Park Lane Club Privacy Policy

1. Introduction

This Privacy Policy sets out how personal data is collected, used, stored, shared and protected in connection with the services operated under the Park Lane Club brand. It applies to all individuals who access or use the platform or services, including prospective customers, registered account holders and visitors to the website.

Processing of personal data takes place in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as applicable gambling legislation and guidance issued by the UK Gambling Commission, including requirements relating to fair and transparent terms and practices.

This document should be read carefully. By using the services or creating an account, you acknowledge that you have read and understood how your personal data is processed as described in this Privacy Policy.

2. Data Controller

Park Lane Club acts as the data controller for personal data processed in connection with its services. As data controller, the company determines the purposes and means of processing personal data.

Questions about this Privacy Policy or requests to exercise data protection rights can be directed to the Data Protection Officer (DPO) using the contact details set out in Section 9.

3. Personal Data Collected

The following categories of personal data are collected and processed, as applicable:

Identity data - full name, date of birth, username and government-issued identification documents.
Contact data - email address, postal address and telephone number.
Financial data - payment account details and transaction records, collected for the purposes of processing transactions and meeting anti-money laundering obligations.
Technical data - IP address, browser type, device identifiers and access logs.
Transactional data - records of activity conducted through an account, including deposits, withdrawals and account history.
Behavioural data - patterns of use collected for the purposes of responsible gambling monitoring and fraud prevention.
Verification data - information obtained through identity verification checks, including data sourced from third-party verification providers and credit reference agencies.
Communications data - records of correspondence with customer support, including chat logs and email exchanges.

Special category data is not collected unless required by law or where explicit consent has been obtained.

4. Purposes and Legal Bases for Processing

Personal data is processed for the following purposes and on the following lawful bases:

Account registration and management - performance of a contract.
Identity verification and age checks (KYC) - legal obligation.
Anti-money laundering (AML) compliance - legal obligation.
Fraud detection and prevention - legitimate interests.
Responsible gambling monitoring and intervention - legal obligation / legitimate interests.
Customer support and complaint handling - performance of a contract.
Regulatory reporting to the Gambling Commission - legal obligation.
Marketing communications (where consent is given) - consent.
Website security and technical maintenance - legitimate interests.

Where processing is based on legitimate interests, an assessment is carried out to ensure that such interests do not override the fundamental rights and freedoms of data subjects. Users have the right to object to processing carried out on this basis. Further information is provided in Section 7.

Personal data may be shared with third parties in the following circumstances, to the extent necessary for the purposes set out in this Privacy Policy:

Identity verification and fraud prevention providers - third-party services used to verify identity and check against fraud and sanctions databases. These providers act as processors under the instructions of the company.
Credit reference agencies - where required for verification purposes.
Regulatory and law enforcement authorities - including the UK Gambling Commission, the Information Commissioner’s Office (ICO), HMRC and law enforcement bodies, where disclosure is required by law.
Payment processors - to facilitate financial transactions associated with an account.
IT and security service providers - to support the operation, maintenance and security of systems.

Personal data is not sold to third parties. Personal data is not shared for third-party marketing purposes without explicit consent.

Where personal data is transferred outside the United Kingdom or the European Economic Area, appropriate safeguards are implemented, such as standard contractual clauses approved under UK law.

6. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory and accounting obligations.

As a general principle, account data is retained for a minimum of six years from the date of account closure or from the last date of account activity, whichever is later. This retention period reflects obligations under anti-money laundering legislation and Gambling Commission requirements.

Once data is no longer required, it is securely deleted or anonymised in accordance with internal data retention procedures.

Data subjects have the following rights in relation to their personal data, subject to applicable legal limitations and exemptions:

Right to be informed - to receive clear information about how personal data is used, as set out in this Privacy Policy.
Right of access - to request a copy of the personal data held (Subject Access Request).
Right to rectification - to request correction of inaccurate or incomplete data.
Right to erasure - to request deletion of personal data, subject to legal and regulatory retention obligations.
Right to restrict processing - to request that use of personal data is limited in certain circumstances.
Right to object - to object to processing based on legitimate interests or for direct marketing purposes.
Right to data portability - to receive personal data in a structured, commonly used and machine-readable format.
Right to withdraw consent - where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact the DPO using the details in Section 9. Valid requests are responded to within one calendar month of receipt, free of charge. In the case of complex or multiple requests, this period may be extended by a further two months. In such cases, notification of the extension and reasons for it will be provided.

Subject Access Requests may cover records such as account history, transaction logs, customer support communications and internal account notes. Information will be provided in a structured electronic format such as CSV or PDF.

8. Automated Decision-Making and Profiling

Automated processing, including profiling, may be used in connection with responsible gambling monitoring, fraud detection and identity verification.

Where automated processing produces decisions that have a significant effect on an individual, that individual has the right to request human review of the decision, to express their point of view and to contest the outcome.

Upon request, information will be provided about any automated decision-making that materially affects an account.

9. Contact and Complaints

To exercise data protection rights, submit a Subject Access Request, or raise a concern about the handling of personal data, contact the Data Protection Officer:

Email: [email protected]
Post: Data Protection Officer, Park Lane Club, [Registered Address]

Individuals who are not satisfied with the response received, or who believe that their personal data has been processed in breach of data protection law, have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Changes to This Privacy Policy

This Privacy Policy is reviewed periodically and updated when required to reflect changes in law, regulatory guidance or internal practices. The current version of the Privacy Policy is published on the website.

Where changes are material, registered users will be informed in advance by email or through a notice on the website before the changes take effect.