Subject Access Request to bet365

bet365 is the trading name of two partnerships incorporated in Malta: Hillside (UK Sports) ENC for sports betting and Fantasy Sports, and Hillside (UK Gaming) ENC for Casino, Live Casino and Poker. Both are licensed by the Gambling Commission (account numbers 55148 and 55149), both are named as the data controller in one privacy policy, and one request covers your bet365 account whichever products you used — say which products you mean if it matters. bet365 publishes no ICO registration number for either partnership, which is why none is shown here. bet365's help centre has a Subject Access Requests page, and the quickest way to reach it is to search the help centre for "subject access" — it is not linked from the privacy policy or the terms. The page asks customers to complete an online form hosted by OneTrust, at bet365's customer form (bet365 links it from a "draft" address, so if it stops working go back to the page above for the current link). The form asks for your country, your past and present usernames, date of birth, name, email address, phone number, address and postcode, a description of what you want, and an optional upload of identification. bet365 says "you will be required to complete security" and that without satisfactory verification it cannot fulfil the request. If you would rather not use the form, bet365's page says to contact its customer support team through the website or app, and links its Contact Us page, which offers Live Chat, a webform, social media and post. Its privacy policy says a request can be addressed to the customer service team rather than to the Data Protection Officer, whose mailbox is data.protection@bet365.com. Live Chat is answered first by an automated assistant, with a human agent available if you need one. The Stoke-on-Trent address above is the postal address bet365 publishes for Customer Services; bet365 does not name post as a subject access route, so use the form or the email address if you can, and keep a copy of whatever you send. A solicitor acting for a client has a separate Law Firm Webform, which requires the firm's name, address and email address, the client's details, and an upload of client identification and a power of attorney. bet365 says a representative "will be required to provide sufficient supporting documentation including appropriate form of authority". It publishes nothing about other kinds of representative. bet365 does not commit to a number of days. Its page says it will respond "within the permitted timeframe allowed under applicable legislation for your jurisdiction", that the period may be extended where a request is complex or you have made several, and that it will tell you if so. There is no fee unless a request is manifestly unfounded or excessive. bet365 says some information may not be provided, "such as data relating to other individuals or information that is subject to legal privilege", and its privacy policy adds that the rights are "subject to limitations or exceptions in certain circumstances" without naming any. If you only want your betting record, you may not need a request at all: your account History shows settled and unsettled bets in date ranges of up to six months, and bet365's terms say your balance and transaction history can be viewed at any time once you are logged in. If your request is about affordability or source of funds, note what bet365 says it does. It runs "Financial Vulnerability Checks" when losses reach a certain level and may set net deposit limits as a result; it says it does not run credit checks but uses information from credit reference agencies — public data such as bankruptcy and County Court Judgments — and that those searches show on your own credit file but not to other companies. To increase a limit it asks for financial documents through a third party, Bet Budget. Its terms say verification checks cover age, identity, address, location, financial circumstances and the source of the funds you deposit, and may involve a passport, driving licence, birth certificate, financial statements and documents supporting the spending on your account. bet365 points UK account holders to the industry Credit Reference Agency Information Notice, which names Equifax, Experian and TransUnion; what an agency holds about you needs a request to that agency — see Experian, Equifax and TransUnion. Many requests follow a suspension, a closure or a withheld withdrawal. bet365's terms say it may close, limit or suspend an account at any time; that a suspension for suspected "Prohibited Activity" is applied without notice and funds cannot be withdrawn while it investigates; that on a closure for Prohibited Activity it will withhold all or part of the balance; and that it may be required by law or by a regulator to withhold funds until its verification checks are complete. An account not logged into for 365 days is treated as dormant, and once bet365 has tried to return a positive balance a £2 administration fee is deducted every 28 days from 35 days after that first attempt. A subject access request gathers evidence; it is not a complaint. bet365 says to raise a complaint through its Contact Us page (it will not handle complaints on social media), that it aims to respond within 48 hours, that an escalation to its Customer Service Management team is its final response, and that after eight weeks or a rejected final response it issues a Complaint Reference so you can take the dispute to the Independent Betting Adjudication Service, which is free and whose ruling bet365 says it will abide by. A complaint about how your personal data was handled goes to the ICO instead. Self-exclusion and account closure are different things at bet365. Self-exclusion runs for 6 months, 1 year, 2 years or 5 years, cannot be reversed for any reason during that time, and still lets you log in to withdraw a balance; bet365 keeps your data for the whole period of an exclusion, and for a permanent one for as long as it lasts. Account closure runs from one week to indefinitely, or to a date you choose; an online closure reopens automatically when the period ends, and after an online closure you can still log in to withdraw a remaining balance. GAMSTOP is a separate scheme, run by The National Online Self Exclusion Scheme Limited, and a GAMSTOP registration needs its own request to GAMSTOP. bet365 also takes part in GamProtect, under which operators share the name, date of birth, postcode, email address and phone number of customers they have identified as at high risk of harm; GamProtect's privacy notice names bet365's two partnerships as controllers and data.protection@bet365.com as the contact for rights over that data, says an entry stays active for five years and can then persist for 35 more, and routes any challenge to the operator that added you. bet365 says it keeps personal data for a minimum of five years — ten in some locations — from your last interaction, longer where it has a lawful purpose, and specifically longer for responsible gambling, self-exclusion, anti-money-laundering, fraud, crime prevention and account-restriction reasons. bet365 publishes nothing about requests concerning a customer who has died. Data protection rights end at death, so that is not a subject access request; ask bet365's customer service team about a deceased customer's account instead. If gambling is causing you harm, bet365's Safer Gambling site points to GamCare, which operates the National Gambling Helpline on Freephone 0808 8020 133, open 24 hours every day.

Made under UK GDPR Article 15

Licensed operators must monitor customer activity to identify harm or potential harm from the point an account is opened, and the files they build doing it hold far more than your betting history: affordability and source of funds checks, responsible gambling interaction notes, internal risk flags, VIP or high-value customer designations, and the marketing you were sent and when.

These records are most often requested by people building a complaint about how an operator handled their account. The operator's own interaction notes and affordability checks are usually the substance of that complaint, and they are personal data, so they fall within a subject access request.

Self-exclusion is handled by more than one organisation. The national online self-exclusion scheme is run by The National Online Self Exclusion Scheme Limited, trading as GAMSTOP, which publishes its own data protection contact — so records of a GAMSTOP registration need a separate request to GAMSTOP rather than to the operator.

• Complete account and transaction history
• Affordability, source of funds and Know Your Customer checks
• Responsible gambling interaction notes and internal flags
• Marketing and bonus offers sent to you, with dates
• Self-exclusion requests and how they were actioned

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.