Tombola Privacy Policy
Tombola, licensed by the UK Gambling Commission under Account No. 38613 and owned by Flutter Entertainment since 2022, processes personal data under the UK GDPR and the Data Protection Act 2018. This page explains what information the operator collects when you register and play, how that information is used, and what rights you hold as a UK player. Understanding these practices matters because every deposit, withdrawal and identity check at Tombola involves the handling of sensitive personal and financial data.
Table of contents
Data Collection
What personal information we collect
Tombola collects personal information at registration and throughout the life of an account. According to the operator, the data gathered falls into several distinct categories:
- Identity data: full name, date of birth (to verify the minimum age of 18), gender and residential address.
- Contact data: email address, telephone number and communication preferences.
- Financial data: debit card details (Visa, Mastercard, Visa Electron) and Apple Pay token references, used to process deposits and withdrawals.
- Verification data: documents supplied for Know Your Customer checks, such as proof of identity or address.
- Gameplay data: ticket purchases, game history, win and loss records, and use of responsible gambling tools such as net spend limits, deposit/loss caps and session reminders.
- Technical data: IP address, device type, operating system, browser version and login timestamps.
How we collect your data
Data reaches Tombola through three main routes. First, you supply it directly when creating an account, making a first deposit of at least £10, or contacting support via live chat, email (support@tombola.co.uk) or the UK freephone line 0800 29 888 73. Second, the operator generates data automatically as you use the native iOS and Android apps or the HTML5 web client. Third, third parties such as identity verification services and gambling self-exclusion schemes may supply information that Tombola is legally required to hold.
Cookies and tracking technologies
Tombola uses cookies and similar tracking technologies to keep sessions secure, remember preferences and analyse site performance. Strictly necessary cookies support login and payment functions such as 3-D Secure 2.0 on card transactions, while analytical cookies help the operator understand how players navigate the site. You can manage cookie preferences through your browser settings, although disabling essential cookies may prevent deposits, withdrawals or access to the game lobby.
Data Usage
How we use your information
Tombola processes personal data to run accounts, meet licence obligations and keep gambling safe. The operator documents the following purposes:
- Opening and managing your account, including processing deposits from £5 and withdrawals to debit cards, which take 3-5 banking days.
- Verifying identity and age to comply with UK Gambling Commission requirements.
- Applying safer gambling controls, including the £300 maximum account balance, the weekly net-deposit ceiling and self-exclusion requests.
- Detecting fraud, money laundering and duplicate accounts.
- Administering promotions, such as the welcome offer and the Playmates referral programme, and awarding Free Plays.
- Providing customer support and resolving disputes.
Marketing communications
Marketing messages from Tombola are sent only where you have consented, and preferences can be changed at any time in the account settings or by using the unsubscribe link in each email. Consent covers information about new in-house games, occasional £5 FREE code promotions for new players and Playmates referral offers. Withdrawing consent does not affect service messages the operator must send, such as changes to account security or responsible gambling notifications.
Third-party sharing policies
Tombola shares personal data only where there is a lawful basis. Recipients include payment processors handling debit card and Apple Pay transactions, identity verification agencies, regulators such as the UK Gambling Commission, and bodies supporting responsible gambling including BeGambleAware-linked services. Since 2022 the brand has sat within the Flutter Entertainment group, so certain data may be shared with group companies for compliance, security and reporting purposes. The operator states it does not sell personal data to advertisers.
Data Protection & Your Rights
Security measures
The operator applies technical and organisational safeguards across its platform. Full-site SSL encryption protects data in transit, and 3-D Secure 2.0 adds an authentication layer to card payments. Card details are handled by compliant payment processors rather than stored in plain form, and access to personal data within the business is restricted to staff who need it for a defined purpose. The UK Gambling Commission licence framework also requires the operator to demonstrate adequate protection of player funds and data as a condition of continued licensing.
Your rights under GDPR
As a UK player you hold the following rights over the personal data Tombola holds about you:
- Access: request a copy of the personal data held about you.
- Rectification: correct inaccurate or incomplete information.
- Erasure: ask for data to be deleted where there is no overriding legal reason to retain it.
- Restriction: limit how your data is processed in certain circumstances.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on legitimate interests, including direct marketing.
- Complaint: raise concerns with the Information Commissioner’s Office if you believe your data has been mishandled.
How to request data deletion
To request deletion of your personal data, contact Tombola support by email at support@tombola.co.uk, via the 24/7 live chat, or through the freephone line 0800 29 888 73 (9 AM-11 PM). The operator will verify your identity before acting on the request. Note that some records must be retained for statutory periods to satisfy anti-money laundering rules and UK Gambling Commission conditions, so deletion applies only to data the operator is not legally obliged to keep. Account closure can also be combined with self-exclusion where gambling harm is a factor.
For broader context on how the operator presents its rules, see the dedicated pages: Tombola terms and conditions and about Tombola. An overview of the reviewed casino as a whole is available here: home.
Frequently Asked Questions about Tombola
What personal data does Tombola collect?
Tombola collects identity details (name, date of birth, address), contact information, debit card and Apple Pay payment data, verification documents, gameplay history and technical data such as IP address and device type. This information supports account management, age verification for the 18+ requirement and UK Gambling Commission compliance obligations.
How does Tombola protect my information?
The operator applies full-site SSL encryption to all data transfers and 3-D Secure 2.0 authentication on debit card payments. Access to personal data is restricted to authorised staff, and the UK Gambling Commission licence (Account No. 38613) requires the operator to maintain adequate safeguards for player data as an ongoing licensing condition.
Can I request my data from Tombola?
Yes. Under the UK GDPR you can request a copy of the personal data Tombola holds about you. Submit the request via the 24/7 live chat, by email to support@tombola.co.uk or by calling 0800 29 888 73. The operator will confirm your identity before releasing any information and must respond within the statutory timeframe.
Does Tombola share my data with third parties?
Tombola shares data only where a lawful basis exists: with payment processors for debit card and Apple Pay transactions, identity verification agencies, regulators including the UK Gambling Commission, and Flutter Entertainment group companies for compliance and reporting. The operator states it does not sell personal data to advertisers or unrelated marketing companies.
If you are comfortable with how the operator handles player data and want to see the platform for yourself, the reviewed casino is open to UK players aged 18 and over.