Privacy Policy for BetXS

Thank you for choosing BetXS. Your privacy and the security of your personal data are very important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website. Please read this policy carefully to understand our practices regarding your personal data and how we will treat it.

Changes on 29 October 2026

• We have added a summary of our personal data breach response plan and how we notify the relevant authority and affected people when required.

Changes on 22 October 2026

• Who we are now names the company responsible for your data and our data protection officer.
• Identity verification now asks for, and records, your consent before the selfie. You can verify with documents instead, which a person checks. Sumsub keeps your verification data for the period we keep it, and we tell Sumsub to delete it when that ends. It also explains the checks against sanctions and politically exposed person lists made during verification, and where that information comes from.
• How long we keep your data now says how long we keep the record of a request you make about your data.
• Who we share your data with now names Sumsub Tech Ltd (Cyprus), and Bugsink B.V. (Netherlands) for error monitoring, which replaced a provider in the United States. It also names the providers your browser loads fonts and code from.
• We no longer ask why you are self-excluding, and the reasons given before October 2026 have been deleted (Health information).
• Our Cookie Policy now lists the browser storage used for live odds and our error monitoring.

General Information

At BetXS, we are dedicated to protecting your privacy and safeguarding your personal data. Our commitment extends to explaining in clear terms how we process your data, ensuring accountability and compliance with the General Data Protection Regulation (GDPR).

This Privacy Policy serves as a foundation for understanding how any personal data we collect from you, or that you provide to us, is processed by us. It outlines our practices for managing your data and informs you of your rights regarding your personal information.

Who We Are — the Data Controller

The data controller for the personal data described in this policy is Abbeycoole Limited, trading as BetXS, company number 567745, registered office Co. Meath, A85 WY97. You can contact us about anything in this policy, or to exercise any of your rights, by email at dpo@betxs.ie, by phone on 0877725423 or through your account. Our data protection officer can be reached at dpo@betxs.ie.

Our betting platform is operated and maintained on our behalf by Dove Shield Tech Limited , which acts as a data processor under our instructions — see “Who We May Share Your Personal Information With?” below.

We also encourage you to review our Cookie Policy, which provides detailed information about the cookies we use on our website. Understanding these details will help you manage your privacy preferences effectively.

Furthermore, our Terms of Use outline the legal terms under which we deliver our services to you. We recommend reviewing this document to understand fully the terms and conditions of accessing and using our services.

Information Collection

We collect various types of information from and about users of our website, including:

• Personal data, such as name, email address, and contact details, that you provide by filling in forms on our website, and identity, biometric, and address data provided through our identity-verification provider (see “Identity Verification with Sumsub” below).
• Transactional details about your bets, deposits, and withdrawals.
• Technical data, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser types, and versions, operating system, and platform.
• Information about your use of our safer gambling features: the time you spend on the site while logged in (when each visit starts and ends), the reminders, statements and check-ins we show or send you and when you acknowledge them, any spending limit you set, your answers to our safer gambling questionnaire, and when your Safe Gambling page is opened, by you or by our staff, and from which IP address.

Use of Your Information — Purposes and Legal Bases

The information we collect from you is used for the following purposes, each with the legal basis we rely on under the GDPR:

• To provide you with our betting services — operating your account, accepting and settling bets, and processing deposits and withdrawals. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• To verify your identity, age, and residence, and to protect our operations from fraud, money laundering, and other illegal activities — including anti-money laundering checks and safer-gambling controls. Legal basis: compliance with our legal obligations (Art. 6(1)(c)), and our legitimate interest in preventing fraud (Art. 6(1)(f)).
• To help you keep your gambling under control, and to meet our safer gambling obligations — recording your time on the site; showing you reminders of your winnings, losses and time on site while you are on the site and every 7 days; sending you a statement every 30 days, in your account and by email, whatever your email preferences; checking in with you as your total stakes grow, including a short questionnaire about how you gamble; and applying any spending limit you set. Legal basis: compliance with our legal obligations under the Gambling Regulation Act 2024 (Art. 6(1)(c)) — section 164 for spending limits, and section 173 for the reminders, statements and time on site once the Gambling Regulatory Authority of Ireland makes its regulations under that section. Until then, our legitimate interest in protecting our customers from gambling harm (Art. 6(1)(f)). The check-ins and questionnaire are our own safer gambling policy, on that legitimate interest. The questionnaire asks about how you gamble, not about your health.
• To notify you about changes to our service, and to send bet placement and settlement messages you have opted into. Legal basis: performance of our contract with you (Art. 6(1)(b)).
• To improve our website's usability, security, and services — including server-side error monitoring. Legal basis: our legitimate interests in maintaining and improving a secure, working service (Art. 6(1)(f)).

Where we rely on legitimate interests, those interests are the prevention of fraud and abuse, protecting our customers from gambling harm, the security of our platform, and the maintenance and improvement of our service. You have the right to object — see “Your Rights as a Data Subject” below.

Health Information

Health information is a special category under the GDPR, and the principle of data minimisation (Art. 5(1)(c)) requires us to collect no more than we need. We do not ask you about your health. The safer gambling questionnaire asks only about how you gamble (below), and self-exclusion does not ask why you are excluding. Reasons given when self-excluding before October 2026 have been deleted.

The Safer Gambling Questionnaire

We ask you a short questionnaire once a quarter, and when your total stakes reach set levels, as part of how we check in with customers whose gambling is growing. It asks only about how you gamble — how much and how often, whether you chase losses or borrow to gamble, and whether you would like help — and not about your health, mood or wellbeing. The Data Protection Commission lists the monitoring of behaviour, and decisions that affect access to a service, among the kinds of processing that need a data protection impact assessment; our assessment of the questionnaire is why it asks about behaviour rather than health.

Your answers are added up into a score that our safer gambling team sees, so they can decide whether to get in touch. Your answers never block your account by themselves. We rely on our legitimate interest in protecting our customers from gambling harm (Art. 6(1)(f)). We keep your answers for one quarter, or until our team finishes reviewing them if that is later, and then delete them.

When You Must Provide Data

Some personal data is a statutory requirement: we are legally obliged to verify your identity, age, and residential address before providing gambling services, and to hold records of your transactions. If you do not provide this data — or do not complete identity verification — we cannot open or continue to operate your account. Other data, such as optional contact preferences, is up to you.

Who We May Share Your Personal Information With?

Protecting your privacy is paramount to us. We do not sell, rent, or lend individual information to any third parties for marketing purposes. However, there are certain circumstances under which we may need to share your personal information:

• Requests by Government Agencies: We may disclose any information in our possession to law enforcement, regulatory bodies, or other governmental authorities if required for legal proceedings or if we, in our sole discretion, believe it necessary to investigate or address illegal activities or to prevent legal liability.
• Lawful Disclosures: In compliance with legal obligations, we may disclose your information if legally required to do so under any law, regulation, or by a court order. This includes sharing information for the purposes of fraud protection and credit risk reduction.
• Service Providers (Data Processors): Companies that process personal data on our behalf, under written contracts and only on our instructions, to deliver parts of our service:
  • Dove Shield Tech Limited — operates and maintains the betting platform on our behalf.
  • Sumsub Tech Ltd (Sumsub) — identity verification (see “Identity Verification with Sumsub” below). Cyprus, European Union.
  • Hetzner Online GmbH — hosting of the betting platform. European Union.
  • Amazon Web Services — secure file storage and backups.
  • Brevo — delivery of the emails we send you (account and bet notifications, and your activity statements). European Union.
  • Twilio — delivery of SMS messages and phone calls. United States.
  • Slack Technologies — internal alerts to our staff about accounts, bets and safer gambling. Safer gambling alerts identify you only by an account code, never by your name or email address. United States.
  • Bugsink B.V. — error monitoring, on our servers and in your browser, that helps us find and fix faults; error reports may include technical data, such as your browser and device, the page in use and identifiers within our system, but not your name, email address or IP address. Netherlands, European Union.
• Font and Code Delivery Networks: To display our pages, your browser loads fonts from Google Fonts (Google, United States) and code libraries from jsDelivr and code.jquery.com. Your browser contacts these providers directly, so they receive your IP address and browser details under their own terms. We give them no account information.

We are committed to ensuring that your information is secure and only shared in accordance with our policies and in compliance with applicable privacy laws.

International Transfers

Some of the providers above are based outside the European Economic Area. Where personal data is transferred internationally, we do so only where the destination is covered by a European Commission adequacy decision or subject to appropriate safeguards required by the GDPR, such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses for providers in the United States (Twilio, Slack). You can contact us for more information about the safeguard applying to a particular transfer. Google Fonts and the code delivery networks may serve your browser from outside the European Economic Area.

How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes above and to meet our legal obligations. The main retention periods are:

• Identity and AML verification records: at least 5 years from the end of our business relationship, as required by anti-money laundering law. This includes any documents you upload to verify without a selfie.
• Betting, transaction, and financial records: at least 6 years after the relevant financial year, for accounting and tax purposes.
• Self-exclusion records: for the duration of any exclusion; for permanent self-exclusion, limited identifiers only, kept as long as needed to prevent re-registration.
• Safer gambling records: your time on the site, the reminders, statements and check-ins we show or send you, your spending limits, and the record of when your Safe Gambling page was opened — for the life of your account and 6 years after it closes.
• Safer gambling questionnaire answers: one quarter after you give them, or until our safer gambling team finishes reviewing them if that is later, then deleted. The record that you completed the questionnaire is kept with your safer gambling records.
• Your data protection requests: the record of each request and how we answered it, for 6 years after we answer it. A copy of your data that we prepare for you is deleted 30 days after it is ready.
• Disputes, fraud, and regulatory matters: until the matter is resolved and any statutory period has expired.

When these periods end, we delete or irreversibly anonymise the data. The Data Retention section of our Terms of Use describes what happens after your account closes.

Identity Verification with Sumsub

We are required by law — including anti-money laundering (AML) legislation, age-verification requirements, and the residency conditions of our licence — to verify the identity of our customers before they can make full use of our services. To carry out these checks we use a specialist identity-verification provider, Sumsub (Sumsub Tech Ltd, a company registered in Cyprus). When handling your verification data, Sumsub acts as a data processor on our behalf and under our instructions.

This section explains what happens to your data when you complete identity verification. Please read it before starting the verification process.

What Information You Provide Through Sumsub

During verification, the following information is collected directly by Sumsub through the verification step on our website:

• Identity document data: photographs of your government-issued identity document (passport, ID card, residence permit, or driving licence) and the information it contains, such as your name, date of birth, nationality, document number, and expiry date.
• Biometric data: a selfie captured during a liveness check — facial images used to confirm that you are a real, present person and that the identity document belongs to you.
• Proof of address: a recent document (for example a utility bill or bank statement) showing your residential address.
• Technical data: your IP address and information about the device and browser used during verification.

What We Receive and Store

Your document images, selfies, and biometric data are held by Sumsub — we do not receive or store them on our own systems. From the verification process, we receive and store only:

• The outcome and status of your verification (for example: in progress, under review, verified, or failed), together with the date of the decision.
• Once your verification is approved: your verified name, date of birth, and residential address, as extracted from your approved documents. These details are stored in encrypted form on our systems.

Where our staff need to review the underlying verification evidence, they do so within Sumsub's secure platform under access controls; the evidence is not copied into our own systems.

Checks Against Sanctions and Politically Exposed Person Lists

As part of verification, Sumsub checks your name and date of birth against sanctions lists, lists of politically exposed persons (people who hold or have held a prominent public position, and their family members and close associates) and adverse media reports. Anti-money laundering law requires us to make these checks (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010).

This information does not come from you. Sumsub obtains it from a specialist data provider, which compiles it from official sanctions lists, such as those of the European Union and the United Nations, and from publicly available sources, such as government publications and news reports.

A possible match is not a finding that you are on a list. It puts your verification on hold until a person has reviewed it. If you are a politically exposed person, we may ask you about the source of your funds. The result of the check is kept with your verification records, for the period described below.

Verifying Without a Selfie

If you do not want to take the selfie, you can call us and we can switch your account to document verification instead. You then upload a photo ID and a proof of address through our website, and our team compares them with the details you entered before approving them. No selfie, liveness check or face data is used on this route, and no automated decision is made: a person approves or rejects your documents.

The documents you upload on this route are stored on our own systems, in Amazon Web Services' data centres in Ireland, with access limited to our staff who check them. We keep them as identity and AML verification records, for the period set out under “How Long We Keep Your Data” above.

Legal Basis, Retention and International Transfers

We process your verification data because we are legally obliged to do so. Biometric processing during the liveness check is carried out on the basis of your explicit consent, which we ask for on our verification page before the check begins. We record your answer, the version of the notice you were shown and the time. If you do not consent, you can verify with your documents instead, as described above. If you do not complete verification by either route, we will be unable to provide our services to you.

Verification records are retained in line with our legal obligations — at least 5 years from the end of our business relationship, as described in the Data Retention section of our Terms of Use. Sumsub keeps your verification data, including your selfie and face data, for us for the same period. When it ends, we tell Sumsub to delete it.

Sumsub is based in Cyprus, within the European Economic Area, and stores verification data in Germany. Where Sumsub transfers verification data outside the European Economic Area, for example to its own service providers, it is protected by appropriate safeguards required under the GDPR.

Your Rights and More Information

We remain the data controller for your verification data, and you can exercise all of the rights described in the "Your Rights as a Data Subject" section below by contacting us. You can read more about how Sumsub handles personal data in Sumsub's Privacy Notice.

Automated Decision-Making

Identity verification involves automated processing. Sumsub's checks — document authenticity, and the biometric comparison of your liveness selfie against your identity document — run automatically, and where every check passes, your account can be verified without a person reviewing the decision. Because we cannot provide our services without a completed verification, this automated approval has a significant effect on you.

You are protected in the following ways: verifications that cannot be approved automatically are reviewed rather than automatically refused; you can verify with your documents instead, which a person checks; and for any verification outcome you may contact our support team to obtain human intervention, express your point of view, and contest the decision.

Our safer gambling checks also make automated decisions about your betting:

• When your total stakes reach €2,000, betting on your account is paused automatically until you complete our safer gambling questionnaire. Your total stakes are worked out automatically from your bets, as set out in How your activity figures are calculated. At €1,000 and €1,500 we ask you to complete the questionnaire, without pausing your betting.
• If you set a spending limit, a bet that would take you over it is refused automatically, as the limit you chose requires.

A pause on your betting has a significant effect on you. Completing the questionnaire lifts it straight away, and you may contact our support team at any time to have a person review it, express your point of view, and contest it.

We do not use automated profiling for marketing purposes.

Use of Cookies

Cookies are small pieces of data stored on your computer by your web browser at the request of a website you're visiting. They are used to improve your online experience by almost every website, including ours. Below is how we use cookies on our website:

For more detailed information on how we use cookies, please refer to our Cookie Policy.

Security – How We Store Your Information

At BetXS we take the security of your personal information very seriously. We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Here’s how we work to protect the data you entrust to us:

• Secure Storage: All personal information you provide is stored on our secure servers. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure.
• Password Protection: Access to your personal account on our website is secured with a password. This is to ensure that your private information remains confidential and is accessible only by you or those you have authorized.

Despite our efforts to ensure the security of your information, no system can be completely secure. Therefore, we cannot guarantee the absolute security of any information you transmit to us online. Transmitting personal information is done at your own risk.

What does all this mean? Just like in the real world, it is crucial that you take steps to protect yourself online:

• You are responsible for keeping your passwords and account details secret.
• Always be cautious about the information you provide in public areas of our website, as these can be accessed by other users.
• Ensure that you use a strong, unique password for your accounts and do not share it with others.

Your vigilance in protecting your personal information plays a crucial role in helping us maintain a safe and secure platform.

Personal Data Breach Response

We have a documented personal data breach response plan. It covers prompt reporting, containment, investigation, assessing risks to people, recording breaches and the actions taken, and notifying the relevant authority and affected people when required. Dove Shield Tech Limited supports us as our platform provider and must tell us about breaches affecting the personal data it processes on our behalf without undue delay.

Unless a breach is unlikely to result in a risk to people's rights and freedoms, we notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we tell you without undue delay as required by data protection law, explain the likely consequences and the measures taken, and give practical advice on protecting yourself. To report a concern or ask about your data, use the data protection contacts above.

Your Rights as a Data Subject

We are committed to upholding your rights as provided under data protection laws. You have several rights concerning your personal information, and we facilitate the exercise of these rights through our data protection policy and subject access request procedure, both of which are available upon request.

• Right of Access: You have the right to request a copy of the personal information we hold about you, ensuring you can check we are using your information in accordance with data protection law.
• Right of Rectification: You can ask us to correct any inaccuracies in the personal information we hold about you, enhancing the accuracy of your data.
• Right to be Forgotten: You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
• Right to Restriction of Processing: Under certain conditions, you have the right to restrict the processing of your personal information.
• Right of Portability: You have the right to have the data we hold about you transferred to another organization, where technically feasible.
• Right to Object: You have the right to object to certain types of processing, such as direct marketing, processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority, and processing for purposes of scientific/historical research and statistics.
• Right to Object to Automated Processing, Including Profiling: You have the right not to be subject to the legal effects of automated processing or profiling.
• Right to Withdraw Consent: Where we rely on your consent — the optional “Keep me signed in” cookie, or the biometric liveness check during identity verification — you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Signing out removes the “Keep me signed in” cookie, and you can simply leave the box unticked when you next sign in. To withdraw your consent to the liveness check, contact us: we stop using the selfie route for your account and you can verify with your documents instead. Withdrawing consent does not end our legal duty to keep the verification records already made, as set out under “How Long We Keep Your Data”.

How to make a request

You can ask for a copy of your data from the Compliance page of your account settings. We prepare it as a ZIP file: a summary that explains it, and your records in files you can open in a spreadsheet or move to another service. We email you when it is ready, and you download it from your account while signed in; we do not send your data by email. The file is deleted 30 days after it is ready.

For any other right, or if you prefer, contact us using the details in the “Who We Are” section at the top of this policy, by email, by phone or by letter. We may ask you to confirm who you are before we act. We answer within one month of receiving your request, free of charge. Where a request is complex, or you have made several, we may take up to two further months; if so, we tell you why within the first month.

Please note that some of these rights might be limited where we have an overriding interest or legal obligation to continue to process the data or where data is needed for the establishment, exercise or defense of legal claims.

Complaints

We strive to meet the highest standards when processing your personal information. However, if you are not satisfied with our use of your personal data, or our response to any requests you have made to exercise your rights, you have the right to lodge a complaint with the Data Protection Commission (DPC).

Before reaching out to the DPC, we encourage you to contact us first with any concerns, as we may be able to resolve them directly. If you do choose to proceed with a formal complaint, here are the contact details for the DPC:

• Address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
• Phone: 01 7650100 / 1800437 737
• Email: info@dataprotection.ie
• Online: Submit a Complaint Form

The DPC is Ireland's authority responsible for upholding the fundamental right of individuals to data privacy through the enforcement and monitoring of compliance with data protection legislation.

Changes to Our Privacy Policy

We regularly review and update this Privacy Policy to reflect changes in technology, legislation, our services, or how we operate our business. These updates are crucial for ensuring that we continue to protect your data and keep you informed about how we use it.

Any changes we make to this policy will be posted on this page with an updated “Last updated” date. Where a change is material, we will actively notify you — for example by email or a notice on the website — rather than relying on you noticing the change.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact BetXS by phone on 0877725423 or through your account. Our data protection officer can be reached at dpo@betxs.ie.