SmartEXCLUSION (AGC) Privacy Notice

Revision date: 04/11/2026. This notice replaces the version dated 02/06/2026.

The short version

This notice explains what happens to your personal data when you self-exclude using SmartEXCLUSION.

There are two self-exclusion schemes for Adult Gaming Centres and High Street Bingo venues on the same database: Boomerang Digital’s scheme and the scheme run by Bacta Self-Exclusion Services Limited (BSESL). The venue where you register decides which scheme you are in.
We use your data only to run your self-exclusion. We never sell it, and we do not use it for marketing.
Only registrations made in Boomerang’s own scheme can be used for facial recognition. BSESL scheme registrations are not used.

• You can contact us about your data whichever scheme you are in: dataprotection@boomerangdigital.co.uk.

Who we are

Boomerang Digital Ltd (“Boomerang”, “we”, “us”)

Registered office: 2 Saxon Business Park, Owen Avenue, Hessle, HU13 9PD

Office and postal address: Unit 2, Therm Road, Hull, HU8 7BF

Company registration number: 02993612. ICO registration number: Z5087366.

Data Protection Officer: dataprotection@boomerangdigital.co.uk. Self-Exclusion and SmartHub telephone line: 0330 043 1699.

We are responsible for the personal data we receive under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, all as amended by the Data (Use and Access) Act 2025.

If you are visiting our website, please see our standard Privacy Policy (https://boomerangdigital.co.uk/privacy-policy/). If you are using another Boomerang service, please see our Privacy Notice Menu (https://boomerangdigital.co.uk/smarthub-privacy-notice-menu/). If you are a member of staff using SmartHub, please see the Staff User Privacy Notice.

What is SmartEXCLUSION?

SmartEXCLUSION is a digital self-exclusion system. It lets people enrol in self-exclusion schemes through land-based gambling premises. It runs on our SmartHub software platform.

There are four types of self-exclusion that may be offered to you in a venue:

Standard Self-Exclusion: the default offered by all venues. It excludes you in line with the selections you make when you complete your self-exclusion.
National Self-Exclusion*: excludes you across all venues that operate SmartEXCLUSION.
Company (Brand) Exclusion*: excludes you across all venues operated by a single company.
Single Site Exclusion*: excludes you from the venue where you complete your self-exclusion only.

* National, Company and Single Site exclusions are not available in all venues.

Please check what your exclusion covers. “National” does not mean every gambling venue in the country. Your exclusion covers the venues and sectors recorded when you registered. It does not cover online gambling. If you are not sure what your exclusion covers, call us on 0330 043 1699.

The two schemes and the single database

Two organisations own self-exclusion schemes that operators can join:

Boomerang Digital Ltd, which owns the SmartEXCLUSION scheme; and
Bacta Self-Exclusion Services Limited (BSESL), 29-30 Ely Place, London EC1N 6TD (company number 10012887, ICO registration number ZB066914), which owns its own self-exclusion scheme. BSESL is supported by Bacta, the trade association, and BSESL and Bacta are joint controllers of BSESL’s scheme data.

Each operator belongs to one of these schemes. You do not choose the scheme yourself: it depends on the operator of the venue where you register.

Under agreements made between Boomerang and BSESL in May 2026, the records of both schemes are held on one SmartEXCLUSION database, which we host and manage. BSESL scheme venues reach it through the Bacta compliance portal. Every registration carries a marker showing which scheme it came from. Each registration has its own photograph. A registration in either scheme takes effect across both schemes, in line with the selections made when you registered.

Our partners and customers

We also work with the operators of other self-exclusion schemes, so that self-exclusion is supported across more licensed premises:

The Bingo Association, operator of the Bingo Industry Self-Exclusion Scheme (BISES) for traditional bingo.
Self Enrolment National Self Exclusion Ltd (SENSE), operator of the casino national self-exclusion scheme.

We provide SmartEXCLUSION to operators of Adult Gaming Centres, Casinos and Licensed Bingo premises in Great Britain. These are our Customers, and their premises are Venues.

Who is responsible for your data

More than one organisation is responsible for your data. Data protection law calls them “controllers”, or “joint controllers” where they decide together how data is used.

Stage	Who is responsible
While you complete your self-exclusion at a Venue	The owner of the scheme the Venue belongs to (Boomerang or BSESL), jointly with the operator of the Venue.
Your registration once enrolled	The owner of the scheme you registered in. For the Boomerang scheme that is us. For the BSESL scheme that is BSESL, with Bacta. We are also a controller of BSESL scheme registrations, because we host them and process them through our software (see the next row).
The single database, hosting, the technical checking of your photograph, and sharing between the two schemes	Boomerang and BSESL are joint controllers, for the purpose of running self-exclusion.
Sharing Boomerang scheme registrations with other schemes that the exclusion covers (BISES or SENSE)	The scheme sharing your data and the scheme receiving it are joint controllers.
Checking and enforcing your exclusion at a Venue	The operator of that Venue, which is responsible for its own compliance with the Gambling Commission’s rules.

Joint control between Boomerang and BSESL covers self-exclusion only. It does not allow either of us to use the other scheme’s registrations for anything else, including facial recognition.

How Boomerang and BSESL share responsibility (the “essence” of our arrangement)

This summary is provided under Article 26(2) of the UK GDPR. It sets out the main points of the arrangement between Boomerang and BSESL. We are sharing it with BSESL and will update it if any changes are agreed.

Task	Boomerang	BSESL
The SmartEXCLUSION software, platform hosting and platform security	Responsible	Responsible for its own systems, staff and service providers
The operators and venues in each scheme, and the accuracy of the records they enrol	Its own scheme	Its own scheme
Privacy information	Provides template information; publishes this notice	Publishes its own notice, including a summary of this arrangement
Requests about your data rights	Handles those received through its channels; responds on Boomerang scheme registrations	Handles those received through its channels; responds on BSESL scheme registrations
Personal data breaches	Leads on the platform and the Boomerang scheme	Leads on the BSESL scheme
Anonymised statistics for the Gambling Commission	Its own scheme	Its own scheme
Retention rules and sharing with additional schemes	Agreed jointly	Agreed jointly

You can exercise your rights with either of us. If your request or complaint covers both schemes, we will work together so that you get one clear answer within the legal time limit. BSESL’s own privacy notice is at https://bacta.org.uk/self-exclusion-privacy-policy/. If you are unsure who to contact, contact us.

When we collect your data

If you self-exclude at a Venue in Boomerang’s scheme, staff will complete your registration with you on a tablet or PC.
If you self-exclude at a Venue in BSESL’s scheme, staff will complete your registration through the Bacta compliance portal, and your data is stored on the SmartEXCLUSION database.
If you have self-excluded with another scheme, that scheme will share your exclusion data with us where your exclusion needs to apply to Venues we support.

You self-exclude at your own request. We ask you to sign to confirm your agreement to the terms of your self-exclusion, but we do not rely on your consent as the legal basis for using your data. Without the required details we cannot set up your exclusion.

The data we use

When you register

Required: title, gender, first and last name, address, photograph, date of birth and signature. Vehicle registration number at Motorway Service Areas only.
Optional: email address, mobile phone number, other names or nicknames, photographic ID.

While your exclusion is in place

Exclusion details: the submitting venue and operator, start and end dates, the venues and sectors covered, and any extension or reinstatement.
Breach records: if you enter a Venue during your exclusion, staff must record it as an actual breach (you gambled) or an attempted breach (you entered but did not gamble).

When you self-exclude with another scheme

Title, gender, name, address, photograph, date of birth, email address, phone number and your exclusion details.

Data we do not collect

We do not collect data about your racial or ethnic origin.

Special category data

The fact that you have decided to self-exclude is treated as health data, because gambling disorder is a recognised health condition. Health data is “special category data”, which has extra legal protection. Boomerang and BSESL have agreed that the personal data of a self-excluder qualifies as special category data. We protect all of your self-exclusion data accordingly.

Why we use your data

We use your data only to provide and manage self-exclusion:

to record your self-exclusion at your request, and to deliver, support and maintain the scheme;
to check that your photograph contains a face and is good enough to identify you;
to map your exclusion to the right operators, Venues and sectors;
to share your exclusion with the operators and Venues it covers, so that they can identify you and act on it;
to share your exclusion with other schemes where your exclusion covers them;
to help operators meet their self-exclusion obligations under the Gambling Commission’s Licence Conditions and Codes of Practice;
to send you a confirmation by email or text if you gave us your details, including information about gambling support services;
to record and share extensions, reinstatements and breaches;
to deal with complaints and requests about your data; and
to produce anonymised statistics, including for the Gambling Commission.

Our legal basis

Legitimate interests (Article 6(1)(f) UK GDPR). It is in our legitimate interests, and those of operators and scheme partners, to run self-exclusion schemes that protect people from gambling harm. You would reasonably expect us to use your data for this. We have carried out a Legitimate Interests Assessment and concluded that this use is proportionate and that your rights are not overridden.

Substantial public interest (Article 9(2)(g) UK GDPR). For special category data, we rely on the substantial public interest, under Schedule 1 to the Data Protection Act 2018: paragraph 18 (safeguarding of individuals at risk) and paragraph 19 (safeguarding of the economic well-being of certain individuals). We keep an appropriate policy document that explains this, and how we retain and erase this data.

Facial recognition

Some Venues in Boomerang’s scheme use, or may start to use, facial recognition technology to help staff identify self-excluded people. Not all Venues use it. A Venue that uses it must display clear signs and have its own privacy notice.

Only Boomerang scheme registrations are used

In October 2026 we changed the SmartEXCLUSION database so that only registrations originating from Boomerang’s own scheme can be used for facial recognition. Nothing from a BSESL scheme registration is used. That includes its photograph, its other data and any biometric template made from it.

If you have registrations in both schemes, only your Boomerang scheme registration and its own photograph are used.

If you registered in the BSESL scheme, facial recognition will not be used to identify you from that registration. Your exclusion is enforced by Venue staff. This would change only if BSESL agreed, and we would update this notice first. If you enter a Venue that uses facial recognition, cameras may still capture your image as they do for any visitor. It will not be matched against your BSESL registration.

Schemes run by others, such as SENSE for casinos, have their own arrangements and privacy notices.

How it works

A biometric template, which is a mathematical representation of your face, is made from the photograph in your Boomerang scheme registration. Cameras at the Venue entrance compare the faces of people entering against the templates that apply to that Venue. If there is a possible match, the system alerts a trained member of staff, who decides what to do. No decision is made by the technology alone.

Who is responsible and our legal basis

The operator of the Venue is responsible for its facial recognition system and its privacy notice, which tells you who supplies the system. We are responsible for making Boomerang scheme registrations available for this purpose. Biometric data is special category data. We rely on legitimate interests and, for biometric data, the substantial public interest under paragraph 18 of Schedule 1 to the Data Protection Act 2018.

How long this data is kept

Data	How long
Images of people who do not match	Deleted immediately after the matching process
Biometric template of a self-excluder	While your exclusion is active, including the Thinking Period. Deleted within 30 days of reinstatement or expiry
Alert images, routine resolved alerts	Deleted within 48 hours
Alert images, flagged incidents	Up to 7 days
Alert records with no biometric data (time, camera, outcome of staff check)	12 months
Complaints about facial recognition	3 years from final resolution. Longer if there are legal proceedings or a regulatory investigation

If facial recognition contributes to a decision about you, you can ask for more information, explain why you think it is wrong, ask for a person to review it, and challenge the decision. You can do this at the Venue or by contacting us.

Who we share your data with

Operators and Venues covered by your exclusion, so that they can act on it.
BSESL and Bacta, because the two schemes share one database and take effect across both schemes.
Other self-exclusion schemes (the Bingo Association for BISES, and SENSE), where a Boomerang scheme exclusion covers them. A registration from BSESL’s scheme is not shared with BISES or SENSE, so it does not apply at venues that belong only to those schemes. It can apply at High Street Bingo venues on the SmartEXCLUSION database.
Service providers who act on our instructions: Amazon Web Services (hosting) and Google (Google Vision, which detects a face in the photograph as a quality check; no image is stored by Google). We also use other technology and support providers, including for address and postcode mapping and for managing the tablets we supply.
Regulators and law enforcement, such as the Gambling Commission and the Information Commissioner’s Office, where the law requires it. The Gambling Commission receives anonymised statistics from us.
Professional advisers and insurers, where needed to deal with a complaint or legal claim.

BSESL scheme venues use the Bacta compliance portal, which is provided to BSESL by its own service provider.

We will not sell your data, and we will not use it for marketing.

Where your data is stored

Your data is hosted by Amazon Web Services in Ireland, in an ISO 27001-accredited data centre, and may be accessed from our UK offices. UK law treats Ireland, as part of the European Economic Area, as providing an adequate level of protection.

When a photograph is submitted, Google Vision checks it in the United States. Google is certified under the UK-US Data Bridge, which UK law recognises as giving adequate protection to data sent to certified US organisations. No image is stored by Google. If you would like to know more about these safeguards, contact us.

How long we keep your data

Stage	How long	Who can see it
Active	Your chosen exclusion period	Venues covered by your exclusion
Thinking Period	Up to 6 months after the exclusion period	Venues covered by your exclusion
Cooling-Off Period	24 hours after the Thinking Period or after reinstatement	Venues covered by your exclusion
Expired	6 months after the Cooling-Off Period	Only the operators of the self-exclusion scheme
Anonymised	After the Expired period	No one can identify you

We may keep data for longer if the law requires it, or for a legal claim or complaint.

How we keep your data secure

We have physical, technical and organisational measures in place, including encryption of data in transit, role-based access controls, continuous network monitoring, protection against denial-of-service attacks and regular vulnerability testing. No system is completely secure. If you think your data has been exposed, contact us straight away at dataprotection@boomerangdigital.co.uk.

Your rights

You have the following rights. Some have limits, which we will explain if they apply to your request.

Access: to ask for a copy of your data and information about how we use it.
Correction: to have inaccurate data corrected. We will tell you when it is done.
Erasure: to ask us to delete your data. We can usually do this only once your data is no longer needed for your self-exclusion.
Restriction: to ask us to limit how we use your data in certain circumstances.
Objection: to object to our use of your data based on legitimate interests. While your exclusion is running we will normally need to keep using your data to enforce it, unless you end it through the reinstatement process.
Portability: to receive data you gave us in a structured, machine-readable format, where this right applies.
Automated decisions: we do not make decisions about you by automated means alone. See the facial recognition section above.

To use any of these rights, email dataprotection@boomerangdigital.co.uk, or call 0330 043 1699. We will need to confirm your identity. We will respond within one month. If your request is complex, we may take up to two further months and will tell you why. We will tell you if we cannot meet your request, and explain the reason.

How to complain

If you are unhappy with how your data has been used, you have the right to complain to us. You can use our online contact form at https://boomerangdigital.co.uk/latest-news/#contact-us (choose “Self-Exclusion” as the enquiry type), email dataprotection@boomerangdigital.co.uk, or write to the Data Protection Officer at our office address above. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office: www.ico.org.uk or 0303 123 1113.

Links to other sites

If you follow a link to another scheme, a gambling support service or another website, please read that site’s privacy notice. It is not covered by this notice.

Cookies

We use cookies in the management of self-exclusion data only to identify the login credentials of staff accessing the system.

Changes to this notice

We will update this notice if the way we use your data changes. The revision date at the top shows when it last changed. If we make an important change, we will publish it here first.

If you are struggling with gambling, free and confidential support is available from the National Gambling Helpline on 0808 8020 133, 24 hours a day.