We collect the following categories of personal data:

• Identity data — name, date of birth, address, and (where required for verification) copies of identity documents.

• Contact data — email address and phone number.

• Account and transaction data — your username, password (stored hashed, never in plain text), account balance, lottery and pool entries, picks, results, prize payments, deposits and withdrawals.

• Payment data — the payment method you use (e.g. PayPal account reference or bank account details for withdrawals) and transaction records. We do not store full card numbers ourselves; card payments are handled directly by our payment service provider.

• Safer gambling data — deposit limits, self-exclusion requests, timeout requests, and the outcome of self-exclusion register checks.

• Technical data — IP address, device identifiers, and session data needed to keep you signed in and to detect fraud and duplicate accounts.

• Communications data — records of correspondence with our support team, and marketing preferences.

We use your personal data, and rely on the following lawful bases under UK GDPR, for:

• Setting up and running your account, taking lottery/pool entries and settling prizes — performance of our contract with you (the Customer Terms).

• Identity and age verification, self-exclusion register checks, fraud and duplicate-account prevention, and responding to regulator requests — compliance with our legal obligations as a Gambling Commission licensee (including the Licence Conditions and Codes of Practice) and under money-laundering regulations.

• Safer gambling monitoring, and processing self-exclusion or deposit-limit requests — legal obligation and, where the check goes beyond what the law strictly requires, our legitimate interest in protecting customers and the integrity of our products.

• Direct marketing — your consent, which you can withdraw at any time (see "Your Rights" below). We never send direct gambling marketing to a self-excluded customer.

• Website and app security, and preventing abuse of our services — our legitimate interest in keeping our systems and customers safe.

Before you can deposit or gamble, we verify your identity and age using an accredited third-party verification provider (IDComply, powered by GeoComply), which checks your details against independent data sources. This is a legal requirement for every UK gambling operator.

Most checks are completed automatically within seconds. If an automated check cannot confirm your identity, it is reviewed by a trained member of our compliance team before any decision is made — you will never be permanently blocked from your account by an automated decision alone. You can contact support@strike6.co.uk at any time to ask a person to review a verification outcome.

We use third-party payment service providers to process deposits and withdrawals (currently PayPal and bank transfer). When you pay by card through a payment provider, your card details are handled directly by that provider under its own privacy notice — we only receive confirmation that payment succeeded and a reference number.

We keep transaction records for as long as required by gambling and financial-crime regulations, and to investigate any dispute or complaint.

We check every new account, and every login, against GAMSTOP's national self-exclusion register. If you are registered with GAMSTOP, we will not allow you to deposit or gamble, in line with our licence conditions.

If you set a deposit limit, request a self-exclusion, or tell us you are struggling with your gambling, we record this so we can apply the correct controls to your account and, where legally required, suppress gambling marketing to you. We do not share safer-gambling data for marketing purposes.

We share personal data with:

• Identity-verification and self-exclusion providers (IDComply/GeoComply, GAMSTOP) to meet our licensing obligations.

• Payment service providers (currently PayPal, and our bank) to process deposits, withdrawals and prize payments.

• The Gambling Commission and other regulators or law-enforcement bodies, where we are legally required to report information.

• IT and hosting providers, and our error-monitoring provider (Sentry), who process data on our behalf under contract, only to the extent needed to run and secure our services.

• Professional advisers (auditors, lawyers) where necessary for our legal or regulatory obligations.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

Some of our service providers may process data outside the UK (for example, cloud infrastructure and error-monitoring services with servers in the EU). Where this happens, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or transfers to a country the UK Government has confirmed provides adequate protection.

We keep account, transaction and verification records for as long as your account is open, and for a period afterwards as required by the Gambling Commission's Licence Conditions and Codes of Practice and money-laundering regulations (currently a minimum of five years from the date of the relevant transaction or the closure of your account). Marketing preferences are kept until you withdraw consent. We delete or anonymise personal data once it is no longer needed for these purposes.

Automated decision-making. Identity-verification checks are run automatically in the first instance, but any outcome that would restrict your account is reviewed by a person before it takes effect — see "Identity and Age Verification" above. You can always ask us to explain or review a decision.

Your rights. Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to erase data we no longer have a lawful basis to keep; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent to marketing at any time. Some rights (for example erasure) do not apply while we have an overriding legal obligation to keep a record, such as our anti-money-laundering duties.

To exercise any of these rights, email privacy@strike6.co.uk. If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice. If we make a material change to this notice, we will ask you to accept the updated version the next time you use your account — continued use alone is not treated as acceptance of a revised notice.