Sugar Rush operates this Privacy Policy to provide a transparent explanation of how personal data is collected, processed, stored, and protected when players use the platform. This document outlines the brands data handling practices in compliance with the United Kingdom General Data Protection Regulation and the Data Protection Act 2018. The policy details lawful processing activities, account management procedures, and security safeguards applied to player information. It also explains individual rights regarding data access, rectification, erasure, and portability. All processing is conducted on a lawful basis, including contract performance, legal obligation, and legitimate interest. Players are advised to review this document to understand their rights and the brands responsibilities concerning personal data management.
Categories of Personal Data Collected from Players
The brand collects multiple categories of personal data to facilitate account registration, transaction processing, and compliance with legal obligations. Registration details include full name, date of birth, residential address, email address, and telephone number. Identification data consists of government-issued photographic identification, proof of address documents, and in certain cases, financial statements or utility bills. Transactional information encompasses deposit amounts, withdrawal requests, betting history, game session logs, and payment method details. Technical data includes internet protocol addresses, device identifiers, browser type, operating system, and usage statistics collected through cookies and similar tracking technologies. Compliance-related records include self-exclusion flags, responsible gambling assessments, source of funds documentation, and communications with regulatory bodies. The brand may also process data related to the sugar rush ollerton promotional event for verification of eligibility and prize distribution.
Legal Bases for Processing Player Information
Personal data is processed under specific lawful bases as defined by applicable data protection legislation. Contractual necessity is the primary basis for processing registration details, transaction records, and account management data necessary to operate the gaming service. Legal obligation applies to identity verification, anti-money laundering checks, problem gambling monitoring, and reporting to the United Kingdom Gambling Commission. Legitimate interest supports fraud prevention, network security, system maintenance, and internal analytics to improve platform functionality. Consent is obtained for direct marketing communications and non-essential cookie usage. The brand processes data related to the sugar rush speedway promotional period solely for administering competition entries and prize fulfillment. Processing of sensitive data such as health information related to gambling addiction assessments requires explicit consent. The legal basis for each processing activity is documented and reviewed periodically to ensure compliance with regulatory standards.
- Contractual necessity for account operations and game services
- Legal obligation for identity verification and regulatory reporting
- Legitimate interest for fraud detection and platform security
- Consent for marketing preferences and non-essential cookies
Data Storage Infrastructure and Retention Schedules
Player data is stored on servers located within the European Economic Area and the United Kingdom. Encryption protocols including TLS 1.2 or higher protect data during transmission. At rest, personal data is encrypted using AES-256 standards. Access controls restrict data visibility to authorised personnel only, with role-based permissions enforced through identity and access management systems. Retention periods are determined by legal requirements and operational necessity. Account data is retained for the duration of the account relationship plus six years after closure to comply with financial record-keeping obligations. Transaction records are kept for five years after completion. Identification documents are stored for five years following account closure. Self-exclusion records are retained indefinitely or until the exclusion period expires. Data related to the sugar rush slot uk marketing campaign is retained for two years after the campaign concludes. Automated deletion scripts execute at the end of each retention period. Archival procedures move inactive account data to separate storage with limited access after twelve months of inactivity.
| Data Category | Retention Period | Legal Basis for Retention |
|---|---|---|
| Account registration data | Duration of account plus six years | Financial record-keeping obligations |
| Transaction records | Five years from transaction date | Anti-money laundering requirements |
| Identification documents | Five years after account closure | Regulatory compliance |
| Self-exclusion records | Until exclusion period ends | Player protection obligations |
| Marketing campaign data (sugar rush british tv series) | Two years from campaign conclusion | Legitimate interest in analytics |
Player Data Rights and Exercise Procedures
Players hold specific rights regarding their personal data under the United Kingdom General Data Protection Regulation. The right to access allows players to request a copy of all personal data held by the brand. The right to rectification permits corrections to inaccurate or incomplete information. The right to erasure, also known as the right to be forgotten, applies when data is no longer necessary for the original purpose or consent is withdrawn. The right to restrict processing limits how data can be used while a complaint is investigated. The right to object applies to processing based on legitimate interest, including direct marketing. The right to data portability enables players to receive their data in a structured, machine-readable format. To exercise these rights, players must submit a written request through the designated data protection email address or postal address. Identity verification is mandatory before any request is processed, requiring submission of a copy of photographic identification and a recent utility bill. The brand responds to all valid requests within one calendar month, with a possible extension of two additional months for complex requests. Requests can be refused only where permitted by law, with a written explanation provided to the player. The brand maintains a register of all data subject requests for audit purposes. Players who believe data processing violates their rights may lodge a complaint with the Information Commissioners Office.