Privacy Policy

Last updated: 24.06.2026

This Privacy Policy explains how Sligo Limited ("Operator", "we", "us", "our"), trading as Lizaro Casino, collects, uses, stores, shares, and protects the personal data of individuals ("Player", "you", "your") who access or use the Lizaro Casino website and associated services ("Platform").

The Operator is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where applicable.

By registering an account or using the Platform, the Player acknowledges and accepts the data processing practices described in this Privacy Policy. This Privacy Policy should be read in conjunction with the Platform's Terms and Conditions.

1. Data Controller

Sligo Limited Registration Number: C 104415 Registered Address: 64 Excalibur, B. Bontadini Street, Birkirkara, BKR 1737, Malta Email: [DPO_EMAIL / PRIVACY_EMAIL] Data Protection Officer: [DPO_NAME], contactable at [DPO_EMAIL]

2. Personal Data We Collect

The Operator collects and processes the following categories of personal data.

2.1. Data Provided by the Player

This includes information supplied directly during registration, account use, and communication with the Platform:

• Identity data: Full name, date of birth, gender, nationality.
• Contact data: Email address, telephone number, residential address.
• Account data: Username, password (stored in encrypted form), preferred language, account currency.
• Financial data: Payment method details (bank card numbers, e-wallet account identifiers, cryptocurrency wallet addresses), deposit and withdrawal history, transaction records.
• Verification data: Copies of government-issued photo identification, proof of address documents, proof of payment method ownership, and source-of-funds documentation submitted during KYC or enhanced due diligence procedures.
• Communication data: Contents of emails, live chat transcripts, telephone call recordings, and any other correspondence with the Operator's support team.
• Responsible gambling data: Self-imposed deposit limits, loss limits, session time limits, cool-off periods, and self-exclusion requests.

2.2. Data Collected Automatically

When the Player accesses or uses the Platform, the following data is collected automatically:

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers.
• Usage data: Pages visited, games played, bet history, session duration, click patterns, referral URLs, login timestamps.
• Location data: Approximate geographic location derived from IP address (not precise GPS location).
• Cookie and tracking data: Information collected through cookies, web beacons, pixels, and similar technologies as described in Section 9 of this Privacy Policy.

2.3. Data Received from Third Parties

The Operator may receive personal data from third-party sources including:

• Payment processors: Transaction confirmations, fraud screening results, chargeback notifications.
• Identity verification providers: Results of electronic identity checks, document authentication, sanctions screening, and politically exposed person (PEP) checks.
• Affiliate and marketing partners: Referral source data, campaign identifiers.
• Game providers: Gameplay data, bet settlement records, RNG audit data.
• Public databases and registries: Electoral roll data, company registries, court records (where relevant for AML compliance).

3. Purposes and Legal Bases for Processing

The Operator processes personal data for the following purposes, relying on the legal bases indicated.

3.1. Performance of Contract (Article 6(1)(b) UK GDPR)

• Registering and managing Player accounts.
• Processing deposits, withdrawals, and other financial transactions.
• Providing access to casino games, sports betting, and related services.
• Administering bonuses, promotions, and loyalty programmes.
• Communicating with Players about their account, transactions, and service-related matters.
• Resolving disputes, complaints, and support requests.

3.2. Legal Obligations (Article 6(1)(c) UK GDPR)

• Conducting identity verification (KYC) and enhanced due diligence.
• Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• Detecting and preventing fraud, collusion, and other financial crime.
• Reporting suspicious activity to financial intelligence units and regulatory authorities.
• Maintaining records as required by gambling, tax, and financial regulations.
• Implementing responsible gambling measures, including age verification.

3.3. Legitimate Interests (Article 6(1)(f) UK GDPR)

• Improving and optimising the Platform, its features, and user experience.
• Analysing player behaviour and preferences to develop new products and services.
• Protecting the Platform against security threats, technical failures, and unauthorised access.
• Detecting and preventing bonus abuse, irregular play patterns, and breaches of the Terms and Conditions.
• Conducting internal business analytics, reporting, and auditing.
• Enforcing the Operator's legal rights and defending against claims.

3.4. Consent (Article 6(1)(a) UK GDPR)

• Sending direct marketing communications (email, SMS, push notifications) about promotions, offers, and new features — where the Player has opted in.
• Placing non-essential cookies and similar tracking technologies — where the Player has provided cookie consent.

Where processing is based on consent, the Player has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

4. Data Sharing

The Operator may share personal data with the following categories of recipients.

4.1. Service Providers and Processors

The Operator engages third-party service providers who process personal data on the Operator's behalf, including:

• Payment processors and financial institutions (for transaction processing, fraud detection, and chargeback management).
• Identity verification and KYC providers (for document authentication, electronic ID checks, and AML screening).
• Game providers and software suppliers (for game delivery, RNG auditing, and technical support).
• Cloud hosting and infrastructure providers (for data storage and Platform operation).
• Email and communication service providers (for transactional and marketing communications).
• Analytics and performance monitoring providers (for Platform optimisation and business intelligence).
• Customer support platform providers (for live chat and ticket management).

All third-party processors are bound by data processing agreements that require appropriate security measures and restrict the use of personal data to the purposes specified by the Operator.

4.2. Regulatory and Law Enforcement Authorities

The Operator may disclose personal data to regulatory authorities, licensing bodies, law enforcement agencies, tax authorities, and financial intelligence units where required by law, regulation, or lawful request, or where the Operator reasonably believes disclosure is necessary to:

• Comply with a legal obligation or regulatory requirement.
• Prevent, detect, or investigate fraud, money laundering, or other criminal activity.
• Protect the rights, property, or safety of the Operator, its Players, or the public.

4.3. Professional Advisers

The Operator may share personal data with legal advisers, auditors, accountants, and consultants in connection with regulatory compliance, legal proceedings, or business operations.

4.4. Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, the Operator may transfer personal data to the acquiring entity or successor, subject to this Privacy Policy continuing to apply or the successor adopting equivalent data protection standards.

4.5. Affiliate and Marketing Partners

Where the Player has been referred to the Platform through an affiliate or marketing partner, the Operator may share limited data (such as registration confirmation and first-deposit status) with that partner for the purpose of commission attribution. No sensitive personal data is shared for this purpose.

5. International Data Transfers

5.1. The Operator is established in Malta (European Economic Area). Personal data may be transferred to, stored in, or processed in countries outside the United Kingdom and the EEA where the Operator's service providers or group companies are located.

5.2. Where personal data is transferred outside the UK or EEA, the Operator ensures that appropriate safeguards are in place, including:

• Transfers to countries recognised by the UK Secretary of State or the European Commission as providing an adequate level of data protection.
• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office or the European Commission.
• Binding Corporate Rules, where applicable.
• Other lawful transfer mechanisms recognised under UK GDPR or EU GDPR.

5.3. Players may request a copy of the safeguards in place for any specific transfer by contacting the Data Protection Officer.

6. Data Retention

6.1. The Operator retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

6.2. General retention periods are as follows:

• Active account data: Retained for the duration of the account's activity and for a minimum of [RETENTION_PERIOD — e.g., five (5) years] following account closure, as required by AML regulations and the Operator's licensing obligations.
• Identity verification documents: Retained for a minimum of [RETENTION_PERIOD — e.g., five (5) years] following account closure or the last transaction, whichever is later.
• Transaction records: Retained for a minimum of [RETENTION_PERIOD — e.g., five (5) to seven (7) years] as required by financial record-keeping obligations.
• Marketing consent records: Retained for as long as the consent remains valid, plus [RETENTION_PERIOD — e.g., two (2) years] following withdrawal of consent for audit purposes.
• Communication records: Retained for [RETENTION_PERIOD — e.g., three (3) years] from the date of the communication.
• Responsible gambling records (self-exclusion, limits): Retained indefinitely or as required by regulatory guidance.

6.3. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

7. Your Rights

7.1. Under the UK GDPR and Data Protection Act 2018, Players have the following rights in relation to their personal data:

• Right of access (Article 15): The right to obtain confirmation of whether personal data is being processed and, if so, to access the data along with supplementary information about the processing.
• Right to rectification (Article 16): The right to have inaccurate personal data corrected or incomplete data completed.
• Right to erasure (Article 17): The right to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, consent has been withdrawn, or processing is unlawful. This right is subject to the Operator's legal and regulatory obligations to retain certain data.
• Right to restriction (Article 18): The right to request that processing be restricted in certain circumstances, for example where the accuracy of the data is contested.
• Right to data portability (Article 20): The right to receive personal data provided to the Operator in a structured, commonly used, machine-readable format and to transmit that data to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to object (Article 21): The right to object to processing based on legitimate interests or for direct marketing purposes. Where the Player objects to processing for direct marketing, processing ceases immediately.
• Rights in relation to automated decision-making (Article 22): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the Player. Where automated decisions are made (e.g., in AML or fraud screening), the Player has the right to request human review.

7.2. To exercise any of these rights, Players should submit a request to the Data Protection Officer at [DPO_EMAIL]. The Operator responds to valid requests within one (1) calendar month. This period may be extended by a further two (2) months where the request is complex or where multiple requests have been received.

7.3. The Operator may request proof of identity before processing a rights request to ensure the security of personal data.

7.4. Where the Player believes the Operator has not handled a data protection request satisfactorily, the Player has the right to lodge a complaint with:

• UK Information Commissioner's Office (ICO):www.ico.org.uk — 0303 123 1113
• Office of the Information and Data Protection Commissioner (Malta):www.idpc.org.mt

8. Data Security

8.1. The Operator implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include but are not limited to:

• Encryption: All data transmitted between the Player's device and the Platform is protected by SSL/TLS encryption. Sensitive data at rest, including passwords and financial information, is encrypted using industry-standard algorithms.
• PCI DSS compliance: Payment card processing adheres to the Payment Card Industry Data Security Standard (PCI DSS).
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls and multi-factor authentication.
• Monitoring and logging: Continuous monitoring of systems for security incidents, with activity logs maintained for forensic analysis.
• Regular security assessments: Periodic vulnerability assessments, penetration testing, and security audits conducted by internal and external specialists.
• Incident response: A documented data breach response plan is in place, with procedures for containment, investigation, notification to supervisory authorities and affected individuals (where required), and remediation.

8.2. While the Operator takes all reasonable steps to protect personal data, no method of transmission or storage is entirely secure. Players are responsible for maintaining the confidentiality of their login credentials and for promptly reporting any suspected unauthorised access to their account.

9. Cookies and Tracking Technologies

9.1. The Platform uses cookies and similar technologies to provide essential functionality, analyse usage, and deliver personalised content. The Operator's use of cookies is governed by the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR.

9.2. The categories of cookies used on the Platform are as follows:

9.2.1. Strictly Necessary Cookies

These cookies are essential for the operation of the Platform and cannot be disabled. They enable core functionality such as account authentication, session management, security features, and payment processing. No consent is required for strictly necessary cookies.

9.2.2. Performance and Analytics Cookies

These cookies collect anonymised or pseudonymised data about how Players interact with the Platform, including pages visited, games played, and time spent on specific sections. This information is used to improve Platform performance and user experience. These cookies require the Player's consent.

9.2.3. Functionality Cookies

These cookies remember the Player's preferences (such as language, currency, and display settings) to provide a more personalised experience. These cookies require the Player's consent.

9.2.4. Marketing and Advertising Cookies

These cookies are used to deliver relevant promotional content based on the Player's interests and behaviour on the Platform and across third-party websites. They may also be used to measure the effectiveness of marketing campaigns. These cookies require the Player's consent and may involve data sharing with advertising partners.

9.3. Players can manage cookie preferences through the Platform's cookie consent banner displayed on first visit, or through the cookie settings page accessible at any time. Players may also configure cookie settings through their browser. Disabling certain cookies may affect the functionality of the Platform.

9.4. For detailed information about the specific cookies used, their purposes, and their retention periods, refer to the Cookie Policy available on the Platform.

10. Direct Marketing

10.1. Where the Player has provided consent, the Operator may send direct marketing communications via email, SMS, push notifications, or other electronic channels, containing information about promotions, bonuses, new games, events, and other offers.

10.2. The Player may withdraw marketing consent at any time by:

• Clicking the "unsubscribe" link included in any marketing email.
• Adjusting notification preferences in the account settings.
• Contacting customer support via live chat or email at [SUPPORT_EMAIL].

10.3. Withdrawal of marketing consent does not affect the Player's receipt of transactional and service-related communications (such as account notifications, withdrawal confirmations, and KYC requests), which are sent on the basis of contractual necessity.

10.4. The Operator does not sell personal data to third parties for their own direct marketing purposes.

11. Third-Party Links

11.1. The Platform may contain links to third-party websites, services, or applications that are not operated or controlled by the Operator.

11.2. This Privacy Policy does not apply to third-party websites. The Operator is not responsible for the privacy practices or content of any third-party site. Players are encouraged to review the privacy policies of any third-party site before providing personal data.

12. Children's Data

12.1. The Platform is not intended for individuals under the age of 18. The Operator does not knowingly collect personal data from minors.

12.2. If the Operator becomes aware that personal data has been collected from a person under 18, the account is closed immediately and the data is deleted without undue delay.

12.3. Any person who believes that the Operator may have inadvertently collected personal data from a minor should contact the Data Protection Officer immediately at [DPO_EMAIL].

13. Changes to This Privacy Policy

13.1. The Operator reserves the right to update or amend this Privacy Policy at any time. Material changes are communicated to Players through a notice on the Platform, email notification, or both.

13.2. The "Last updated" date at the top of this Privacy Policy indicates when the most recent revision took effect.

13.3. Continued use of the Platform following publication of a revised Privacy Policy constitutes acceptance of the updated terms. Players who do not agree with any changes should cease using the Platform and contact the Operator regarding account closure.

14. Contact Us

For questions, requests, or complaints related to this Privacy Policy or the processing of personal data, Players may contact:

Data Protection Officer Sligo Limited 64 Excalibur, B. Bontadini Street Birkirkara, BKR 1737, Malta Email: [DPO_EMAIL]

Customer Support Live Chat: Available 24/7 on the Platform Email: [SUPPORT_EMAIL]

Supervisory Authorities

• UK Information Commissioner's Office:www.ico.org.uk — 0303 123 1113
• Malta Information and Data Protection Commissioner:www.idpc.org.mt

18+ | Gamble responsibly. If you feel you may have a gambling problem, contact GamCare (0808 8020 133) or visitwww.begambleaware.org.