If you wish to send a SAR to a UK betting company, cut, paste and replace all fields marked in blue below.
They love to give customers the runaround with paperwork, so why not repay the favour?
Your address line 1
Your address line 2
Your address line 3
Your postcode
Your address line 2
Your address line 3
Your postcode
Current Date
Data Controller [Company Name]
Company address line 1
Company address line 2
Company address line 3
Company Postcode
Dear Sir/Madam,
Re: General Data Protection Regulation: Right of access [Your account username]
As my account with you is subject to stake restrictions and no longer qualifies for Best Odds Guaranteed or other customer offers, I would like to understand the reasons why this is the case, and the reason(s) [Company Name] has restricted my account to the point that it is unusable, except in the casino.
This letter is a subject access request pursuant to article 15 GDPR in order to access personal data that was used to make all decisions concerning my account.
https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/
The European Union defines personal data widely, including IP addresses. The UK’s Information Commissioner’s Office has ruled that e-device data becomes personal data when it is combined with other personal data, e.g. a home and/or email addresses. I am of the understanding that [Company Name] does combine e-device data with other personal data when processing data and profiling customers, therefore “all data held” will include e-device data held by [Company Name] and all third parties.
To make decisions about my account [Company Name] must have processed my personal data (e.g. hopefully in line with Article 6(1) or Article 9(2) GDPR and certainly in line with the UK’s Data Protection Act [1998]) and profiled me (hopefully in line with Article 21 GDPR and certainly in line with the UK’s Data Protection Act [1998]). This profiling is likely to have meant [Company Name] has disclosed my personal data to third parties, e.g. tickets sent to Iovation and/or other services (please do not leave this data out of my SAR).
The following is the data I would like a copy of or access to:
The categories of personal data you have about me in your files and databases, including but not limited too; completed forms, emails, live chats, financial transactions, full betting history, etc.
A detailed account of the specific uses that you have made or still making of my personal data.
A list of all third parties with whom you have (or may have) shared my personal data.
Advice on how long you store my personal data, and if retention is based upon the category of personal data, please identify how long each category is retained.
If you are additionally collecting personal data about me from any source other than me, please provide me with all information about those sources, as referred to in article 14 GDPR, including but not limited too; Iovation tickets and any other form of data generated from e-device ‘footprinting’.
If you have or still are making automated decisions about me, including profiling, whether or not on the basis of article 22 GDPR, please provide me with information concerning the basis for the logic in making such automated decisions, and the significance and consequences of such processing.
To avoid unnecessary administration or further correspondence, I am including the following information which will help you to identify records pertaining to me: [Your username]
Your name in full
Your date of birth in full
Your registered email
Your account username
I look forward to receiving the data I’ve requested within the 30 day legally stipulated period under article 12 GDPR. The deadline is [insert date in 30 days time].
Yours faithfully,
Your name