within the Flutter Group, are based in, or carry out their activities in, countries outside the European Economic Area ('EEA') and/or outside the UK. Countries outside the EEA and UK do not always have strong data protection laws. This means that, unless your personal data is being transferred to a country where the European Commission or UK has determined there to be an adequate level of protection, we have to put in place additional protections to ensure that your personal data is protected to the same level as it is within Europe or the UK. We put these additional protections in place by using standardised contractual clauses that have been approved by the European Commission (for transfers outside the EEA) and the Information Commissioner's Office (for transfers outside the UK). Where necessary, we also put in place any additional contractual measures required by local law in any of the countries in which we operate. As and when required, we will also put additional technical or organisational measures in place to ensure that your data is kept safe.

4.3. Keeping your personal data secure

We recognise that online security and data protection is an area of vital importance for all our customers, so it is important to us that you have confidence in the security of your personal details before you register an account. We are committed to employing security measures to protect your information from access by unauthorised persons and to prevent accidental or unlawful processing, disclosure, destruction, loss, alteration and damage. Our technological security solutions are very advanced and are governed by a mature framework. Our approach is focused on preventing risks. In order to help us in this regard, we employ pseudonymisation and encryption whenever possible to reduce the impact of any potential incidents. As the security of some communications via the internet is not completely secure, we cannot guarantee the security of any information that you disclose using your internet connection. You accept the inherent security implications of using the internet and the Group will accept no liability for any direct, consequential, incidental, indirect, or punitive losses or damages arising out of such an occurrence.

4.4. How long we keep your personal data for

A key principle of data protection is 'storage limitation', which means that organisations should only hold onto your personal data for as long as is needed. At SBG, we have taken steps to ensure that we hold your personal data only as long as we have a valid legal basis or reason to do so, which includes providing you with the Services you have requested, meeting our legal and regulatory obligations, resolving disputes and enforcing our agreements. The length of time for which we keep different types of personal data can vary, depending on why we originally obtained them, the reason we process them and the legal requirements that apply to them. When setting our data retention and deletion timescales we take into account a range of factors including applicable regulations and standards relating to gambling and gaming, anti-money laundering, taxation, payment processing and complaint handling, the need to prevent or detect crime or other misuses of our Services, and audit requirements. To fulfil our requirements, some of your personal data will need to be retained for a period of time after you cease to be a customer. When we no longer need it to fulfil the purposes and legal bases set out in this Statement, we delete it securely. Subject to us not having a legal or regulatory requirement or a risk management reason for retaining your information for a longer period, your information will not be kept for longer than 7 years from your last login or expiry of a self-exclusion. This allows us to meet our record-keeping obligations in applicable legislation, as well as allowing us to defend ourselves against potential legal claims. Please note that if you opt to apply an exclusion to your account, your data will be retained for the period of that exclusion, plus a further seven years from the date of the expiry of that exclusion. In certain circumstances we may be required to retain your information indefinitely. For example, where you elect to permanently exclude yourself from accessing our Services under our procedures on safer gambling, we are obliged to retain your data indefinitely to prevent you from creating new accounts. We will take all necessary steps to ensure that the privacy of information is maintained for the period of retention. Where we wish to retain any information for analysis purposes, we first anonymise it to the standards approved by the UK Information Commissioner's Office, (which, as we are based in the UK, is our lead regulator on matters relating to data protection) so that it can no longer be linked back to an individual.

5. Your Data Subject Rights

Under data protection law, you have a number of rights which are detailed below. We want to be clear about what those rights mean in practice and how you can exercise them. Please note that some of these rights only apply in specific circumstances and are qualified in several respects by exemptions in Data Protection legislation. We will advise you in our response to your request if we are relying on any such exemptions.

For any queries related to your personal data or any of your rights referenced below, please feel free to contact us at: [email protected]