Stake Privacy Policy for Players in India

Every Stake account generates two separate streams of personal data once registration begins. One stream is supplied directly by the account holder through forms, uploads and conversations with support. The other accumulates in the background from device activity, session behaviour and transaction history. Based on our analysis of how similar platforms operate, this second stream typically ends up larger than the first once an account has been active for several months.

Personal data collected through the Stake platform serves several distinct purposes, and the operator has no discretion over some of them. Identity and age must be confirmed before an account can deposit or place a bet on a casino game or sportsbook market. Deposits and withdrawals are processed and matched back to the correct payment instrument. Device and account data get screened for fraud, duplicate registrations, collusion and automated betting patterns. Know Your Customer and money laundering prevention obligations imposed by the licence, including review of the source of funds and reporting to the relevant financial intelligence authority where required, leave the operator with no discretion. Play is monitored for signs of gambling harm, and any limit or exclusion a player has set gets enforced against that record. Platform data feeds fault diagnosis and usage analysis. Marketing about offers and new games is the one purpose a player can decline without the account being affected. The opt out works through account settings or the unsubscribe link in each message, while service and compliance messages continue regardless, since they fall outside the definition of marketing.

Every purpose behind Stake’s data processing rests on a specific legal ground, and that ground decides what an account holder can do about it.

Withdrawing consent only unwinds consent based processing going forward. It does not reverse data already processed lawfully under contract or legal obligation before the withdrawal.

Cookies sit alongside local storage entries, software development kits inside the Stake app and tracking pixels in email, all performing the same function: recognising a browser or device across separate visits to the platform. Strictly necessary cookies keep a login session open and support fraud detection; these cannot be declined without breaking core site functionality. Analytical and advertising cookies operate only once consent is given through the banner, and that consent can be refused or changed at any later point. Consent choices get recorded separately per browser and per device, so accepting cookies on a phone does not carry over to a desktop login. The dedicated Stake cookie policy carries the category by category detail, lifespans and browser level controls in full.

Account data reaches a limited set of external recipients once it leaves Stake’s own systems, and the operator does not sell personal data to any of them. Each category listed below receives only the portion of data its function actually requires.

Data belonging to a player in India rarely stays within the country, given the licensed entity behind Stake, its hosting infrastructure, its verification vendors and parts of its support operation sit across different jurisdictions. A transfer is a structural feature of running the platform rather than an exception applied to certain accounts. Where data moves to a country without an equivalent data protection regime, the safeguard relied on is typically an adequacy decision covering the destination, standard contractual clauses between the parties, or binding internal rules within the corporate group, paired with encryption in transit and at rest. A player can ask which safeguard applies to a specific transfer. A transfer compelled by a lawful order from an authority falls outside these contractual arrangements.

Data is kept for a period tied to the reason it was collected, and closing a Stake account does not trigger immediate deletion, because several retention periods are set by law rather than by operator preference.

A deletion request cannot override a statutory retention period that is still running. Data held only to satisfy such a period is restricted from ordinary use in the meantime, meaning it sits outside day to day processing. Once the period expires, it gets deleted or anonymised rather than retained indefinitely.

Traffic between a player’s device and the Stake platform runs over an encrypted connection, and stored identity documents and payment records get encrypted at rest. Full card numbers are typically held by the payment provider under its own card industry security obligations rather than by the operator directly. Access to verification and transaction records is limited by staff role, and each access gets logged. Sensitive account actions, such as changing a withdrawal address or resetting a password, trigger an additional verification step. Ongoing monitoring flags an unusual login location or an atypical transaction pattern for review. No transmission or storage method is completely secure, and the account password and the device used to log in remain the holder’s own responsibility. Where a breach is likely to present a risk, the operator commits to notifying both the account holder and the relevant supervisory authority.

A player account registered in India carries a defined set of rights over the data Stake holds, each one subject to the retention and compliance obligations already described. Before acting on any request, identity has to be confirmed, since releasing account data to the wrong person would itself count as a data breach.

Stake’s casino and sportsbook platform is not directed at anyone below the legal gambling age in India, and the operator does not knowingly collect data from a minor. Age gets checked at registration and confirmed again through documentary verification before a withdrawal is approved. Where an account turns out to belong to an underage person, it gets closed immediately, deposits are returned, winnings are forfeited, and the data is deleted beyond what has to be retained as a record of the incident. A parent or guardian who suspects an underage account can report it through the support channel. On a shared device, filtering software installed at device level adds protection that account controls alone cannot provide once a session is already signed in.

Stake’s privacy policy carries a publication date, so a player can identify which version is currently in force. A revision reflecting a new legal obligation, or correcting the description of an existing practice, can take effect on publication without separate notice. A change introducing a new purpose or a new category of data sharing normally triggers notice to the registered contact, and where the new purpose relies on consent, a fresh consent has to be obtained rather than assumed from silence. Continuing to use the account after the effective date is treated as acknowledgement of the revised terms for anything that does not require consent.

A data request under any of the rights described above gets submitted through the privacy or data protection contact published in Stake’s policy, with the support channel within the account available as an alternative route. The request should state the account identifier, the specific right being exercised, and the period or category of data concerned. Identity gets confirmed before any data is released, since handing account data to the wrong person would itself count as a breach. Stake typically works to a response deadline measured in weeks, extendable in complex cases with notice given to the requester. A refusal comes with the reason and the exemption relied on set out in writing, and a player can complain to the Data Protection Board of India without going through the operator first.