Tombola Privacy Policy
Understanding how an operator handles personal data matters as much as understanding its games or bonuses, particularly at a long-running UK-licensed brand such as Tombola, which has operated under UK Gambling Commission licence no. 38613 since 2006 and has been owned by Flutter Entertainment since 2022. This independent review breaks down the operator’s documented approach to data collection, usage, protection and player rights, so readers know exactly what information is requested at registration, how it is processed, and what control they retain over it. The analysis reflects the policies Tombola publishes on its own platform rather than any personal testing by this website.
Data Collection
What personal information we collect
Tombola collects the standard categories of personal data required of any UK Gambling Commission-licensed operator. At account registration, players are asked to provide identity details including full name, date of birth, residential address, email address and telephone number. The date of birth field is not a formality: because the minimum legal age for gambling in the United Kingdom is 18, the operator uses this information to run age verification checks against third-party databases, a licensing obligation rather than an optional security feature.
Financial data forms the second major category. When a player makes a deposit using a Visa debit card, Mastercard debit card or Visa Electron, card details are transmitted and processed under 3-D Secure 2.0 authentication, and the operator records transaction histories covering deposits, withdrawals and account balances. Apple Pay deposits (£5 minimum, available after the first card deposit) are handled through Apple’s tokenised payment layer, meaning the underlying card number is not shared directly with the operator in the same way. Gameplay data is also collected: which rooms a player enters, ticket purchases from 1p up to 50p, wins, losses, session lengths and interactions with in-house titles such as Bingo90, Bingo75 Lines, Bingo80, Pulse, Burst, Blocks and Paper.
How we collect your data
Collection happens through three main channels. The first is direct submission: everything typed into the registration form, the cashier, or the account settings pages. The second is automated collection during play — every session on the native iOS and Android apps or the responsive HTML5 web client generates behavioural records, including login times, device identifiers, IP addresses and gameplay patterns. The third is third-party verification: identity and age checks are typically confirmed through external reference agencies, and any documents a player uploads for Know Your Customer purposes (proof of identity or address) are stored as part of the account file. Players who contact the 24/7 live chat, email support@tombola.co.uk or call the UK freephone line 0800 29 888 73 (9 AM-11 PM) should also be aware that correspondence is logged and retained as part of the service record.
Cookies and tracking technologies
Like virtually every regulated gambling site, Tombola deploys cookies across its web client. Strictly necessary cookies keep sessions authenticated and the cashier functional; without them, login and deposit flows would not work. Functional cookies remember preferences such as room selection and display settings. Analytics cookies measure how visitors move through the site, informing product decisions, while marketing cookies may track referral sources — relevant, for example, to the Playmates referral programme, where the operator needs to attribute a new signup to the referring player. Players can manage non-essential cookies through the consent controls presented on the site and through browser settings, though disabling essential cookies will impair core functionality.
Data Usage
How we use your information
The primary lawful bases for processing are contract performance and legal obligation. On the contractual side, Tombola uses account data to operate the service: crediting deposits, processing withdrawals to debit cards within the stated 3-5 banking days, settling bingo tickets and paying winnings — including bonus winnings from the welcome offer (100% bonus match up to £50 on a minimum £10 first deposit, with 1 Free Play awarded for every £1 up to 50 Free Plays and no wagering requirements, so winnings are paid as withdrawable cash). On the legal-obligation side, the UK Gambling Commission framework requires the operator to verify age and identity, monitor transactions for anti-money-laundering purposes, enforce the £300 maximum balance and weekly net-deposit ceiling, and flag behaviour consistent with problem gambling.
Behavioural data also feeds the responsible gambling toolkit. Deposit and loss caps, net spend limits, session reminders and self-exclusion all depend on accurate, continuously updated records of player activity. Where a player self-excludes, that status is applied across the account and retained for the exclusion period — a case where retaining data, rather than deleting it, is itself a protective measure.
Marketing communications
Marketing at Tombola operates on a consent basis. Players can opt in to receive promotions — such as occasional £5 FREE code offers for new players — via email, SMS or push notification through the mobile apps, and can withdraw that consent at any time through account settings or the unsubscribe mechanism in each message. Opting out of marketing does not affect service communications, which the operator will still send: withdrawal confirmations, security alerts, changes to the Tombola terms and conditions and responsible gambling notifications all fall outside marketing consent and cannot be switched off while an account remains active.
Third-party sharing policies
Sharing is limited and purpose-bound. Payment processors handle card transactions; identity verification agencies confirm age and address; regulators, including the UK Gambling Commission, receive data where the licence requires it; and law enforcement may be served disclosures under legal compulsion. As part of Flutter Entertainment since 2022, Tombola may also share data within the corporate group for compliance, fraud prevention and operational purposes, under group-level data protection agreements. The operator’s published position does not contemplate selling personal data to unrelated third parties for their own marketing. Players who want broader context on the brand’s ownership and structure can find it here: about Tombola.
Data Protection & Your Rights
Security measures
Tombola applies full-site SSL encryption, meaning data transmitted between the player’s device and the operator’s servers — including login credentials and payment details — travels encrypted. Card deposits run through 3-D Secure 2.0, adding a second authentication layer at the point of payment. Account balances are capped at £300 maximum, which limits exposure in the event of account compromise, and the operator’s licensing under both the UK Gambling Commission (Account No. 38613) and the Gibraltar regulator (RGL 052) subjects its security practices to ongoing regulatory scrutiny. Access controls within the organisation restrict which staff can view sensitive records, and retention periods are defined so data is not held beyond its regulatory or operational necessity.
Your rights under GDPR
UK players are protected by the UK GDPR and the Data Protection Act 2018. The rights available include: the right of access (a copy of the personal data held), the right to rectification of inaccurate records, the right to erasure in qualifying circumstances, the right to restrict or object to certain processing, the right to data portability, and the right to lodge a complaint with the Information Commissioner’s Office. Two caveats matter in practice. First, erasure rights are balanced against legal retention duties — anti-money-laundering rules and Gambling Commission record-keeping requirements mean some data must be kept for defined periods even after an account closes. Second, self-exclusion records are deliberately retained to enforce the exclusion, which overrides a deletion request during that period.
How to request data deletion
Requests are made directly to the operator, not to this independent review website. The practical route is to contact Tombola support via the 24/7 live chat or by emailing support@tombola.co.uk, stating clearly that the request concerns erasure of personal data; the UK freephone line 0800 29 888 73 (9 AM-11 PM) can also be used for guidance. The operator will verify the requester’s identity before acting — a necessary safeguard against fraudulent deletion requests — and will confirm which data can be erased immediately and which must be retained under regulatory obligations, with a timeline for the remainder. If the response is unsatisfactory, escalation to the ICO is the formal next step.
Frequently Asked Questions about Tombola
What personal data does Tombola collect?
Tombola collects identity details (name, date of birth, address, email, phone), payment data from Visa, Mastercard and Visa Electron debit cards or Apple Pay, full transaction histories, gameplay records across its in-house bingo and speciality titles, and technical data such as IP addresses and device identifiers from its apps and web client.
How does Tombola protect my information?
The operator secures the platform with full-site SSL encryption and 3-D Secure 2.0 on card payments, enforces a £300 maximum account balance, and operates under UK Gambling Commission licence no. 38613, which requires ongoing compliance with data security and player protection standards, including responsible gambling monitoring.
Can I request my data from Tombola?
Yes. Under UK GDPR, players can submit a subject access request through the 24/7 live chat or by emailing support@tombola.co.uk. After identity verification, the operator provides a copy of the personal data it holds. Complaints about the handling of such requests can be escalated to the Information Commissioner’s Office.
Does Tombola share my data with third parties?
Sharing is limited to defined purposes: payment processors, identity verification agencies, regulators such as the UK Gambling Commission, and, since 2022, the wider Flutter Entertainment group for compliance and fraud prevention. The operator does not document selling personal data to unrelated third parties for independent marketing use.
For a full picture of the brand behind these policies — its games, payments and welcome offer — start with the main review here: Tombola.
Readers ready to see how the operator handles their data in practice can visit the site directly.