Privacy Policy

This Privacy Policy explains how personal data is collected and used when you access or use the Bet Storm online casino and sportsbook made available through bedstormi.com (the "Website"), including the specific UK-facing project identified as Bet Storm. It applies to all visitors to the Website, registered players, and any other individuals whose data we process in connection with our remote gambling services.

Please read this Privacy Policy carefully, as it forms part of the terms that govern your relationship with us. This document is intended to provide transparent information about our data practices and your rights under applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018.

Effective date: 1 January 2026

Who We Are

The Website and the Bet Storm project are operated under the Bet Storm brand on a white-label basis by ProgressPlay Limited ("ProgressPlay", "we", "us", or "our"). For the purposes of UK data protection law, ProgressPlay Limited is the primary data controller in respect of personal data processed in connection with the Website and associated gambling services offered to UK players.

Legal entity details:

Company name: ProgressPlay Limited
Legal form: Limited liability company
Registration number: C58305
Register: Malta company registry
Registered / legal address: Soho Office, 3A, Punchbowl Centre, Elia Zammit Street, St. Julians, STJ3154, Malta

Gambling licences and regulatory context (UK players):

ProgressPlay Limited is licensed and regulated by the UK Gambling Commission ("UKGC") under account number 39335 to provide remote casino and sports betting services to players in the United Kingdom.
For certain non-UK players, services may be provided under a licence from the Malta Gaming Authority (MGA/B2C/231/2012). The Website primarily targets UK players in GBP; access from some other jurisdictions (including parts of the EU, the USA and Australia) may be restricted.
eCOGRA acts as an alternative dispute resolution (ADR) provider for gambling-related disputes involving ProgressPlay Limited brands, including Bet Storm.

Data protection contact: We take data protection and privacy seriously. You may contact our data protection team (including our Data Protection Officer, where formally appointed) using the contact details published from time to time in the "Contact Us", "Support", or similar sections on bedstormi.com, or via any support channels available in your player account. These contact points are the primary channels for privacy-related queries, requests, or complaints.

Because the Website operates as a white-label platform, some marketing and affiliate activities may be performed by third parties. However, ProgressPlay Limited remains responsible for the core operation of the Website, for player fund protection in line with its UKGC "Medium Protection" classification, and for ensuring that personal data is handled in accordance with this Privacy Policy.

What Personal Data We Collect

We collect only the personal data that is necessary for lawful operation of our remote gambling services, compliance with regulatory obligations, and improvement of the Website. The specific categories of data collected may vary depending on how you interact with the Website, but typically include the following:

Identity and contact data

Registration data: full name, username, title, date of birth, and proof of age to meet UK 18+ requirements and mandatory age verification rules.
Contact details: email address, residential address, country of residence, postcode, and (where provided) telephone number or mobile number.
Verification/KYC data: copies or details of identity documents (such as passport, ID card, driving licence), proof of address, and where required under KYC/AML checks, additional documents relating to source of funds or affordability.

Technical and usage data

Technical identifiers: IP address, device identifiers, browser type and version, operating system, language settings, and time zone.
Log and session data: login timestamps, session duration, pages viewed, referral URLs, clickstream data, and error or crash logs.
Device and network data: information about your device hardware, connection type, and mobile network (where applicable) used to access the Website.

Financial and transactional data

Payment data: payment method type (e.g. debit card, e-wallet, Pay via Phone), partial card details (masked where possible), transaction identifiers, deposits, withdrawals, chargebacks, and refunds processed through our payment partners.
Account and balance data: account balances, bonus balances, wagering progress, and records of player funds which are held in a manner consistent with the UKGC's "Medium Protection" requirements (segregated from business funds but not fully safeguarded in insolvency).
Financial verification data: information supplied to support AML or source-of-funds checks, as required by law and by our licence conditions.

Behavioural and gambling-related data

Betting and gaming history: wagers placed, game rounds, outcomes, wins and losses, stakes, odds, game preferences, session length, and frequency of play.
Responsible gambling data: self-exclusion information (including GamStop registrations for UK players), deposit limits, reality checks, cooling-off periods, and records of responsible gambling interactions.
Website interaction data: clicks, navigation paths, and responses to promotions, which help us understand how you use the Website and how our services perform.

Communications and marketing data

Communications: copies of emails, live chat logs, support tickets, and any feedback or complaints you submit via contact forms or other support channels.
Marketing preferences: your consents and preferences regarding receipt of marketing communications (email, SMS, push notifications, phone), and records of opt-in/opt-out decisions.

Cookies and similar technologies

Cookie identifiers: unique identifiers stored via cookies, web beacons, pixels, SDKs, or similar technologies on your device to recognise your browser or device.
Analytics data: aggregated statistics on usage, performance, and traffic patterns collected via first-party and certain third-party analytics tools.
Advertising data: where applicable and based on your consent, online identifiers and cookie data that allow us or selected partners to deliver personalised offers or measure marketing performance.

We do not intentionally collect special categories of personal data (such as health information) except where you voluntarily disclose such information to us, for example when informing us about gambling-related vulnerabilities so that we can apply enhanced protections. When such information is processed, it is handled with heightened safeguards and only where strictly necessary for responsible gambling or legal purposes.

Legal Basis for Processing

We process your personal data only where we have a lawful basis under applicable data protection law. Different legal grounds may apply to different processing activities:

Contractual necessity

We process identity, contact, technical, transactional, and betting data because it is necessary to enter into and perform our contract with you. This includes creating and managing your player account, enabling deposits and withdrawals, providing access to games and betting markets, and delivering customer support.
Without this processing, we would not be able to provide the Website or fulfil our obligations under the terms and conditions, including payment of winnings and application of bonuses.

Compliance with legal obligations

As a UKGC-licensed operator and a regulated entity under AML and counter-terrorist financing laws, we must carry out age verification, identity checks, affordability assessments where appropriate, transaction monitoring, and reporting of suspicious activities.
We therefore process and retain certain identity, KYC, financial, and transactional data to comply with these legal and regulatory obligations, including AML/CTF regulations, responsible gambling requirements, and requests from regulators or law enforcement authorities.

Legitimate interests

We process certain data because it is necessary for our legitimate interests, provided these are not overridden by your interests or fundamental rights. These interests include:
- Ensuring the security and integrity of our systems and games (for example, preventing fraud, abuse, and cheating).
- Monitoring and improving website performance, customer service, and player experience, including analytics and service optimisation.
- Protecting our business, enforcing our terms and conditions, and managing disputes or claims.
Where we rely on legitimate interests, we balance our interests against your privacy expectations and implement appropriate safeguards such as pseudonymisation, minimisation, and access controls.

Consent

In some situations we process your personal data based on your consent, for example:
- Sending direct electronic marketing communications (such as promotional emails or SMS) where consent is required.
- Using non-essential cookies or similar technologies for targeted advertising or advanced analytics, where local e-privacy rules require consent.
You may withdraw your consent at any time via your account settings, by using unsubscribe links in our communications, or by adjusting your browser and cookie preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Protection of vital interests and public interest

In rare cases, we may process personal data where necessary to protect an individual's vital interests (for example, communicating with emergency services in case of serious harm) or for reasons of substantial public interest as recognised by law, such as preventing serious crime or significant financial fraud.

Purpose of Processing

We use your personal data only for specified, explicit, and legitimate purposes, and we do not process it in a manner incompatible with those purposes. The main purposes are:

Provision of gambling and related services: to register and operate player accounts; verify age and identity; provide access to casino games and sportsbook markets; process deposits, bets, and withdrawals; administer bonuses and loyalty programmes; and deliver customer support via email, chat, or other channels.
Regulatory compliance and responsible gambling: to comply with UKGC, MGA, AML/CTF, and other legal requirements; to participate in the GamStop self-exclusion scheme for UK players; to apply self-exclusion, deposit limits, time-outs, and other responsible gambling tools; and to maintain appropriate records for audit and regulatory inspections.
Service improvement and analytics: to monitor performance of the Website, understand player behaviour (e.g., popular games, typical session lengths), identify technical issues, and improve our products, interfaces, and customer journey based on aggregated analytics.
Marketing, promotions, and personalisation: to send you offers, bonuses, and news relating to Bet Storm and bedstormi.com in accordance with your marketing preferences; to personalise content and promotions using your betting history and preferences; and to work with approved affiliates or advertising partners who promote our services.
Fraud detection and security: to detect and prevent fraudulent transactions, bonus abuse, money laundering, account takeover, and other security incidents, including through risk scoring and behavioural analysis tools.
Business operations and dispute management: to perform internal reporting, financial reconciliation, accounting, auditing, and to manage complaints, chargebacks, legal claims, and disputes (including those handled via eCOGRA or other ADR mechanisms).

Where we intend to use your data for a new purpose that is not compatible with the purposes described in this Privacy Policy, we will inform you of that new purpose and the applicable legal basis before we start such processing, and where required we will seek your consent.

Disclosure & Sharing

We do not sell your personal data. However, we may share your data with carefully selected third parties where this is necessary for the operation of the Website, to comply with our legal obligations, or where you have given your consent. These recipients fall into the following categories:

Service providers and business partners

Payment processors and financial institutions: banks, card schemes, e-wallet providers, Pay via Phone and similar providers, and payment gateways that process your deposits and withdrawals and support fraud prevention and AML checks.
Platform and game providers: software vendors that supply casino games, sportsbook odds, and white-label infrastructure, and that may process technical, gameplay, and session data as our processors.
IT and security vendors: hosting providers, data centres, content delivery networks, customer support platforms, email/SMS gateways, analytics tools, and security solution providers that help us operate and protect the Website.

Regulators, authorities, and dispute resolution bodies

Regulators and law enforcement: the UK Gambling Commission, Malta Gaming Authority, data protection authorities (such as the UK Information Commissioner's Office), tax authorities, law enforcement agencies, or other competent authorities where we are legally required or permitted to disclose information (for example, to comply with licence conditions, AML obligations, or lawful requests).
ADR bodies and courts: eCOGRA or other approved ADR entities that handle gambling-related disputes; courts, legal advisers, and professional consultants in connection with claims, proceedings, or legal advice.

Affiliates, marketers, and advertising networks

Affiliate partners: third-party affiliates who promote Bet Storm and bedstormi.com and who may receive aggregated or limited personal data (for example, tracking IDs) to verify marketing performance and commission calculations.
Advertising and analytics partners: where permitted by law and subject to your cookie and marketing preferences, selected third parties that provide advertising or analytics services. These partners may use cookies or similar technologies to help us measure campaigns and, where applicable, deliver more relevant offers.

Corporate transactions

In the event of a business transaction, such as a merger, acquisition, corporate reorganisation, or sale of assets, your personal data may be transferred to one or more third parties as part of that transaction. In such cases, we will ensure that your rights are protected and that you are informed of any material changes to the controller's identity.

Whenever we share personal data with processors or other recipients, we require them to protect your data in accordance with applicable law, to use it only for specified purposes, and to implement appropriate security measures. Where a recipient acts as an independent controller (for example, certain payment providers or regulators), their own privacy policy will govern their processing activities.

International Transfers

Given the international nature of online gambling and our corporate structure, your personal data may be transferred to and processed in countries outside the United Kingdom, including:

Malta and other EEA countries: where ProgressPlay Limited operates infrastructure or where certain game providers, payment processors, or support teams are located.
Other non-EEA countries: where specific service providers, technology vendors, or support partners are based (for example, data centres or specialist fraud-prevention providers).

Some of these countries may not offer the same level of data protection as the UK. In such cases, we implement appropriate safeguards to ensure that your personal data remains protected, including:

Transferring data only to countries recognised by the UK government as providing an adequate level of protection; and/or
Using standard contractual clauses approved under UK data protection law (often together with the UK International Data Transfer Addendum or equivalent instruments) to contractually require recipients to protect your data; and
Applying additional technical and organisational safeguards, such as encryption, access controls, and data minimisation, where appropriate.

You may contact us via the channels provided on bedstormi.com if you would like more information about the specific safeguards we use for international data transfers.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, and reporting obligations, and to resolve disputes. Retention periods may vary depending on the category of data and applicable law, but we generally apply the following principles:

Player account and identity data: Normally kept for the duration of your active account and for a period of up to five (5) years after account closure, or longer where required by AML, gambling, or tax laws. In some cases, AML regulations or UKGC licence conditions may require retention for up to seven (7) years from the date of the last transaction or from account closure.
Transactional and betting data: Deposit, withdrawal, and betting records are retained for at least five (5) years from the date of the relevant transaction, and potentially longer where required for regulatory, accounting, or legal purposes.
Responsible gambling and self-exclusion data: Records relating to self-exclusion, GamStop enrolments, and responsible gambling interactions are retained for the duration of the relevant measures and for an appropriate period thereafter to ensure compliance and to protect players from harm.
Marketing and consent records: Information about consents and preferences for marketing is retained for as long as we send you marketing communications and for a period afterwards to demonstrate compliance with consent requirements (typically up to two (2) years from the last marketing contact or until a lawful objection is recorded).
Technical and analytics data: Logs and analytics data may be retained for shorter periods (for example, 6 - 24 months) depending on our operational needs and security requirements.

When personal data is no longer required, we will either securely delete it or anonymise it so that it can no longer be associated with you. In some cases, we may aggregate data for statistical or analytical purposes; in such cases, we ensure that individuals cannot be re-identified from the data. If you exercise your right to erasure, we will also take into account any overriding legal obligations that may require us to retain certain information.

Your Rights

Under the UK GDPR and other applicable data protection laws, you have a number of rights in relation to your personal data. These rights may vary depending on your place of residence, but for UK and EU/EEA players generally include:

Right of access: to obtain confirmation as to whether we process your personal data and, if so, to receive a copy of that data and additional information about our processing.
Right to rectification: to request correction of inaccurate or incomplete personal data. You can often update certain details directly in your player account.
Right to erasure: to request deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for processing. This right may be limited where we must retain data to comply with legal or regulatory obligations.
Right to restriction of processing: to request that we temporarily restrict processing of your data in certain situations, such as while verifying the accuracy of data or where you have objected to processing.
Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interests. You also have an absolute right to object to processing of your data for direct marketing purposes at any time.
Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and to request that we transmit that data directly to another controller, where technically feasible and where processing is based on consent or contractual necessity.
Right to withdraw consent: where we rely on your consent (for example, for marketing or certain cookies), you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before withdrawal.

Mexican data protection alignment: Although the Website primarily targets UK players and some non-UK markets under the MGA licence, if you are located in Mexico and our services are lawfully available to you, your rights will generally align with those recognised under Mexican data protection law (including ARCO rights - access, rectification, cancellation, and opposition - under the Federal Law on the Protection of Personal Data Held by Private Parties). In practice, the procedures described in this section (access, correction, deletion, restriction, objection, and portability) are intended to be consistent with those standards, subject to any mandatory legal or regulatory obligations that apply to us.

How to exercise your rights:

Submit your request via the support or contact channels listed on bedstormi.com (for example, through the "Contact Us" page, live chat, or support email if specified) and indicate that your request relates to privacy or data protection.
Provide sufficient information to verify your identity and to locate your account (such as username, registered email address, and any relevant reference numbers). We may request additional information if needed to confirm your identity and protect your account.
We will review your request and respond within one (1) month of receipt. In complex cases, or where multiple requests are made, this period may be extended by up to a further two (2) months, in which case we will inform you of the extension and reasons for the delay.
We will normally handle your request free of charge. However, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, in accordance with applicable law.

You also have the right to lodge a complaint with a supervisory authority (see the "Complaints & Contacts" section below) if you believe that your rights have been infringed or that your personal data has been processed unlawfully.

Cookies & Tracking Technologies

The Website uses cookies and similar technologies to enable core functionality, improve performance, and support marketing and analytics. Cookies are small text files stored on your device when you visit the Website. Depending on their function and duration, we categorise these technologies as follows:

Types of cookies

Session cookies: temporary cookies that are stored on your device only while your browser is open and are automatically deleted when you close your browser. They are used, for example, to maintain your login session and keep your bets or game state active during a session.
Persistent cookies: cookies that remain on your device for a predefined period or until you delete them. They help us remember your preferences (such as language or region) and improve your experience when you return to the Website.
First-party cookies: cookies set directly by bedstormi.com that are primarily used to operate and enhance the Website.
Third-party cookies: cookies set by third-party providers, such as analytics or advertising partners, that support functions like usage statistics, fraud prevention, or marketing performance measurement.

Purposes of cookies

Strictly necessary / functional: required to operate the Website and provide core functionality, such as enabling secure login, managing sessions, and processing payments. These cookies cannot be switched off via our internal tools because the Website cannot function properly without them.
Performance / analytics: used to collect aggregated information about how visitors use the Website (for example, pages visited, time spent, error messages). This helps us improve performance, diagnose issues, and optimise user experience.
Advertising / targeting: used, where applicable and subject to your consent, to deliver more relevant offers, measure campaign effectiveness, and limit how often you see a particular advertisement. These may include pixel tags or similar technologies used by our affiliates or advertising partners.

Cookie management

You can manage your cookie preferences through your browser settings, where you can choose to block or delete cookies. Please note that blocking some types of cookies may impact your experience of the Website and some features may not function properly.
Where available, we may provide an internal cookie preference panel or consent management tool on bedstormi.com, allowing you to accept or reject certain categories of cookies (for example, analytics or advertising cookies) while keeping strictly necessary cookies enabled.
For more detailed information about our use of cookies and similar technologies, and how long they remain active, please refer to any dedicated Cookie Policy or cookie information page that may be made available on the Website.

Data Security

We implement technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or damage. While no online service can guarantee absolute security, we aim to maintain a security posture that is appropriate to the risks associated with remote gambling services.

Encryption: data transmitted between your browser and our servers is protected using industry-standard encryption technologies (such as TLS 1.2 or higher), helping to ensure the confidentiality and integrity of your information in transit. Sensitive data is stored using appropriate encryption or pseudonymisation measures where feasible.
Access controls: access to personal data is restricted to authorised personnel and service providers who need it for legitimate business purposes and are bound by confidentiality obligations. Access rights are reviewed periodically and revoked when no longer required.
Authentication and account protection: we encourage the use of strong passwords and may offer additional security features (for example, multi-factor authentication) to help protect player accounts. We also monitor for unusual login patterns or suspicious activity to reduce the risk of account compromise.
Network and infrastructure security: our systems are hosted in secure environments with firewalls, intrusion detection or prevention systems, and other security controls designed to prevent unauthorised access and cyber attacks.
Organisational measures and training: staff with access to personal data receive training on data protection and security responsibilities, including handling of KYC documents, financial data, and responsible gambling information.
Risk management and audits: we regularly review and update our security controls and may engage external specialists to perform security assessments or audits. Where applicable and proportionate, we align our practices with recognised international security standards, while ensuring compliance with UK regulatory expectations.
Incident response: we maintain procedures to detect, investigate, and respond to suspected data breaches or security incidents. Where required by law, we will notify the relevant supervisory authority and affected individuals without undue delay.

In addition to data security, player funds are managed in accordance with the UKGC's "Medium Protection" category, meaning that customer funds are kept in a separate account from business funds, although they may not be fully protected in the event of insolvency. This classification relates to financial protection rather than personal data, but it forms part of our overall risk and compliance framework.

Complaints & Contacts

We are committed to handling your personal data fairly and transparently. If you have questions, concerns, or complaints about this Privacy Policy or our data practices, you should contact us first so that we can attempt to resolve the issue.

How to contact us

Online contact: use the contact, support, or feedback forms available on bedstormi.com or through your player account interface.
Support channels: you may contact our customer support team using the communication methods (such as email or live chat) indicated in the "Contact Us" or "Help" sections of the Website.
Postal correspondence: you may write to ProgressPlay Limited at its registered address: Soho Office, 3A, Punchbowl Centre, Elia Zammit Street, St. Julians, STJ3154, Malta, clearly marking your correspondence as "Data Protection" or "Privacy".

Internal complaint procedure

Step 1 - Contact support: raise your concern with our customer support team using one of the channels above, providing as much detail as possible (including your username or account ID, relevant dates, and a description of your concern).
Step 2 - Escalation to data protection team: if your issue is not resolved or relates specifically to privacy, you may ask for your complaint to be escalated to our data protection team or Data Protection Officer (where applicable). We may ask for additional information to better understand your concern.
Step 3 - Response timeframe: we aim to acknowledge privacy-related complaints promptly and to provide a substantive response within one (1) month of receipt. Complex matters may require more time; in such cases we will inform you of any extension and explain the reasons.

Escalation to supervisory or dispute resolution bodies

UK data protection authority: if you are located in the UK and are not satisfied with how we have handled your complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
EU/EEA data protection authorities: if you are located in the EU/EEA and covered by EU data protection law, you may lodge a complaint with your local supervisory authority or with the authority of your habitual residence or place of work.
Mexican data protection authority: if you are located in Mexico and our services are lawfully available to you, you may have the right to submit a complaint to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) or any successor authority, in accordance with Mexican data protection regulations.
Gambling dispute resolution (non-data protection): for disputes relating to gambling transactions or outcomes rather than data protection (for example, account balances, bet settlements, or bonus terms), you may be able to refer your complaint to eCOGRA or another approved ADR provider in accordance with our terms and your jurisdiction's rules.

We encourage you to contact us first so we have an opportunity to resolve your concerns directly before you approach a supervisory authority or ADR body.

Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, regulatory guidance, or the features of the Website. When we make material changes, we will take appropriate steps to inform you in advance.

Notification methods: we may notify you of updates via email (using the address associated with your account), by displaying an in-account notification or banner when you next log in, and/or by publishing a notice or highlighted link on bedstormi.com.
Version control and effective date: each version of this Privacy Policy will be identified by an effective date and, where appropriate, a version reference. Significant changes may be accompanied by a brief summary of the modifications (for example, changes to data sharing practices, new purposes of processing, or changes driven by regulatory developments).
Advance notice for significant changes: where changes are likely to materially affect your rights or the way we use your personal data, we will provide, where reasonably practicable, at least 30 days' advance notice before the new version becomes effective, except where immediate changes are required by law or to address urgent security or compliance issues.
Your choices: if you do not agree with an updated Privacy Policy, you may close your account and stop using the Website. Continued use of the Website after the effective date of an updated policy will normally be treated as your acknowledgement of the changes, to the extent permitted by law.

Last updated: January 2026