Sprut Gaming Privacy Policy

Sprut Gaming (hereinafter referred to as the "Company," "We," or "Our Platform") takes the protection of your personal data very seriously. This privacy policy explains how we collect, process, and store your data when you use our services.

Introduction

At Sprut Gaming, the privacy of our users and partners is a matter we treat with the utmost care. We are dedicated to safeguarding your personal data and upholding your rights at every step. This Privacy Policy sets out what personal data we collect, the purposes and legal grounds for collecting it, how it is used, the circumstances under which it may be shared with third parties, the rights available to you, and the measures we take to keep your data secure. The scope of this Privacy Policy covers all personal data we process in connection with your use of this Website, as well as any personal data that arises from our correspondence with you, the handling of your enquiries or job applications, your engagement with our products and/or services, and any other relationship between us that is not separately governed by its own privacy policy.

General Information

Sprut Gaming ("Sprut Gaming", "we", "us", "our") is the data controller responsible for the personal data described in this Privacy Policy.

Data We Collect

We collect and process personal data in the following categories:

Data You Provide Directly

  • Contact form submissions: full name, business email address, telephone number, company name, and self-reported iGaming experience level;
  • Business correspondence: content of emails, Telegram or WhatsApp messages, and any other communications you initiate;
  • Commercial relationship data: job title, company registration and licensing details, jurisdictional information, and business purpose disclosures provided during onboarding or pre-contractual discussions;
  • Event and conference data: name and contact details provided when meeting Sprut Gaming representatives at industry events.

Data Collected Automatically

  • Technical identifiers: IP location, browser type and version, operating system, device information, and timezone;
  • Usage and behavioural data: pages visited, time spent on pages, click events, and navigation patterns, and other similar activities;
  • Cookie and tracking data: data collected through cookies and similar technologies (see our Cookie Policy for full details).

Purposes and Legal Bases for Data Processing

We collect and process personal data in the following categories:

Purposes and Legal Bases for Data Processing

Purpose: To respond to business enquiries, provide demonstrations, and evaluate a potential commercial relationship with you or your organisation. Legal basis: Performance of a contract or pre-contractual measures at your request; Legitimate interests.

Marketing and Business Development

Purpose: To send information about our products, services, industry insights, webinars, and events. For existing contacts, we may rely on legitimate interests; for new contacts, we rely on consent. Legal basis: Consent or Legitimate interests as applicable.

Website Analytics and Improvement

Purpose: To analyse website traffic, understand user behaviour, measure campaign performance, and improve website functionality and content. Legal basis: Legitimate interests, subject to your cookie consent where required under applicable legislation.

Compliance with Legal Obligations

Purpose: To comply with applicable laws and regulations, including anti-money laundering (AML), counter-terrorism financing (CTF), know-your-customer (KYC / KYB), sanctions screening, and regulatory reporting obligations. Legal basis: Legal obligation.

Protection of Legal Rights and Prevention of Fraud

Purpose: To protect the rights, property, and safety of Sprut Gaming, our clients, and third parties; to prevent, detect, and investigate fraud, security incidents, and unlawful activity; and to establish, exercise, or defend legal claims. Legal basis: Legitimate interests; Legal obligation.

Disclosure of Personal Data

We do not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. We may share personal data in the following circumstances:

Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf, including:

  • Cloud infrastructure and hosting providers;
  • CRM, marketing automation, and email delivery platforms;
  • Analytics providers (including Google Analytics / Google Tag Manager);
  • Identity verification and AML/KYC screening services;
  • Legal, accounting, audit, and professional advisory consultants;
  • IT security and monitoring service providers.

All processors are bound by data processing agreements requiring appropriate security measures and limiting use to specified purposes.

Group Companies

We may share personal data within the Sprut Gaming group of companies where reasonably necessary for the purposes described in this Policy, subject to equivalent data protection safeguards.

Regulatory and Law Enforcement Authorities

We will disclose personal data to competent governmental, regulatory, or law enforcement authorities when required to do so by applicable law, court order, or binding regulatory direction, or where we reasonably believe disclosure is necessary to prevent illegal activity or harm.

Business Restructuring

In the event of a merger, acquisition, business transfer, or insolvency proceeding, personal data may be transferred to a successor entity, subject to appropriate confidentiality obligations and notification to affected individuals where required.

International Transfers of Personal Data

Sprut Gaming operates internationally. Your personal data may be transferred to, and processed in, countries outside your home jurisdiction, including countries that may not provide equivalent levels of data protection under their domestic law. Where we transfer personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on one or more of the following transfer mechanisms:

  • Adequacy decisions of the European Commission or UK Secretary of State
  • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office (ICO)
  • Binding Corporate Rules (BCRs) where applicable
  • Other lawful transfer mechanisms recognised under applicable law

Retention of Personal Data

We retain personal data for no longer than is necessary for the purposes for which it was collected, and as required by applicable legal, regulatory, and contractual obligations. Our principal retention periods are as follows:

  • Enquiries not resulting in a business relationship: up to 24 months from the date of last contact;
  • Active client and business partner data: for the duration of the commercial relationship and for 5 years following its termination (or longer where required by applicable law);
  • AML/CTF and KYC records: 5-7 years from the end of the business relationship, as required by applicable AML legislation;
  • Website analytics data: up to 26 months (as configured in analytics tools);
  • Marketing preference and opt-out records: retained indefinitely to honour your preferences;
  • Financial and accounting records: as required by applicable tax and corporate law.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data retention and disposal procedures.

Your Rights as a Data Subject

Depending on your jurisdiction, you may have the following rights in relation to your personal data. We will respond to all verified requests within 30 days of receipt (extendable to 90 days in complex cases, with notice):

Summary of Rights

  • Right of Access: to obtain confirmation of whether we process your personal data and, if so, a copy of that data and related information;
  • Right to Rectification: to request correction of inaccurate or completion of incomplete personal data;
  • Right to Erasure ("Right to be Forgotten"): to request deletion of your personal data in certain circumstances;
  • Right to Restriction: to request that we limit processing of your personal data in certain circumstances;
  • Right to Data Portability: to receive your personal data in a structured, commonly used, machine-readable format;
  • Right to Object: to object to processing on the basis of legitimate interests or for direct marketing purposes;
  • Right to Withdraw Consent: to withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of prior processing;
  • Rights in Relation to Automated Decision-Making: to not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to: [email protected] We may require you to provide proof of identity before processing your request. We will not charge a fee for reasonable requests. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or to decline, with reasons.

Right to Complain to a Supervisory Authority

If you are dissatisfied with how we handle your personal data or your exercise of rights, you have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence or establishment.

Security of Personal Data

Sprut Gaming implements and maintains a comprehensive programme of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful processing. These measures include, but are not limited to:

  • TLS/SSL encryption for all data transmitted via the website;
  • Encryption of sensitive data at rest;
  • Role-based access controls and the principle of least privilege;
  • Regular security assessments, vulnerability testing, and penetration testing;
  • Mandatory data protection training for all personnel with access to personal data;
  • Incident response and personal data breach notification procedures in compliance with applicable regulatory requirements;
  • Data processing agreements with all third-party service providers.

Notwithstanding the above, no method of electronic transmission or storage is entirely secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

Children's Privacy

The Sprut Gaming website and provided services are intended exclusively for business professionals who are at least 18 years of age. We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take prompt steps to delete such data.

Third-Party Websites

This website may contain links to websites and online services operated by third parties. This Privacy Policy does not apply to those third-party websites. We are not responsible for the privacy practices or content of any third-party site and encourage you to review the privacy policies of any external websites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or for other legitimate operational reasons. We encourage you to review this Policy periodically. Your continued use of our website or engagement with our services following any update constitutes your acknowledgement of the revised Policy.

Contact

For all privacy-related enquiries, please contact: [email protected]