Privacy Policy

Version 1.3 | Effective date: 1 July 2026 | Last updated: 18 August 2026 | Operator: TWOFOLD Ltd

This Privacy Policy explains how TWOFOLD Ltd collects, uses, shares and protects your personal data when you use double.com. It forms part of our Terms of Service. Please read it alongside our Cookie Policy. Because we serve players in parts of the European Economic Area, we apply the standards of the EU General Data Protection Regulation (GDPR) to all players as our baseline, wherever you are.

1. Who We Are (Data Controller)

1.1 The data controller is TWOFOLD Ltd (company number 16279), registered at Hamchako, Mutsamudu, Autonomous Island of Anjouan, Union of Comoros (the "Operator", "we", "us").

1.2 For any privacy question, to exercise your rights, or to raise a concern about how we handle your data, contact our privacy team at support@double.com. Where a matter concerns verification, sanctions screening or financial-crime controls, you may also write to compliance@double.com.

2. What We Collect, Why, and Our Lawful Basis

2.1 We collect and use the following categories of personal data:

Identity and contact: name, date of birth, nationality, address, email and phone number. Used to register and administer your Account and to verify your age and identity. Lawful basis (where the GDPR applies): performance of contract; legal obligation (anti-money-laundering and age verification).
Verification (KYC): identity documents, proof of address, a selfie or liveness check, and source-of-funds and source-of-wealth evidence. Used to comply with anti-money-laundering, age and licensing obligations and to prevent fraud. Lawful basis: legal obligation; legitimate interests (fraud prevention); and, for biometric data, your explicit consent (see paragraph 2.4).
Financial and transactional: wallet addresses, on-chain transaction data, deposits, withdrawals, bets and balances. Used to process play and payments, detect financial crime and maintain records. Lawful basis: performance of contract; legal obligation.
Screening and risk: sanctions, politically-exposed-person and adverse-media match data, blockchain-analytics risk scoring and risk ratings. Used to meet sanctions and anti-money-laundering obligations and to assess and manage risk. Lawful basis: legal obligation; legitimate interests.
Technical and usage: IP address, device and browser characteristics, approximate location, log and gameplay data, and cookies and similar technologies. Used to provide and secure the Services, enforce geo-restrictions, and detect abuse and duplicate accounts. Lawful basis: legitimate interests; legal obligation.
Behavioural and responsible gambling: play patterns, limit settings, self-exclusion status, and interventions and interactions. Used to operate responsible-gambling controls and to identify and respond to potential harm. Lawful basis: legal obligation; legitimate interests; consent where required.
Communications: support chats, emails, call records and complaint files. Used to provide support, investigate complaints and maintain evidence of what was said. Lawful basis: performance of contract; legitimate interests; legal obligation.
Marketing preferences: your choices about offers and updates. Used to send marketing where you have consented or have not opted out. Lawful basis: consent or legitimate interests, as applicable.

2.2 We collect data directly from you (registration, verification, play, support contact), automatically (technical and usage data), from public blockchain records associated with the addresses you use, and from third parties (identity-verification and know-your-customer providers, blockchain-analytics providers, sanctions and politically-exposed-person data sources, fraud-prevention databases, affiliates who refer you, and our platform, game and payment providers).

2.3 Where we rely on consent (for example certain marketing or non-essential cookies), you may withdraw it at any time. Where we rely on legal obligation or legitimate interests (including anti-money-laundering, sanctions, fraud prevention, age verification, responsible gambling and security) we may continue to process data on that basis, and withdrawing consent does not affect that processing.

2.4 Biometric data. Identity verification includes a selfie or liveness check, which involves the processing of biometric data (a scan of your facial features) to confirm that you are a real person and that you match your identity document. Where the GDPR applies, we process this data on the basis of your explicit consent, which is requested within the verification process before the check begins, and which you may decline or later withdraw by contacting support@double.com. Because verification is a condition of using the Services, if no alternative method of verification is available to you we may be unable to provide the Services. Biometric verification is performed by a specialist identity-verification provider acting on our behalf under contractual safeguards; access to biometric data is restricted, and it is retained only for as long as verification and compliance purposes require.

2.5 Beyond this, we do not deliberately collect special categories of personal data. Information about your health or wellbeing may reach us if you choose to tell us about it, for example when you contact us about gambling harm. Where that happens we use it only to respond appropriately and to apply the Responsible Gambling Policy, we restrict access to it, and we retain it only as long as we need it.

3. How We Use Your Data

3.1 We use personal data to: create and administer your Account; verify your identity, age, residence and location; process deposits, bets and withdrawals; meet anti-money-laundering, counter-terrorist-financing, sanctions, licensing and other legal obligations; operate responsible-gambling controls and identify potential harm; detect and prevent fraud, cheating, bonus abuse, duplicate accounts and prohibited use; provide support and handle complaints; personalise and improve the Services; send marketing where permitted; and establish, exercise or defend legal claims and enforce our Terms.

3.2 We do not use your personal data for purposes that are incompatible with those set out above without telling you first.

4. Sharing Your Data

4.1 We share personal data, on a need-to-know basis and under appropriate contractual safeguards, with:

Service providers acting as our processors, described by category rather than by name: identity-verification and know-your-customer providers; blockchain-analytics and transaction-screening providers; sanctions and politically-exposed-person data providers; fraud-prevention and device-intelligence providers; hosting and IT service providers; customer-support and communications platforms; marketing and analytics providers; and our platform, game-content and payment providers.
Regulators and authorities: the Licensing Authority, financial intelligence units, law-enforcement, tax and other competent authorities, where required or permitted by law. This includes suspicious-activity reporting, which we are often prohibited from disclosing to you.
Other entities within the Operator's group, for administration, compliance and shared services, under appropriate safeguards.
Professional advisers and auditors, and, in a sale, merger, reorganisation or financing, prospective counterparties, in each case under confidentiality.

4.2 We do not sell your personal data, and we do not share it with third parties for their own independent marketing.

4.3 Where a provider acts as an independent controller rather than as our processor (for example a game provider in respect of its own game logs, or a payment provider in respect of its own compliance obligations) it does so under its own privacy notice.

5. International Transfers

5.1 Personal data is hosted and processed within the European Economic Area, the United Kingdom and the United States, and may also be processed in other countries where our service providers operate, including outside your own country.

5.2 Where we transfer personal data out of the European Economic Area, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses, or a finding of adequacy in respect of the destination country. We assess each transfer and apply additional technical and organisational measures where they are needed.

5.3 You may ask us for information about the safeguards applying to a particular transfer by writing to support@double.com. We describe our arrangements by region and safeguard rather than by naming individual providers or facilities, for security reasons.

6. Data Retention

6.1 We keep personal data only as long as necessary for the purposes above and to meet our legal obligations. Our retention approach by category is:

Verification and anti-money-laundering records, and transaction records: at least 5 years after the end of the customer relationship, or longer where the law or the Licensing Authority requires.
Account, gameplay and betting records: for the life of the Account and then for the period in 6.1 above, because they are transaction records.
Responsible-gambling records, including self-exclusion: for the duration of the exclusion and for a period afterwards sufficient to honour it and to evidence that we did.
Complaint and dispute files: for the period required by the Licensing Authority and, where longer, until any related claim is time-barred.
Support communications: for a period proportionate to their purpose, and longer where they form part of a complaint or investigation file.
Marketing preferences: until you withdraw consent or object, and then a minimal record that you have done so, so that we can honour it.

6.2 Where you ask us to delete your data, we will do so unless we are required or permitted to retain it. Anti-money-laundering record-keeping, sanctions obligations, fraud prevention, responsible-gambling enforcement and the establishment or defence of legal claims override deletion requests to the extent of any conflict. We will retain only what is necessary for those purposes and securely delete or anonymise the rest when the retention period ends.

7. Your Rights

7.1 Subject to applicable law, and to the GDPR where it applies to you, you have the right to: access your data; have inaccurate data corrected; request erasure; restrict or object to certain processing; data portability; and withdraw consent. You may also object to direct marketing at any time, and we will always honour that.

7.2 To exercise these rights, contact support@double.com. We will respond within the period required by law, generally one month under the GDPR, and will tell you if we need longer because the request is complex. We may need to verify your identity first, and we may ask you to narrow a very broad request.

7.3 Some rights are limited where we must retain or process data for legal or regulatory reasons (Section 6), or where responding would reveal information about our financial-crime controls that we are not permitted to disclose.

7.4 We do not charge for responding to a request unless it is manifestly unfounded or excessive.

7.5 If you are in the European Economic Area and are unhappy with how we handle your data, you may complain to your local supervisory authority. We would ask you to raise it with us first so that we have the chance to put it right.

8. Automated Decisions and Profiling

8.1 We use automated tools for identity verification, fraud detection, transaction and sanctions screening, duplicate-account detection, geo-location enforcement, and responsible-gambling risk flagging. These tools may restrict an Account or a transaction pending human review.

8.2 Where an automated decision produces legal or similarly significant effects for you, you may request human review and may contest the decision, by writing to support@double.com. That right does not extend to requiring us to waive a sanctions, anti-money-laundering or licensing control, and in some cases we are prohibited from explaining the basis of a decision.

9. Security

9.1 We implement appropriate technical and organisational measures to protect personal data, including encryption of data in transit and at rest, access controls and least-privilege access, segregation of verification material, logging and monitoring, secure development practices, and confidentiality obligations on our staff and providers. We do not publish details of our security arrangements or name our providers, because doing so would itself create risk.

9.2 No system is completely secure. You are responsible for keeping your login credentials confidential, and we recommend that you enable two-factor authentication where it is offered.

9.3 If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where the risk is high, notify you, in each case within the time limits the law requires.

10. Children

10.1 The Services are strictly for adults, 18 or over, or the local age of majority if higher. We do not knowingly collect data from anyone under age. If we learn that we hold such data, we will delete it, close any associated Account and act under the Responsible Gambling Policy.

11. Cookies and Similar Technologies

11.1 We use cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy.

12. Affiliates and Marketing Partners

12.1 If you reached us through an affiliate or marketing partner, we receive limited data identifying the referral so that we can attribute it. Affiliates are contractually required to handle personal data lawfully and are not permitted to market to self-excluded players. We do not give affiliates access to your verification documents, your transaction records or your responsible-gambling status.

13. Changes and Contact

13.1 We may update this Policy from time to time and will post the updated version with a new effective date, retaining dated archives. Where a change materially affects how we use your data, we will take reasonable steps to tell you.

13.2 For any privacy question or to exercise your rights, contact support@double.com. Complaints about our handling of your data are dealt with under the Complaints & Dispute Resolution Policy, without prejudice to your right to complain to a supervisory authority.