Privacy Policy

This Privacy Policy explains how Thunder Pick, operating the online gambling platform available at thunderp.bet as the Thunder Pick offering, collects, uses, discloses, and protects personal data of players and website visitors from the United Kingdom and other regions. It applies to all users who visit our website, create an account, place bets, use our services, contact support, or otherwise interact with thunderp.bet. By using thunderp.bet, you acknowledge that your personal data will be processed in accordance with this Privacy Policy and applicable data protection laws, including the UK GDPR, the Data Protection Act 2018, and, where relevant, Mexican data protection regulations. The effective date of this Privacy Policy is 6 November 2025.

Who We Are

Data controller. The primary data controller responsible for processing your personal data in connection with the Thunder Pick offering is:

Paloma Media B.V.
Schout Bij Nacht Doormanweg 40, Curaçao
("Paloma Media B.V." or "we", "us", "our")

Paloma Media B.V. operates the Thunder Pick brand and the website thunderp.bet under a license issued by Gaming Curacao (License 365/JAZ, sub-license GLH-OCCHKTW0701272021, master license registration number 155557). Thunder Pick is not licensed by the UK Gambling Commission; UK users access thunderp.bet as an offshore (grey-market) gambling service and do not benefit from UKGC regulatory protections.

Payment processing subsidiary. Certain payment-related services and transactions for thunderp.bet are handled by our subsidiary:

Paloma Media Ltd
Cyprus (Company Registration No. HE 435063)

Paloma Media Ltd acts primarily as a payment processing and support entity and may process personal data on our behalf as a processor or joint controller, depending on the specific processing activity.

Data protection contact / DPO. We have designated an internal contact point for data protection matters (Data Protection Officer or equivalent function). You can reach us for any privacy-related question or request at:

Email: [email protected] (please include "Privacy" in the subject line)
Website: https://thunderp.bet
Postal contact: Data Protection Officer, Paloma Media B.V., Schout Bij Nacht Doormanweg 40, Curaçao

We will use your personal data in accordance with this Privacy Policy and applicable laws in the United Kingdom and, where relevant, other jurisdictions whose residents use thunderp.bet.

What Personal Data We Collect

We collect different categories of personal data depending on how you interact with thunderp.bet and the Thunder Pick offering.

Identification and contact data

Account details: full name, username, password (stored in hashed form), date of birth, nationality, and gender (where provided).
Contact details: email address, telephone number (where provided), and other contact channels you choose to use when communicating with us.
Verification data (KYC/AML): copies or details of identity documents (passport, ID card, driving licence), proof of address (utility bills, bank statements), and other documents we may request to comply with anti-money laundering (AML), counter-terrorist financing (CTF), responsible gambling, and age verification obligations.

Technical and usage data

Device and connection data: IP address, browser type and version, time zone, language settings, device identifiers, operating system, and similar technical information.
Log and usage data: login timestamps, session duration, page views, clicks, navigation paths, referral URLs, and interaction with site features.
Security and fraud logs: failed login attempts, suspicious activity flags, device fingerprints, and related diagnostic information.

Financial and transactional data

Payment data: limited payment card details (processed via secure payment providers), crypto wallet identifiers, bank account information where necessary, and transaction references.
Transaction history: deposits, withdrawals, bonuses credited and used, chargebacks, and payment disputes.

Behavioral and profile data

Betting and gaming activity: betting history, wagering patterns, stakes, wins and losses, preferred games and sports, and in-game behavior.
Risk and responsible gambling data: self-exclusion status, account limits, affordability assessments (where applicable), and communications relating to responsible gambling.
Marketing and preference data: marketing preferences, communication channels, response to campaigns, and feedback or survey responses.

Cookies and similar technologies

Cookies: small text files stored on your device to remember your preferences, maintain sessions, and improve site performance.
Tracking technologies: web beacons, pixels, SDKs, and similar tools used for analytics, advertising, and security purposes.

We collect this data directly from you (for example, when you register or contact support), automatically through your use of thunderp.bet, and, where legally permitted, from third-party service providers or partners (such as payment providers or fraud prevention services).

Legal Basis for Processing

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU GDPR and Mexican data protection laws. Our main legal bases are:

Contractual necessity

Providing our services: We process your data to create and manage your thunderp.bet account, verify your identity, allow you to deposit and withdraw funds, place bets, participate in casino games, and use all functionalities of the Thunder Pick offering.
Customer support: We use your contact and account data to respond to queries, resolve technical issues, and handle complaints related to our services.

Compliance with legal obligations

AML/CTF and responsible gambling: We are required under applicable laws and our Gaming Curacao license (365/JAZ, sub-license GLH-OCCHKTW0701272021) to perform KYC checks, monitor transactions, prevent money laundering and fraud, verify age, and implement responsible gambling measures.
Tax, accounting, and regulatory reporting: We retain and may disclose certain transactional and identity data to comply with bookkeeping, tax, regulatory, and law enforcement obligations in Curaçao, Cyprus, the UK, and other relevant jurisdictions.

Legitimate interests

Service improvement and analytics: We analyze aggregated and pseudonymised usage data to improve site performance, user experience, and product development, while respecting your privacy.
Security and fraud prevention: We process technical and behavioral data to protect thunderp.bet, detect and prevent fraud, abuse, bonus misuse, account takeover, and other security incidents.
Business operations: We use data for internal audits, risk management, and group-level administration within Paloma Media B.V. and Paloma Media Ltd.

Consent

Marketing communications: We send electronic marketing (e.g., email, push notifications, SMS) only where we have your consent or where permitted under applicable law. You may withdraw your consent at any time.
Optional cookies and tracking: We use non-essential cookies (e.g., analytics and advertising cookies) based on your consent via our cookie banner or settings interface.

Mexican privacy law alignment

For users to whom Mexican data protection law applies, we also rely on lawful bases recognized under the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations, including consent, contractual necessity, and legal obligations, in alignment with the GDPR/UK GDPR framework described above.

Purpose of Processing

We process personal data for clearly defined purposes, using only what is necessary to achieve each purpose.

Provision and administration of gambling services

Operating your account: creating and maintaining your thunderp.bet account, verifying identity and age, managing login credentials, and enabling deposits, wagers, and withdrawals.
Running games and bets: recording bets, calculating odds and payouts, preventing duplicate or invalid bets, and providing game history and account statements.

Compliance, risk, and responsible gambling

Legal and regulatory obligations: fulfilling AML/CTF, KYC, sanction screening, and other regulatory requirements arising from our Gaming Curacao license and applicable laws in relevant jurisdictions, including the UK.
Responsible gambling: monitoring behavior to detect signs of problem gambling, applying self-exclusion and limits, and communicating with you about your gambling activity where necessary.

Service improvement and analytics

Usage analytics: understanding how users interact with thunderp.bet to improve performance, navigation, and content, and to fix bugs.
Product development: using aggregated and pseudonymised data to evaluate new features, games, and promotional mechanisms.

Marketing and personalization

Direct marketing: sending promotional communications about offers, bonuses, and events related to thunderp.bet, where permitted by law and your preferences.
Personalized experience: tailoring content, recommendations, and bonuses based on your interests and prior activity, subject to your choices and applicable laws.

Security and fraud prevention

Protecting our platform: monitoring and logging access, detecting suspicious activity, preventing fraud, collusion, chargebacks, money laundering, and other abuses.
Incident management: investigating and responding to security incidents or technical faults, and implementing corrective measures.

Disclosure & Sharing

We do not sell your personal data. We share personal data only with trusted parties and only to the extent necessary for the purposes described in this Privacy Policy, subject to appropriate safeguards and contractual arrangements.

Service providers and partners

Payment and banking partners: payment processors, banks, crypto payment gateways, and financial institutions that process deposits, withdrawals, and related financial operations (including Paloma Media Ltd in Cyprus for payment processing).
Technical and infrastructure providers: hosting providers, IT and security vendors, content delivery networks, analytics providers, customer support tools, and communication platforms.
Verification and fraud prevention providers: identity verification services, AML/CTF screening providers, fraud detection and risk scoring platforms.

Affiliates and marketing partners

Affiliate networks: partners that refer players to thunderp.bet, to measure campaign performance and pay commissions. We share only the data necessary for attribution and reporting, often in pseudonymised form.
Advertising networks and analytics: third parties that provide analytics or advertising services, subject to your consent for cookies and tracking technologies where required by law.

Group companies

Intra-group transfers: Paloma Media B.V., Paloma Media Ltd, and any future group entities may share data where necessary for centralized operations, risk management, customer support, or regulatory compliance, always under appropriate contractual safeguards.

Regulators, authorities, and dispute resolution bodies

Regulators and law enforcement: Gaming Curacao, tax authorities, courts, police, or other public authorities when we are legally required or permitted to do so, including for AML/CTF or responsible gambling investigations.
Complaints bodies: where you lodge a complaint with Gaming Curacao or a data protection authority, we may share relevant information necessary to handle the complaint.

Corporate transactions

Business transfers: in connection with any merger, acquisition, reorganization, sale of assets, or similar corporate transaction, your personal data may be transferred to the relevant third parties, subject to confidentiality and, where required, notice to you.

International Transfers

Thunder Pick operates globally, and your personal data may be transferred to and processed in countries outside the United Kingdom, including Curaçao, Cyprus, and other jurisdictions where we or our service providers are located.

Locations of processing

Curaçao: primary operational and licensing jurisdiction for Paloma Media B.V.
Cyprus: payment processing and certain back-office services via Paloma Media Ltd (HE 435063).
Other countries: locations of hosting providers, analytics partners, and technical vendors, which may include countries outside the UK and European Economic Area (EEA).

Transfer safeguards

Standard Contractual Clauses (SCCs): where required, we use European Commission or UK-approved standard contractual clauses to ensure an adequate level of protection for data transferred outside the UK/EEA.
Contractual and technical protections: we implement data protection agreements, access controls, encryption, and other safeguards to protect your data during and after transfer.
Risk assessments: we assess the legal environment of third countries and, where necessary, adopt additional measures to protect your rights.

By using thunderp.bet, you acknowledge that your personal data may be transferred internationally in accordance with this section and applicable data protection laws.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with legal, regulatory, or reporting obligations. Retention periods may differ depending on the category of data and applicable law.

Typical retention periods

Account and identification data: generally retained for the duration of your relationship with us and for up to five (5) years after account closure, or longer where required by AML/CTF or other legal obligations.
KYC/AML documentation: retained for at least five (5) years after the end of the business relationship or last transaction, and up to ten (10) years where permitted or required by law.
Transactional data: retained for seven (7) to ten (10) years to comply with accounting, tax, and regulatory requirements.
Technical logs and security data: retained typically for one (1) to two (2) years, unless needed longer for investigations or legal proceedings.
Marketing data: retained until you withdraw consent or object to marketing, and for a limited period (for example, up to two (2) years) after your last interaction with thunderp.bet.
Cookies: stored for the lifespan indicated in our cookie settings interface (session cookies expire when you close your browser; persistent cookies may last from a few days up to two (2) years).

Deletion and anonymization

When data is no longer needed and no legal obligation requires us to keep it, we will delete it or irreversibly anonymize it so that it can no longer be linked to you. We may retain anonymized or aggregated data for analytics, business planning, and statistical purposes without further notice to you.

Your Rights

You have a number of rights in relation to your personal data under the UK GDPR, the Data Protection Act 2018, and, where applicable, under the EU GDPR and Mexican data protection laws. These rights may be subject to certain conditions and legal exceptions.

GDPR / UK GDPR rights

Right of access: to obtain confirmation of whether we process your personal data and to receive a copy of that data, along with relevant information about the processing.
Right to rectification: to have inaccurate or incomplete personal data corrected or completed.
Right to erasure: to request deletion of your personal data where, for example, it is no longer necessary for the purposes for which it was collected, you withdraw consent (where processing is based on consent), or you successfully object to processing. Legal retention obligations may limit this right.
Right to restriction: to request that we restrict processing of your data in certain circumstances (for example, while we verify the accuracy of data you contest).
Right to object: to object to processing based on our legitimate interests, including profiling, and to object at any time to processing for direct marketing purposes.
Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
Rights related to automated decision-making: to request human intervention, express your point of view, and contest decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Mexican privacy law (ARCO rights)

Where Mexican data protection law applies, you may have additional or overlapping rights commonly referred to as ARCO rights:

Access: to know what personal data we hold about you, how we use it, and the conditions of its processing.
Rectification: to request correction of inaccurate or incomplete data.
Cancellation: to request that we stop processing and delete your data when it is no longer necessary, subject to legal obligations.
Opposition: to oppose the use of your data for certain purposes, such as marketing or profiling, where permitted by law.

How to exercise your rights

Contact channel: You can exercise your rights by contacting us at [email protected] with "Data Rights Request" in the subject line, or by using any dedicated privacy tools we may make available in your account dashboard.
Information required: Please provide sufficient information to identify yourself (such as username, registered email, and country of residence) and clearly describe the right you wish to exercise.
Response time: We aim to respond to your request within one (1) month (30 days) of receipt. Where requests are complex or numerous, we may extend this period by up to two further months, and we will inform you of any such extension.
Fees: We handle rights requests free of charge. However, where requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, in line with applicable law.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate thunderp.bet, enhance your experience, perform analytics, and deliver personalized content. Cookies may be placed by us (first-party cookies) or by third parties.

Types of cookies

Session cookies: temporary cookies that are deleted when you close your browser. They are used to maintain your session, keep you logged in, and ensure security during your visit.
Persistent cookies: cookies that remain on your device for a defined period or until you delete them. They remember your preferences, such as language or region, and help provide a more consistent experience.
Third-party cookies: cookies placed by third parties (e.g., analytics providers, marketing networks, or social media platforms) to measure performance, provide statistics, or deliver targeted advertising, subject to your consent where required.

Purposes of cookies

Strictly necessary / functional: required for the operation of thunderp.bet, including authentication, security, and core functionality. You cannot disable these through our cookie tools without affecting site performance.
Analytics: used to collect aggregated information about how visitors use the site (e.g., pages visited, time spent, error messages) so we can improve performance and usability.
Advertising and personalization: used to deliver relevant promotions, track the effectiveness of campaigns (including affiliate marketing), and personalize content based on your interests.

Managing cookies

Cookie banner / settings: when you first access thunderp.bet (and periodically thereafter), you may be presented with a cookie banner or settings panel, allowing you to accept, reject, or customize non-essential cookies.
Browser settings: you can configure your browser to block or delete cookies. However, disabling certain cookies may affect the functionality or performance of thunderp.bet.
Opt-out mechanisms: where applicable, you may use industry-standard opt-out tools (for example, for interest-based advertising) in addition to our own settings.

Data Security

We take the security of your personal data seriously and implement technical and organizational measures designed to protect it against unauthorized access, alteration, disclosure, or destruction.

Technical measures

Encryption in transit and at rest: we use modern cryptographic protocols (such as TLS 1.2 or higher) to encrypt data in transit between your device and our servers, and we employ encryption or equivalent safeguards for sensitive data at rest where appropriate.
Access controls: access to personal data is restricted to authorized personnel and service providers who need it for specific tasks, based on role-based access control and the principle of least privilege.
Network and application security: we use firewalls, intrusion detection and prevention systems, anti-malware tools, and secure coding practices to reduce security risks.

Organizational measures

Policies and training: we maintain internal policies on data protection and security, and provide regular training to staff involved in processing personal data.
Vendor management: we require service providers that process personal data on our behalf to implement appropriate security measures and to process data only on our instructions.
Security testing and audits: we periodically review our systems and controls, which may include internal audits, vulnerability assessments, or independent reviews, to maintain and improve security.

Incident response

Monitoring: we monitor systems for unusual or suspicious activity that may indicate a security incident.
Response plan: we maintain procedures to investigate, contain, and remediate security incidents, and to reduce the risk of recurrence.
Breach notifications: where required by law, we will notify relevant authorities and affected individuals of personal data breaches without undue delay.

While we strive to align our practices with recognized industry standards (such as ISO 27001 or SOC 2 principles) where appropriate, no system can be guaranteed to be 100% secure. You are encouraged to use strong, unique passwords, enable any available account security features, and promptly inform us of any suspected unauthorized use of your account.

Complaints & Contacts

If you have questions about this Privacy Policy or how we process your personal data, or if you wish to lodge a complaint, you may contact us using the details below.

Contacting us

Email (primary contact): [email protected] (please include "Privacy Complaint" or "Data Protection" in the subject line).
Postal address: Data Protection Officer, Paloma Media B.V., Schout Bij Nacht Doormanweg 40, Curaçao.
Website: via any support or contact features available in your thunderp.bet account.

Internal complaint procedure

Step 1 - Contact support: submit your complaint or query via [email protected] or through our support tools, providing as much detail as possible.
Step 2 - Review by privacy team: where the issue concerns data protection, it will be reviewed by our Data Protection Officer or designated privacy team.
Step 3 - Response timeframe: we aim to acknowledge your complaint within a reasonable period and provide a substantive response within one (1) month (30 days), or inform you if more time is needed.
Step 4 - Escalation: if you are not satisfied with our response, you may request further review or escalate your complaint to a relevant authority as outlined below.

Supervisory and regulatory authorities

UK data protection authority: if you are in the United Kingdom, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). For current contact details, please refer to the official ICO website.
EU data protection authorities: if EU data protection law applies to you, you may lodge a complaint with your local supervisory authority or with the authority of the place of alleged infringement.
Mexican data protection authority: where Mexican data protection law applies, you may file a complaint with the competent Mexican data protection authority (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales - INAI). Please consult the official INAI website for up-to-date contact information and procedures.
Gaming Curacao: for complaints specifically regarding gambling operations under our license 365/JAZ (sub-license GLH-OCCHKTW0701272021), you may contact Gaming Curacao using the contact details provided on its official website or via the dispute resolution contact information indicated on thunderp.bet.

Your right to lodge a complaint with a supervisory authority exists in addition to, and is not conditional upon, using our internal complaint process.

Updates

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or business practices relating to thunderp.bet and the Thunder Pick offering.

How we will inform you

Website publication: the most current version of this Privacy Policy will always be available on https://thunderp.bet.
Direct notifications: for material changes, we may notify you by email, account notifications, or prominent banners on the website.
Advance notice: where reasonably possible and required by law, we will provide at least 30 days' notice before material changes take effect, so that you can review them.

Your options

Continued use: if you continue to use thunderp.bet after changes come into effect, you will be deemed to have accepted the updated Privacy Policy to the extent permitted by applicable law.
Objection and account closure: if you do not agree with changes that materially affect the way your personal data is processed, you may contact us to raise objections or, where applicable, close your account and request deletion or restriction of your data, subject to legal retention requirements.

Last updated: November 2025