1. Who we are
Banana Exchange Ltd ("we", "us"), registered in England & Wales (Company No. [COMPANY NUMBER]) and licensed by the UK Gambling Commission (licence [LICENCE NUMBER]), is the data controller for personal data processed through the Banana Exchange website and platform. Contact our Data Protection Officer at privacy@bananaexchange.org.
2. What data we collect
- Identity data — name, date of birth, photographs and identity documents used for age and KYC verification.
- Contact data — email address, phone number, residential address.
- Financial data — payment method details, deposits, withdrawals, and where required by law, source-of-funds evidence.
- Activity data — bets placed, markets viewed, game play, commission tier and account settings, including responsible-gambling limits.
- Technical data — IP address, device and browser information, and cookies (see section 7).
3. Why we process it
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating and operating your account, matching and settling bets, processing payments | Performance of a contract |
| Age verification, KYC, anti-money-laundering and fraud checks, reporting to the Gambling Commission | Legal obligation |
| Responsible-gambling monitoring and safer-gambling interventions | Legal obligation / legitimate interests |
| Improving the platform, security monitoring, analytics | Legitimate interests |
| Marketing emails, product updates and offers | Consent (withdraw any time) |
4. Who we share it with
We share data only where necessary: with identity-verification and payment providers, casino game suppliers (pseudonymised game-play data), fraud-prevention agencies, GAMSTOP and self-exclusion schemes, our regulators (the UK Gambling Commission, ICO, HMRC), sports governing bodies where betting integrity is at issue, and professional advisers. We never sell your personal data.
5. International transfers
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement (IDTA) with additional safeguards.
6. How long we keep it
We keep account and transaction records for at least five years after account closure to meet anti-money-laundering and licensing obligations, and longer where required for legal claims. Self-exclusion records are retained in line with GAMSTOP requirements. Data no longer needed is securely deleted or anonymised.
7. Cookies
We use strictly necessary cookies (login sessions, security), functional cookies (preferences), and — with your consent — analytics and marketing cookies. You can manage non-essential cookies from the cookie banner or your browser settings at any time.
8. Security
All traffic is protected with 256-bit TLS encryption. Personal data is stored on access-controlled systems, payment data is handled by PCI-DSS-compliant providers, and player funds are held in segregated accounts. We test our defences regularly and will notify you and the ICO of any breach where legally required.
9. Your rights
- Access a copy of your personal data.
- Correct inaccurate data, or ask us to delete data we no longer need to keep.
- Restrict or object to certain processing, including direct marketing (which we will always stop on request).
- Receive your data in a portable format.
- Withdraw consent at any time, where consent is the legal basis.
To exercise any right, email privacy@bananaexchange.org. We respond within one month. You may also complain to the Information Commissioner's Office at ico.org.uk.
10. Children
Our Services are strictly for adults aged 18+. We do not knowingly process children's data; any underage account discovered is closed immediately and stakes returned in line with our licence conditions.
11. Changes to this policy
We will notify you of material changes by email or on-site notice before they take effect. The "Last updated" date above shows the current version.