Who is responsible for your data
1.1 The controller of the personal data collected through irishracingraceclubs.com is Kiron Interactive (pty) Limited, 1st Floor South Entrance, 26 Baker Street, Rosebank, Johannesburg, 2196, South Africa ("we", "us"). Licensed and regulated in Great Britain by the Gambling Commission, account number 11572.
1.2 We have appointed a Privacy Officer who handles questions and requests about personal data. Contact the Privacy Officer by email at privacy@irishracingraceclubs.com. General account questions go to support at support@irishracingraceclubs.com.
1.3 This policy applies to the website, to your account and to the emails we exchange with you. It should be read with the Terms and Conditions and the Cookie Policy.
What data we collect
2.1 Registration data. First name, last name, date of birth, email address, password (stored as a one-way hash, never in plain text), address, city and postcode, the date and time you accepted the Terms and this policy, and whether you gave marketing consent.
2.2 Contact data. Messages you send us through the contact form, the support section of your account or by email, our replies, and the complaint records described on the Complaints page.
2.3 Verification data. Copies of the identity document you upload (passport, driving licence or national identity card), any proof of address we ask for, the result of each check, your verification status (Verification Required, Pending, Verified) and, where an external identity-verification provider is used, the response it returns to us.
2.4 Payment data. The payment methods you register, the deposits and withdrawals you make, their amounts, dates and status. For debit cards we hold only enough to identify the card in your account (the card type and its last digits); we do not store full card numbers or security codes — these are handled by the payment provider. For bank transfers we hold the account name and the reference used. For e-wallets we hold the wallet identifier.
2.5 Betting activity. Every bet you place: the race, the selection, the market, the price or pool, the stake, the time of placement, the result and the settlement. Also your account balance, transaction history and the responsible-gambling settings you choose (deposit limits, time-outs, self-exclusion).
2.6 Technical data. IP address, approximate location derived from it, device type, operating system, browser, the pages you visit, the time of each login and logout, and the cookies described in the Cookie Policy.
Why we use it and the lawful basis
3.1 Under UK GDPR we need a lawful basis for each use of your data. The table below shows what we do and why.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Opening and running your account, accepting and settling bets, processing deposits and withdrawals, answering support requests | Registration, payment, betting, contact | Performance of our contract with you (the Terms and Conditions) |
| Verifying your age and identity, checking your address, keeping records the Gambling Commission requires, preventing money laundering, checking self-exclusion registers, reporting to authorities where required | Registration, verification, payment, betting, technical | Legal obligation — the Gambling Act 2005, our licence conditions, anti-money-laundering rules |
| Keeping your account secure, detecting fraud and misuse (multiple accounts, third-party funds, automated tools), monitoring for signs of gambling harm and applying responsible-gambling tools, defending legal claims | Registration, betting, payment, technical | Legitimate interests — ours in running a safe and lawful service, and yours in a secure account; we have checked that these do not override your rights |
| Sending you marketing emails about racing, markets and site features | Name, email, betting preferences | Consent — only if you ticked the marketing box, and until you withdraw it |
| Setting optional cookies (functional, analytics, marketing) | Technical | Consent — given in the cookie banner or preferences |
| Improving the site, fixing faults, understanding which pages are used | Technical, in aggregated form where possible | Legitimate interests — maintaining a working site |
3.2 Where we rely on a legal obligation, you cannot ask us to stop the processing while the obligation lasts. For example, we cannot delete verification records before the retention period the licence requires, even if you close your account.
3.3 We do not use your data to make automated decisions that have a legal or similarly significant effect on you without a person reviewing the decision. Automated checks (for example an identity match or a self-exclusion match) flag an account for review by staff; the decision to suspend, close or restrict an account is taken by a person.
Who we share it with
4.1 We share your data only where we need to in order to run the service or where the law requires it:
- Payment providers — card acquirers, banks and e-wallet operators, so that deposits can be taken and withdrawals paid. They receive the data needed to process the payment and act under their own privacy policies for that processing.
- Identity and age-verification providers — to confirm that the details you gave match the records the provider holds and that you are 18 or over. These checks are identity checks, not credit checks.
- The Gambling Commission — as our regulator, it can require information about accounts, bets and transactions, and we report matters our licence obliges us to report.
- GAMSTOP — we check your registration details against the national self-exclusion scheme at registration and while the account is open, so that a self-exclusion is honoured.
- Law enforcement and other authorities — the police, HMRC, the National Crime Agency, courts and sports governing bodies where we are required by law or a court order, or where we reasonably need to in order to prevent or detect crime, including money laundering and betting corruption.
- IT and hosting providers — the companies that host the site, store its data and deliver our emails. They act on our written instructions under a data-processing contract and may not use the data for their own purposes.
4.2 We do not sell personal data, and we do not share it with other gambling operators or with advertisers for their own marketing.
4.3 Verification documents are seen only by the verification team and, where used, the identity-verification provider. They are not visible to general support staff.
International transfers
5.1 The operator is based in South Africa. Your data is processed in the United Kingdom, where the site is offered, and may also be accessed and processed in South Africa by our staff for account administration, verification, payments and compliance.
5.2 A transfer of personal data outside the United Kingdom is made only under the UK GDPR transfer rules. Where the destination country has not been found by the UK to provide adequate protection, we put appropriate safeguards in place — the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask the Privacy Officer for a copy of the safeguards that apply to your data.
5.3 Some of our providers (for example payment or hosting companies) may process data in other countries. The same rules apply: a transfer takes place only with an adequacy decision or with the safeguards described above.
How long we keep it
6.1 We keep personal data for as long as we need it for the purpose it was collected for, and then for as long as the law and our licence require.
- Account records — registration details, betting activity, deposits, withdrawals and support messages — are kept for at least 5 years after the account is closed, as our licence and anti-money-laundering rules require. Where a dispute, investigation or legal claim is open, they are kept until it is concluded.
- Verification documents and the results of identity checks are kept for the same period: at least 5 years after closure of the account.
- Marketing preferences are kept until you withdraw consent. After you withdraw, we keep a record of the withdrawal so that we do not contact you again.
- Self-exclusion records are kept for the length of the exclusion and for a further period after it ends, so that the exclusion can be honoured and so that you are not marketed to during that time.
- Technical logs — IP addresses and login records — are kept for as long as we need them for security, and are then deleted or aggregated.
- Cookies last for the periods stated in the Cookie Policy.
6.2 When a retention period ends, the data is deleted or anonymised so that it can no longer be linked to you.
How we protect it
7.1 Data is transmitted between your browser and the site over an encrypted connection (HTTPS). Passwords are stored as one-way hashes. Card details are handled by the payment provider and are never stored in full on our systems.
7.2 Access to account data is restricted to staff who need it for their role, and access to verification documents is restricted further, to the verification team. Access is logged.
7.3 Use a strong password that you do not use elsewhere, log out on shared devices, and tell us at once if you think someone else has used your account. You can change your password in the Security section of your account.
7.4 If a personal data breach occurs that is likely to put your rights at risk, we tell you and the Information Commissioner's Office as the law requires.
Your rights
8.1 Under UK GDPR you have the right to:
- Access — receive a copy of the personal data we hold about you and information about how we use it.
- Rectification — have inaccurate data corrected and incomplete data completed. You can change most account details yourself in your account.
- Erasure — have your data deleted where we no longer need it and no legal obligation requires us to keep it. Because of the retention rules above, records of a gambling account cannot be erased before the licence retention period ends, but we tell you which data can be removed and remove it.
- Restriction — ask us to stop using your data, but keep it, while a dispute about its accuracy or our use of it is resolved.
- Portability — receive the data you gave us, and that we process by automated means under contract or consent, in a machine-readable format, and have it sent to another controller where technically feasible.
- Objection — object to processing based on our legitimate interests. We stop unless we can show compelling grounds that override your interests. You can always object to direct marketing, and we stop at once.
- Withdraw consent — at any time, for marketing and for optional cookies. Withdrawal does not affect processing that took place before it.
- Complain to the ICO — the Information Commissioner's Office is the UK supervisory authority for data protection: ico.org.uk. We would prefer the chance to resolve a concern first, but you can go to the ICO at any time.
8.2 How to exercise a right. Email the Privacy Officer at privacy@irishracingraceclubs.com from the email address registered on your account, and say which right you are exercising. We may ask you to confirm your identity before we act, so that data is not released to the wrong person. We respond within one month; if a request is complex we may extend this by up to two further months and will tell you why. There is no charge, unless a request is clearly unfounded or excessive.
Marketing
9.1 We send marketing emails only if you gave consent — by ticking the optional marketing box at registration or by switching marketing on in your account afterwards. Marketing is not a condition of having an account.
9.2 You can withdraw consent at any time: in the Profile section of your account, through the unsubscribe link in every marketing email, or by emailing the Privacy Officer. We stop within a short time of the request; you may receive an email that was already queued.
9.3 Marketing stops automatically when you set a self-exclusion, when you exclude through GAMSTOP, and when you close your account. Messages about your account itself — verification requests, withdrawal decisions, changes to the Terms — are not marketing and are sent for as long as you hold an account.
Cookies
10.1 The site uses a small number of cookies and similar storage. Necessary cookies keep you logged in and record your age-gate and cookie choices; optional cookies are set only after you accept them. The full list, with the purpose and duration of each cookie and how to change your choice, is in the Cookie Policy.
Children
11.1 This site is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. Age is checked at registration and again during identity verification. If we find that an account belongs to someone under 18, the account is closed as the Terms and Conditions describe, and the personal data is deleted except where we must keep a record of the closure for the regulator.
11.2 If you believe a person under 18 has registered with us, tell the Privacy Officer or support so that we can act.
Changes to this policy
12.1 We update this policy when the data we collect, the providers we use or the law changes. The date at the top of the page shows the version in force. Where a change significantly affects how we use your data, we tell you by email or by a notice when you log in before it takes effect.
12.2 Questions about this policy or about your data: privacy@irishracingraceclubs.com. Postal address: Kiron Interactive (pty) Limited, 1st Floor South Entrance, 26 Baker Street, Rosebank, Johannesburg, 2196, South Africa.