This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to the Market Kings website, apps and related services (the "Platform"). Capitalised terms not defined here have the meaning given in our Terms of Service.
1. Who we are
The controller of your personal data is TFX Services Ltd (trading as Market Kings), a company registered in England and Wales under number 15932148, with its registered office at 10 Boughton Road, Rugby, England, CV21 1BJ.
- ICO registration number: number
- EU representative (GDPR Article 27): name and address, if appointed
- Privacy contact: admin@playmarketkings.com (subject line "Privacy") We are not currently required to appoint a Data Protection Officer. Our privacy lead can be reached at the address above.
2. Scope
This policy covers personal data about players, Crown Club members, waitlist sign-ups, visitors to our website, people who contact us, and winners who go through verification and payout. It does not cover third-party websites or services linked from the Platform, including advertisers, which have their own policies.
3. The personal data we collect
3.1 Information you give us Category Examples Account data Full name, username, email address, password (stored only as a salted hash), date of birth, country and state or region of residence, preferred language Profile data Avatar, display preferences, public profile details Identity verification data Government-issued ID document (type, number, issuing country, expiry, images), proof of address, selfie or liveness video, date of birth, nationality Payout data Wise, Skrill or Rise account identifiers, cryptocurrency wallet addresses, name on payout account, payout history Tax data Tax residency, tax identification number and tax forms (such as W-9 or W-8BEN) where legally required Communications Support requests, complaints, appeals, cheating reports, survey answers, feedback and any content you send us Marketing preferences Email and notification opt-ins and opt-outs, waitlist sign-up details Category Examples User Content Anything you post or submit on the Platform
3.2 Information generated when you use the Platform Category Examples Gameplay and trading data Events entered, Competition Accounts, orders, trades, positions, timestamps, P&L, drawdown, results, rankings, XP balance and history, Crown Index score and component data, Crown Store redemptions Subscription and transaction data Crown Club status, plan, billing dates, amounts, currency, billing country, last four digits and type of card, transaction and refund history Device and technical data IP address, device type and model, operating system, browser type and version, screen resolution, language, time zone, app version, device and advertising identifiers, crash and error logs Usage data Log-in times, pages and screens viewed, features used, clicks, session length, referral source, ads viewed or clicked Location data Approximate location derived from IP address and device settings. We do not collect precise GPS location Fair-play and security signals Device fingerprints, network and connection data, VPN and proxy indicators, login patterns, links between accounts, trading-pattern analysis and risk scores
3.3 Information from third parties
- Payment processor: confirmation of payments, refunds, chargebacks and limited card details. We never receive full card numbers.
- Payout partners (Wise, Skrill, Rise, crypto providers): payout status and confirmation of account ownership.
- Advertising and analytics partners (Google AdSense, Google Analytics): aggregated or pseudonymised measurement data.
- Fraud-prevention and sanctions screening sources: results of checks against sanctions, politically exposed person and fraud lists.
- Other players: reports that mention you, and messages or content that include you.
- Public sources: information needed to verify eligibility or investigate fraud.
3.4 Sensitive data
- Biometric data. If you complete a selfie or liveness check, we may compare your facial image with your ID photo to confirm you are the person named on the document. Where this involves creating a facial template or geometry, it is biometric data. We process it only with your explicit consent, only for identity verification and fraud prevention, and we never use it for any other purpose, sell it, lease it or profit from it. See Section 8.
- Government identifiers. ID document numbers and tax identification numbers are treated as sensitive and subject to additional access restrictions.
- We do not ask for, and ask you not to share, information about your health, religion, ethnicity, political views, sexual orientation or trade union membership.
4. How we use your data, and our legal bases
Under UK and EU data protection law we must have a legal basis for each use. The main bases we rely on are:
contract (to provide the service you signed up for), legal obligation (to comply with the law), legitimate interests (our reasonable business interests, balanced against your rights), and consent (where you have agreed).
Purpose Data used Legal basis Create, run and secure your Account Account, device, security data Contract; legitimate interests Run Events, calculate results, maintain leaderboards and award XP Gameplay and trading data Contract Calculate your Crown Index score Gameplay and trading data Contract; legitimate interests Provide and bill Crown Club Subscription and transaction data Contract; legal obligation Verify identity, age, residence and eligibility Identity verification, account and location data Contract; legal obligation;
legitimate interests (fraud prevention) Biometric face matching during verification Selfie, liveness and ID photo data Explicit consent Pay Cash Bonuses Payout, identity and tax data Contract; legal obligation Screen against sanctions and fraud lists Identity and account data Legal obligation; legitimate interests Detect and prevent cheating, multi-accounting, collusion and fraud Fair-play signals, gameplay, device and account data Legitimate interests (fair competition, protecting players and our business); legal obligation Handle support, complaints, appeals and reports Communications, account and gameplay data Contract; legitimate interests Show advertising in the Open Arena Device, usage and approximate location data Legitimate interests (non-personalised ads); consent (personalised ads and ad cookies) Measure and improve the Platform Usage, device and gameplay data Consent (analytics cookies);
legitimate interests (aggregated internal analytics) Send service messages (receipts, security alerts, rule and policy changes) Account data Contract; legal obligation Send marketing emails and notifications Account data, marketing preferences Consent, or legitimate interests for existing users where permitted (opt out any time) Publish winners and results Username, country, results Contract; legitimate interests Purpose Data used Legal basis Comply with tax, accounting and legal duties, and respond to lawful requests All relevant data Legal obligation Establish, exercise or defend legal claims All relevant data Legitimate interests Business transactions such as a merger, investment or sale All relevant data, under confidentiality Legitimate interests Where we rely on legitimate interests, you can ask us for details of the balancing test we carried out.
5. Automated decision-making and profiling
5.1 We use automated systems to analyse trading patterns, device signals and account links to flag possible cheating, multi-accounting and fraud, and to calculate rankings and the Crown Index.
5.2 No solely automated decisions with significant effects. A trained member of our team reviews every case before we disqualify you, withhold or reclaim a Cash Bonus, or suspend or close your Account. You can request human reconsideration, express your view and contest any decision by contacting us.
5.3 Rankings and the Crown Index are calculated automatically from your gameplay. They affect your standing on the Platform but do not have legal or similarly significant effects outside it.
6. What other players and the public can see
Your username, avatar, country, rank, XP level, Crown Index score, Event results and Rewards may appear on public leaderboards, profiles and results pages, and winners may be featured in our marketing as described in our Terms of Service. We do not publicly display your real name, email address, date of birth, precise location or verification details. We will ask for your separate consent before using your real name, image or voice.
7. Who we share your data with
We share personal data only where necessary, and only with parties bound by contractual confidentiality and data protection obligations.
Recipient Purpose Vercel and Amazon Web Services (AWS) Hosting, storage and infrastructure Payment processor Stripe Processing Crown Club payments, refunds and chargebacks Wise, Skrill, Rise and supported cryptocurrency providers Paying Cash Bonuses Market data and charting providers Delivering prices and charts (they do not receive your personal data except technical data needed to serve content) Google Analytics Website and app analytics (with consent) Google AdSense Serving and measuring Open Arena ads Email, messaging and support tools names Sending service and marketing emails, handling support Contractors and developers Building, maintaining and securing the Platform under confidentiality agreements and our instructions Professional advisers Lawyers, accountants, auditors and insurers Recipient Purpose Authorities Tax authorities, regulators, law enforcement, courts and sanctions bodies, where legally required or to protect rights, safety and the integrity of the Platform Corporate transactions Investors, acquirers or successors, under confidentiality, in connection with a financing, merger, acquisition or sale. This policy will continue to apply Identity verification is performed in-house. We do not pass your ID documents or biometric data to a third-party verification provider. Where our hosting providers store this data, they do so as processors under our instructions and cannot access it for their own purposes.
We do not sell personal data, and we do not share it for money.
8. Biometric information notice
This section applies if you complete a selfie or liveness check, and is intended to meet the requirements of biometric privacy laws, including the Illinois Biometric Information Privacy Act, Texas and Washington biometric laws, and Article 9 of the UK and EU GDPR.
- What we collect: facial images and, where our verification process generates them, facial geometry or templates derived from your selfie, liveness video and ID photo ("Biometric Data").
- Why: solely to confirm that you are the person named on your ID and to prevent fraud, multi-accounting and identity theft.
- Consent: we collect Biometric Data only after you give written consent in the verification flow. You can choose not to consent; if so, contact us to discuss an alternative method of verification, although we may be unable to pay Cash Bonuses without verifying your identity.
- No sale: we never sell, lease, trade or otherwise profit from Biometric Data, and we do not disclose it except as required by law or to our hosting processors.
- Retention and destruction: we permanently destroy Biometric Data once the verification purpose is fulfilled, and in any case within 30 days of verification being completed, or earlier if required by law.
Verification outcome records (not Biometric Data) are kept as set out in Section 10.
- Security: Biometric Data is encrypted, stored separately from other data and accessible only to authorised verification staff.
9. International transfers
Our team, contractors and service providers are located in several countries, including the United Kingdom, the United States and other countries outside the UK and EEA. When we transfer personal data outside the UK or EEA, we protect it by:
- relying on an adequacy decision or regulation (for example, the UK-US Data Bridge or EU-US Data Privacy Framework, where the recipient is certified);
- using the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses;
and
- carrying out transfer risk assessments and applying supplementary measures such as encryption and access controls.
You can request a copy of the relevant safeguards by contacting us.
10. How long we keep your data
We keep personal data only as long as necessary for the purposes described, then delete or irreversibly anonymise it.
Data Retention period Account and profile data While your Account is open, then up to 24 months after closure Gameplay, trading and Event records While your Account is open, then up to 24 months after closure;
anonymised statistics may be kept indefinitely Biometric Data Destroyed within 30 days of verification completing (see Section 8) ID documents and proof of address Up to 5 years after your last payout or verification, to meet anti-fraud and legal obligations Verification outcome, payout and tax records
6 years after the end of the tax year of payment, or longer if required by law Subscription and transaction records
6 years after the transaction, for accounting and tax law Fair-play, ban and fraud records For as long as needed to prevent banned players from re-registering and to defend legal claims, reviewed at least every 3 years Support and complaint records
3 years after the matter closes Marketing preferences and suppression lists Until you withdraw consent; we keep a minimal record to honour your opt-out Device, usage and security logs Up to 12 months Waitlist sign-ups Until Crown Club opens to you, then 12 months if you do not join Cookies See our Cookie Policy We may keep data longer where required by law, a regulator or a court, or where needed to establish, exercise or defend legal claims.
11. How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, strict role-based access controls, multi-factor authentication for staff, logging and monitoring, separation of sensitive data, and regular security review. Full details are on our Data & Security page. No system is completely secure, and we cannot guarantee the absolute security of your data.
12. Your rights (UK, EEA and similar laws)
Depending on where you live, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data in certain circumstances;
- Restrict our use of your data in certain circumstances;
- Object to our use of your data based on legitimate interests, and to direct marketing at any time;
- Data portability, meaning receipt of data you provided to us in a structured, machine-readable format;
- Withdraw consent at any time, without affecting processing already carried out; and
- Not be subject to solely automated decisions with legal or similarly significant effects, and to obtain human review.
How to exercise your rights. Email admin@playmarketkings.com with the subject "Privacy Request". We will respond within one month, which may be extended by two further months for complex requests. We may need to verify your identity before acting. Requests are free unless manifestly unfounded or excessive.
Limits. Some rights are not absolute. For example, we may need to keep certain data to meet legal obligations, prevent fraud and cheating, or defend legal claims, and we cannot erase data needed to stop a banned player re-registering.
Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or your local data protection authority. We would appreciate the chance to address your concern first.
13. United States privacy rights
This section applies to residents of US states with comprehensive consumer privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others.
13.1 Categories of personal information collected in the last 12 months: identifiers (name, email, username, IP address, device IDs); customer records (payment and payout details); protected classification characteristics (age); commercial information (subscriptions, redemptions); biometric information (see Section 8); internet and network activity; approximate geolocation; audio, electronic or visual information (ID images and selfies); inferences (fair-play risk scores); and sensitive personal information (government ID numbers, account log-ins, biometric data).
13.2 Sources, purposes and recipients are described in Sections 3, 4 and 7.
13.3 Sale and sharing. We do not sell personal information for money. Our use of advertising cookies in the Open Arena may be considered "sharing" for cross-context behavioural advertising under California law. You can opt out through Cookie Settings or the "Your Privacy Choices" link in our footer, and we honour Global Privacy Control browser signals as a valid opt-out.
13.4 Sensitive personal information. We use sensitive personal information only for purposes permitted by law, such as verifying identity, preventing fraud and securing Accounts, and not to infer characteristics about you.
13.5 Your rights. You may request to know, access, correct and delete your personal information, obtain a portable copy, opt out of sale, sharing and targeted advertising, and limit the use of sensitive personal information. You may use an authorised agent, who must provide proof of authority. We will verify requests by matching information you provide with our records.
13.6 Appeals. If we decline your request, you may appeal by replying to our decision or emailing admin@playmarketkings.com with the subject "Privacy Appeal". If you remain unhappy, you may contact your state Attorney General.
13.7 Non-discrimination. We will not deny you service, charge different prices or provide a different quality of service because you exercised your rights.
13.8 Do Not Track. We respond to Global Privacy Control signals as described above. There is no common standard for other "Do Not Track" signals, and we do not currently respond to them.
14. Children
The Platform is strictly for adults aged 18 or over (or the age of majority where you live). We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will close the Account and delete the data, except where we must keep it for legal reasons. If you believe a minor is using the Platform, contact admin@playmarketkings.com.
15. Marketing
We will send you marketing emails and push notifications only where you have agreed or where the law otherwise allows. You can opt out at any time using the unsubscribe link in any email, your notification settings or by contacting us. We will still send service messages, such as receipts, security alerts and important changes to our Terms.
16. Data breaches
If a personal data breach occurs, we will act promptly to contain it, notify the Information Commissioner's Office within 72 hours where required, and notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
17. Changes to this policy
We may update this Privacy Policy from time to time. The effective date and version at the top show the current version. If we make material changes, we will notify you by email or in-app before they take effect.
18. Contact us
TFX Services Ltd (trading as Market Kings)
10 Boughton Road, Rugby, England, CV21 1BJ Email: admin@playmarketkings.com (subject line "Privacy")