(Version: Draft for Iowa IRGC Submission)
Last modified: May 19, 2025
Smarkets Iowa Op Co
Protecting your privacy is important to Smarkets Iowa Op Co ("the Company"). This policy outlines how personal data we collect from you, or that you provide to us, will be processed by us in connection with the provision of sports wagering and related services in Iowa, in compliance with Iowa Code chapter 99F, Iowa Racing and Gaming Commission (IRGC) rules, the Iowa Consumer Data Protection Act (Iowa Code chapter 715D, effective January 1, 2025), and other applicable federal and state law. Please read the following policy to understand the information we collect, how we will use that information and the circumstances where we will share it with third parties. The policy also describes your data protection rights, including a right to object to some of the processing which the Company carries out. More information about your rights, and how to exercise them, is set out in the "Your Rights" section.
Information we may collect about you
What you give us
Information about you is stored when you fill in online forms or correspond with us via email or live chat. This includes, but is not limited to, personal information provided when you register to use our service, depositing and withdrawing money or reporting issues with our service.
Information you give us may include your name, date of birth, postal address, email address, phone number, financial and credit card information, photograph, copies of identification, proof of address and other documents.
All player registration and account establishment is conducted in compliance with this Privacy Policy. By registering an account, you confirm that you have read and understood this policy.
What we collect automatically
We automatically collect information when you use our service which may include, but is not limited to, betting transactions, account transfers, technical information such as IP address, login information, browser type, operating system and platform, mobile device ID, network information as well as full URL clickstream to and through our website and/or mobile application(s).
If you are a US customer, or are located in the US, we will also collect movement data from your device's accelerometer and GPS location data. This geolocation data is collected during active wagering sessions to verify that you remain within a jurisdiction where wagering is lawfully permitted, as required by applicable state gaming regulations and the federal Wire Act. Collection of precise geolocation data requires your affirmative opt-in consent before your first wagering session. You may withdraw consent at any time through your device settings; however, withdrawal of consent will prevent you from placing wagers, as geolocation verification is a mandatory requirement under applicable state law.
What we receive from other sources
We may from time to time receive information about you from third parties (including identity verification agencies, advertising networks, analytics providers, and search information providers) we work closely with.
Cookies
We use cookies to distinguish you from other users on the site, allowing us to provide you with a good experience and improve our service. For a detailed explanation on what cookies we use, their purpose, and how to disable them, please refer to our Cookie Policy.
How we use the information we collect and the legal basis for our use
We collect and use your personal information and other information the Company (or others on its behalf) collect from or about you for the following purposes:
To fulfill a contract with you, or take steps linked to a contract with you.
This includes:
- delivering our services to you;
- verifying your identity and undertaking necessary security checks (including checks undertaken by trusted third parties and making use of a soft search against registers held by authorised credit reference agencies);
- taking payments from you;
- communicating with you in relation to your account and our services;
- providing customer services to you.
As required by the Company to conduct our business and pursue our legitimate interests, in particular:
- in order to provide a better betting service, we may use your usage data in order to provide trading information to our liquidity partners. Data made available to our liquidity partners includes an anonymous unique identifier that represents counterparty information and markets accessed;
- we monitor use of our websites and online services, and use your information to help us monitor, improve and protect our content, services and websites, both online and offline;
- we use information you provide to personalise our website, products or services for you;
- we monitor customer accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law;
- we use information you provide to investigate any complaints received from you or from others, about our website or our products or services;
- we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation);
- we collect and retain geolocation data to verify that customers are physically located in states where SBK is licensed and wagering is lawfully permitted, as required by state regulation.
Where you give us consent:
- we will send you direct marketing in relation to products and services provided by us, our affiliates and carefully selected partners;
- we collect precise geolocation data from your device, including GPS coordinates, accelerometer data, Wi-Fi triangulation, and Bluetooth signals, on the basis of your affirmative opt-in consent and as required by applicable state law and gaming rules. You may withdraw this consent at any time, subject to the limitations described above;
- we place cookies and use similar technologies in accordance with our Cookies Policy and the information provided to you when those technologies are used;
- on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.
For purposes which are required by law:
For example, in response to requests by government or law enforcement authorities conducting an investigation, or as required by the relevant state gaming regulator, state department of revenue, or other regulatory authority.
Non-discrimination:
In accordance with applicable state consumer data protection law, the Company will not discriminate against you for exercising any of your privacy rights. Note that geolocation collection is a mandatory condition of lawful sports wagering in US licensed states; withdrawal of consent for this processing will affect your ability to place wagers.
We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain further information by contacting us using the details set out later in this notice.
Withdrawing consent or otherwise objecting to direct marketing
Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.
Disclosure of personal information to third parties
As a policy we do not disclose any personal information to anyone other than those employees or third parties that need access to your data to provide you with a service.
For the purposes of applicable data protection law, the Company is a data controller of your personal data.
All player account information that is not subject to disclosure under this Privacy Policy must be kept strictly confidential. Employees and third parties with access to player data are bound by confidentiality obligations. Information will only be released beyond the terms of this policy where required by law, regulation, or order of a competent authority, including the relevant state gaming regulator.
Personal data may be shared with government authorities, law enforcement officials, or relevant regulators (including the relevant state gaming commission, state department of revenue, and state attorney general) if required for the purposes above, if mandated by law or regulation, or if required for the legal protection of our legitimate interests in compliance with applicable laws.
Personal data may be shared with sporting bodies with which the Company has agreements for the purpose of policing the integrity and enforcing the rules of a sport or detection and prevention of crime.
Personal data will also be shared with third party service providers, who will process it on behalf of the Company for the purposes identified above. These include:
- Payment providers
- Identity verification agencies
- Credit rating agencies
- Fraud prevention agencies
- Digital marketing and content delivery agencies
- Geolocation data collection, processing, and validation services
In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.
Where information is transferred outside the United States, data is adequately protected by applicable legal mechanisms, including standard contractual clauses or equivalent safeguards approved under applicable law. A copy of the relevant mechanism can be provided for your review on request to the Company using the contact details below.
Your rights
Under applicable state consumer data protection law and other applicable law, you have the following rights with respect to your personal data:
- the right to know and access the categories of personal data we process about you;
- the right to correct inaccurate personal data;
- the right to delete personal data you have provided or that we have collected about you, subject to legal and regulatory retention requirements described below;
- the right to obtain a portable copy of your personal data in a structured, machine-readable format;
- the right to opt out of the processing of your personal data for purposes of targeted advertising and the sale of personal data.
To submit a rights request, you may contact us using the details set out below. We will respond to verifiable requests within 90 days. Where we require additional time (up to a further 45 days) due to the complexity or volume of requests, we will notify you within the initial 90-day period.
These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights), or where we are required by law or applicable gaming regulation to retain the information. In particular, sports wagering records — including geolocation logs — are subject to mandatory retention requirements under applicable state gaming regulations and may not be deleted without prior regulatory approval.
If you have unresolved concerns and believe a violation of applicable privacy law has occurred, you have the right to submit a complaint to your state's Attorney General or relevant data protection authority.
We may from time to time send you content containing links to other sites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
How do I get in touch with you?
We hope that we can satisfy queries you may have about the way we process your data. You can get in touch with us at support@smarkets.com or by writing to:
Smarkets Iowa Op Co
1 E Erie St,
Ste 525, PMB 2,
Chicago, IL 60611
United States
How long will you retain my data?
Where we process registration data, we retain this for as long as you are an active user of our services and for a period thereafter as required by applicable law and applicable gaming regulations.
Sports wagering records, including geolocation logs generated during wagering sessions, are subject to mandatory retention requirements under applicable state gaming regulations. Such records will not be purged or deleted without prior approval from the relevant state gaming regulator. All records pertaining to accounts of persons who registered or have account activity in the relevant state will be maintained to allow for regulatory audits and player complaint resolution.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.
Where we process personal data in connection with providing services to you, we retain the data for a minimum of 5 years from your last interaction with us, or for such longer period as required by applicable gaming regulations, state law, or applicable federal law.
Raw geolocation data collected solely for the purpose of session-level location verification (i.e. data not forming part of a wagering transaction record) will be retained for a minimum of 90 days from collection, or for such longer period as may be required by the relevant regulator or applicable law.
Secure disposal of your data
When your personal data is no longer required to be retained under this policy or applicable law, the Company is committed to ensuring it is securely and permanently deleted. This applies to all physical and digital storage, and to any third party processors who hold your data on our behalf. Where data is held in cloud-based systems, we require our providers to permanently delete your data using industry-standard protocols. Where physical devices cannot be securely erased, they are destroyed prior to disposal.
Commitment to privacy
The Company’s Privacy Policy is subject to change at any time. We will notify you of any material changes to how we process your personal data. The current version of this policy is always available at [URL to be confirmed].