Privacy

Introduction

Gullybet respects your privacy and provides this Privacy Policy to explain how we collect, use and disclose your personal information in connection with our gambling services. The policy describes what data we process, why we process it, and your rights regarding that data.

Controller and Contact

Gullybet is the data controller for personal information processed in relation to our services. If you have questions, requests or concerns about your personal data, contact our Support Team. We have appointed a Data Protection Officer to oversee data-protection matters and ensure compliance with applicable laws.

Categories of Personal Data We Collect

• Account information you provide when creating an account, including your name, date of birth, email address, residential address and contact details.
• Identification and verification data, including government-issued identification documents and proof of address.
• Payment details and transaction history, including the payment method used and billing information.
• Usage data and technical data, such as IP address, browser type, device identifiers, login times and pages visited.
• Communications with our Support Team and other correspondence related to the services.
• Marketing preferences and consent records for communications where permitted by law.
• KYC (Know Your Customer) and AML (Anti-Money Laundering) verification data as required by regulators.
• Referral and affiliate data where applicable.

How We Use Personal Data

• To provide our products and services and to support account operations, including payments, bets and customer service.
• To verify identity, prevent fraud and assess risk associated with accounts and transactions.
• To comply with applicable laws and regulatory obligations, including gambling licensing and anti-money-laundering requirements.
• To monitor and improve the performance, security and reliability of our platform.
• To communicate with you, including marketing communications where you have provided consent or where permitted by law.
• To conduct analytics and research, using data in aggregated or de-identified form where appropriate.

Legal Bases for Processing

We rely on contractual necessity to provide our services, compliance with legal obligations, and legitimate interests including security, fraud prevention and platform improvement. Where required by law, we obtain consent for processing activities such as direct marketing.

Sharing and International Transfers

We may disclose personal data to:

• Service providers, contractors and affiliates who process data on our behalf to deliver products and services.
• Regulators, auditors and lawful authorities as required by applicable laws and regulations.
• Affiliates for business purposes and to protect the rights and safety of our users and ourselves, including fraud prevention.
• External partners to support KYC/AML checks and other compliance activities.
• With your consent or at your direction.

We may transfer personal data to countries outside your residence. When transferring data, we apply appropriate safeguards to ensure an equivalent level of protection, including contractual protections and other recognized transfer mechanisms in accordance with applicable data protection laws.

Security

We implement technical and organizational measures designed to protect personal data, including access controls, encryption for data at rest and in transit where appropriate, and secure storage. We require our processors and personnel to adhere to equivalent security standards.

Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, or for legitimate business purposes. When data is no longer required, we securely delete or destroy it.

Your Rights

You have rights in relation to your personal data, including:

• Right of access to confirm what data we hold and how it is used.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure where there is no compelling reason for continued processing.
• Right to restrict processing in certain circumstances.
• Right to data portability where applicable.
• Right to object to processing, including for direct marketing, and to withdraw consent where it was granted.
• Right to lodge a complaint with a data protection authority in your jurisdiction.

To exercise these rights, contact our Support Team. We will respond within one month; in complex cases we may extend the period with notice and provide an explanation. We may require information to verify your identity before processing requests.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate the site, remember preferences, analyze usage and support security. We may employ analytics services to measure site performance and usage. You can manage cookie preferences via our cookie banner and by adjusting your browser settings. Some functions may not operate correctly if cookies are disabled.

Know Your Customer and Anti-Money Laundering

To comply with regulatory requirements, we perform identity verification before enabling certain levels of activity and prior to major transactions. You may be required to provide documents such as government-issued photo ID, proof of address, and a selfie holding the ID. Verification may be revisited for high-risk activity or large transactions, and insufficient verification may result in restrictions on deposits or withdrawals.

Changes to This Policy

We may update this Privacy Policy from time to time. When material changes occur, we will post the updated policy on our platforms and, where required by law, provide notice or obtain your consent. Continued use of our services after changes constitutes acceptance of the updated policy.

How to Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact our Support Team. If required by applicable law, you may be provided with the option to contact our Data Protection Officer. We may request identity verification before fulfilling data requests and will respond within one month, with extensions where justified by complexity.