Privacy Policy for Users

PURPOSE OF THIS PRIVACY NOTICE

This Privacy Notice describes how we gather and process your personal data when you use any of our online services.

The controller of your personal data when using the 888 brand is Virtual Digital Services Ltd (VDSL), which is licensed by the Maltese Gaming Authority.

VDSL forms part of the Evoke plc group.

In this Privacy Notice, VDSL and our brands 888, 888 Casino, 888 Poker and 888 Sport are collectively referred to as “we”, “us” or “our”.

This Privacy Notice is connected to our General Terms. You should read and understand both documents. We revise this Privacy Notice whenever our processes are updated.

Categories of personal data

We collect the following information when you create an account with us:

Username & Account Number.
Name.
Title.
Gender.
Date of birth (DOB).
Telephone numbers.
Home address.
Geolocation.
Answers to security questions.
Your marketing preferences.
E-mail address.

You must provide this information in order to open and keep an account with us.

We collect this information when you use our products:

Betting and gaming activities.
Interactions with customer services.
Where chatrooms are available, we process the information you choose to share in these areas.
Telephone calls.
Audit logs related to your account.
Payment methods.
Responses to market research.

We collect some or all of this information to meet our legal obligations where required, or for fraud prevention or other legitimate interests:

Information needed to carry out Know Your Customer (“KYC”) checks.
Information relating to your source of funds.
Information connected to safer gambling including but not limited to behaviour, self-exclusion, operator exclusion, deposit limits and product blocks.
Information about your deposits and withdrawals.
Information required to comply with our safer gambling and Anti-Money Laundering (“AML”) obligations.
Source of funds documentation.
Financial information.
Information received from Credit Reference Agencies that does not impact your credit score.
Social media information.
Device and other technical data such as IP address communicated over the internet to our services.
Information obtained from publicly available sources.
Information received from other brands within our group.
Information obtained from third parties such as affordability solution providers and ID verification services, betting integrity and mediation organisations, or from friends and family where they contact us.

You are responsible for notifying us when your details change so that our records remain accurate and up to date. Some of the listed information is obtained via third-party organisations that provide services to the business. To learn the source of any data we process, please contact us using the details provided below.

Processing your personal data:

In general, we process your personal data to deliver our products to you, carry out marketing activities and meet our legal and regulatory requirements. Further details on how we use your personal data are set out in the table below.

Purpose	Legal Basis
To create and operate your account with us, including adding funds, placing bets and playing games.	Necessary for the performance of a contract.
Providing access to our betting and gaming products and services.	Necessary for the performance of a contract.
Monitoring deposit, spending or loss limits and any other limits we may offer.	Necessary to comply with a legal obligation.
Delivering customer support services.	Necessary for the performance of a contract.
Linking multiple accounts for Anti-Money Laundering and Responsible Gambling purposes.	Necessary to comply with a legal obligation.
Checking the accuracy of the information you have provided.	Necessary to comply with a legal obligation.
Carrying out Anti-Money Laundering (AML) checks.	Necessary to comply with a legal obligation.
Conducting identity verification and Know Your Customer (“KYC”) checks.	Necessary to comply with a legal obligation.
Performing fraud prevention and detection checks.	Legitimate interest of protecting the business from fraudulent activity.
Monitoring behavioural indicators that may suggest a risk of gambling related harm and taking appropriate steps to prevent harm.	Necessary to comply with a legal obligation.
Carrying out financial risk checks, including affordability assessments.	Necessary to comply with a legal obligation.
Monitoring activity to identify and prevent financial crime and fraud.	Necessary to comply with a legal obligation.
Sharing information with authorities such as law enforcement agencies or regulators.	Necessary to comply with a legal obligation.
Monitoring betting and gaming behaviour to identify potential safer gambling concerns.	Necessary to comply with a legal obligation.
Compiling and analysing reports on how our products and services are used.	Legitimate interest of ensuring our products and services are delivered to a high standard.
Contacting you for research purposes to better understand our services and how they are perceived by our customers.	Legitimate interest of understanding our customers and collecting their feedback.
Using aggregated gambling activity statistics to manage business risk.	Legitimate interest for operating our betting and gaming business.
Communicating with you about the services we provide, including updates to our Services, changes to our Terms and Conditions, and amendments to this Privacy Notice.	Necessary for the performance of a contract; or, Legitimate interests in communicating important service information; or, Necessary to comply with a legal obligation. The applicable legal basis depends on the nature of the communication.
Using your data to offer a personalised experience of our Services, helping us deliver improved services to you and other players.	Legitimate interest of providing relevant content to customers.
Analysing your data to build a profile that helps us understand your preferences and identify which products and offers may be most suitable for you and similar customers.	Legitimate interests of understanding our customers and promoting relevant materials.
When you download our mobile application, you may choose to receive notifications.	Consent. Preferences can be managed through your device settings.
Preventing or detecting criminal offences.	Necessary to comply with a legal obligation.
Sending you marketing communications about promotions, products or services that may be relevant to you.	Consent You can change your marketing preferences or opt out at any time. Our communications also include unsubscribe options that you can use to stop receiving future marketing messages. Opting out may take up to 28 days to take effect. Opting out on one brand does not affect your preferences for other brands within our Group.
Using your data to run paid advertising campaigns on social media. Social media platforms allow organisations to share hashed customer data to match it with information they hold, enabling targeted advertising. We make use of this service. You can manage your social media data sharing preferences in your account settings or by contacting customer services. Please review the privacy notices of the social media platforms you use for further details on their advertising services.	Legitimate interest of promoting our brands on social media platforms.
Collecting and analysing data through cookies and similar technologies. Please refer to our cookie policy.	Consent You can withdraw your consent via your device and browser settings.
Processing outcomes of safer gambling measures such as self-exclusion, deposit limits and time-outs, and sharing this information with companies within our group.	Necessary to comply with a legal obligation.
Bonus reward scheme.	Necessary for the performance of a contract.
Recording, storing and reviewing telephone conversations.	Legitimate interests related to customer support, training and security.
Displaying masked usernames on game leader boards.	Legitimate interest of operating gaming leader boards.
Processing health data provided in connection with responsible gambling interactions.	Necessary to comply with a legal obligation.
Using customer data to test new product features and toolsets.	Legitimate interest of testing new products and toolsets.
Using personal data for the testing and development of new processes and systems.	Legitimate interest of ensuring effective system and process performance.
Managing access to our products.	Legitimate interest to ensure valid business traffic reaches our site.

When you provide information about any health-related matter concerning yourself or a third party, we will process this data with your consent, where it is necessary to protect vital interests of you or the third party, or where processing is required for reasons of substantial public interest.

Where we process your personal data on the basis of “legitimate interest”, you may request additional information about our use of this legal basis, including details of the balancing test, by contacting us using the details provided in this Privacy Notice.

We may disclose anonymised information, such as aggregated statistics, about users of our Services to describe our sales, customer base, traffic trends and other data to potential partners, advertisers, investors and other reputable third parties, as well as for other lawful purposes. This information does not include your personal data.

Transferring your personal data abroad:

As part of providing our services, we transfer personal data to organisations located both within and outside the European Economic Area (EEA), in line with the purposes outlined above.

Where personal data is transferred outside the EEA to a country that does not benefit from an adequacy decision, we use standard contractual clauses or other approved safeguards to ensure your data is protected to the standard required within the EEA. Details of these safeguards can be provided on request.

Safeguarding your data:

Technical security measures: we implement security controls designed to protect personal data.
Data Protection Impact Assessments (DPIAs): we carry out DPIAs where required to identify and reduce privacy risks linked to our data processing activities described above. This supports the protection and security of your personal data in accordance with data protection laws.
Industry guidelines: where applicable, we follow relevant industry-specific guidelines to maintain appropriate data protection standards. These codes of conduct may provide additional safeguards for your data.
Data Protection by Design and Default: we apply Data Protection by Design and Default principles across our data processing activities. This means data protection is considered throughout the full lifecycle of data handling, from account creation through to account closure and beyond, ensuring ongoing protection of your data.
Legitimate Interest Assessments: where we process personal data on the legal basis of legitimate interest, we balance our interests against yours. Further information about our balancing assessments is available by contacting us using the details provided in this notice.

Your rights:

Right to information:	You have the right to be informed about how we use your personal data. Details of the personal data we process about you are set out in this notice.
The right of access:	You have the right to request a copy of the personal information we hold about you.
The right to rectification:	You have the right to request correction of personal information you believe to be inaccurate or incomplete.
The right to erasure:	You have the right to request deletion of your personal information in certain circumstances.
The right to restriction of processing:	You have the right to request a restriction on the processing of your personal information in specific circumstances.
The right to object to processing:	You have the right to object to our processing of your personal information in certain situations.
The right to data portability:	You have the right to request that the personal information you provided to us is transferred to another organisation, or to you, in certain circumstances.
The right to remove your consent:	Where processing of your personal data is based on your consent, you have the right to withdraw that consent at any time, for example where you have agreed to receive marketing communications.
The right to lodge a complaint with the supervisory authority:	You have the right to submit a complaint to the relevant supervisory authority.
The right not to be subject to solely automated decision making and profiling that produces legal or similarly significant effects:	You have the right not to be subject solely to automated decision making and profiling that results in legal or similarly significant effects, as well as the right to receive an explanation of the logic involved in such decisions. You may request that a person reviews any solely automated decisions that produce legal or similar effects by contacting customer services.

Data subject rights are generally respected, however they are not absolute and may be subject to restrictions or exceptions in certain situations. For example, data protection laws may include exemptions that limit the full application of the rights listed above.

Use of Artificial Intelligence

We may use artificial intelligence (AI) technologies to improve our services and to support a safe, fair and responsible gaming environment, for example in fraud prevention and customer support. Some AI solutions are developed internally, while others are supplied by third parties. AI systems may involve the processing of personal data, although this is not always the case. Your rights as a data subject, as described in this Privacy Notice, apply equally to any personal data processed within AI systems.

Retaining your personal data:

We retain your personal data only for as long as is necessary to achieve the purposes for which it was collected, including meeting any legal, accounting or reporting obligations applicable to our business. The standard retention period for customer data is outlined below, however we reserve the right to keep data for longer than the stated period where required for business purposes or to comply with legal and regulatory requirements.

The retention period begins from the date of account closure or from a prolonged period of account inactivity, such as the last log-in date.

Location of customer	Retention period (years)
Malta	10
Rest of world	10

In certain situations, legal, regulatory or business requirements may require us to retain your personal data for extended periods. These situations may include, but are not limited to:

Where the account is subject to self-exclusion or other safer gambling measures
Where the account is under review by AML or fraud teams
Where the account is restricted due to betting or gaming limitations applied by our trading team
Where the account is subject to a Refusal of Service status

Contacting us:

You may contact our Data Protection Officer regarding any requests by e-mail at [email protected].
If you wish to exercise any of your rights, you do not need to contact the Data Protection Officer directly. You can submit your request through our customer service team, who can also assist you.