This Privacy Policy sets out how personal information is collected, used, stored, shared, and protected in connection with the online casino and betting services operated under The Palm Beach brand. The Policy applies to all individuals who access or use the services through the websites associated with The Palm Beach.
Processing of personal data is carried out in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In the context of this Privacy Policy, 36Gaming Ltd acts as data controller and determines the purposes and means of processing personal data, and is responsible for ensuring that processing is lawful, fair, and transparent.
Questions regarding this Privacy Policy or requests to exercise data protection rights may be addressed to the Data Protection Officer at: [email protected]
1. Who the Data Controller Is
The Palm Beach is operated by 36Gaming Ltd, registered at The Old Convent, Llanbadarn Road, Aberystwyth, Ceredigion, Wales, SY23 1EY, United Kingdom. 36Gaming Ltd is the data controller in relation to all personal data processed in connection with the services provided through The Palm Beach platforms.
2. Personal Data Collected
Personal data is collected only to the extent necessary to provide the services, to meet legal and regulatory obligations, and to comply with gambling licence requirements. The categories of personal data that may be collected include:
- Identity information: full name, date of birth, username, and copies of identity documents used for verification.
- Contact information: email address, postal address, and telephone number.
- Financial information: payment details, transaction history, and records relevant to financial risk assessments.
- Account activity: login records, session data, betting and gaming history, and account preferences.
- Verification and compliance data: information collected as part of age verification, anti-money laundering checks, and source of funds assessments.
- Technical data: IP address, browser type, device identifiers, and cookie data.
Personal data is not collected in excess of what is necessary for the purposes described in this Privacy Policy. Where processing is based on consent, that consent is obtained separately from acceptance of general terms and conditions.
3. Purposes and Legal Bases for Processing
Personal data is processed on the following legal bases:
- Performance of a contract: to create and administer user accounts, process payments and withdrawals, and deliver the requested gambling and betting services.
- Legal obligation: to comply with gambling licence conditions, anti-money laundering and counter-terrorist financing legislation, age verification and identity verification requirements, and other applicable laws and regulatory requirements. Data held for regulatory compliance purposes is retained for a minimum of five years following the end of the customer relationship, in line with Gambling Commission expectations.
- Legitimate interests: to detect and prevent fraud and misuse of the services, to maintain the security and integrity of systems, to carry out internal analysis necessary for the operation and integrity of the services, where such interests are not overridden by the rights and freedoms of the data subject.
- Consent: for optional processing activities, including certain types of direct marketing and non-essential cookies or similar technologies. Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
Personal data is not used solely for commercial benefit or publicity in a way that conflicts with reasonable expectations and legitimate privacy interests of users.
4. Financial Risk Checks and Data Sharing
In order to meet the requirements of applicable gambling regulation, financial risk checks may be carried out on customer accounts. This may involve sharing relevant personal data with credit reference agencies or other authorised third parties for the purpose of assessing financial risk associated with gambling activity.
Any data received from credit reference agencies in the context of financial risk checks is used solely for that purpose. It is not used for marketing, commercial profiling, or any purpose unrelated to financial risk assessment.
Appropriate technical and organisational measures are maintained to ensure that such data is accurate, secure, and processed in accordance with UK GDPR. Information will be provided to account holders where financial risk checks are conducted and what categories of data sharing are involved. The privacy notice and account communications will be updated to reflect any material changes in these data sharing arrangements.
5. Cookies and Tracking Technologies
The websites associated with The Palm Beach use cookies and similar tracking technologies. A distinction is made between:
- Strictly necessary cookies, which are required for the functioning of the websites and the delivery of core services.
- Optional cookies, such as analytics or advertising cookies, which are not essential for core functionality.
Non-essential cookies are not set without the prior consent of the user. The cookie consent mechanism provides opt-in and opt-out options with equal prominence. Cookie preferences can be withdrawn or adjusted at any time through the cookie settings made available on the websites.
No deceptive or manipulative design practices are used to influence cookie choices. Where third-party trackers are implemented, these are identified in the cookie notice or cookie policy made available on the websites.
6. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by applicable law or regulatory obligations.
Data related to regulatory compliance, including identity verification records, transaction data, and account history, is retained for a minimum of five years following the end of the customer relationship. Other categories of data may be retained for shorter periods, depending on the nature of the data and the purpose of processing.
Retention periods may also take into account statutory limitation periods, regulatory instructions, and requirements to retain data for the establishment, exercise, or defence of legal claims.
7. Data Subject Rights
Under UK GDPR, individuals whose personal data is processed in connection with The Palm Beach services have the following rights, subject to applicable legal limitations:
- Right of access: to request confirmation as to whether personal data is being processed and to obtain a copy of such data, together with certain related information.
- Right to rectification: to request correction of inaccurate personal data and completion of incomplete data.
- Right to erasure: to request deletion of personal data where there is no lawful basis for continued processing. Certain legal and regulatory retention obligations may limit the extent to which this right can be exercised.
- Right to restriction of processing: to request that processing of personal data is limited in certain circumstances, for example where the accuracy of the data is contested or where processing is contested pending verification.
- Right to data portability: to receive personal data that has been provided in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where processing is based on consent or contract and carried out by automated means.
- Right to object: to object, on grounds relating to the particular situation of the data subject, to processing that is based on legitimate interests, including profiling. In such cases, processing will cease unless there are compelling legitimate grounds to continue or the data is needed for legal claims.
- Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
Requests to exercise any of these rights should be addressed to the Data Protection Officer at [email protected]. Responses will be provided within the time limits set by applicable law.
If an individual is not satisfied with the handling of a request or any aspect of personal data processing, a complaint may be lodged with the Information Commissioner’s Office (ICO). Further information is available at ico.org.uk.
8. Data Security
Appropriate technical and organisational measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Access to personal data is restricted to personnel who require it for the performance of their duties and functions in relation to the services, and such personnel are subject to confidentiality obligations.
Security measures are reviewed and updated periodically, taking into account technological developments, the nature of the data processed, and the risks associated with processing.
9. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in processing activities, legal requirements, or regulatory guidance. Where changes are material, reasonable steps will be taken to inform account holders, for example through the registered account or other appropriate communication channels.
The current version of this Privacy Policy is available on the relevant websites. Continued use of the services following publication of an updated version will be treated as acknowledgement of the updated Policy to the extent permitted by applicable law.
10. Contact Details
Questions, concerns, or requests relating to this Privacy Policy or to the processing of personal data in connection with The Palm Beach may be directed to the Data Protection Officer:
Email: [email protected]
Postal address:
36Gaming Ltd
The Old Convent
Llanbadarn Road
Aberystwyth
Ceredigion
Wales
SY23 1EY
United Kingdom