Last Updated: March 2025

This Privacy Policy explains how UK Cravento Ltd (“we,” “our,” or “us”) collects, uses, protects, and shares your personal information when you visit our website or use our services. We are committed to protecting your privacy and ensuring your personal data is handled in accordance with UK GDPR, the Data Protection Act 2018, and other applicable data protection laws.

1. Information Controller and Contact Details

Data Controller

UK Cravento Ltd is the data controller responsible for your personal information collected through our website and services.

Contact Information:

• Company: UK Cravento Ltd
• Address: London, United Kingdom
• Email: privacy@cravento.com
• Data Protection Officer: privacy@cravento.com

Regulatory Authority

Our data protection practices are overseen by the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

2. Information We Collect

Information You Provide Directly

Account Registration When you create an account with us, we collect:

• Full name and username
• Email address
• Date of birth (for age verification)
• Country and region
• Communication preferences

Contact and Communication When you contact us, we collect:

• Contact details (name, email, phone number)
• Content of your messages and inquiries
• Support ticket information and resolution details
• Feedback and survey responses

Newsletter and Marketing When you subscribe to our communications:

• Email address
• Subscription preferences and interests
• Marketing consent records
• Engagement and interaction data

Information We Collect Automatically

Website Usage Data Our website automatically collects:

• Pages visited and time spent on each page
• Click-through rates and navigation patterns
• Search queries performed on our site
• Referral sources and exit pages
• Session duration and frequency of visits

Technical Information We automatically collect technical data about your device and connection:

• IP address and approximate geographic location
• Browser type, version, and language settings
• Operating system and device information
• Screen resolution and device capabilities
• Connection speed and network information

Cookies and Tracking Technologies We use various tracking technologies to collect:

• Cookie identifiers and preferences
• Local storage data for website functionality
• Analytics and performance metrics
• Advertising and marketing attribution data

Information from Third Parties

Analytics Providers We receive aggregated data from:

• Google Analytics (website performance and user behavior)
• Hotjar (user experience and heatmap data)
• Social media platforms (engagement and sharing statistics)

Security Services We may receive information from:

• Fraud prevention services
• Security monitoring tools
• IP reputation databases
• Spam and abuse detection systems

Public Sources We may supplement our data with publicly available information:

• Social media profiles (when you interact with us)
• Professional networking sites
• Public records and directories (for verification purposes)

3. How We Use Your Information

Primary Purposes

Service Provision and Enhancement

• Providing access to our website and content
• Maintaining and improving website functionality
• Personalizing content and user experience
• Responding to your inquiries and providing customer support
• Processing newsletter subscriptions and communications

Security and Fraud Prevention

• Protecting our website and users from security threats
• Detecting and preventing fraudulent activities
• Monitoring for abuse and terms violations
• Maintaining system integrity and availability

Analytics and Research

• Understanding how users interact with our website
• Identifying popular content and user preferences
• Conducting research to improve our services
• Analyzing trends and patterns in user behavior

Communication and Marketing

Service Communications

• Sending important updates about our services
• Notifying you of changes to our terms or policies
• Providing technical support and assistance
• Confirming your actions and account changes

Marketing Communications (with consent)

• Sending newsletters and educational content
• Promoting new features and content
• Sharing industry news and insights
• Inviting participation in surveys and feedback requests

Legal and Compliance

Legal Obligations

• Complying with applicable laws and regulations
• Responding to legal requests and court orders
• Maintaining records as required by law
• Cooperating with regulatory investigations

Business Operations

• Managing our business operations and administration
• Conducting financial and accounting activities
• Planning and strategic decision-making
• Mergers, acquisitions, or business transfers

4. Legal Basis for Processing

We process your personal information based on the following legal grounds under UK GDPR:

Consent

• Newsletter subscriptions and marketing communications
• Cookie usage (except essential cookies)
• Optional features and enhanced functionality
• Participation in surveys and research

Contractual Necessity

• Providing our website services
• Managing user accounts
• Processing support requests
• Delivering requested content and information

Legitimate Interests

• Website analytics and performance monitoring
• Security and fraud prevention
• Business administration and operations
• Research and development activities

Legal Obligation

• Compliance with applicable laws and regulations
• Response to legal requests and investigations
• Regulatory reporting requirements
• Record retention as required by law

5. Information Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

Service Providers and Processors

Web Hosting and Infrastructure

• Cloud hosting providers for website and data storage
• Content delivery networks for performance optimization
• Backup and disaster recovery services
• Technical maintenance and support providers

Analytics and Marketing

• Google Analytics for website performance analysis
• Email marketing platforms for newsletter delivery
• Social media management tools
• Customer relationship management systems

Security and Fraud Prevention

• Security monitoring and threat detection services
• Fraud prevention and risk assessment tools
• Identity verification and age checking services
• Compliance and regulatory reporting tools

Legal and Regulatory Requirements

Law Enforcement and Legal Process

• Response to court orders, subpoenas, and legal requests
• Compliance with regulatory investigations
• Cooperation with law enforcement agencies
• Protection of our legal rights and interests

Regulatory Compliance

• Reporting to gambling regulators when required
• Compliance with anti-money laundering obligations
• Tax and financial reporting requirements
• Industry regulatory requirements

Business Transfers

Corporate Transactions In the event of a merger, acquisition, or sale of our business:

• Information may be transferred to the acquiring entity
• Equivalent privacy protections will be maintained
• Users will be notified of significant changes
• Options for data deletion may be provided

6. International Data Transfers

Transfer Safeguards

When we transfer your personal information outside the UK, we ensure adequate protection through:

Adequacy Decisions

• Transfers only to countries recognized as having adequate data protection standards
• Regular monitoring of adequacy status changes
• Alternative safeguards if adequacy status changes

Standard Contractual Clauses

• EU-approved standard contractual clauses with international partners
• Additional security measures beyond standard requirements
• Regular auditing of international partners’ practices

Specific Safeguards

• Technical and organizational measures for data protection
• Encryption and security protocols for data transmission
• Contractual obligations for data protection and security

Primary Transfer Locations

We may transfer data to:

• United States: For analytics and marketing services (with appropriate safeguards)
• European Union: For cloud hosting and technical services
• Other jurisdictions: Only with adequate protection measures

7. Data Security and Protection

Technical Safeguards

Encryption and Transmission Security

• All data transmission protected by SSL/TLS encryption
• At-rest encryption for sensitive stored data
• Secure API connections with authentication protocols
• Regular security certificate updates and monitoring

Access Controls and Authentication

• Role-based access controls for all systems
• Multi-factor authentication for administrative access
• Regular access reviews and permission audits
• Automated access logging and monitoring

Infrastructure Security

• Secure cloud hosting with ISO 27001 certified providers
• Regular security updates and patch management
• Network monitoring and intrusion detection systems
• Automated backup systems with encryption

Organizational Safeguards

Staff Training and Policies

• Regular privacy and security training for all team members
• Clear data handling policies and procedures
• Background checks for personnel with data access
• Confidentiality agreements and privacy obligations

Incident Response

• Documented data breach response procedures
• 72-hour notification protocols for relevant authorities
• User notification procedures for data breaches
• Regular testing and updating of response plans

Third-Party Management

• Due diligence assessments for all data processors
• Contractual data protection obligations
• Regular auditing of third-party security practices
• Incident notification requirements in contracts

8. Data Retention and Deletion

Retention Periods

Account Data

• Active accounts: Retained while account remains active
• Inactive accounts: Deleted after 3 years of inactivity
• Verification data: Retained for 7 years for regulatory compliance
• Communication records: Retained for 2 years after last contact

Website Usage Data

• Analytics data: Personal identifiers removed after 26 months
• Server logs: Retained for 12 months for security purposes
• Cookie data: Expires according to individual cookie settings
• Performance monitoring: Anonymized after 6 months

Marketing Data

• Newsletter subscriptions: Retained until unsubscribe
• Marketing analytics: Anonymized after 3 years
• Consent records: Retained for 7 years for compliance
• Unsubscribe requests: Processed immediately, record retained for compliance

Deletion Procedures

Automated Deletion

• Expired session data automatically removed
• Inactive account data scheduled for automatic deletion
• Cookie expiration honored automatically
• Temporary processing data purged regularly

Manual Deletion Requests

• User requests processed within 30 days
• Verification of identity required for deletion requests
• Notification of completed deletion provided
• Some data may be retained for legal compliance

9. Your Rights and Choices

Under UK GDPR, you have several rights regarding your personal information:

Access and Portability Rights

Right of Access

• Request a copy of all personal information we hold about you
• Receive information about how your data is processed
• Obtain details about data sources and retention periods
• Get information about data sharing and international transfers

Data Portability

• Receive your data in a structured, machine-readable format
• Transfer your data to another service provider
• Direct transfer to another controller where technically feasible

Correction and Control Rights

Right to Rectification

• Correct inaccurate or incomplete personal information
• Update outdated information in your account
• Add missing information where relevant
• Notify third parties of corrections where applicable

Right to Restrict Processing

• Limit how we use your information in certain circumstances
• Temporarily suspend processing while verifying accuracy
• Restrict processing for legal claim purposes
• Object to processing for direct marketing

Deletion and Objection Rights

Right to Erasure (“Right to be Forgotten”)

• Request deletion of your personal information
• Automatic deletion when data is no longer necessary
• Removal following withdrawal of consent
• Deletion when processing is unlawful

Right to Object

• Object to processing based on legitimate interests
• Opt out of direct marketing and profiling
• Object to automated decision-making
• Stop processing for research purposes

Exercising Your Rights

How to Make Requests

• Email us at privacy@cravento.com
• Include your full name and email address for verification
• Specify which rights you wish to exercise
• Provide details about your specific request

Response Timeframes

• Initial response within 48 hours acknowledging your request
• Full response within 30 days (may be extended for complex requests)
• Identity verification may be required before processing
• No charge for most requests (excessive requests may incur fees)

Appeal Process

• Contact us directly if unsatisfied with our response
• Escalate to our Data Protection Officer
• File a complaint with the ICO if needed
• Seek legal remedy through courts if necessary

10. Cookies and Tracking Technologies

Types of Cookies We Use

Essential Cookies

• Session management and security
• User preferences and settings
• Shopping cart and form data
• Security and fraud prevention

Analytics Cookies

• Website performance measurement
• User behavior analysis
• Content effectiveness tracking
• Technical error monitoring

Marketing Cookies

• Campaign attribution and tracking
• Social media integration
• Personalized content delivery
• Advertising performance measurement

Cookie Management

Your Choices

• Accept all cookies for full functionality
• Accept only essential cookies
• Customize cookie categories
• Reject all non-essential cookies

Browser Controls

• Manage cookies through browser settings
• Delete existing cookies
• Block future cookie placement
• Use private browsing modes

Detailed information about our cookie usage is available in our Cookie Policy.

11. Children’s Privacy

Age Restrictions

• Our website is not intended for users under 18 years of age
• We do not knowingly collect information from children under 18
• Age verification may be required for certain features
• Parents should monitor their children’s internet usage

Parental Responsibilities

• Parents and guardians should supervise children’s online activities
• Report any suspected underage account creation
• Contact us immediately if you believe we have collected information from a child
• We will promptly delete any information from users under 18

12. Privacy Policy Updates

When We Update This Policy

Reasons for Updates

• Changes in our data processing practices
• New features or services that affect privacy
• Legal or regulatory requirement changes
• Technology updates that impact data collection

Types of Changes

• Minor clarifications that don’t affect your rights
• Material changes that impact how we process your data
• Updates to contact information or procedures
• New legal obligations or rights

How We Communicate Changes

Notification Methods

• Updated policy posted on our website with revision date
• Email notification to registered users for material changes
• Website banner notification highlighting important updates
• Summary of changes provided in update communications

Your Options After Updates

• Review and understand the updated policy
• Exercise your rights if you disagree with changes
• Contact us with questions about updated practices
• Withdraw consent for new processing activities

13. Special Categories of Data

Sensitive Personal Information

We generally do not collect sensitive personal information (special categories of data under GDPR) such as:

• Health information
• Political opinions
• Religious beliefs
• Trade union membership
• Biometric data for identification
• Information about sexual orientation

Limited Collection

In rare circumstances, we may collect sensitive information:

• With your explicit consent
• For legal obligations or public interest
• For establishment of legal claims
• Where processing is necessary for substantial public interest

14. Automated Decision-Making and Profiling

Our Practices

We generally do not engage in automated decision-making that significantly affects you, including:

• Automated account approval or rejection
• Algorithmic content filtering (beyond basic spam prevention)
• Automated customer service decisions
• Profiling for discriminatory purposes

When We Use Automation

Limited automated processing may include:

• Spam and abuse detection
• Basic content personalization
• Technical performance optimization
• Security threat detection

Your Rights

• Right to human review of automated decisions
• Right to challenge automated decision outcomes
• Right to express your point of view
• Right to obtain an explanation of automated decision logic

15. Contact Information and Support

Privacy-Related Inquiries

General Privacy Questions

• Email: privacy@cravento.com
• Response Time: 48-72 hours
• Subject Line: “Privacy Inquiry”

Data Protection Rights Requests

• Email: privacy@cravento.com
• Response Time: 30 days maximum
• Subject Line: “Data Rights Request”

Data Protection Officer

• Email: dpo@cravento.com
• Response Time: 72 hours for urgent matters
• Subject Line: “DPO Inquiry”

Other Contact Methods

General Customer Support

• Email: support@cravento.com
• Response Time: 24 hours

Technical Issues

• Email: technical@cravento.com
• Response Time: 24-48 hours

Regulatory Complaints

Information Commissioner’s Office (ICO) If you’re not satisfied with our response to your privacy concerns:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Online: File a complaint through ICO’s website
• Mail: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

16. Additional Information

Privacy by Design

We implement privacy by design principles:

• Privacy considerations in all new features and services
• Data minimization and purpose limitation
• Transparency and user control
• Security and confidentiality by default

Regular Privacy Assessments

We conduct regular privacy impact assessments:

• Annual review of data processing activities
• Assessment of new technologies and features
• Evaluation of third-party processors and services
• Regular updates to privacy safeguards and controls

Industry Standards

We align our practices with industry standards:

• ISO 27001 information security management
• NIST cybersecurity framework
• Industry privacy best practices
• Relevant gambling industry guidance

---

Summary

This Privacy Policy explains how UK Cravento collects, uses, and protects your personal information. We are committed to transparency, giving you control over your data, and maintaining the highest standards of data protection.

Key Points:

• We collect minimal personal information necessary to provide our services
• We use your information to improve our website and provide better content
• We do not sell your personal information to third parties
• You have full control over your data and can exercise your rights at any time
• We implement strong security measures to protect your information

Contact Us: For any privacy-related questions or concerns, please contact us at privacy@cravento.com.

---

This Privacy Policy is effective as of March 2025 and applies to all users of the UK Cravento website and services.

Document Version: 2025.1
Last Review: March 2025
Next Scheduled Review: 2025