Privacy Policy · Exclude Global

In short

We collect only your name, email, country and chosen exclusion period.
We use them for one thing: inviting you to activate your exclusion when we launch.
We never sell your data, share it for marketing, or use it to profile you.
Your name and email are encrypted in our database.
You can ask us to delete everything at any time, and we will do it within 30 days.

1Who we are

Exclude Global is run by Exclude Global Foundation [legal form, e.g. fond / ApS], registered under number [CVR / company number], at [registered address]. We are the data controller for the information described here.

For anything about your data, write to privacy@exclude.global. [If you appoint a Data Protection Officer, add their name and contact here.]

2What we collect

When you pre-register, you give us:

your full legal name
your email address
your country of residence
the exclusion period you prefer (1 year, 5 years or permanent)

We also record which version of the consent text you agreed to and when, so we can show that you gave consent.

Because the form is for gambling self-exclusion, signing up may suggest something about your relationship with gambling. We treat that as sensitive information and ask for your explicit consent before storing anything.

Technical data. To stop automated abuse of the form, we keep a one-way, keyed fingerprint of your IP address for one hour. We cannot turn it back into your IP address. Like all web servers, our hosting provider also keeps standard access logs, which include IP addresses, for [log retention period, check with Site5].

What we do not collect: identity documents, date of birth, payment details, gambling history, your reasons for excluding, location data or device identifiers. Identity verification happens only later, at activation, and will be covered by a separate notice.

3Why, and on what legal basis

We use your details only to:

email you once, when Exclude Global launches, with a secure link to verify your identity and activate your exclusion
answer messages you send us about your pre-registration
prevent duplicate and automated sign-ups

Our legal basis is your explicit consent (GDPR Article 6(1)(a) and Article 9(2)(a)). You can withdraw consent at any time by writing to privacy@exclude.global. Withdrawing does not affect anything we did lawfully before you withdrew.

We do not use your details for newsletters, fundraising, research, advertising, profiling or automated decisions.

4Who can see it

Pre-registration data is not shared with gambling operators, licensing authorities or anyone else. Operators and authorities will only ever be involved after you activate your exclusion, and then they receive a yes or no answer, never your name or contact details.

We use these service providers (processors), under written agreements that let them handle the data only on our instructions:

Provider	What they do	Data involved
Site5 [legal entity]	Hosts the website and database	All pre-registration data (name and email encrypted), access logs
Google Fonts	Supplies the typefaces on this website	Your IP address and browser details when the page loads
[Email provider]	Sends the launch email	Name and email address, at launch only

We will disclose data to public authorities only when the law requires it, and we will tell you unless the law forbids it.

5Where it is stored

The database is held on servers in [data centre country, check with Site5]. If any provider processes data outside the EU/EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses, and you can ask us for a copy of the safeguards.

6How long we keep it

Data	Kept until
Pre-registration details	You activate your exclusion (the record then moves to the register under its own notice), or 12 months after launch if you have not activated, whichever comes first
Consent record	As long as the pre-registration, plus up to 3 years to show consent was given if a complaint is made
IP fingerprint	1 hour
Server access logs	[hosting retention period]

If you ask us to delete your data, we do so within 30 days, including from backups as they roll over.

7How we protect it

The whole site is served over HTTPS, so your details are encrypted on the way to us.
Your name and email are stored encrypted with AES-256. The key is kept outside the database and outside the public website.
Duplicate checks use a keyed one-way fingerprint of your email, not the email itself.
Only named staff who need it to run the launch can decrypt the data.

If a breach affects your data and puts you at risk, we will tell you and the supervisory authority as the law requires.

8Your rights

You can ask us, free of charge, to:

see the data we hold about you and get a copy
correct anything that is wrong
delete your pre-registration
restrict or object to how we use it
receive your data in a machine-readable format
withdraw consent at any time

Write to privacy@exclude.global from the email address you registered with, and include your reference (EG-XXXX-XXXX) if you have it. We reply within one month.

You can also complain to a data protection authority. Ours is [e.g. Datatilsynet, Denmark, if the Foundation is established there]. You may also complain to the authority in the country where you live.

9Cookies and tracking

This website sets no cookies and uses no analytics, advertising pixels or tracking scripts. The only third-party request is for the typefaces from Google Fonts, described in section 4.

10Under 18s

Pre-registration is for people aged 18 and over. If you are a parent or guardian and believe a child has pre-registered, contact us and we will delete the record.

11Changes to this policy

If we change how we use pre-registration data, we will update this page, change the version number and date above, and email you before the change takes effect if it affects you. We will never start using your data for a new purpose without asking for your consent first.