Privacy Notice

Below you will find our Privacy Notice which tells you about how we will process your personal data and about the rights that you have under data protection. We strongly recommend that you familiarize yourself with this Privacy Notice. We understand that people have busy lives, so here is a quick summary of how we use your personal data. This first section is just an overview; please read the full Privacy Notice below for complete details.

We process your personal data for the purposes discussed in detail below, but the two main purposes are to enable us to provide you with services and to comply with our regulatory obligations, specifically:

• Providing our Services: in order for us to offer you services, we will need you to register a user account and provide bank details to deposit money.
• Complying with regulatory obligations: we are required to monitor our customers and to keep records of transactions to ensure that we are offering a fair, responsible and safe service – this includes verifying your age and monitoring our customers to ensure that they are gambling within their means.

This Privacy Notice applies to our websites, applications, goods and services that link to this Notice or which do not have a separate privacy notice. The purpose of this Privacy Notice is to provide you with information about how we use your personal data. This Privacy Notice may be updated from time to time so we recommend that you review it regularly. When we make material changes, we will make sure to alert you to this.

The controller (formerly known as data controller) of your personal data is:

• TSG Interactive Gaming Europe Limited, Spinola Terraces, Mikiel Ang Borg Street, St. Julian’s, SPK 1000, Malta.

This is who we refer to in this Privacy Notice when saying “TSG”, “PokerStars”, “we”, “our” and “us” etc.

Yes, we have appointed a Data Protection Officer (DPO). While our DPO can be reached at dataprotection@pokerstarsint.com, our Customer Service team will be your initial point of contact if you wish to exercise your rights. Please see the ‘Your Rights’ section below.

Flutter Entertainment plc operates a federated model comprising of several independent controllers.

Reference to the Group within this Privacy Notice means Flutter Entertainment plc and all or any of its direct or indirect subsidiary undertakings, joint venture partners, and their related companies wherever located in the world as may exist from time to time including, but not limited to known brand such as Adjarabet, Betfair, Betnacional, FanDuel, Junglee, Maxbet, Paddy Power, PokerStars, Singular, Sisal, Sky Betting and gaming, Snaitech, Sportsbet, Timeform, Tombola and TVG.

In addition to the main purposes – providing our services and complying with regulatory obligations – here are some further clarifications on how we collect your personal data.

We collect information about the transactions you make, including your gaming activity. We may collect personal data through surveys which we, or companies engaged by us for such purpose, undertake. In addition, we collect information about your use of our websites, mobile applications and services. We also collect other information necessary for us to process your personal data for the purposes set out in this Privacy Notice.

When you contact us, we will process any personal data you provide in these communications.

We may also collect personal data from third party service providers, such as credit reference agencies and fraud prevention companies.

Finally, we also use “cookies” and similar technologies which may collect certain information about you, such as your devices’ IP addresses and online activity, some of which will constitute your personal data. You can learn more about the cookies we use in the ‘Cookies’ section below.

The table below sets out:

• our purposes for processing your personal data
• our legal justifications (each called a ‘legal basis’) under data protection law, for each purpose
• categories of personal data which we use for each purpose. See more about these categories in the table below.

Here is a general explanation of each ‘legal basis’ to help you understand the purposes for processing your personal data:

• Performance of a Contract: When it’s necessary for PokerStars (or a third party) to process your personal data to:
• Comply with obligations under our contract with you. This includes PokerStars’ obligations under the Terms of Use to provide the Service to you, or
• Verify information before a new contract with you begins.
• Compliance with Legal or Regulatory Obligations: When PokerStars must process your personal data to comply with a legal or regulatory obligation.
• Consent: When PokerStars asks you to actively indicate your agreement to PokerStars use of your personal data for a certain purpose.
• Legitimate Interest: When PokerStars or a third party has an interest in using your personal data in a certain way, which is necessary and justified considering any possible risks to you and other PokerStars users. For example, using your personal data to send surveys in order to better understand and improve our products and services.  

Except for limited circumstances, we do not process special categories of personal data about you (such as personal data relating to your health, ethnicity, religion, political persuasion, trade union membership or sexuality) or personal data relating to criminal offences or convictions. For the limited circumstances in which we process special categories of personal data, we have set out the additional lawful basis required in italics below.

In addition to the purposes set out above, we may also process your personal data for other purposes that we deem compatible with those listed. We use artificial intelligence (AI) technologies in a limited manner that may involve the processing of certain personal data. Any use of AI is carried out in strict compliance with applicable data protection laws and privacy standards to ensure your rights and information are protected. We will update this Privacy Notice accordingly when we do this. For more information see “Automated Decision Making and the Use of AI” section below.

Please note that the lawful bases set out above are those which will primarily apply although it is possible that a change in circumstance may result in a change in lawful basis – for example, if you close your user account with us, we will no longer process your personal data to perform a contract with you but will continue to do so in order to comply with legal requirements.

We are part of the Group and there will be instances where your personal data is shared with other members of the Group. This may occur where:

• We disclose your personal data to another member of the Group for the purposes described above in the “How will we use your personal data” section; or
• another member of the Group provides services to us and processes personal data on our behalf in support of our operations

We may also in the future share personal data with other members of our Group for purposes that are related to and compatible with those set out above. Finally, where we are required by law or regulation to share personal data throughout our Group for reasons beyond those set out above, we will do so as required.

Please check this Privacy Notice frequently to learn of any updates to our intra-group sharing.

In addition to the purposes described above, we may share your personal data with trusted third parties who support our services.

These organizations act as processors or, in some cases, independent controllers, and are engaged under contractual arrangements with appropriate data protection safeguards.

Because of the global nature of our business, PokerStars shares personal data internationally with Group companies, subcontractors and partners when carrying out the activities described in this Notice. They may process your data in countries whose data protection laws are not considered to be as strong as EU laws or the laws which apply where you live. For example, they may not give you the same rights over your data.

Wherever your personal data is transferred, we will ensure the same level of protection for your personal data wherever it is processed by implementing appropriate contractual, technical and/or organizational safeguards.

We will take appropriate security, technical and organizational measures to ensure that your personal data is kept secure and to prevent the theft, loss or unauthorized access to your personal data. We will never sell your personal data to third parties. It is important to understand however that security can never be guaranteed, and you will not hold us liable save where the security of your personal data is compromised due to our negligence.

If you have signed up to services offered by us we may send you direct marketing in relation to other services offered by us or our Group provided that you have given your consent to receive such marketing.

At any time you can manage your marketing consents via your user account. You can also unsubscribe by using the tools in any marketing communication you receive. Please note that if you unsubscribe from marketing it may take up to five working days for this to take effect.

We may also use information you provide to us to show you relevant advertising and personalized content about our Group’s services on certain third-party social media platforms (Social Media Sites) made available to us through relevant service providers (e.g. Facebook, Twitter). If you do not wish to see these advertisements, you can change your settings on the Social Media Sites. If you do not want us to share this information with Social Media Sites you can contact us directly.

In this Privacy Notice, we use the expression ‘cookie’ to refer to cookies and similar technologies we use to store information (such as web beacons). A cookie is a simple text file that is stored on your computer or mobile (or other) device by a website’s server, and only that server will be able to retrieve or read the contents of that cookie. Each cookie is unique to your web browser. It will contain some anonymous information, such as a unique identifier and the website name and some digits and characters.

Almost all websites and applications you visit, including our websites, will use cookies in order to improve your user experience by enabling that website and/or application to ‘remember’ you, either for the duration of your visit (using a ‘session cookie’) or for repeat visits (using a ‘persistent cookie’).

Cookies are used to improve your use of a website or application, for example through letting you navigate between pages efficiently and storing your preferences. Cookies make the interaction between you and the website faster and easier. If a website or application doesn't use cookies, it will think you are a new visitor every time you move to a new page on the website. Cookies can also be used to enable targeted advertising and analyze your browsing of a website.

You can learn more about cookies generally and how to disable them on your browser here.  

You can learn more about what advertising cookies exist on your device and you can disable them directly by clicking here.

We use AI tools and automated processing, including profiling, to support business operations, improve services, and analyze information more efficiently. Where you interact with automated tools, we aim to make this clear to you.

In the purposes outlined Automated processing may be used:

• To direct and manage support requests, including through initial chatbot or automated routing. We will inform you when you are communicating with a chatbot.
• To assess and manage risk, prevent fraud, and support compliance with legal and regulatory obligations.
• To analyze customer activity, preferences, and engagement in order to improve services, personalize experiences, and measure the effectiveness of communications.
• To support internal analytics, reporting, and operational efficiency.

Where automated processing, including profiling, may significantly affect individuals, such decision-making does not occur without human intervention, and appropriate safeguards are in place to ensure fair and accountable outcomes.

We use these technologies in accordance with applicable data protection laws and privacy requirements.

We retain your personal data for six years. Six years is calculated from the closure of your user account or where your user account has been dormant for this period. There are some exceptions to this retention period, namely:

• If you self-exclude from any of our services, we will retain this information indefinitely.
• If you are under investigation or we have identified possible fraud, money-laundering, criminal activity we may retain your personal data for longer.
• If there is a legal dispute, we will retain your personal data for the duration of the dispute and for six years thereafter.

You can update some of your personal data at any time via your user account. We request that when your personal data changes you update your user account as soon as possible. If you are unable to change your information via your user account, please contact Support.

You have the following rights in relation to your personal data:

• a right to access your personal data. This includes receiving confirmation on whether your personal data is being processed, why it is being processed and the personal data being processed.
• a right to rectification of inaccurate personal data or updating of incomplete personal data.
• a right to erasure (also known as the right to be forgotten) of personal data under certain circumstances, including where you (i) object to Flutter’s processing for its own legitimate interests or (ii) where Flutter’s processing of the personal data is unlawful. In the case of unlawful processing, you may request that this processing is restricted rather than the personal data being erased.
• a right to data portability i.e. to receive your personal data in a portable format or, subject to it being technically feasible, have us transfer your personal data directly to a third party. This right applies where processing is taking place based on consent or for the performance of a contract.
• a right to object to the processing of personal data, where such processing is being conducted for the purpose of (a) direct marketing; (b) establishing, exercising or defending ourselves or others from legal claims; or (c) Flutter’s legitimate interests where Flutter cannot demonstrate its interests override your interests and rights. Please note, restriction on processing may be requested while an investigation of legitimate interests takes place. You shall have the right to obtain from us restriction of processing in limited circumstances.
• a right not to be subject to decisions taken solely on the basis of automated processing of personal data of an individual (i.e. no human involvement in the decision) which produce legal effects or have similarly significant effects unless permitted by law.

If you are unsure about your rights or are concerned about how your personal data may be processed, you should contact our Support or your national data protection supervisory authority.

If you would like to exercise any of your rights then you can do so by contacting Support. Please be aware that while we will try to accommodate any request you make in respect of your rights, they are not absolute rights. This means that we may have to refuse your request or may only be able to comply with it in part.

When you make a request in respect of your rights, we will require proof of identification. We may also ask that you clarify your request. We will aim to respond to any request within one month of verifying your identity, but it may take longer (we will notify you if this is the case). If we receive repeated requests, or have reason to believe requests are being made unreasonably, we reserve the right not to respond.

If you have any complaints, you have the right to contact your own national data protection supervisory authority, however we do ask that you contact us in the first instance to allow us the opportunity to address your concerns.

If you have any questions regarding our use of your personal data, or you would like to exercise any of your rights, please contact our Support in the first instance. You can also contact our Data Protection Officer at dataprotection@pokerstarsint.com.

Privacy Notice last revised: September 10, 2026