Legal
Cosmobet Privacy Policy
A plain-English explanation of how Cosmobet collects, uses and protects the personal information of UK players, written to satisfy UK GDPR and the Data Protection Act 2018.
In short: Cosmobet only collects the data it genuinely needs to verify your age, secure your account, process payments, prevent fraud and meet UK Gambling Commission obligations. You can request a copy, a correction or a deletion of your personal data at any time.
This Privacy Policy explains how Cosmobet ("we", "us", "our") processes personal data when you visit cosmo-bet.online or use any related service. It applies to every adult UK resident who registers an account, opens our website or contacts our support team. By using Cosmobet you agree to the practices described below; if you do not agree, please stop using the service and close your account from the dashboard.
What personal data we collect
When you create a Cosmobet account we ask for the minimum information required to verify your identity and meet the UK Gambling Commission's Know Your Customer expectations. That includes your full name, date of birth, residential address, email address, phone number and a username of your choice. We also store the IP address used at sign-up, the device fingerprint, and the time and date of registration to help with fraud detection.
During verification we may ask for a photographic ID such as a passport or driving licence, a recent proof of address such as a bank statement or utility bill, and, for higher-stakes play, a proof of source of funds such as a payslip or savings statement. We collect transactional data every time you deposit, withdraw, place a bet or spin a slot, including the method used, amount, currency, game or market and outcome. Finally, we record technical data such as browser type, operating system, screen resolution and broad geographic location based on IP, plus the pages you visit and the actions you take inside the platform.
Why we process your data and the legal basis
We process personal data on the legal bases set out in Article 6 of the UK GDPR. We rely on the performance of a contract when we operate your account, process deposits and pay out withdrawals. We rely on legal obligation when we verify your age, run anti-money-laundering checks, file regulatory reports with the UK Gambling Commission and respond to information requests from the police or HMRC. We rely on legitimate interest for fraud prevention, platform analytics and improving the casino lobby. We rely on consent for non-essential marketing emails, push notifications and personalised promotions; you can withdraw that consent at any time from your account preferences or via the unsubscribe link in any marketing message.
Who we share data with
We share data only with parties that play a direct role in operating Cosmobet safely. That includes our payment processors (for example Stripe, Trustly and Worldpay) for deposits and withdrawals; identity verification providers such as Onfido and GBG for KYC checks; game studios (Pragmatic Play, NetEnt, Evolution, Play'n GO, Hacksaw and similar) who provide the games you launch; analytics providers such as Google Analytics 4 in a privacy-preserving mode; cloud hosting providers in the United Kingdom and European Economic Area; and the UK Gambling Commission, GamStop and law enforcement when we are required to do so by law.
We never sell your personal data, and we do not share it with third parties for their own marketing purposes. When a processor handles data on our behalf we sign a data-processing agreement that obliges them to apply at least the same standards of confidentiality and security as we do, and to delete the data at the end of the engagement.
How long we keep it
Account and transactional data is kept for the lifetime of your account and for a further seven years after closure, in line with the UK Gambling Commission's record-keeping requirements and HMRC tax legislation. Marketing preferences are kept until you withdraw consent or close your account. Technical analytics data is retained for 26 months in identifiable form and then either anonymised or deleted. Documents uploaded for verification are kept securely for six years after the last use of the account, then destroyed.
How we keep it secure
Cosmobet runs on HTTPS with HSTS across the entire estate, with TLS 1.3 by default and modern cipher suites only. Card details are tokenised by PCI-DSS certified processors and never stored on Cosmobet servers. Production databases are encrypted at rest with AES-256 and access is restricted on a strict least-privilege basis with mandatory two-factor authentication for every team member. We carry out regular penetration testing through an external CREST-accredited supplier and run continuous automated vulnerability scanning on every release.
Your rights under UK GDPR
You have the right to access the personal data we hold about you, to ask us to correct anything that is inaccurate, to ask us to delete it (subject to the regulatory retention periods explained above), to restrict or object to certain types of processing, and to receive a portable copy of the data you have provided. You also have the right to withdraw consent for marketing at any time, and to complain to the Information Commissioner's Office at ico.org.uk if you feel we have not handled your data properly.
To exercise any of these rights, email our Data Protection Officer at privacy@cosmo-bet.online. We aim to respond within five working days and will always respond within the statutory one calendar month. We may ask for proof of identity before releasing personal data, to make sure we are sending it to the right person.
International transfers
Most processing takes place in the United Kingdom or the European Economic Area. Where data is transferred outside the UK and EEA, we rely on the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses, supplemented by appropriate technical measures such as encryption in transit and at rest.
Children
Cosmobet is strictly an 18+ service. We do not knowingly collect personal data from anyone under the age of eighteen. If you are a parent or guardian and believe a minor has registered, please contact us immediately so that we can close the account and refund any deposits.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in the law, regulation or our own practices. Material changes will be notified by email at least 30 days before they take effect, and the "Last updated" date below will always reflect the current version. Continued use of Cosmobet after the change takes effect is taken as acceptance of the updated policy.
Last updated: 29 May 2026