Irish Bookmakers Association
Version 2.0, October 2026
1. Introduction
The Irish Bookmakers Association (IBA) respects your privacy and is committed to protecting personal data in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018.
This policy explains how we collect, use, share and protect personal data in connection with our website, our online training platform, our membership and stakeholder work, our events, and our sporting integrity arrangements. It also explains your rights and how to use them.
2. Who we are
Irish Bookmakers Association Company Limited by Guarantee (CRO number 406253) is the data controller for the personal data described in this policy. This means we decide why and how that personal data is processed.
Postal address: Irish Bookmakers Association, Rathganley, Kilcock, Co. Meath, W23 C5P6
Email: info@irishbookmakersassociation.com
Website: www.irishbookmakersassociation.com
We are not required to appoint a Data Protection Officer. Please send any data protection query to the email address above and it will be dealt with by the IBA Chief Executive.
3. Personal data we collect
Members, stakeholders and other contacts
For people who work for our member operators, and for officials, regulators, partner organisations and others we deal with, we may hold your name, job title, organisation, business address, email address, telephone number and our correspondence with you.
Learners on our training platform
When you create an account or enrol in a course, we collect your full name, email address, username and password, and your organisation name if you choose to give it. As you use the platform we record your course enrolments, progress, assessment results, completion status, certificates issued and training history, together with basic login activity. Our courses are currently free, and we do not collect payment card or bank details.
Event attendees
If you attend an IBA event or briefing, we may record your attendance and, where you provide them, your feedback or survey responses. For hospitality events we may also ask for dietary requirements and the name of a guest, spouse or partner attending with you.
Website visitors
If you accept analytics cookies, we collect information about how you use our website, such as device and browser type, pages visited, time on pages and general location. Section 11 explains this.
Sporting integrity
Under Memoranda of Understanding with sports governing bodies, we may receive and share information about betting activity that may raise integrity concerns. This may include personal data about individuals connected with those concerns.
4. Where we get your data
Most of the data we hold comes directly from you. Your employer may give us your details, for example when a member operator registers staff for training or nominates a contact. We may also confirm professional details, such as your job title, from publicly available sources like your employer’s website or LinkedIn. Integrity information may come from member operators or sports governing bodies.
5. How we use your data and our lawful basis
The table below sets out each purpose and the lawful basis we rely on under Article 6(1) GDPR.
| Purpose | Lawful basis | Our legitimate interest, where relevant |
|---|---|---|
| Registering learners, giving access to courses, tracking progress, issuing certificates and keeping training records | Contract (the terms you accept when you register) | |
| Keeping member and stakeholder contact lists and corresponding with you about IBA work | Legitimate interests | Running a representative association and engaging with members, regulators and partners |
| Sending information, updates, briefings and invitations to events and training | Legitimate interests for member contacts; consent for others | Keeping members informed about regulatory and sector developments |
| Organising events, including catering and guest arrangements | Legitimate interests; explicit consent for dietary requirements (see section 6) | Running events that members and stakeholders attend |
| Sharing and receiving sporting integrity information under MoUs | Legitimate interests | Protecting the integrity of sport and betting |
| Website analytics | Consent (through our cookie banner) | |
| Meeting legal, regulatory and audit requirements | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. You can ask us for more detail on that assessment.
6. Dietary requirements
Dietary requirements can sometimes reveal information about health or religious belief, which is special category data under Article 9 GDPR. We only collect this information if you choose to give it, we process it on the basis of your explicit consent, we use it only to arrange catering for the event, and we delete it after the event (see section 9).
7. Who we share your data with
We do not sell or rent personal data. We share it only where necessary, with the following:
Service providers who act as data processors on our behalf, including website hosting, learning management system infrastructure, email and IT and security providers, and Google Analytics. They may only process data on our documented instructions.
Sports governing bodies, under Memoranda of Understanding, for sporting integrity purposes.
Regulators, law enforcement or other public bodies, where the law requires it.
Accreditation bodies, where a course is CPD accredited, to the limited extent needed for them to assess or audit the accreditation.
We do not share learner training records with employers or member operators unless the learner has given express written consent.
8. International transfers
Some of our service providers may process data outside the European Economic Area, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as an adequacy decision (including the EU–US Data Privacy Framework, for certified US companies) or EU Standard Contractual Clauses.
9. How long we keep your data
| Type of data | Retention period |
|---|---|
| Training records and certificates | 5 years from the date of course completion, then deleted |
| Learner accounts | Accounts with no activity for 2 years may be closed. Completion records are kept for the rest of the 5 year period |
| Member, stakeholder and contact details | While the relationship continues, and up to 2 years after it ends |
| Email correspondence and enquiries | Up to 24 months, unless needed longer for governance, legal or audit reasons |
| Event attendance records | Up to 2 years after the event |
| Dietary requirements and guest names | Deleted within 3 months after the event |
| Sporting integrity information | As long as required under the relevant MoU |
| Website analytics data | Up to 14 months, in line with our Google Analytics settings |
| Unsubscribe requests | We keep your email address on a suppression list so we do not contact you again |
We may keep data for longer where the law, a regulator or an audit requires it. We do not guarantee long term storage of training results, so learners should always download a copy of their certificates.
10. Security
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include secure hosting, encrypted connections (SSL), password protected accounts, access restricted to authorised people, and regular monitoring and backups.
11. Cookies and website analytics
Our website uses essential cookies needed for the site and training platform to work, and, with your consent, analytics and preference cookies.
We use Google Analytics, provided by Google Ireland Limited, to understand how visitors use the site and to improve it. It only runs if you accept analytics cookies through our cookie banner, and you can withdraw that consent at any time by changing your cookie preferences. Google acts as our data processor. The data is used in aggregate to analyse traffic and does not allow us to identify you directly. For more information, see Google’s Privacy Policy.
12. Your rights
Under GDPR you have the right to access your personal data, to have inaccurate data corrected, to have your data erased, to restrict how we use it, to receive your data in a portable format, and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing that took place before you withdrew it.
Your right to object
Where we rely on legitimate interests, you have the right to object to our use of your data. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims. You can object to receiving communications from us at any time, and we will stop.
To use any of your rights, contact us using the details in section 2. We will respond within one month, and there is normally no charge.
13. Do you have to give us your data?
You need to give us your name and email address to create a training account, because we cannot provide courses or certificates without them. Everything else, such as your organisation name or dietary requirements, is optional.
Course assessments are marked automatically to show whether you have passed, and you can retake them. We do not make any decisions based solely on automated processing that have legal or similarly significant effects on you.
14. Children
Our services and training are intended for adults working in or with the gambling sector. They are not intended for anyone under 18.
15. Unsubscribing
You can unsubscribe from our communications at any time by using the unsubscribe link in our emails or by emailing info@irishbookmakersassociation.com.
16. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Data Protection Commission:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963
Email: info@dataprotection.ie
Website: www.dataprotection.ie
17. Changes to this policy
We may update this policy to reflect legal, technical or operational changes. The latest version will always be published on our website, and we will tell registered users about any significant change.
Document change control
| Version | Date | Updated by | Summary of change |
|---|---|---|---|
| 1.1 | June 2025 | Sharon Byrne | Website policy updated for the introduction of the online training platform and membership portal, including learner progress data, assessment results, certification records, account login data and expanded analytics processing. |
| 1.2 | February 2026 | Sharon Byrne | Website policy updated to strengthen the GDPR sections, clarify the data controller role, and cover LMS learner data and analytics. |
| 2.0 | October 2026 | Sharon Byrne | Full legal name, CRO number and postal address added for the controller, with a statement that no DPO is required. Each purpose now linked to its lawful basis and legitimate interest; consent added as a basis; explicit consent added for dietary requirements. Specific retention periods replace general wording. Right to object set out separately; one month response time added. Statements added on whether data must be provided, automated decisions and children. Accreditation bodies added as possible recipients; EU–US Data Privacy Framework added to international transfers. Data Protection Commission address updated to 6 Pembroke Row. References to payment and billing removed, as courses are free; legal advice disclaimer removed. |