Privacy Policy

1.1  This Privacy Policy explains how VigBreak collects, uses, shares and protects personal data about you when you use the VigBreak website at www.vigbreak.com (the Website) and the VigBreak web application at app.vigbreak.com (the App, and together the Service), and when you otherwise interact with us.

1.2  We are committed to protecting your privacy and to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.3  Please read this Policy together with our Cookie Policy, which explains how we use cookies and similar technologies, and our Terms and Conditions.

2.1  For the purposes of UK data protection law, the controller of your personal data is William Duffy, a sole trader trading as “VigBreak” of 6 Springbrook Close, St Helens, WA10 5EN, (we, us, our).

2.2  If our business is incorporated as a company, the company will become the controller of your personal data in place of the sole trader, on the same terms set out in this Policy, and we will update the details above and notify you of the change where required.

2.3  If you have any questions about this Policy or how we handle your personal data, please contact us at support@vigbreak.com.

2.4  We have not appointed a statutory Data Protection Officer, as we are not required to do so.

3.1  This Policy covers personal data we process about: visitors to the Website; registered users of the App; and individuals who contact us or communicate with us.

3.2  The Service may link to third-party websites, including those of betting operators (Bookmakers). We are not responsible for the privacy practices of those third parties, and you should review their own privacy notices.

4.1  We collect and process the following categories of personal data:

• Account data – the email address you use to register and sign in;
• Profile and settings data – your account settings and preferences within the App;
• Tracking data – the bets and related information you choose to record and track in the App. This is your own record-keeping data and is private to your Account;
• Technical and usage data – your IP address, approximate location derived from your IP address, device and browser type, and information about how you use the Service;
• Analytics data – information about your interaction with the Website collected through analytics tools, as described in clause 11 and our Cookie Policy;
• Communications data – the content of, and metadata relating to, any messages you send us; and
• Payment data – if and when paid Subscriptions are introduced, limited billing information. Full payment card details are collected and processed directly by our payment provider (Stripe) and are not stored by us.

4.2  We do not intentionally collect special category data (such as data about health, race or beliefs). Please do not provide such data to us. The Service is not directed at children and we do not knowingly collect data about anyone under 18.

5.1  We collect personal data: (a) directly from you, when you register, use the App, record Tracking Data, adjust settings or contact us; (b) automatically, through cookies and similar technologies and through server logs, when you use the Service; and (c) from our service providers, such as our analytics, hosting, email and (in future) payment providers, acting on our behalf.

6.1  The Website uses cookies and similar technologies, including for analytics, subject to your consent where required. The App is cookieless apart from a strictly necessary session cookie used to keep you signed in. Full details are set out in our Cookie Policy.

7.1  We use your personal data to:

• create and administer your Account and provide passwordless sign-in;
• provide, operate and maintain the Service, including delivering analytics, Signals and your private bet-tracking features;
• send you service and transactional communications, such as sign-in links and important notices about the Service;
• respond to your enquiries and provide support;
• understand and improve how the Service is used, and to develop new features;
• keep the Service secure and prevent, detect and investigate fraud, misuse and unauthorised access;
• process payments and manage Subscriptions, if and when introduced;
• send you marketing communications where you have agreed to receive them; and
• comply with our legal and regulatory obligations and establish, exercise or defend legal claims.

8.1  Under the UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are set out below:

8.2  Where we rely on legitimate interests, we have carried out a balancing exercise to ensure our interests are not overridden by your rights. You may ask us for more information about this. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

9.1  We use passwordless, “magic link” authentication. When you sign in, we send a single-use link to your registered email address. We do not store passwords for your Account. Because sign-in depends on access to your email, you should keep your email account secure.

9.2  Sign-in links are delivered by our transactional email provider on our behalf, as described in clause 13.

10.1  We will only send you marketing communications where you have consented, or where otherwise permitted by law. You can opt out at any time by using the unsubscribe link in our emails or by contacting us at support@vigbreak.com.

10.2  Service and transactional messages (such as sign-in links and essential notices about the Service or your Account) are not marketing and will continue to be sent while you hold an Account.

11.1  On the Website we use Google Analytics, provided by Google, to understand how visitors use the Website. Google Analytics uses cookies and is loaded only where you have given consent through our cookie banner. Google processes this data as described in its own privacy documentation.

11.2  We also use Cloudflare for DNS and for privacy-focused website analytics. Where our Cloudflare analytics do not use cookies or collect personal data in a way that requires consent, they may operate without a consent requirement; this is explained further in our Cookie Policy.

11.3  The App does not use analytics cookies. Full details of cookies and how to manage them are in our Cookie Policy.

12.1  If and when we introduce paid Subscriptions, payments will be processed by Stripe. Stripe collects and processes your payment card details directly as a separate controller for certain purposes (such as fraud prevention) and as our processor for others. We do not receive or store your full card number.

12.2  We will receive limited billing information, such as confirmation of payment, the subscription plan and partial card details, to administer your Subscription. Stripe’s handling of your data is governed by Stripe’s own privacy policy.

13.1  We do not sell your personal data. We share it only as described below.

13.2  We use trusted third-party service providers who process personal data on our behalf, under contract and only on our instructions. Our key providers are:

13.3  This list may change as our Service develops; we will keep this Policy up to date. We may also disclose personal data: (a) where required by law, regulation, court order or a regulator; (b) to establish, exercise or defend legal claims; (c) to protect the rights, property or safety of us, our users or others; and (d) to a buyer or successor in connection with a sale, merger or reorganisation of our business, subject to appropriate confidentiality protections.

14.1  Some of our service providers are located outside the UK. Where we transfer your personal data outside the UK, we ensure an appropriate level of protection is in place using a lawful transfer mechanism recognised under the UK GDPR.

14.2  Transfers to providers in the European Economic Area (such as our hosting provider in Germany) are covered by the UK’s adequacy regulations for the EEA, which recognise that the EEA offers an adequate level of data protection.

14.3  For transfers to providers in the United States (such as our email, backup, analytics and payment providers), we rely on one or more of the following, as applicable to each provider: (a) the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), where the provider is certified under the Data Privacy Framework and has opted into the UK Extension; or (b) the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, supported where appropriate by a transfer risk assessment and additional safeguards such as encryption.

14.4  You may request further information about the safeguards we apply to a particular transfer by contacting us at support@vigbreak.com.

15.1  We keep your personal data only for as long as necessary for the purposes set out in this Policy, including to provide the Service, to comply with legal, accounting or reporting obligations, and to resolve disputes.

15.2  In general: (a) Account, settings and Tracking data are retained for as long as your Account is active; (b) following closure of your Account, we delete or anonymise your data within a reasonable period, unless we are required to keep it longer (for example, transaction records for tax purposes are typically kept for six years); and (c) backups are retained on a rolling basis and are overwritten in the ordinary course.

15.3  Where we no longer need your personal data, we will securely delete or anonymise it.

16.1  We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include passwordless authentication, encryption of backups, access controls and use of reputable infrastructure providers.

16.2  No method of transmission or storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security, and any transmission is at your own risk.

17.1  Under the UK GDPR you have the following rights in relation to your personal data:

• the right to be informed about how we use your data (which this Policy provides);
• the right of access to a copy of the personal data we hold about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of your data in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability, to receive certain data in a portable format;
• the right to object to processing based on our legitimate interests, and to object to direct marketing at any time; and
• the right to withdraw consent at any time where we rely on consent.

17.2  Some of these rights apply only in certain circumstances and are subject to exemptions under data protection law.

18.1  To exercise any of your rights, please contact us at support@vigbreak.com. We may need to verify your identity before responding, to protect your data.

18.2  We will respond within one month of receiving your request. This period may be extended by up to two further months for complex or numerous requests, in which case we will let you know. Exercising your rights is normally free of charge, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

19.1  We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. The analytics and Signals produced by the Service are general informational outputs and are not automated decisions about you as an individual within the meaning of Article 22 of the UK GDPR.

20.1  The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at support@vigbreak.com and we will take steps to delete it.

21.1  The Service may contain links to third-party websites, including Bookmakers and other resources. If you follow a link, please note that those third parties have their own privacy notices and we are not responsible for their processing of your personal data. We encourage you to read their privacy notices before providing any data to them.

22.1  We may update this Policy from time to time to reflect changes in our Service, our business (including incorporation as a company), or the law. The current version will always be available on the Service, with the effective date shown at the top.

22.2  Where changes are material, we will take reasonable steps to notify you, for example by email or a notice on the Service.

23.1  We have procedures in place to detect, report and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required, and we will notify you without undue delay where the breach is likely to result in a high risk to you.

24.1  If you have a concern about how we handle your personal data, please contact us first at support@vigbreak.com so that we can try to resolve it.

24.2  You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection. The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; www.ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

25.1  If you have any questions, requests or comments about this Policy or our data practices, please contact us at support@vigbreak.com, or by post at 6 Springbrook Close, St Helens, WA10 5EN.