Privacy Policy

This Privacy Policy explains how Shuffle, operated for UK-facing users via the Shuffle version of our website at shufflerok.com, collects, uses, discloses and protects personal data of players and website visitors. It applies to all visitors, registered account holders and other users who access or interact with shufflerok.com from the United Kingdom. The policy is effective from 6 November 2025 and was last revised in January 2026. By using shufflerok.com, you acknowledge that your personal data will be processed in accordance with this Privacy Policy and applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

Who We Are

Observe: This section identifies the company responsible for your personal data and how you can contact us.

Expand: The Shuffle version of Shuffle available at shufflerok.com is operated by:

Legal entity (data controller): Natural Nine B.V.
Legal form: Besloten Vennootschap (B.V.), incorporated under the laws of Curaçao
Registered address: Scharlooweg 39, Willemstad, Curaçao
Company registration number: 160998
Gaming licence: Sub-licence under Master eGaming Licence no. 8048/JAZ issued by Antillephone N.V., Curaçao

Regulatory context: Natural Nine B.V. is licensed and regulated in Curaçao and does not hold a licence from the UK Gambling Commission. Shuffle on shufflerok.com is therefore an offshore, non-GamStop, crypto-based gambling service accessible to certain UK users, typically on an offshore basis. For data protection purposes, Natural Nine B.V. acts as the "controller" of personal data collected through shufflerok.com, including where underlying technical services are provided via the platform domain shuffle.com.

Data Protection Officer (DPO) / privacy contact:

E-mail: privacy@shufflerok.com (preferred channel for all privacy and data protection enquiries)
Postal: Data Protection Officer, Natural Nine B.V., Scharlooweg 39, Willemstad, Curaçao

Reflect: You should use the contact details above for any questions about this Privacy Policy, to exercise your data protection rights, or to raise concerns about how Shuffle on shufflerok.com handles your personal data.

What Personal Data We Collect

Observe: We collect different categories of personal and technical information when you visit shufflerok.com, create an account, play games, or otherwise interact with Shuffle.

Account and identification data

Identity details: full name, username, date of birth, country of residence, nationality, and verification documents (e.g. copies of ID cards, passports, driving licences, proof of address) used for KYC/AML checks.
Contact details: e-mail address, postal address (if provided), and any telephone number you choose to share with us.

Technical and device data

Technical identifiers: IP address, device identifiers, browser type and version, operating system, language settings, time zone, and referral URLs.
Usage logs: login and logout times, pages viewed, clickstream data, session duration, and interaction with website features or game lobbies.

Payment and crypto transaction data

Crypto wallet information: public wallet addresses you use to deposit or withdraw (e.g. BTC, ETH, LTC, USDT, USDC, TRX, MATIC, SOL, SHFL).
Transaction data: deposit and withdrawal records, token balances, timestamps, and transaction identifiers on the relevant blockchain.
Banking context: Shuffle on shufflerok.com operates as a crypto-only casino; we do not maintain GBP wallets or process direct card payments from UK banks, but you may buy crypto through third-party exchanges and then transfer it to us.

Behavioural and profile data

Gameplay data: betting history, stakes, wins and losses, game preferences, bonus usage, and session time.
Behavioural signals: interaction with promotions, clicks on banners, response to in-product messages, and responsible gambling tools usage (e.g. self-exclusion, limits).
Risk and compliance data: internal risk scores, fraud indicators and AML/KYC flags generated under our AML/KYC policy.

Communications and marketing data

Support interactions: records of e-mails, live chat transcripts, complaint correspondence, and feedback forms.
Marketing preferences: opt-in/opt-out status for e-mail, SMS or on-site marketing, including logs of consent and withdrawal of consent.

Cookies and similar technologies

Cookies and tags: small data files placed on your device (session and persistent cookies), pixels, and similar tracking technologies used to remember your choices, secure your sessions, and analyse usage.
Third-party identifiers: identifiers from analytics tools, affiliate trackers or advertising networks where you have given consent.

Reflect: The exact data collected depends on how you use shufflerok.com and which features of Shuffle you choose to engage with. Where specific data is mandatory (for example, identity and age verification), we will make this clear at the point of collection.

Legal Basis for Processing

Observe: Data protection laws (including the UK GDPR) require us to identify the lawful bases on which we process your personal data.

Contractual necessity

Account creation and management: We use your identity, contact, and account data to create and administer your account, provide access to games, process deposits and withdrawals, and offer customer support.
Service delivery: Processing of gameplay, transaction, and technical data is necessary to provide the online gambling services you request and to ensure proper operation of shufflerok.com.

Legal obligations

KYC/AML and responsible gambling: We process identification documents, transaction data and behavioural information to comply with anti-money laundering, counter-terrorist financing and responsible gambling obligations in Curaçao and other applicable jurisdictions.
Record-keeping and reporting: We retain certain records for tax, accounting, regulatory reporting and dispute-handling purposes for the periods required by law.

Legitimate interests

Security and fraud prevention: We process technical, behavioural and transactional data to detect and prevent fraud, abuse of bonuses, account takeovers, and other unlawful or harmful activities.
Service improvement and analytics: We use aggregated and pseudonymised data to understand performance, improve game offerings, and optimise the user experience of Shuffle on shufflerok.com.
Business operations: We may process data for internal governance, risk management, corporate transactions, and the protection of our rights, subject to your reasonable expectations and privacy impact.

Consent

Marketing communications: We send direct electronic marketing (such as promotional e-mails or push notifications) only where you have given valid consent or where otherwise permitted by law, and you can withdraw consent at any time.
Optional cookies and advertising: We use analytics and advertising cookies or similar technologies on shufflerok.com only with your consent obtained through our cookie banner or settings panel.

Protection of vital interests and legal claims

Risk of serious harm: In rare cases, we may process data where necessary to protect your vital interests or those of another person (for example, where we reasonably believe a player is at serious and immediate risk of harm).
Legal claims: We process data as necessary to establish, exercise, or defend legal claims in any relevant jurisdiction.

Reflect: Where we rely on legitimate interests, we balance those interests against your rights and freedoms and implement appropriate safeguards. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Purpose of Processing

Observe: Personal data is processed for clearly defined, lawful purposes related to Shuffle on shufflerok.com.

Core service provision

Running the casino: To operate user accounts, enable deposits and withdrawals in supported crypto assets, provide access to games, and manage gameplay, bonuses and loyalty programmes.
Customer support: To answer queries, resolve technical issues, handle complaints and provide responsible gambling assistance.

Compliance and risk management

KYC/AML checks: To verify your identity, age and eligibility, monitor transactions, and comply with anti-money laundering and counter-terrorist financing obligations.
Fraud and security: To detect and prevent fraudulent transactions, account misuse, chargeback abuse and other security threats.

Service improvement and analytics

Performance analysis: To analyse how users interact with shufflerok.com, identify technical problems, and improve the design and functionality of the site.
Product development: To evaluate the popularity of games, promotions and features and to develop new offerings suited to users of Shuffle.

Marketing and personalisation

Marketing communications: To send you offers, promotions, and newsletters about shufflerok.com where permitted by law and your preferences.
Personalised content: To tailor promotions and recommendations based on your preferences and gameplay behaviour, subject to your marketing and cookie choices.

Legal, regulatory and business purposes

Legal compliance: To comply with regulatory requirements, respond to lawful requests from authorities, and maintain appropriate business records.
Corporate governance: To manage our business, including audits, mergers, acquisitions, restructurings, or transfers of business, subject to appropriate safeguards.

Reflect: We do not process your personal data in ways that are incompatible with these purposes, and we will inform you of any new, materially different purposes where required by law.

Disclosure & Sharing

Observe: We share personal data with carefully selected third parties where necessary for Shuffle to operate, subject to contractual and legal safeguards.

Service providers and business partners

Payment and crypto partners: Providers that facilitate crypto deposits and withdrawals, blockchain infrastructure, and asset conversion (for example, wallet providers or payment gateways), who receive necessary transaction data and wallet addresses.
Verification and compliance providers: KYC/AML service providers that perform identity checks and sanctions screening using your identification documents and related data.
Technical and security providers: Hosting companies, content delivery networks, security monitoring services and IT support providers that process technical data to keep shufflerok.com secure and reliable.

Analytics, affiliates and advertising partners

Analytics providers: Third-party analytics tools that help us understand how users interact with shufflerok.com, generally using pseudonymised or aggregated data and cookies where you have consented.
Affiliate partners: Affiliates and marketing partners who refer users to Shuffle; we may share limited tracking identifiers and aggregated performance data.
Advertising networks: Subject to your consent, advertising networks may receive cookie or device identifiers to measure and optimise campaigns.

Corporate and legal disclosures

Group and corporate transactions: Other entities within the Natural Nine B.V. structure (if applicable), and advisors, in connection with internal administration, audits, or corporate transactions such as mergers or asset sales.
Regulators and authorities: Licensing bodies (including Antillephone N.V.), law enforcement, tax and other government authorities, where required or permitted by law.
Legal proceedings: Courts, legal advisers and other parties where disclosure is necessary to establish, exercise, or defend legal claims.

Public blockchains

Blockchain transparency: When you transact in crypto with Shuffle, certain transaction details (including your public wallet address) are recorded on public blockchains that are not controlled by us and may be globally accessible.

Reflect: We do not sell your personal data for monetary consideration. Any sharing with advertising or analytics partners is based on consent or another lawful basis and is governed by data protection agreements and appropriate safeguards.

International Transfers

Observe: Because Natural Nine B.V. is based in Curaçao and uses global service providers, your data may be transferred to and processed in countries outside the United Kingdom.

Where your data may be processed

Curaçao: Primary corporate and licensing jurisdiction of Natural Nine B.V.
European Economic Area (EEA) and other locations: Some hosting, analytics, support and verification providers may be located in the EEA or in other countries, including the United States and other non-UK, non-EEA jurisdictions.
Global blockchain networks: Crypto transactions are processed on decentralised, public blockchains that may be replicated across nodes worldwide.

Safeguards for international transfers

Standard Contractual Clauses and UK addendum: Where required, we enter into the European Commission's Standard Contractual Clauses and/or the UK International Data Transfer Agreement (IDTA) or UK Addendum to ensure an adequate level of protection.
Adequacy and data transfer frameworks: Where applicable, we rely on adequacy regulations or recognised frameworks (such as the EU - US Data Privacy Framework and its UK extension) for transfers to certified US entities. We do not rely on the invalidated EU - US Privacy Shield.
Technical and organisational measures: We apply encryption, access controls, and data minimisation to reduce risks associated with cross-border transfers.

Reflect: By using shufflerok.com, you acknowledge that your data may be processed in countries whose laws may provide a different level of protection than those in the UK; however, we will always implement appropriate safeguards in accordance with UK data protection law.

Data Retention

Observe: We keep personal data only for as long as necessary for the purposes for which it was collected or to meet legal, regulatory, or operational requirements.

Typical retention periods

Account and identification data: Generally retained for the duration of your account and for up to 5 years after account closure, to satisfy KYC/AML, anti-fraud and record-keeping obligations.
Transaction and gameplay data: Retained for the duration of your account and for 5 - 7 years after closure, depending on applicable legal and tax requirements in relevant jurisdictions.
KYC documents: Copies of identity and verification documents are typically retained for 5 years after the end of the business relationship or the date of the last transaction, in line with AML rules.
Technical logs: Security and access logs are usually kept for 12 - 24 months unless a longer period is required in connection with an investigation or legal claim.
Marketing data: Retained while you remain opted in and for up to 2 years after your last interaction with shufflerok.com, unless you withdraw consent earlier.
Complaints and legal records: Correspondence and dispute-related records are generally retained for 6 years after closure of the matter.

Deletion criteria: We will delete or irreversibly anonymise personal data when (i) it is no longer reasonably required for the purposes described in this policy, (ii) retention is no longer required by applicable law or regulation, and (iii) any relevant limitation period for potential legal claims has expired. Where you request erasure, we will also respect your rights subject to the exemptions under applicable law.

Reflect: Retention periods may vary depending on the specific data category and the jurisdictions whose laws apply, but we apply consistent criteria to ensure data is not kept longer than necessary.

Your Rights

Observe: As a user of Shuffle on shufflerok.com, you have data protection rights under the UK GDPR and, where applicable, equivalent rights reflecting EU GDPR and Mexican data protection principles.

Core data protection rights

Right of access: To obtain confirmation of whether we process your personal data and to receive a copy of that data, together with information about the processing.
Right to rectification: To have inaccurate or incomplete personal data corrected or updated.
Right to erasure: To request deletion of your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis. Legal and regulatory retention obligations may limit this right.
Right to restriction: To ask us to temporarily suspend processing of your data in specific situations, such as while we verify accuracy or assess an objection.
Right to object: To object at any time to processing based on our legitimate interests, including profiling, and to object to direct marketing (including profiling for marketing) at any time.
Right to data portability: To receive certain personal data you provided to us in a structured, commonly used and machine-readable format, and to request that we transmit it to another controller where technically feasible.
Right to withdraw consent: Where processing is based on your consent (e.g. marketing or optional cookies), you may withdraw that consent at any time without affecting prior lawful processing.
Rights related to automated decision-making: Where we use automated decision-making that has legal or similarly significant effects, you have the right to obtain human review, to express your point of view, and to contest the decision.

Alignment with Mexican privacy concepts

ARCO-style rights: If you are protected by Mexican data protection laws, the above rights broadly correspond to rights of access, rectification, cancellation (erasure) and opposition (ARCO). While Natural Nine B.V. is established in Curaçao, we aim to handle requests from Mexican users in a manner consistent with these principles where applicable.

How to exercise your rights

Submission: You can exercise your rights by contacting our DPO at privacy@shufflerok.com, clearly stating that your request concerns data protection rights in relation to Shuffle on shufflerok.com.
Verification: We may ask you to provide information to confirm your identity (for example, login information or limited additional details) before actioning your request.
Timeframe: We aim to respond to all valid requests within 30 days of receipt. This period may be extended by up to a further two months for complex or numerous requests, in which case we will inform you of the extension and reasons.
Cost: Requests are handled free of charge, unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by law.

Reflect: You also have the right to lodge a complaint with a supervisory authority, as described in the "Complaints & Contacts" section, if you are not satisfied with our response or handling of your personal data.

Cookies & Tracking Technologies

Observe: Shuffle on shufflerok.com uses cookies and similar technologies to operate and improve the site and to support marketing activities, in accordance with applicable laws (including the UK Privacy and Electronic Communications Regulations).

Types of cookies we use

Strictly necessary (session) cookies: Essential for the functioning of the website and your secure login; they enable core features such as account authentication, security checks, and transaction processing. These are typically session cookies that expire when you close your browser.
Functional (persistent) cookies: Used to remember your preferences (such as language, region, and display settings) and to enhance your experience on recurring visits.
Analytics cookies: Used to gather information about how visitors use shufflerok.com (for example, pages visited, time spent, error messages). These help us improve performance and usability.
Advertising and affiliate cookies: Used, with your consent, to measure the effectiveness of marketing campaigns, deliver more relevant advertising, and track referrals from affiliate partners.
Security cookies: Used to help detect malicious activity and protect your account from unauthorised access.

Managing cookies and tracking

Cookie banner and settings: On your first visit (and periodically thereafter), we present a cookie banner that allows you to accept or manage non-essential cookies. You can adjust your preferences at any time via our cookie settings panel where available.
Browser controls: You can configure your browser to block or delete cookies. Doing so may affect some functionalities of shufflerok.com, particularly for strictly necessary cookies.
Third-party opt-outs: For certain analytics and advertising providers, you may also use their own opt-out mechanisms, where available.

Reflect: We aim to implement cookies in a transparent and privacy-respecting way. For more detailed information about specific cookies and durations, you may contact us at privacy@shufflerok.com.

Data Security

Observe: We implement technical and organisational measures designed to protect personal data processed in connection with Shuffle on shufflerok.com.

Technical safeguards

Encryption in transit and at rest: We use modern transport layer security (TLS 1.2 or higher) to encrypt data in transit and apply industry-standard encryption and access controls for data at rest.
Access control and authentication: Access to personal data is restricted to authorised personnel who require it for their roles, following the principle of least privilege and role-based access controls. Multi-factor authentication is implemented on critical internal systems where feasible.
Network and infrastructure security: We use firewalls, intrusion detection/prevention systems, and regular patching to protect our infrastructure and hosting environments.

Organisational safeguards

Policies and training: Staff with access to personal data receive training on data protection, information security, and responsible handling of player information.
Vendor management: We carefully select third-party service providers, require them to implement appropriate security measures, and enter into data protection agreements where required.
Audits and testing: We conduct periodic reviews and testing of security controls and, where appropriate, engage independent experts to assess our security posture.

Incident response

Monitoring and detection: Systems are monitored for unusual activity, and suspected incidents are investigated promptly.
Breach handling: In the event of a personal data breach, we will assess the risk to your rights and freedoms and notify relevant supervisory authorities and affected individuals where required by law.

Reflect: We design our security programme with reference to internationally recognised standards such as ISO 27001 and SOC 2, while acknowledging that Shuffle (Shuffle) may not hold formal certifications under these frameworks. No system is completely secure, but we continuously work to reduce risks and enhance protection.

Complaints & Contacts

Observe: You have the right to raise concerns or complaints about how we handle your personal data, and you can do so both directly with us and with relevant supervisory authorities.

Contacting us first

Submit your complaint: Send details of your concern to our DPO at privacy@shufflerok.com, clearly indicating that your complaint relates to data protection and Shuffle on shufflerok.com.
Acknowledgement: We aim to acknowledge receipt of your complaint within 7 days.
Investigation and response: We will investigate your complaint and strive to provide a substantive response within 30 days. If more time is needed due to complexity, we will inform you of the delay and reasons.
Escalation: If you are not satisfied with the response, you may request further review by a senior member of our compliance or legal team.

Supervisory authorities

United Kingdom - Information Commissioner's Office (ICO): If you are located in the UK, you have the right to lodge a complaint with the ICO. Website: https://ico.org.uk. Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.
European Union / EEA: If you are in the EU/EEA, you may also lodge a complaint with your local data protection authority, particularly in the country of your habitual residence, place of work, or place of the alleged infringement.
Mexico - INAI: If you are protected by Mexican data protection laws, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). Website: https://www.inai.org.mx.

Reflect: We encourage you to contact us first so we can attempt to resolve your concerns directly. However, you may contact a supervisory authority at any time, particularly if you believe your rights have been infringed or that our response has been inadequate.

Updates

Observe: We may update this Privacy Policy from time to time to reflect changes in legal requirements, our processing practices, or the services offered through Shuffle on shufflerok.com.

How we will notify you

On-site notices: We will post the updated Privacy Policy on shufflerok.com and indicate the "Last updated" date at the top or bottom of the policy.
E-mail notifications: For material changes, we will, where feasible, send an e-mail notification to the address associated with your account.
Account alerts and banners: We may also display in-account notifications or banners drawing your attention to significant changes.

Timing and your options

Advance notice: Where changes are material and reasonably foreseeable, we will provide at least 30 days' notice before the updated policy takes effect, unless immediate changes are required by law or for security reasons.
Review and consent: Continued use of shufflerok.com after the effective date of an updated Privacy Policy will constitute your acknowledgement of the changes, to the extent permitted by law.
Right to object or close your account: If you do not agree with material changes, you may object where applicable or close your account. We will continue to process your data only as necessary for legitimate purposes such as legal and regulatory compliance.

Versioning and history: The current version of this Privacy Policy is identified by the "Last updated" date below. Earlier versions may be made available upon request. Last updated: January 2026.

Reflect: We recommend that you review this Privacy Policy periodically to stay informed about how Shuffle processes personal data in relation to Shuffle on shufflerok.com.