Privacy Policy for Users

PURPOSE OF THIS PRIVACY NOTICE

This Privacy Notice explains how we collect and use your personal data when you use any of our online services.

The data controller of your personal data, when using the 888 brand, is 888 UK Limited, which is licensed by the Gambling Commission.

888 UK Limited is part of the Evoke plc group.

In this Privacy Notice, 888 UK Limited and 888 are collectively referred to as “we”, “us” or “our”.

We are part of Evoke plc which owns and operates multiple brands including William Hill. The terms “group”, “group of companies” or “Evoke group” refer to Evoke plc and any direct and indirect subsidiaries thereof from time to time.

This Privacy Notice is linked to our General Terms. You should read and understand both documents. We update this Privacy Notice as and when our processes change.

Categories of personal data

We collect the following information when you register an account with us:

Username & Account Number.
Name.
Title.
Gender.
Date of birth (DOB).
Telephone numbers.
Home address.
Geolocation
Answers to security questions.
Your marketing preferences.
E-mail address.

You are required to provide this information in order to register and maintain an account with us.

We collect this information when you use our products:

Betting and gaming activities.
Customer services interactions.
Where chatrooms are provided, we process information that you share in these spaces.
Telephone calls.
Audit logs relating to your account.
Payment methods.
Market research responses.

We collect some or all of this information to comply with our legal obligations where we are required to, or for fraud detection or other legitimate interests:

Information required to complete Know Your Customer (“KYC”) checks.
Information about your source of funds.
Information about safer gambling including but not limited to behaviour, self-exclusion, operator exclusion, deposit limits and product blocks.
Information about your deposits and withdrawals.
Information required to comply with our safer gambling and Anti-Money Laundering (“AML”) obligations.
Source of funds documents.
Financial information.
Information received from Credit Reference Agencies that does not affect your credit score.
Social media information.
Device and other technical information such as IP address communicated over the internet to our services.
Information collected from publicly available sources.
Information from other brands within our group.
Information collected from third parties such as for affordability solutions and ID verification, betting integrity and mediation organisations or friends and family where they contact us.

It is your responsibility to inform us when your details change so that we can keep our records accurate and up-to-date. Some of the listed information is obtained through third-party organisations that provide services to the business. To find out the source of any of the data we process please contact us on the details provided below.

Processing your personal data:

Generally, we process your personal data to provide our product to you, conduct marketing and comply with our legal and regulatory obligations.
The below table provides further information on how we use your personal data. This includes but is not limited to:

Purpose	Legal Basis
To set up and use your account with us, including topping up funds, placing bets, and playing games.	Necessary for the performance of a contract.
Providing you with our betting and gaming products and services.	Necessary for the performance of a contract.
Monitoring deposit, spend or loss limits and any other limit we offer.	Necessary to comply with a legal obligation.
Providing customer support.	Necessary for the performance of a contract.
Linking multiple accounts for Anti-Money Laundering (AML) and Responsible Gambling purposes.	Necessary to comply with a legal obligation.
Verifying the accuracy of the data you have provided.	Necessary to comply with a legal obligation.
Conducting Anti-Money Laundering (AML) checks.	Necessary to comply with a legal obligation.
Conducting identity and Know Your Customer (“KYC”) checks.	Necessary to comply with a legal obligation.
Sharing data for KYC checks to help customers pass verification across the Evoke group.	Legitimate Interests of helping customers pass KYC checks.
Conducting fraud checks.	Legitimate interest of protecting the business from fraudulent activity.
Monitoring behavioral indicators of risk of suffering gambling related harm and taking any necessary actions to prevent harm.	Necessary to comply with a legal obligation.
Conducting financial risk checks including affordability assessments.	Necessary to comply with a legal obligation.
Monitoring activities to analyse and conduct investigations into proceeds of crime and other criminal behaviour – including from third party sources and social media.	Necessary to comply with a legal obligation.
Sharing information with authorities such as law enforcement or regulators.	Necessary to comply with a legal obligation.
Investigating and managing legal claims, including sharing information with internal and external legal counsel and bodies such as courts and tribunals.	Necessary to comply with a legal obligation.
Preventing, investigating and recording criminal, antisocial or any other undesirable behaviour as defined by the Group.	Legitimate Interest of protecting the business.
Monitoring betting and gaming patterns to identify potential issues related to safer gambling.	Necessary to comply with a legal obligation.
Prevention, detection and investigation of a criminal offence.	Necessary to comply with a legal obligation.
Conducting Safer Gambling interactions.	Necessary to comply with a legal obligation.
To compile and analyse reports on the use of our products and services.	Legitimate interest of ensuring our products and services are delivered to a high standard.
Sharing and transferring information during and as part of brand licensing and affiliate relationships.	Legitimate interest of evaluating, assessing and negotiating brand licensing and affiliate relationships. Or; Necessary for the performance of a contract where a brand license and/or affiliate relationship is confirmed.
Sharing and transferring information during and as part of corporate restructuring, sales, mergers and acquisitions.	Legitimate interest of evaluating, assessing and negotiating sales, mergers and acquisitions. Or; Necessary for the performance of a contract where a sale, merger and/or acquisition is confirmed.
To contact you for research purposes so that we can better understand our services and how they are perceived by our customers.	Legitimate interest of understanding our customers and collating their feedback.
Using aggregated statistics about gambling activity to manage our risk.	Legitimate interest for running our betting and gaming business.
Communicating to you about the services we are providing to you, including changes to our Services, changes to our Terms and Conditions, and changes to this Privacy Notice.	Necessary for the performance of a contract; or, Legitimate interests in communicating important service information to you; or, Necessary to comply with a legal obligation. The appropriate legal basis will depend on the nature of the communication.
Prevention or detection of a criminal offence.	Necessary to comply with a legal obligation.
To process outcomes of safer gambling activities such as self-exclusion, deposit limits and time-outs and to share this information with companies within our group of companies.	Necessary to comply with a legal obligation.
Bonus reward scheme	Necessary for the performance of a contract.
Recording and listening to telephone conversations including conducting quality assurance on customer service interactions.	Legitimate interest of customer support, training and/or security purposes.
To monitor gambling activity and manage our commercial risks.	Legitimate Interest of protecting the business.
Displaying masked usernames on game leader boards.	Legitimate interest of operating gaming leader boards.
Processing health data that is provided in regard to responsible gambling interactions.	Necessary to comply with a legal obligation.
Using customer data for testing new product features and toolsets.	Legitimate interest of testing new products and toolsets.
Using personal data for testing and development of new processes and systems.	Legitimate interest of ensuring optimal system and process performance.
Managing access to our products.	Legitimate interest to ensure legitimate business traffic reaches our site.
Using your data to carry out paid advertising campaigns on social media. Social media companies provide a service where organisations can share hashed customer information to match with the personal information that they hold to display advertisements to people on their platform and we utilise this service. You can set your social media data sharing preferences in your account settings or by contacting customer services. Please refer to the privacy notices of the social networking platforms you use for further information on the advertising services they provide.	Legitimate interest of marketing our brands on social media platforms.
To send you marketing messages regarding promotions, products or services that may be of interest to you.	Consent You can update your marketing preferences and also opt-out at any time via Preferences tab located within the Balance Icon menu. We will also include unsubscribe features in our communications which you can utilise to opt-out of future marketing communications. Opting out of receiving can take up to 28 days to take effect. If you opt-out of marketing on one brand this does not affect your preferences on any other brands within our Group.
To collect and analyse data collected through "cookies" and similar technologies. Please refer to our cookie policy.	Consent You can withdraw your consent through the settings on your device and browser.
Using your data to provide you with a personalised use of our Services so that we can provide you and other players with a better service.	Legitimate interest of providing relevant content to customers.
Analysing your data to create a profile so that we can better understand your preferences and determine which products and offers are best suited for you and similar customers.	Legitimate interests of understanding our customers and promoting relevant materials.
When you download our mobile application, you have the option to receive push notifications.	Consent. Preferences can be set on your device.

For further information regarding the type of marketing we do, and the personal data we use to market to you, please see our dedicated page.

When you give us information about any health issue related to yourself or any third party, for example in connection with customer support, complaints or safer gambling interactions, we will only process this information where permitted by law. This includes where you have provided your explicit consent, where it is necessary to protect your vital interests or those of another individual, or where it is necessary for reasons of substantial public interest, including safeguarding vulnerable individuals and complying with our legal and regulatory obligations. Please see section ‘safeguarding your personal data’ for assurances on the security of your information.

Where we are processing your personal data for under the legal basis of “legitimate interest” we have assessed that our interests are not overridden by your rights and freedoms.

Categories of recipients of your personal data:

Companies within the Evoke group
Affiliate companies of the Evoke group
Brand licensees of the Evoke group
Prospective or confirmed buyers of any, or all of the Evoke group products or services
Advertising agencies
Fraud checking companies
Social media companies
Regulators, ombudsman, external complaint bodies
Credit reference agencies
Game providers
Payment service providers
Public registers
Public authorities (where information is requested by them)
Law enforcement agencies
Behavioural analytics companies
Consumer vulnerability services
Debt recovery agencies
Sports betting integrity organisations

We disclose anonymized data (such as aggregated statistics) about the users of our Services in order to describe our sales, customers, traffic patterns and other information to prospective partners, advertisers, investors and other reputable third parties and for other lawful purposes, but these statistics will not contain your personal data.

We share your personal data with TransUnion who provide us with both verification and affordability services. As part of our financial risk checks, we use the TransUnion Affordability Solution to perform an affordability assessment of our customers. In order to provide their Affordability Solution, TransUnion process publicly available data such as insolvency, bankruptcy events or court judgments entered against you. The assessments and processing of your personal data are in line with the purposes listed above.
TransUnion use your data for the purposes outlined in their privacy notice which you can find here:

We may also use services from other credit reference agencies including:

Transferring your personal data abroad:

We transfer personal data with organisations located inside and outside of the UK & European Economic Area (EEA) as part of our service provision and do so in accordance with the stated purposes, above.

Where personal data is transferred outside of the UK or EEA to a country without an adequacy decision, we will use standard contractual clauses or any other approved methods to guarantee your data's protection at the level required in the EEA. These protections can be made available upon request.

Safeguarding your data:

Technical security measures: we adopt security measures to protect personal data.
Data Protection Impact Assessments (DPIAs): We conduct DPIAs where necessary to identify and mitigate privacy risks associated with our data processing activities, outlined above. This helps to ensure the safety and security of your personal data in line with data protection regulations.
Industry guidelines: Where appropriate we adhere to applicable industry-specific guidelines to maintain standards of data protection. These codes of conduct can provide additional safeguards to protect your data.
Data Protection by Design and Default: We integrate Data Protection by Design and Default principles into our data processing practices. This means that we prioritise data protection throughout the entire lifecycle of our data handling, from account creation to account closure and beyond, ensuring that your data is consistently safeguarded.
Legitimate Interest Assessments: where we process personal data under the legal basis of ‘Legitimate interest’ we balance our interests with yours. You can find out more information on our balancing tests by contacting us through the details on this notice.

Your rights:

Right to information:	You have the right be informed about how we use your personal data. The personal data that we process about you is provided within this notice.
The right of access:	You have the right to ask us for a copy of the personal information we hold about you.
The right to rectification:	You have the right to ask us to rectify personal information you think is inaccurate or incomplete.
The right to erasure:	You have the right to ask us to erase your personal information in certain circumstances.
The right to restriction of processing:	You have the right to ask us to restrict the processing of your personal information in certain circumstances.
The right to object to processing:	You have the right to object to our processing of your personal information in certain circumstances.
The right to data portability:	You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
The right to remove your consent:	Where our processing of your personal data is based on your consent, you have the right to remove your consent, at any time, for example where you have provided consent to receive marketing.
The right to lodge a complaint with the supervisory authority:	You have the right to lodge a complaint with the supervisory authority.
The right not to be subject solely automated decision making and profiling that creates legal or similarly significant affects:	You have the right not to be subject solely automated decision making and profiling that creates legal or similarly significant affects and an explanation of any logic involved in these automated decisions. You can request a person looks over any solely automated decisions that produce a legal or similar affects via customer services.
The right to complain to the data controller:	You have the right to complain directly to an organisation if you believe there has been an infringement of data protection regulations.

Data subject rights, while generally upheld, are not always absolute and may be subject to limitations or exceptions in specific circumstances. For example, data protection regulations can contain exemptions for complying in full with the rights listed above.

Use of Artificial Intelligence

We may use artificial intelligence (AI) technologies to enhance our services and ensure a safe, fair, and responsible gaming environment, for example, for fraud detection and customer support. Some of these AI technologies are developed in-house and others are provided by third-party suppliers. AI systems can involve the processing of personal data, but this is not always the case. Your rights as a data subject (as set out in this Privacy Notice) apply equally to any personal data within an AI system.

Retaining your personal data:

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements that we have as a business.

The retention period starts from the date of account closure or prolonged account in-activity such as last log-in date. When your personal data is no longer required, it will be securely deleted or anonymised.

In certain circumstances we may retain data for longer where we have a legitimate business or legal requirement. See the below section for further detail.

Exceptions

We reserve the right to retain data for longer than the prescribed period for our business needs or to comply with our legal and regulatory obligations. These obligations may require us to retain your personal data for an extended period, which may be up to a lifetime (99 years).

Exceptions to our standard retention periods may include:

Self-exclusion or similar safer gambling flags
AML or fraud review or flags
Trading restrictions
Open bets and/or balances on accounts
Refusal of Service status

The above is not an exhaustive list.

Complaints

If you have a complaint around the processing of your personal data we advise you to contact us so that we may resolve your concerns. Please contact the team via dataprotection@williamhill.com for assistance.

If we are unable to resolve your complaint, you can contact your Supervisory Authority.

Contacting us:

You can contact our Data Protection Officer for any requests by e-mail at dataprotection@williamhill.com.

If you wish to exercise any of your rights, you do not need to contact the Data Protection Officer directly, but can address your request to our customer service, who can also help you. Depending upon the nature of your request they may forward to the team for handling.

Please be aware that we cannot assist with queries or complaints which are not related to data protection.