Kambi Player Fair Processing Notice
This Kambi Player Fair Processing Notice (“the Kambi Player FPN”) is applicable to players only. By players we mean registered users who have an account or profile with a gambling operator who uses the Kambi sports betting platform (“Operators”).
Kambi Group plc is a company registered in Malta, Level 3, Quantum House, Abate Rigord Street, Ta’ Xbiex, XBX1120 (“Kambi HQ”). Kambi HQ, working with the other Kambi entities (names available on request using the contact information provided below - together “Kambi”, “we”, “us” and/or “our”), provides a sports betting platform solution for Operators. The solution involves Kambi reviewing and managing the bets placed through an Operator’s website (which uses the Kambi platform) so as to manage the risks associated with those bets. This Kambi Player FPN explains how we handle your Personal Data where you are a player and your bet has been moved through our platform. Please read this Kambi Player FPN carefully to understand how we will treat your Personal Data.
For the purposes of this Kambi Player FPN, Kambi is the “Data Controller” of your Personal Data. This is because when we process your Personal Data, we will (either acting alone or jointly with the Operators) make determinations about why and how your Personal Data is processed.
Types of data we collect/process:
We will collect certain information about you when you are a player. This information originates from the Operator you hold an account with. We get this information from them when they sign up to use our services and pass your information to us. Alternatively, we will collect this information directly from you by virtue of obtaining information about the device which you use to make a bet, which is then linked to the other information which we hold about you, as well as information about the actual bets you make. Additionally, there may be some information which we generate about you in order to provide our services.
By Personal Data, we mean information which, either by itself or when combined with other information that we hold or which is available to us, can be used to identify you.
The type of information we receive, collect, or otherwise process about you is as follows:
- technical information from your computer/laptop/tablet/smartphone, including:
- your IP address;
- your device operating system;
- the number of bets you place;
- time of bet;
- your Operator username (if the Operator has provided this to us);
- your Operator identification number; and
- your Kambi issued identification number.
As you will note, Kambi does not, as a matter of course, hold your name, or contact information. The Personal Data which we process is restricted to the device you use to place bets, your Operator and Kambi unique identifiers, and information relevant to your playing behaviour. Unless you have used your real name as your username, we will only ever hold what is called pseudonymised information about you. What this means is that the only way we can identify you by name, will be when the information which we have is combined with information which an Operator has which would enable us to identify you by name. As noted, if you have used your real name as your username, then the information we hold about you may be directly identifiable and not pseudonymised.
Kambi does not collect or process special category personal data (i.e. information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, and data concerning your health, sex life or sexual orientation).
How we use your Personal Data:
Kambi will use your information in the following ways:
- tracking your betting activity;
- making decisions about you which may involve using computerised or automated technology, which may be reviewed by one of our analysts in order to assess your bets and playing activity, this would include:
- analysing your betting patterns;
- creating risk profiles about you by matching your Kambi ID to your behaviour;
- adjusting your betting limits depending on your risk profile;
- in extreme circumstances, preventing any further betting actions;
- reporting your activity back to the Operator; and/or
- validating your information (and in some cases matching it against information that has been collected by an Operator).
Our legal basis of Processing:
Under applicable Data Protection Law, we have to have a legal basis to process your Personal Data. The legal basis which we have outlined in this Kambi FPN includes (as relevant):
- Processing that is necessary for our own legitimate interests or those of third parties (including the other companies within Kambi and our Operator clients). These interests are:
- the management and audit of our business operations to ensure that they comply with all applicable laws, and good business practices;
- making assessments on your betting behaviour, which is a fundamental part of the service which we provide to Operators;
- sharing your personal data with our service providers, such as:
- IT systems, network providers, data storage and backup providers;
- professional services providers (such as lawyers; accountants, auditors, consultants);
- for analysis and research in connection with improving our approach to risk management and betting analysis, as well as product development;
- fulfilling our contracts with our Operators;
- promoting our products and services;
- compliance with regulatory obligations and best practice guidelines; and/or
- anonymising the data to continue to assess and enhance our services and products.
- Processing that is necessary to comply with a legal obligation – including:
- to process any data subject rights requests in accordance with Data Protection Laws;
- for compliance with legal and regulatory requirements (such as gambling regulations); and/or
- for activities relating to the prevention, detection and investigation of crime.
Who we may disclose your Personal Data to:
As outlined earlier in this Kambi Player FPN, Kambi will disclose to, or share your Personal Data with the Operator you have an account with as part of the service we provide to them, and ultimately to you. We share reports and results of risk assessments we have conducted on you with them. We will liaise with them where we need to limit your betting or make a decision on your account. We will also disclose your information to an Operator where we need to verify your identity in connection with a data subject rights request (please see below for further information).
Kambi will also disclose your Personal Data to law enforcement agencies, regulators, and other authorities with jurisdiction over us (or members of the Kambi group) if we have a legal obligation to do so, or it is in our legitimate interest, or is in the substantial public interest to do so. This includes exchanging information with government departments or gambling authorities.
We will also share your Personal Data, where it is lawful to do so, with:
- third parties in the event of a corporate or other transaction involving the sale or transfer of all or part of Kambi, or as otherwise required for any restructuring of Kambi;
- third party service providers, such as IT systems, network and back-up and storage providers;
- professional advisors, such as lawyers, accountants, auditors and/or consultants.
If you require further information about the above recipients of your Personal Data, please contact us using the contact information provided below.
How long your Personal Data is stored for:
Kambi will retain your Personal Data for as long as it is necessary to fulfil the purposes for which it was collected, particularly the provision of our services to an Operator.
As such, your Personal Data shall be retained for the duration of our contract with an Operator. After such time, we will only hold the information for so long as it is necessary for us to comply with our own legal obligations, or as may be otherwise necessary for our legitimate interests. Where we are advised by an Operator that you have closed your account, or following termination of our agreement with an Operator, we will either anonymise your Personal Data, or we will ensure that it is deleted in accordance with our records retention practices and procedures. If you would like further information about the time period for retention, please contact us using the contact information provided below.
As noted above, Kambi generally keeps pseudonymised data about you. If you cease to be a player for an Operator, or if an Operator ceases to use our services, we may anonymise the pseudonymised information such that you can no longer be identified, and the information can then be used, in anonymous format, for analysis purposes.
Keeping your data secure:
Kambi is committed to and maintains a high level of security to protect data, including Personal Data. Kambi has taken, and will continue to take reasonable steps to keep our data and Personal Data secure and free from unauthorised access by use of technology and internal systems which will be updated as new technology becomes available and is appropriate to our systems.
This also includes ensuring that any service providers that we use, and who assist us to provide our services are also equally obliged to implement and maintain high standards of security to protect Personal Data. These standards are embedded in our contracts with our service providers.
What are your rights?
Your rights are as follows:
- the right to be informed about the Processing of your Personal Data;
- the right to have your Personal Data corrected if it is inaccurate and to have incomplete Personal Data completed;
- the right to object to Processing of your Personal Data;
- the right to restrict Processing of your Personal Data;
- the right to have your Personal Data erased (the “right to be forgotten”);
- the right to request access to your Personal Data and to obtain information about how we Process it;
- the right to move, copy or transfer your Personal Data (“Data Portability”); and
- rights in relation to automated decision making, including profiling which has a legal effect, or which causes a significant effect.
Please note that some of the above rights are qualified, so they will not be applicable in all circumstances. Additionally, we are unable to comply with a request where we are unable to verify your identity. Where this is the case we will balance the rights of the request against the potential detriment that could be suffered where information is handed out to the wrong person, which would amount to a personal data breach. We recommend that you make your request to the Operator with whom you have an account with .
Transfers outside of the EEA:
Yes, as a provider of a global sports betting platform, your Personal Data will be transferred outside of the European Economic Area (EEA). We have to do this in order to provide our services to Operators, and you, regardless of the time of day when a bet is placed. In particular, your Personal Data will be transferred to:
- the Philippines;
Accordingly we will ensure that appropriate safeguards are in place to protect that transfer, such as contractual obligations being imposed on the recipients of your Personal Data. Those obligations require the recipient to protect your Personal Data to the standard required in the EEA. Safeguards also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information.
If you have a query about any aspect of this Kambi Player FPN or wish to have any part of it clarified, or in the event that you have a complaint about the way in which your details are used or stored by Kambi, please contact our Data Protection Officer at - firstname.lastname@example.org.
In relation to Kambi’s operations within the European Union, you have the right to complain to the local Data Protection regulator, applicable to the relevant Kambi Entity which is processing your Personal Data. As Kambi is headquartered in Malta, and has one of its main bases of operations in the UK, further information is available on these two Data Protection regulators at: