Privacy Policy

This Privacy Policy (Part B) explains how we collect, use, share, and protect your personal data when you use the Platform, in accordance with the UK GDPR and the Data Protection Act 2018. It should be read together with Part A (Terms & Conditions) and Part C (Cookie Policy).

This Privacy Policy applies to both companies that operate the Platform: Universal Affiliates Limited and CMA Solutions Limited. Section 2 explains which of the two companies is responsible for your personal data.

We process personal data only to the extent necessary to support fairness, transparency, user protection, fraud prevention, and legal/regulatory compliance.

The Data Controller responsible for your personal data depends on which entity is your Contracting Party for the relevant Partner Offer or activity, determined in the same way as under Part A, Clause 1.2:

Universal Affiliates Limited (Company No. 11667550) is the Data Controller for your account-level data (e.g. login credentials, profile, general support), and for any data relating to a Partner Offer for which it is designated as the Contracting Party under Part A, Clause 1.2. This designation is made per Partner Operator, and is not automatically determined by whether that operator is a GB Licensed Operator or an International Operator.

CMA Solutions Limited (Company No. 16824488) is the Data Controller for any data relating to a Partner Offer for which it is designated as the Contracting Party under Part A, Clause 1.2. This designation is made per Partner Operator, and is not automatically determined by whether that operator is a GB Licensed Operator or an International Operator.

The identity of your Data Controller for a specific Partner Offer is disclosed to you before you apply for it, in the same way as your Contracting Party is disclosed under Part A, Clause 1.2. Which Partner Offers are available to you at all is a separate matter governed by Geo-Blocking (Part A, Clauses 1.4, 1.6, 1.7 and 9) — for example, if you are resident in the United Kingdom, the Platform only presents Partner Offers relating to GB Licensed Operators to you — but this availability rule does not, of itself, determine which company is your Data Controller for those offers.

Both companies are separate, independently responsible legal entities under common ultimate ownership, registered at the same address below, and both apply the identical UK GDPR standards set out in this Privacy Policy regardless of which one is your Data Controller. In this Privacy Policy, we refer to Universal Affiliates Limited and CMA Solutions Limited together as "the Companies" purely as drafting shorthand for convenience. This does not create, imply, or evidence a "group" as defined by the Companies Act 2006, a holding/subsidiary relationship, a joint venture, or joint and several liability between the two companies — see Part A, Clause 1.3 for further detail on their corporate separateness.

Universal Poker is the shared trading name used by Universal Affiliates Limited and CMA Solutions Limited to operate the Platform.

Sutherland House, 1759 London Road, Leigh-on-Sea, Essex, SS9 2RZ (registered office of both companies)

Contact for all privacy and data protection queries: contact@universalpoker.com. If you know which company's services your query relates to, please mention it to help us route your request, though this is not required.

Neither company has appointed a Data Protection Officer (DPO), as neither meets the thresholds requiring mandatory DPO appointment under the UK GDPR (Article 37). The contact point for all data protection matters for either company is the address and email above.

We keep this DPO-threshold assessment under review as either company's processing activities evolve, and would appoint a DPO for either or both companies if it became required.

We may record acceptance events for compliance/evidential purposes, including the specific Partner Operator and Partner Offer applied for, which determines your Data Controller under this Section 2.

You are not required to provide all data, but without certain data some features cannot function.

We use legitimate interests for Platform security, fraud prevention, compliance controls, and referrer-visible reporting for commission verification. Where we rely on legitimate interests, we apply safeguards such as data minimisation, access controls, and pseudonymisation/masking. You have the right to object to legitimate interests processing — see Section 3D above for details.

Partner Operators are independent third parties. If you use their services, they process your data under their own privacy policies and terms. We do not control their KYC decisions, gameplay, or payments/rewards.

We send marketing emails only where you have opted in (or where permitted). You can unsubscribe at any time. We may use an email provider (e.g., Brevo). If email analytics/tracking is enabled, we use consent controls where required by law. We maintain opt-in/opt-out controls and suppression handling for marketing communications. Where applicable to our services, marketing and promotional activity is operated in alignment with the Gambling Commission's Licence Conditions and Codes of Practice (LCCP), the CAP Code, and ASA advertising rules.

We use strictly necessary cookies (e.g. for authentication and security). Where analytics or marketing cookies are enabled (including GA4), we use a cookie consent mechanism and only load non-essential cookies after you have given consent where required by law.

You can manage or withdraw cookie consent at any time via Cookie Settings on the Platform. For full details, see our Cookie Policy at /cookie-policy. This Privacy Policy (Part B) should be read together with our Terms & Conditions (Part A) and Cookie Policy (Part C).

While both companies are UK-based, our technical infrastructure is global. Your data may be processed outside the UK — in particular, our primary database (Supabase) is hosted in the United States (AWS US East, Northern Virginia).

Where transfers occur, we rely on the UK International Data Transfer Addendum (UK IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses (SCCs), incorporated into our providers' Data Processing Addenda, which contractually bind them to protect your data to UK standards. Section 9 below lists the specific safeguards used for each service provider.

This applies identically regardless of whether Universal Affiliates Limited or CMA Solutions Limited is your Data Controller: both companies use the same technical infrastructure and the same transfer safeguards.

We monitor regulatory guidance from the ICO on international transfers and will review our safeguards and contracts if adequacy decisions, SCCs, or the UK IDTA framework change.

We do not sell your personal data. We may share it only as described below.

The service providers listed below process personal data on behalf of whichever of the Companies is your Data Controller under Section 2. Both companies use the same providers and the same safeguards, regardless of which one is your Data Controller.

We retain data only as needed for the purposes above, compliance, fraud prevention, dispute handling, and legal requirements. Typical retention:

For retention purposes, relationship end date means the date your Platform account is closed, terminated, disabled, or otherwise moved into a terminal status.

These retention periods apply identically regardless of whether Universal Affiliates Limited or CMA Solutions Limited is your Data Controller.

Under UK GDPR and the Data Protection Act 2018, you may have the following rights: access to your personal data; rectification of inaccurate data; erasure ('right to be forgotten') where legally applicable; restriction of processing; objection to processing (including direct marketing); data portability; and withdrawal of consent at any time where processing is consent-based. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

How to exercise your rights: Submit a request by email to contact@universalpoker.com, clearly stating your name, the email address linked to your account, and the specific right(s) you wish to exercise. You do not need to know which company is your Data Controller to submit a request — we will identify the correct company under Section 2 and respond accordingly. We may ask you to verify your identity before processing your request. We will respond within one calendar month of receipt. For complex or multiple requests, we may extend this by a further two months and will notify you accordingly.

If your country of residence changes, request an account-country update by contacting contact@universalpoker.com from your registered account email. A country of residence change may affect which Partner Offers are available to you going forward (see Part A, Clause 1.4); it does not, of itself, change your Data Controller for your account-level data or for any specific Partner Offer, which remains determined under Section 2 / Part A, Clause 1.2 for that specific offer. We may request reasonable verification information to protect account security and compliance, and we may temporarily restrict access to affected offers until verification is completed and records are updated.

Right to complain: If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

We use reasonable technical and organisational measures including access controls, least privilege, encryption in transit and at rest, secure credential handling, regular access reviews, monitoring, and anti-abuse processes.

Both companies rely on the same technical infrastructure and security controls described in Section 9, ensuring a consistent standard of protection for your data regardless of whether Universal Affiliates Limited or CMA Solutions Limited is your Data Controller.

If a personal data breach occurs, we assess it promptly. Where the breach is likely to result in a risk to your rights and freedoms, the affected company (Universal Affiliates Limited or CMA Solutions Limited, as your Data Controller under Section 2) notifies the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with UK GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you directly without undue delay, in accordance with UK GDPR Article 34.

Because both companies share the same technical infrastructure (Section 9), we investigate suspected breaches jointly where relevant, but the company that is your Data Controller remains responsible for assessing and, where required, notifying regulators and you about a breach affecting your data.

Where relevant to gambling regulatory obligations, we also notify the Gambling Commission.

Please use the single contact point below for any privacy or data protection query, regardless of which company is your Data Controller under Section 2 — we will identify the correct company and route your query accordingly.