1. Introduction

1.1. Who We Are

Pink Lady Casino operates the website located at pinkladycasino-online.uk (the "Platform"). For the purposes of United Kingdom data protection legislation, we act as the data controller in respect of personal data collected from users of the Platform.

As a data controller, we determine why and how personal data is processed. We take this responsibility seriously and have put in place robust policies, procedures, and technical safeguards to protect the personal information entrusted to us.

1.2. Applicable Law

This Privacy Policy is drafted in accordance with:

• The UK General Data Protection Regulation (UK GDPR) as it forms part of domestic law by virtue of the European Union (Withdrawal) Act 2018;
• The Data Protection Act 2018 (DPA 2018);
• The Privacy and Electronic Communications Regulations 2003 (PECR), as amended;
• The Data (Use and Access) Act 2025 (DUAA 2025), which received Royal Assent on 19 June 2025 and introduced targeted reforms to the above framework.

Together, these instruments require us to process personal data lawfully, fairly, and transparently, to collect it only for specified purposes, and to keep it secure and accurate.

1.3. Relationship with Other Documents

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are available on this Platform. In particular, certain data processing activities described herein—such as age verification and self-exclusion checks—are directly connected to commitments set out in those documents.

1.4. Acceptance

By registering an account, accessing the Platform, or using any of our services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree, you must not use the Platform.

2. Data We Collect

2.1. Categories of Personal Data

We collect and process several categories of personal data, depending on how you interact with the Platform. The following table provides an overview:

2.2. Special Category Data

In limited circumstances, we may process special category data as defined under Article 9 of UK GDPR—such as health-related information provided voluntarily in the context of a responsible gaming self-exclusion request, or information indicating vulnerability. Such data is processed only where strictly necessary and subject to additional safeguards.

2.3. Data We Do Not Collect

We do not knowingly collect personal data from individuals under the age of 18 years. We do not collect biometric data for identification purposes, nor do we process data related to racial or ethnic origin, political opinions, religious beliefs, or trade union membership, except where required by law.

2.4. Data Provided by Third Parties

In addition to data you provide directly, we may receive personal data from third-party sources including:

• Identity verification agencies conducting Know Your Customer (KYC) checks;
• Payment processors confirming transaction status;
• Fraud prevention databases and screening tools;
• Self-exclusion registers, including GAMSTOP, which provides a UK-wide self-exclusion scheme for online gambling;
• Credit reference agencies (where applicable for affordability checks).

3. How We Use Your Data

3.1. Core Service Delivery

The primary purpose of processing your personal data is to provide and manage the gaming services you have requested. This includes:

• Creating and maintaining your account;
• Verifying your identity and age prior to account activation;
• Processing deposits and withdrawals in GBP (£) via your chosen payment method;
• Managing your gaming activity, including bets, wins, and losses;
• Providing customer support and resolving disputes.

3.2. Regulatory and Legal Compliance

As an online gaming platform serving UK customers, we are required by law and regulatory guidance to:

• Conduct Anti-Money Laundering (AML) checks and maintain transaction records;
• Perform Know Your Customer (KYC) identity verification;
• Apply responsible gambling controls, including age verification, affordability assessments, and self-exclusion checks via GAMSTOP;
• Report suspicious transactions to relevant authorities;
• Retain certain financial records for statutory periods.

3.3. Responsible Gambling

We process personal data specifically to promote safer gambling in accordance with our obligations under our Responsible Gaming Policy. This includes monitoring your play patterns, flagging indicators of potential harm, enforcing deposit and time limits you set, and honouring self-exclusion requests. We take this processing extremely seriously and treat the resulting data with the highest level of sensitivity.

3.4. Fraud Prevention and Security

We use your data to detect, investigate, and prevent fraudulent activity, unauthorised access, and other illegal conduct. This includes sharing data with fraud prevention agencies and screening tools on an ongoing basis.

3.5. Marketing and Promotions

With your explicit consent, we may use your contact details and gaming preferences to send you personalised promotional offers, bonus information, and news about Pink Lady Casino. You may withdraw consent at any time by updating your preferences in your account settings or by emailing us at [email protected]. Withdrawal of consent does not affect the lawfulness of prior processing.

3.6. Platform Improvement and Analytics

We process usage and technical data to analyse how users interact with the Platform, identify technical issues, improve user experience, and test new features. Where analytics involve tracking technologies, this is addressed in Section 6 of this Policy.

4. Legal Bases for Processing

Under Article 6 of the UK GDPR, every processing activity must rest on one of six recognised lawful bases. We rely on the following:

4.1. Special Category Data Basis

Where we process special category data (e.g., health-related information in responsible gambling contexts), we rely additionally on explicit consent under Article 9(2)(a) UK GDPR, or on processing necessary for reasons of substantial public interest under Article 9(2)(g) in conjunction with the Data Protection Act 2018, Schedule 1.

5. Data Sharing & Third Parties

5.1. Categories of Recipients

We may share your personal data with the following categories of third parties:

• Payment Processors & Financial Institutions — to facilitate deposits and withdrawals. Our Platform accepts popular UK payment methods including Visa, Mastercard, Maestro, PayPal, Skrill, Neteller, Paysafecard, Apple Pay, Google Pay, bank transfer, and Pay by Mobile. Each processor operates under its own privacy policy and security standards;
• Identity Verification & KYC Providers — to verify your identity, age, and address;
• Fraud Prevention Agencies — to detect and prevent fraud, money laundering, and other financial crime;
• Self-Exclusion Registers — including GAMSTOP, to enforce self-exclusion requests made by or on behalf of players;
• Game Software Providers — third-party game studios and platform providers whose software powers our gaming library may receive limited session data necessary for game functionality;
• Analytics & Marketing Technology Providers — subject to your consent, where applicable;
• Customer Support Tools — platforms that facilitate live chat, ticketing, and email support;
• Regulatory & Law Enforcement Authorities — where required by law, court order, or regulatory demand;
• Professional Advisors — including solicitors, accountants, and auditors, under strict confidentiality obligations.

5.2. Data Processing Agreements

Where third parties process personal data on our behalf (i.e., act as data processors), we enter into written Data Processing Agreements (DPAs) with them, as required under Article 28 of UK GDPR. These agreements require processors to implement appropriate security measures and to process data only on our documented instructions.

5.3. No Selling of Personal Data

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Any data sharing with third parties is strictly limited to what is necessary for the purposes described in this Policy.

5.4. Business Transfers

In the event of a merger, acquisition, or transfer of business assets, personal data held by us may be transferred to a successor entity. We will provide reasonable notice and ensure that the receiving party maintains equivalent data protection standards before any such transfer occurs.

6. Cookies & Tracking Technologies

6.1. What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. They allow us to recognise your browser, remember your preferences, keep you logged in, and collect information about how you use the site. Similar technologies, including pixel tags, web beacons, and local storage objects, may also be used.

6.2. Types of Cookies We Use

6.3. Your Cookie Choices

On your first visit to the Platform, you will be presented with a cookie consent banner that allows you to accept, reject, or customise cookie settings. You may change your preferences at any time via the Cookie Settings link in the site footer. Please note that disabling certain cookies may affect the functionality of the Platform.

You may also control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or receive a warning before a cookie is stored. For further information, visit www.aboutcookies.org.

6.4. Third-Party Tracking

Some cookies are set by third-party services that appear on our pages, such as analytics providers and advertising networks. These third parties have their own privacy policies. We do not control their use of such technologies. Where third-party cookies involve personal data processing, we require contractual safeguards from those parties.

7. Data Security

7.1. Technical and Organisational Measures

We take the security of your personal data very seriously and have implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, alteration, and disclosure. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS);
• Encryption at rest: Sensitive personal and financial data stored on our servers is encrypted using industry-standard algorithms;
• Access controls: Personal data is accessible only to authorised personnel who require it to perform their job functions, enforced through role-based access control (RBAC) and multi-factor authentication (MFA);
• Penetration testing: We conduct regular security assessments and vulnerability scanning of our systems;
• Incident response: We maintain a documented data breach response procedure. In the event of a breach likely to result in a high risk to your rights and freedoms, we will notify you and, where required, the Information Commissioner's Office (ICO) within 72 hours of becoming aware;
• Staff training: All personnel with access to personal data receive data protection training on appointment and periodically thereafter;
• Third-party audits: Key service providers are subject to security assessments as part of our vendor due diligence process.

7.2. Your Responsibility

You are responsible for keeping your account credentials — including your username and password — confidential. We recommend using a strong, unique password and enabling any two-factor authentication options offered by the Platform. You must notify us immediately at [email protected] if you suspect any unauthorised use of your account.

8. Data Retention

8.1. Retention Principles

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. We do not retain personal data in a form that identifies you for longer than necessary.

8.2. Specific Retention Periods

8.3. Secure Disposal

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes.

9. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. We will respond to any valid request within one calendar month of receipt, free of charge in most circumstances.

9.1. How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Privacy team using the details set out in Section 13 of this Policy. We may need to verify your identity before processing your request. In most cases, requests are processed free of charge; however, where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or decline to act.

9.2. Right to Lodge a Complaint

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection supervisory authority:

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO and encourage you to reach out to us in the first instance.

10. International Data Transfers

10.1. General Principle

The Platform is operated primarily within the United Kingdom. However, some of our third-party service providers—including technology vendors, game software providers, and payment processors—may be located outside the UK, in countries that do not provide the same level of data protection as the UK.

10.2. Safeguards for International Transfers

Where we transfer personal data to countries outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of UK GDPR, including:

• UK Adequacy Regulations: Where the Secretary of State has made an adequacy decision confirming the country provides an equivalent level of protection;
• International Data Transfer Agreements (IDTAs): The UK-specific contracts approved by the ICO as a transfer mechanism, which bind the recipient to appropriate data protection standards;
• UK Addenda to EU Standard Contractual Clauses: Where processing involves EU-based processors who already use EU SCCs, these may be adapted via the applicable UK Addendum;
• Binding Corporate Rules (BCRs): Where applicable within multinational corporate groups that have received ICO approval.

10.3. Your Rights in Transfers

You may request further information about the specific safeguards applied to international transfers of your personal data by contacting our Privacy team at [email protected].

11. Minors

11.1. Age Restriction

The Platform is strictly intended for individuals who are 18 years of age or older. We do not knowingly collect, use, or retain personal data from individuals under the age of 18. All registration processes include mandatory age verification steps, and we employ third-party verification tools to detect and prevent underage use.

11.2. Discovery of Underage Use

If we become aware that personal data has been collected from a person under 18 years of age, we will promptly:

• Suspend and close the relevant account;
• Refund any deposits in accordance with our Terms & Conditions;
• Securely delete the personal data of the minor as soon as practicable;
• Report the incident to relevant regulatory authorities where required.

11.3. Parental Concern

If you are a parent or guardian and believe that a minor has accessed or registered on the Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay. We also recommend the use of parental control software such as Gamban (gamban.com) and NetNanny to prevent underage access to gambling sites.

12. Changes to This Policy

12.1. Right to Update

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, regulatory guidance (including any further reforms introduced under the Data (Use and Access) Act 2025), or industry best practice. We will always publish the current version on this page, together with the version number and the date of the most recent update.

12.2. Notification of Material Changes

If we make material changes to this Policy that could significantly affect your privacy rights or the way we process your data, we will notify you by:

• Displaying a prominent banner or pop-up notification on the Platform;
• Sending an email notification to the address registered to your account; and/or
• Requesting renewed consent where required by law.

12.3. Continued Use

Your continued use of the Platform after any update to this Policy constitutes your acknowledgment of the revised terms. If you do not agree with the updated Policy, you should cease using the Platform and contact us to discuss closure of your account. We encourage you to review this page periodically to stay informed about how we protect your data.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Pink Lady Casino processes your personal data, please contact us using the details below. We aim to acknowledge all enquiries within 48 hours and resolve them fully within one calendar month.

13.1. Regulatory & Responsible Gambling Resources

If you are concerned about your gambling, please visit our Responsible Gaming page. The following organisations provide free, confidential support to people affected by problem gambling in the United Kingdom: