Privacy Policy

1. Introduction

Welcome to Gamblezen ("we", "us", "our"), accessible at tymcc.ie. We are committed to protecting the personal data of every individual who interacts with our platform and services (collectively, the "Services"). This Privacy Policy describes, in a transparent and accessible manner, the categories of personal data we collect, the purposes for which we use that data, the legal grounds on which we rely, and the rights you hold as a data subject.

This Policy has been prepared in accordance with the EU General Data Protection Regulation (GDPR) (EU) 2016/679, the Irish Data Protection Act 2018, and the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (the Irish ePrivacy Regulations), which govern the use of cookies and electronic communications in Ireland.

By accessing or using our Services — including visiting the website, registering an account, making a deposit, or communicating with our support team — you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this document, you should refrain from using our Services.

1.1 Who Is the Data Controller?

For the purposes of applicable data protection law, Gamblezen (operating through tymcc.ie) acts as the Data Controller in respect of personal data provided to us or collected by us in connection with the provision of our Services. As Data Controller, we determine the purposes for which, and the means by which, your personal data is processed.

1.2 Scope of This Policy

This Policy applies to all personal data processed in connection with our online gaming platform, including data collected:

• When you create or update a user account;
• When you deposit or withdraw funds;
• When you use or browse our gaming content;
• When you contact us via email, live chat, or any other channel;
• When you subscribe to promotional communications;
• Automatically, through cookies and similar tracking technologies.

2. Data We Collect

We collect personal data from you directly (when you provide it to us) and indirectly (automatically, when you use our Services). The specific data categories are described below.

2.1 Identity & Registration Data

When you register for an account, we collect:

• Full legal name — first name and surname;
• Date of birth — to verify that you meet the minimum age requirement of 18 years;
• Nationality and country of residence;
• Gender (where voluntarily provided);
• Username and account password (stored in encrypted form).

2.2 Contact Data

• Email address;
• Telephone number (where provided for verification or two-factor authentication);
• Postal address (for identity and address verification purposes).

2.3 Know Your Customer (KYC) & Verification Data

As part of our anti-money laundering (AML) and responsible gaming obligations, we may collect:

• Copies of government-issued photo identification (e.g. passport, national identity card, Irish driving licence);
• Proof of residential address (e.g. utility bill, bank statement, not older than three months);
• Source of funds or source of wealth documentation where thresholds are met;
• Enhanced due diligence documentation in specific circumstances.

2.4 Financial & Transaction Data

• Payment method details (e.g. partial card numbers, e-wallet identifiers, bank account references) — full card numbers are never stored by us;
• Deposit and withdrawal history, amounts, and timestamps;
• Currency used — Euro (€);
• Bonus, promotion, and loyalty programme activity.

Accepted payment methods on our platform include:

• Visa & Mastercard (debit and credit cards);
• PayPal;
• Skrill;
• Neteller;
• Paysafecard;
• Apple Pay;
• Google Pay;
• Bank transfer (SEPA);
• Trustly;
• MuchBetter.

2.5 Gaming & Behavioural Data

• Games played, session durations, bet amounts, wins, and losses;
• Responsible gaming tool usage (deposit limits, self-exclusion periods, reality checks);
• Account activity logs and timestamps.

2.6 Technical & Device Data

• IP address;
• Browser type and version;
• Operating system and device identifiers;
• Screen resolution, time zone, and language settings;
• Referring URL and exit pages.

2.7 Communications Data

• Records of correspondence — emails, live chat transcripts, and support tickets;
• Survey responses and feedback submitted voluntarily;
• Preferences relating to marketing communications.

2.8 Special Category Data

We do not intentionally collect special category data (e.g. health, racial or ethnic origin, political opinions, biometric data) as defined under Article 9 GDPR. Where such data is incidentally disclosed in customer support communications or problem-gambling self-assessments, it will be treated with additional safeguards and processed only to the extent strictly necessary.

3. How We Use Your Data

We process your personal data only for specified, explicit, and legitimate purposes. The principal purposes are described in the table below, alongside the corresponding data categories and legal basis.

3.1 Marketing Communications

We will only send you promotional emails, SMS messages, or push notifications with your express prior consent. You may withdraw this consent at any time by clicking the "Unsubscribe" link in any marketing email, adjusting your account notification preferences, or by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

4. Legal Bases for Processing

Under the GDPR, every processing activity must be grounded on at least one of the lawful bases set out in Article 6. We rely on the following bases:

4.1 Performance of a Contract (Article 6(1)(b))

The majority of our core processing — including registering your account, processing transactions, and operating the gaming platform — is necessary to fulfil our contractual obligations to you under our Terms & Conditions. Without this processing, we cannot provide the Services.

4.2 Legal Obligation (Article 6(1)(c))

We are required by law to process certain personal data. This includes obligations under anti-money laundering legislation, age verification requirements applicable to gambling services in Ireland, and responsible gaming duties. Compliance with requests from competent Irish authorities — including the Gambling Regulatory Authority of Ireland (GRAI) and the Data Protection Commission (DPC) — also falls under this basis.

4.3 Legitimate Interests (Article 6(1)(f))

We may process certain data where necessary for the purposes of our own, or a third party's, legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Preventing and detecting fraud, cheating, and collusion;
• Ensuring the security and integrity of our platform;
• Improving and developing our products and Services;
• Analysing website traffic and user experience through aggregated data.

We always carry out a balancing test before relying on legitimate interests and will not use this basis where our interests are outweighed by your privacy rights.

4.4 Consent (Article 6(1)(a))

Where consent is the applicable legal basis — most notably for personalised marketing and non-essential cookies — we will obtain your clear, affirmative consent before processing commences. You have the right to withdraw consent at any time. Withdrawal is prospective and does not retroactively affect prior processing.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data in the following circumstances:

5.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf, strictly under our documented instructions and bound by data processing agreements that meet GDPR requirements. These providers include:

• Payment processors — to facilitate deposits and withdrawals securely;
• Identity verification (KYC) providers — to conduct age and identity checks;
• Fraud detection and risk management platforms;
• Game software providers — who may process technical data necessary to render their games;
• Customer support platform providers — for live chat and ticketing systems;
• Email and marketing automation tools;
• Cloud hosting and infrastructure providers;
• Analytics and website optimisation services.

5.2 Regulatory and Law Enforcement Bodies

We may be legally required to disclose personal data to competent Irish or EU authorities, including but not limited to:

• The Gambling Regulatory Authority of Ireland (GRAI);
• The Data Protection Commission (DPC);
• The Revenue Commissioners;
• An Garda Síochána or other law enforcement agencies;
• Courts of competent jurisdiction.

Such disclosures will only be made to the minimum extent required by law and, where possible, after informing you (unless we are legally prohibited from doing so).

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and the resulting changes to data controllership prior to the transfer taking effect, except where prohibited by law.

5.4 Responsible Gaming Support Organisations

With your explicit consent, or where required under our responsible gaming obligations, we may share limited data with designated responsible gaming bodies or counselling services to facilitate self-exclusion or referral to support. See our Responsible Gaming Policy for further information.

6. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies (such as web beacons and pixel tags) in accordance with the Irish ePrivacy Regulations 2011. A cookie is a small text file placed on your device when you visit a website. We use cookies to ensure the proper functioning of our Services, to improve user experience, and — where you have consented — for analytics and personalisation purposes.

6.1 Cookie Categories

6.2 Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookie categories. You may modify your preferences at any time via the Cookie Settings link located in the website footer. In addition, you can configure your browser to block or delete cookies; however, doing so may impair the functionality of certain features of our Services.

6.3 Third-Party Cookies

Certain features of our platform may embed third-party tools (e.g. analytics providers, live chat widgets, payment widgets) that set their own cookies. These third parties act as independent data controllers in respect of such cookies. We recommend reviewing the privacy policies of those providers directly.

7. Data Security

We implement robust technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to:

7.1 Technical Measures

• TLS/SSL encryption for all data transmitted between your device and our servers;
• AES-256 encryption for sensitive data stored at rest;
• Hashed and salted storage of account passwords;
• Regular automated vulnerability scanning and penetration testing;
• Firewall protection, intrusion detection systems, and real-time anomaly monitoring;
• Multi-factor authentication (MFA) available for user accounts and mandatory for administrative access.

7.2 Organisational Measures

• Strict role-based access control — staff access personal data only on a need-to-know basis;
• Mandatory data protection training for all personnel handling personal data;
• Data processing agreements in place with all third-party processors;
• Internal data protection policies reviewed at least annually.

7.3 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission (DPC) without undue delay and, where required, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals directly without undue delay, providing details of the nature of the breach and the steps we are taking to address it.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders it impossible to re-identify any individual. Where anonymisation is not technically feasible, the data will be securely destroyed.

9. Your Rights

As a data subject residing in Ireland or within the European Economic Area, you are entitled to the following rights under the GDPR and the Data Protection Act 2018. These rights are not absolute and may be subject to exemptions in specific circumstances:

9.1 Summary of Your Rights

9.2 How to Exercise Your Rights

To exercise any of your rights, please submit a written request to our dedicated privacy contact at [email protected]. We will acknowledge receipt of your request promptly and issue a substantive response within one calendar month. Where your request is complex or we have received a high volume of requests, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the initial one-month period.

We will not charge a fee for responding to your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to comply, providing you with written reasons for either decision.

9.3 Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Irish supervisory authority:

We would, however, appreciate the opportunity to address your concerns directly before you approach the DPC, and encourage you to contact us in the first instance.

10. International Data Transfers

Your personal data is primarily processed and stored within the European Economic Area (EEA). Where we engage service providers located outside the EEA — for example, certain cloud infrastructure or analytics providers — we ensure that any international transfer of your personal data is carried out with appropriate safeguards in place, as required by Chapter V of the GDPR.

10.1 Safeguards for International Transfers

The safeguards we rely upon include one or more of the following:

• Adequacy decisions — transfers to countries that the European Commission has determined offer an adequate level of data protection;
• Standard Contractual Clauses (SCCs) — the EU Commission-approved model clauses (as updated in June 2021) incorporated into our contracts with processors and controllers in third countries;
• Binding Corporate Rules (BCRs) — where applicable for intra-group transfers within multinational service providers;
• Approved certification mechanisms or codes of conduct as permitted under Article 46 GDPR.

Upon request, you may obtain further information regarding the specific transfer mechanisms applicable to our international processing activities by contacting us at [email protected].

11. Minors

As part of our registration process, we require all users to declare that they are aged 18 or over. We further conduct mandatory age verification checks using government-issued identification documents before permitting access to real-money gaming. Accounts suspected of belonging to minors will be suspended immediately pending verification, and any funds held in such accounts will be frozen pending investigation.

If we discover, at any point, that we have inadvertently collected personal data from an individual under the age of 18, we will:

• Immediately suspend and permanently close the relevant account;
• Securely delete all associated personal data as promptly as technically possible;
• Refund any deposits made, subject to our verification procedures;
• Report the incident to appropriate authorities where legally required.

If you are a parent or guardian and believe your child has registered on our platform, please contact us immediately at [email protected] so we may take prompt remedial action. For further information about our age verification practices and tools to protect minors from accessing gambling services, please refer to our Responsible Gaming Policy.

11.1 Support Resources for Problem Gambling in Ireland

We are committed to promoting safer gambling. If you or someone you know is experiencing difficulties related to gambling, the following organisations provide free, confidential support in Ireland:

• GamblingCare.ie — National Gambling Helpline: 1800 936 725 (9:00–23:00 daily) | gamblingcare.ie
• Extern Problem Gambling — Free counselling and helpline for individuals and families across Ireland | problemgambling.ie
• Helplink — Free problem gambling counselling service in collaboration with the Gambling Awareness Trust | helplink.ie
• Gamblers Anonymous Ireland — Peer-support group meetings and resources | gamblersanonymous.ie
• HSE Addiction Services — Specialist public health services and recovery supports for addiction | hse.ie
• Samaritans Ireland — 24-hour confidential emotional support: 116 123 (free) | samaritans.org/ireland
• Family Addiction Support Network (FASN) — Support for families affected by a loved one's gambling harm | fasn.ie

12. Changes to This Policy

We review this Privacy Policy at least annually, and more frequently where required by changes in applicable law, regulatory guidance, or our data processing activities. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page;
• Increment the version number accordingly;
• Notify registered users via email or prominent in-platform notification where the changes are material and affect their rights or our processing activities;
• In cases of particularly significant changes, seek fresh consent where the legal basis for processing is consent.

Non-material changes (such as clarifications of existing practices, typographical corrections, or improvements to readability) may be made without prior notice. We encourage you to review this Policy periodically to stay informed of how we protect your personal data.

Continued use of our Services following the publication of an updated Privacy Policy constitutes acknowledgement of the revised terms. If you object to any changes, you should discontinue your use of our Services and, if applicable, close your account.

12.1 Version History

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please do not hesitate to contact us. We are committed to responding promptly and constructively to all data protection enquiries.

13.1 General Support

13.2 Privacy & Data Protection Enquiries

13.3 Supervisory Authority