Topmatch Privacy Policy Analysed: How Player Information Is Handled — October 2026

This page reviews the rules under which the operator gathers, uses and stores information about its players, and it pays particular attention to the reasoning behind each rule. The privacy policy Topmatch has adopted deliberately avoids citing statutes, so the commentary below concentrates on practical questions instead: why a given piece of data is needed, what would happen without it and how far the player can influence its processing. Personal data processing is described here in ordinary language, with the legal background mentioned only where it changes the outcome.

Revision date: October 2026

Purpose and Reach of the Policy

The Topmatch privacy policy sets out three things: which information the operator obtains, the reason each item is required and the options a player has for controlling it. Plain wording is preferred throughout, because a policy that users cannot understand gives them no real control.

Processing at Topmatch starts the moment a person registers and lasts for as long as the service is used. A part of the data, however, is captured automatically even during an ordinary visit to the site, before any account exists.

The licence under which the operator works was granted in Curacao, and the Ukrainian regulator has issued no permit. As a result, data handling is governed by the rules of the licensing jurisdiction, not by Ukrainian legislation, which matters when a player wants to know where to turn in a dispute.

Why consent is tied to the account: completing registration means accepting this policy. Anyone who disagrees with the processing terms should not open an account at all, since consent to essential processing cannot be withdrawn separately; it ends only when the account is closed.

Types of Data the Operator Gathers

Information reaches the operator through two channels. Some of it the player supplies personally, at sign-up and during identity verification; the rest is logged automatically as the site is used. The table groups the data by category and source.

Full card numbers are not kept by the operator. That task belongs to the payment provider, which stores such data in its own environment; the platform retains only what it needs to recognise a particular transaction. This division reduces the damage that any single breach could cause.

Data grows in stages: how much is held depends on how far the player has progressed. An unverified account carries little more than contact details and technical records, while copies of documents are added only once a withdrawal is requested.

Purposes of Processing

Every data category is linked to a defined purpose, and using information for anything outside those purposes is not contemplated by the policy. The operator identifies the user in order to create the account, admit them at login and restore access when it is lost. Financial information serves to credit deposits, execute payout requests and settle slips. Licence obligations, namely age checks and financial monitoring, require their own share of the data. Account security relies on spotting unusual activity, duplicate profiles and unauthorised login attempts. Support staff use records to answer requests and to reconstruct the sequence of events in a dispute, and contact details allow the operator to report on transaction status and service changes.

Marketing is treated differently. Sending promotional messages requires a separate consent, and declining them has no effect on the account: service notifications are still delivered, because they are part of the contract rather than advertising.

Where refusal is not possible: processing that fulfils licence obligations cannot be declined. Age checks and financial monitoring are compulsory, since without them the operator would not be permitted to serve the player.

Grounds That Justify Processing

Each processing activity rests on a legal basis, and that basis decides two questions: whether the operator may handle the information at all and whether the player can say no. The policy recognises four such grounds.

The contrast between consent and licence obligations has the greatest practical effect. A consent can be revoked in the settings in a few clicks, whereas processing required by the licence carries on whatever the player prefers, because the operator has no discretion over it.

Revoking consent is not deletion: once marketing consent is withdrawn, the data does not vanish. It stays in the system on the remaining grounds, since contract performance and licence obligations still apply to it.

Recipients of Player Data

Outside parties obtain information only to the degree a particular task demands it, and the policy makes no provision for selling data to advertisers or anyone else. Each recipient has a clearly delimited role.

• Payment providers process deposits and payouts and confirm who owns the payment instrument
• Game software suppliers receive technical session data so that a specific game can run
• Document checking services confirm identity and age
• The licensing authority obtains information when it submits an official request
• Technical contractors provide hosting, analytics and support tools

Every recipient is obliged to keep the data confidential and may apply it only to the agreed purpose. Disclosure to anyone outside this circle can occur solely on the demand of a competent authority.

A caution about messengers: when a player contacts support via a messaging app, the conversation passes through the infrastructure of that app's provider. For this reason, personal and payment details should not be shared there; secure forms inside the account are designed for such information.

Safeguards Applied to the Data

Protection works on two levels, the technical measures of the platform and the habits of the player. Neither level is sufficient alone; only their combination provides meaningful security.

Measures Taken by the Operator

The platform encrypts the connection between the device and the server, so that intercepted traffic cannot be read. Employees can reach personal data only when their work actually requires it, logins can be protected by two-factor authentication, and unusual behaviour on accounts is monitored to catch takeover attempts early.

Measures Expected From the Player

The player's contribution is equally concrete. A password should be unique rather than reused from other services, two-factor authentication should be switched on, logging in from shared or public devices is best avoided, and the site address deserves a check before any data is typed in, because phishing copies rely on inattention.

Residual risk: no system can promise total security. The operator applies reasonable safeguards, yet sending data across the internet always leaves some risk, as is true for every online service.

How Long Information Is Kept

Retention depends on the life of the account and on obligations that continue after it ends. That is why different categories are removed at different times rather than all at once.

Closing an account does not wipe everything. Financial monitoring procedures and licensing rules oblige the operator to keep part of the records, and until the prescribed period runs out such records cannot be erased even at the player's request.

Where to find exact periods: the specific duration for each category is published in the data protection section of the site. These figures follow the requirements of the licensing authority and may change with them.

Rights Available to the Player

The rights a player has over their own information closely mirror European standards. GDPR-style entitlements are honoured whatever the operator's place of registration, which gives the player a familiar set of tools.

To exercise any of these, the player contacts support and names the right concerned. The operator may first ask for proof of identity, which prevents an outsider from obtaining or altering someone else's data under the guise of a legitimate request.

The limit of erasure: deletion cannot override mandatory retention. Verification documents and transaction history stay in the system until the term set by the licence expires.

Protection of Persons Under 21

The service is meant exclusively for adults. In Ukraine, gambling is lawful from 21, and the operator refuses to open accounts for anyone below that age.

Age is established during verification by comparing the profile with an identity document. Until that step is finished, the account operates with limitations and payouts are blocked, which removes the incentive for a minor to slip through.

When an underage user is detected, the account is closed and the data gathered is erased, apart from information the operator is obliged to keep for reporting.

The role of device owners: preventing a minor from using a device is the responsibility of the person who owns it. If a child has accessed an account, the holder should contact support, and the operator will freeze transactions. The responsible gaming page describes further protective tools.

Cookies in Brief

Cookies are small files that a website places in the browser. Some of them are indispensable for the service, while others are activated only if the user agrees.

Four groups are distinguished. Essential cookies keep the login, the session and the bet slip working, and the site cannot function without them. Functional cookies remember the interface language, the odds format and display preferences. Analytical cookies collect statistics on visits and on how pages are used. Marketing cookies tailor offers and advertising.

Only the first group is beyond the player's control, because without it signing in would be impossible. The remaining three can be managed in the browser settings or through the consent banner shown on a first visit.

More detail elsewhere: the Cookie Policy, a separate document, describes each group, how long the files are kept and how consent is withdrawn.

Submitting a Data Request

Requests relating to personal data are sent to support, either from the personal account or through the contact channels published on the site; there is no separate dedicated address.

A request is resolved without extra back-and-forth when it is specific from the outset. It helps to state which right is being exercised (access, rectification, erasure or withdrawal of consent), the email or account number linked to the profile, the period concerned if the request relates to part of the history, and the preferred way of receiving the answer.

Identity check first: before acting, the operator may ask the requester to confirm who they are. This is a safeguard against a third party attempting to obtain information about somebody else's account.

Revisions to the Policy

The policy is reconsidered whenever legislation, the requirements of the licensing authority or the workings of the platform change. The valid version is always the one published on this page.

The latest revision date is shown at the top. Comparing it with the date of a previous visit is the simplest way to tell whether the processing terms have moved on.

Significant amendments, for instance a newly collected data category or an additional recipient, are announced by a message to the email address in the profile, so players are not expected to monitor the page constantly.

Effect of continued use: carrying on with the service after a new version appears means the updated terms are accepted. A player who objects to them can close the account in the manner set out in the terms of use.

Common Privacy Questions

Is site activity monitored?

Yes. Technical data such as the IP address, device and time of visits is captured automatically, because it is needed to secure accounts and to identify suspicious behaviour.

How are card details kept safe?

Full card numbers are never stored by the operator; the payment provider looks after them. The system retains only the data that identifies a transaction.

Can a player opt out of processing?

Marketing messages can be declined whenever the player wishes. Processing required for age checks and financial monitoring, however, cannot be refused.

Does the operator share data without a reason?

No. Data goes only to the listed recipients and only for specific tasks, and the policy does not allow selling information to advertisers.

How does a player learn what is stored about them?

By writing to support and invoking the right of access. A proof of identity may be requested before the answer is given.

What becomes of the data once an account is closed?

Anything not covered by mandatory retention is erased. The remainder is held until the period imposed by financial monitoring has passed.

Is it possible to delete the account together with every record?

The account itself is closed on request, but some records survive. Verification documents and transaction history are kept for the term set by the licensing authority.

Is processing subject to Ukrainian law?

No. The operator works under a Curacao licence and has no permit from the Ukrainian regulator, so the rules of the licensing jurisdiction apply.