Privacy Policy

Version: 1.0  |  Last Updated: 31 August 2026

This Privacy Policy (“Policy”) describes how Sombrero Spins (“we”, “us”, “our”), the operator of sombrero-spins.org.uk, collects, uses, stores, shares, and protects your personal data when you access and use our Platform. It also explains the rights you have in relation to your personal data and how you can exercise them.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy. By registering an Account or using our Platform, you acknowledge that you have read and understood this Policy.

1. Introduction

1.1 Scope

This Policy applies to all personal data collected about you when you visit our website, register an Account, use our Games and services, or otherwise interact with us. It covers data collected online, via email or live chat, and by any other means of communication.

1.2 Our Role as Data Controller

Sombrero Spins acts as a Data Controller in respect of the personal data it collects and processes about you. This means we determine the purposes for which and the means by which your personal data is processed. We are committed to processing your personal data in compliance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1.3 Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection practices. You may contact our DPO at:

• Email: [email protected]
• Website: sombrero-spins.org.uk

2. Data We Collect

2.1 Data You Provide Directly

We collect the following categories of personal data that you provide to us directly:

• Identity Data: Full legal name, date of birth, gender, username, copies of government-issued identification documents;
• Contact Data: Email address, residential address, telephone number;
• Financial Data: Payment method details (card numbers are stored in tokenised form by our payment processors and not directly by us), transaction history, deposit and withdrawal records, source of funds documentation;
• Verification Data: KYC documents including proof of identity and proof of address;
• Communications Data: Records of correspondence with our support team via email, live chat, or other channels.

2.2 Data Collected Automatically

When you use our Platform, we automatically collect certain technical and behavioural data, including:

• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone settings, and plug-in types;
• Usage Data: Pages visited, game sessions played, betting and wagering history, session duration, clickstream data, and the referring URL;
• Location Data: Geolocation data derived from your IP address for the purpose of verifying geographic eligibility;
• Cookie Data: Data collected via cookies and similar tracking technologies as described in Section 6 of this Policy.

2.3 Data from Third Parties

We may receive personal data about you from third parties in the following circumstances:

• Identity Verification Providers: Third-party KYC and AML service providers who assist in verifying your identity and screening against sanctions and PEP lists;
• Payment Processors: Information relating to your transactions from payment service providers;
• Fraud Prevention Services: Risk scoring and fraud alert data from specialist fraud prevention agencies;
• Analytics Providers: Aggregated and anonymised analytics data from our analytics partners.

2.4 Special Categories of Data

We do not intentionally collect special category data (as defined under UK GDPR, including health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data) unless you voluntarily provide such information, for example, when self-reporting a gambling problem or vulnerability. Where we do collect such data, we will handle it with the highest level of care and in accordance with applicable law.

3. How We Use Your Data

3.1 Purposes of Processing

We use your personal data for the following purposes:

• Account Registration & Management: To create and maintain your Account, verify your identity, and communicate with you about your Account;
• Service Delivery: To provide you with access to our Games, process deposits and withdrawals, manage bonuses and promotions, and deliver customer support;
• Legal & Regulatory Compliance: To comply with our obligations under anti-money laundering (AML) legislation, Know Your Customer (KYC) requirements, data protection law, and any other applicable regulations;
• Fraud & Crime Prevention: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other unlawful conduct;
• Responsible Gaming: To implement and administer responsible gaming tools, monitor for at-risk gambling behaviours, and fulfil our duty of care obligations;
• Marketing & Communications: To send you promotional offers, newsletters, and updates about our services where you have consented or where we have a legitimate interest to do so, subject to your preferences;
• Analytics & Platform Improvement: To analyse usage patterns, improve our Platform, develop new features, and optimise the player experience;
• Dispute Resolution: To investigate and resolve complaints and disputes, and to establish, exercise, or defend legal claims.

4. Legal Bases for Processing

4.1 Overview

We only process your personal data where we have a valid legal basis to do so under UK GDPR. The legal bases we rely upon are:

• Contract Performance (Article 6(1)(b)): Processing necessary to register your Account, deliver our services, and process transactions pursuant to our Terms & Conditions;
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including AML/KYC obligations, gambling regulations, and tax reporting requirements;
• Legitimate Interests (Article 6(1)(f)): Processing in pursuit of our legitimate business interests, including fraud prevention, network security, analytics, and direct marketing (where balanced against your interests and rights);
• Consent (Article 6(1)(a)): Processing based on your freely given, specific, and informed consent, including for certain marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing;
• Vital Interests (Article 6(1)(d)): Processing necessary to protect your vital interests or those of another person in exceptional circumstances.

5. Data Sharing & Third Parties

5.1 Categories of Recipients

We may share your personal data with the following categories of third parties:

• Identity Verification & KYC Providers: To verify your identity and comply with AML obligations;
• Payment Service Providers: To process deposits and withdrawals securely;
• Game Software Providers: Where required to deliver Games and account for game outcomes;
• Cloud Hosting & IT Infrastructure Providers: Who host and maintain the technical infrastructure of the Platform;
• Customer Support Platforms: To facilitate efficient management of your support enquiries;
• Analytics & Marketing Partners: To analyse Platform usage and deliver targeted marketing, subject to your consent where required;
• Fraud Prevention & Risk Management Agencies;
• Regulatory Authorities: Including the Gambling Commission and law enforcement agencies where legally required or permitted;
• Professional Advisers: Including lawyers, auditors, and insurers where necessary for the conduct of our business.

5.2 Data Processing Agreements

Where third parties process personal data on our behalf, we ensure that appropriate Data Processing Agreements are in place, requiring processors to handle data only in accordance with our instructions and in compliance with applicable data protection law.

5.3 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for their independent marketing purposes.

6. Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device by a website. We use cookies and similar technologies (including pixels, web beacons, and local storage) to improve your experience on the Platform, analyse usage, and deliver relevant content.

6.2 Types of Cookies We Use

6.3 Managing Cookies

You may manage your cookie preferences at any time via our Cookie Preference Centre, accessible from the cookie banner displayed on your first visit to the Platform. You may also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For further information about cookies, please refer to www.aboutcookies.org.

7. Data Security

7.1 Technical & Organisational Measures

We implement robust technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and the Platform is protected by industry-standard SSL/TLS encryption;
• Access Controls: Personal data is accessible only to authorised personnel on a strict need-to-know basis;
• Data Pseudonymisation: Where appropriate, personal data is pseudonymised to reduce risk in the event of a security incident;
• Regular Security Audits: We conduct regular penetration testing, vulnerability assessments, and security audits;
• Incident Response Plan: We maintain a documented data breach response plan and will notify the Information Commissioner’s Office (ICO) and affected individuals in accordance with our obligations under UK GDPR where a notifiable breach occurs.

7.2 Your Responsibilities

You are responsible for maintaining the security of your Account credentials. Please refer to Section 4.1 of our Terms & Conditions for guidance on Account security best practices.

8. Data Retention

8.1 Retention Periods

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

8.2 Criteria for Determining Retention

In determining the appropriate retention period for any category of data, we consider: the nature and sensitivity of the data; the purpose for which it was collected; whether the purpose can be achieved with anonymised data; and our legal obligations, including those arising under the Proceeds of Crime Act 2002 and other applicable legislation.

8.3 Secure Deletion

Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Your Rights

9.1 Rights Under UK GDPR

Subject to applicable law and certain exemptions, you have the following rights in relation to your personal data:

• Right of Access: The right to obtain a copy of the personal data we hold about you (a “Subject Access Request”);
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Restriction: The right to request that we restrict the processing of your personal data in certain circumstances;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller;
• Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes;
• Rights Related to Automated Decision-Making: The right not to be subject to solely automated decisions that produce significant legal or similarly significant effects on you, and to request human review where applicable.

9.2 How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Data Protection Officer:

• Email: [email protected]

We will respond to all valid requests within one month of receipt. In complex or multiple cases, we may extend this period by a further two months, and we will notify you accordingly. We may need to verify your identity before processing your request.

9.3 Right to Lodge a Complaint

If you are not satisfied with how we have handled your personal data or responded to your request, you have the right to lodge a complaint with the UK supervisory authority:

• Information Commissioner’s Office (ICO)
  Website: ico.org.uk
  Helpline: 0303 123 1113

10. International Data Transfers

10.1 Transfers Outside the UK

In some circumstances, your personal data may be transferred to and processed in countries outside the United Kingdom. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data in accordance with UK GDPR, including:

• Transfers to countries that benefit from an adequacy decision from the UK Secretary of State;
• Use of the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses;
• Other appropriate safeguards recognised under UK data protection law.

You may request a copy of the relevant safeguards by contacting our DPO at [email protected].

11. Minors

11.1 Age Restriction

Our Platform is strictly intended for individuals aged 18 years or over. We do not knowingly collect or process personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data and close the associated Account.

11.2 Reporting Underage Use

If you believe that a minor has registered an Account on our Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action. For further information on our approach to protecting minors, please see our Responsible Gaming Policy.

12. Changes to This Policy

12.1 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When we make material changes, we will notify you via email or a prominent notice on the Platform prior to the changes taking effect. The “Last Updated” date at the top of this Policy will always reflect the most recent revision.

12.2 Review

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Continued use of the Platform following any update to this Policy constitutes acceptance of the revised terms.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or our data protection practices, please contact us:

• Data Protection Officer (DPO): [email protected]
• General Support: [email protected]
• Website: sombrero-spins.org.uk

We are committed to addressing your enquiries promptly and to the highest standard of data protection practice.