How we handle your data

Last revised 26 September 2026

The short version

We collect what we need to run your account, pay you and keep the site safe, and very little beyond that. We don’t sell your data. You can see what we hold, correct it, and in many cases ask us to delete it. This page is written for players in the United Kingdom, where the UK GDPR and the Data Protection Act 2018 set out your rights.

What we collect

Things you give us

When you register: your email, a password (stored only as a hash), your country and your currency. If you sign up with Google, we receive your name and email from Google and nothing else. Before your first withdrawal: your photo ID and a proof of address. When you talk to support: the content of the chat or email.

Things we record while you play

Deposits, withdrawals, bets, bonus activity, the limits you set, login times and the device and browser you use. We also keep the IP address of each session, which helps us spot account takeovers and fraud.

Why we use it

• To run your account and process your payments.
• To meet legal duties, including identity checks and anti-money-laundering controls.
• To protect you: your limits, time-outs and self-exclusion depend on this data.
• To send offers, only if you have agreed. You can switch marketing off in your profile at any time.

Our legal grounds

Running your account and paying you rests on our contract with you. Identity and anti-money-laundering checks are legal obligations. Fraud prevention and keeping the site secure are our legitimate interests, balanced against your rights. Marketing and optional cookies rest on your consent, which you can withdraw whenever you like.

Automated checks

We use automated checks to flag payments that look unusual and patterns that can point to risky play, such as several deposits in quick succession late at night. A flag never closes an account or blocks a payout on its own. A member of our team looks at it before any decision with a real effect on you, and you can always ask for a person to review a decision and hear your side.

Who else sees it

Payment providers see what they need to move your money. Identity verification services check the documents you upload. Game studios receive the round data needed to run their games. Our hosting and support-tool providers process data on our behalf under written agreements. When the law requires it, we share data with the authorities. Nobody buys your data from us.

Transfers outside the UK

Hidden Jack is run by a company registered in Costa Rica, and some of our providers work from other countries. When your data leaves the United Kingdom, we rely on written contracts and recognised safeguards, such as standard data protection clauses, so that it stays protected to a standard close to the one you have at home. You can ask us for more detail about these safeguards at any time.

How long we keep it

We keep account and transaction records for five years after your account is closed. That period covers anti-money-laundering rules and gives us time to settle any dispute. After five years the data is deleted or made anonymous. Marketing consent ends the moment you withdraw it.

Your rights under the UK GDPR

You have the right to:

• get a copy of the personal data we hold about you;
• have wrong or incomplete details corrected;
• ask us to delete data we no longer need to keep;
• restrict or object to certain kinds of processing;
• receive your data in a portable format;
• withdraw any consent you have given, without affecting what happened before.

To use any of these rights, send us a data request by email from the address linked to your account. We reply within one month. If you are not happy with our answer, you can complain to the Information Commissioner’s Office.

Using your rights, step by step

1. Email us from the address linked to your account and say which right you want to use. A subject line such as “Data request” helps us route it quickly.
2. We may ask you to confirm who you are, for example by answering from that same address or matching details we already hold. We will never ask for your password.
3. We confirm that the request has arrived and start work on it.
4. You get our answer within one month, sent to the email address on your account.

• Access: you receive a copy of your data and an explanation of how we use it.
• Correction: send the right details; for a new name or address, attach a document that shows it.
• Deletion: we delete what we can straight away. Records we must keep under money-laundering rules stay until the five-year period ends.
• Objection to marketing: the switch in your profile works at once, and an email to us does the same.
• Portability: we send your account and transaction data in a common, machine-readable format.

The Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is the UK supervisory authority for data protection. You can raise a concern through the ICO website. We would appreciate the chance to put things right first, so please let us know about any problem as well.

Security

Every page is served over an encrypted connection. Documents are stored separately from your account data, and only the verification team can open them. Staff access is limited to what each role needs.

• Passwords are stored only as a hash, so even our staff cannot read them.
• Payment card details are handled by our payment providers, not stored on our own systems.
• Logins from a new device or location are checked for signs of account takeover.
• Access to player data is logged, so we can see who opened what and when.

You can help too: use a password you don’t use anywhere else, log out on shared computers and tell live chat straight away if something in your account looks wrong.

Local storage in your browser

Besides cookies, the site keeps a few small items in your browser’s local storage, such as your cookie choice and display settings like language. They stay on your device and are not sent to us as personal data. Clearing your browser’s site data removes them.

Children

Hidden Jack is for adults only. Nobody under 18 may open an account, and we don’t knowingly collect data about children. If we learn that an account belongs to someone under 18, we close it and delete the data, keeping only what the law requires us to hold.

Cookies

How we use cookies, and how to change your choice, is explained on the cookie controls page.