Bankrolla Cards Privacy Policy

Last Updated: August 26, 2026

Version: 1.1

Previous Version: 1.0

1. Introduction

a. This Privacy Policy

Epic Play Holding Inc. (“we”, “us” or “our”) operates the Bankrolla Cards platform available at https://bankrolla.cards (the “Platform”). This Privacy Policy explains what personal data we hold about you, how we collect and process it, and for how long we retain it. The Platform is intended for users located in the United States, in the states where the Platform is available as set out in the Bankrolla Cards Terms of Service.

b. Personal Data

In this Privacy Policy, “personal data” and “personal information” are used synonymously and mean any information that directly or indirectly identifies an individual, or from which the identity of an individual can be reasonably inferred. Personal data does not include aggregated information, meaning information about groups or categories of users that does not identify any individual user, or anonymous information, meaning information that does not identify any individual user and cannot reasonably be re-identified.

c. Definitions

Capitalized terms that are not defined in this Privacy Policy have the meaning given to them in the Bankrolla Cards Terms of Service.

2. Data Controller

The data controller responsible for your personal data is:

Name: Epic Play Holding Inc., a corporation registered in the State of Florida, USA.

Address: 1287 E Newport Center Dr Ste 206, Deerfield Beach, Florida, 33442, USA.

Email: [email protected].

3. Collecting Personal Data

We collect the following categories of personal data:

Identity Data, such as: first and last name, gender, date of birth, citizenship, government-issued identification documents.
Contact Data, such as: email address, postal address, phone number.
Location Data, such as: IP address, address, and approximate geolocation information used to confirm that you are located in a state where the Platform is available.
Financial Data, such as: payment card and bank account details, billing information, and records of your purchases, payments and prize redemptions.
Occupation Data, such as: education, career, source of funds.
Online Presence Data, such as: social media and online-commerce information.
Biometric Data, such as: where identity verification includes a liveness check or a comparison of your photo against your government-issued ID, a scan or template of your facial geometry derived from the selfie or photo you submit. Biometric Data is collected and processed by us and our identity-verification vendor solely for identity verification, fraud prevention, security and legal compliance. By completing identity verification on the Platform, you consent to the collection, storage and use of your Biometric Data by us, our identity-verification vendor and contracted service providers for these purposes.
Watchlist Data, such as: information obtained when checking your identity against government, regulatory or industry watch lists (for example, OFAC and other sanctions or AML lists) and customer blacklists.
Communication Data, such as: recorded communications between you and us, including calls, letters (such as mail-in sweepstakes entries), emails, messages and submitted forms.
Usage Data, such as: unique user identifiers, your activity on the Platform, and technical and device information such as content viewed, visit duration, hardware model, device type, operating system version, browser type and IP address.

4. Sources of Personal Data

We collect personal data as follows:

a. Directly from you: Identity, Contact, Financial, Occupation and Communication Data are collected when you create an account, make purchases, complete verification, participate in promotions (including by mail) or otherwise contact or interact with us.

b. Automatically from your device: Usage Data is collected through cookies and similar technologies when you use the Platform.

c. Automatically from third parties: Usage Data may be collected through integrated Third-Party Services, Watchlist Data is collected when your identity is validated against external sources, and Biometric Data may be collected through our identity-verification vendor. We use various tracking technologies to automatically collect Usage Data, including:

Cookies: small text files stored by your browser. You can block cookies in your browser settings, but this may affect the performance of the Platform.
Pixel Tags / Web Beacons: small pieces of embedded code that track page visits and email engagement.
Mobile Device Identifiers: advertising identifiers such as Apple’s IDFA and the Google Advertising ID, which you can manage in your device settings.
Event Tagging: tools (for example, Facebook App Events) that log actions such as app installs to measure advertising performance.

Do Not Track. Some browsers can transmit “Do Not Track” signals. We do not currently respond to Do Not Track signals.

5. Using Personal Data

We use personal data to operate the Platform, provide our services, facilitate transactions (including purchases and prize redemptions), respond to inquiries and meet regulatory requirements, including anti-fraud and anti-money laundering obligations. In particular, we use personal data for:

providing and managing the Platform, including account setup, identity verification and fraud checks;
improving our services based on feedback and usage trends;
complying with legal and regulatory requirements, including taxation and tax reporting, anti-money laundering, sweepstakes administration and responsible gameplay;
personalizing your experience using aggregated analytics;
sending service updates, offers, promotions and surveys, which you can opt out of at any time;
sending technical and legal notices;
advertising the Platform, including through targeted advertising;
resolving disputes that go beyond our internal processes.

6. Sharing Personal Data

We share personal data where necessary to provide you access to the Platform and fulfill our undertakings to you, to comply with applicable law and regulation, or to maintain, improve and develop the Platform — in each case subject to appropriate legal, organizational and technical safeguards. Typical recipients include:

our affiliates;
contractors and suppliers that enable Platform functionality (for example, game providers);
verification and compliance providers;
support and technical teams;
marketing teams;
advertising and analytics partners;
email delivery and verification services;
hosting providers;
government authorities, where disclosure is legally required;
buyers or transferees in connection with a sale of the Platform or any part of it;
other integrated third-party solutions, as needed.

7. Storing Personal Data

We retain personal data for as long as necessary for the purposes for which it was collected. How long that is depends on:

our business and commercial needs;
legal, accounting and regulatory requirements (including anti-money laundering and tax recordkeeping);
our internal operational needs; and
any ongoing or anticipated investigation, dispute or litigation.

Once personal data is no longer needed for these purposes and we are no longer legally required to keep it, it is destroyed or permanently de-identified. Biometric Data is permanently destroyed once the purpose for which it was collected has been satisfied or 3 years after your last interaction with the Platform, whichever occurs first, unless a longer retention period is required by applicable law.

8. Protecting Personal Data

We apply technical and organizational measures designed to protect personal data, including:

information-security and physical-security controls;
management of access rights for personnel and contractors;
regular testing and evaluation of our safeguards;
anonymization, pseudonymization and encryption where appropriate; and
encrypted connections (SSL/TLS) for all Platform traffic.

9. Data Protection Rights

Subject to applicable law, you may have the right to:

Know. whether we process your personal data and obtain a copy of it;
Correct. inaccurate or incomplete personal data;
Delete. personal data that is no longer required for contractual or legal purposes, subject to legal exceptions;
Limit. the use and disclosure of sensitive personal information;
Opt Out. of the sale or sharing of personal data for cross-context behavioral advertising;
Manage Marketing Preferences. at any time;
Data Portability. receive your personal data in a structured, machine-readable format;
Non-Discrimination. not be discriminated against for exercising your rights;
Opt Out of Automated Decisions. that produce legal or similarly significant effects;
File a Complaint. with a supervisory authority.

To exercise these rights, contact us at [email protected]. Requests may be submitted by you or, where permitted by applicable law, by an authorized agent acting on your behalf. We may verify your identity before fulfilling a request. We respond to requests within 45 days (15 business days for opt-out requests) and may extend this period once by a further 45 days where reasonably necessary, in which case we will notify you. Appeals are answered within 45 days.

10. Third-Party Services

The Platform may link to or integrate Third-Party Services. Their privacy practices are outside our control, and we encourage you to review their privacy policies separately.

11. Personal Data of Minors

The Platform is intended for adults only. It is not directed to, and may not be used by, individuals under 18 years of age or under any higher minimum age required in their jurisdiction. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it.

12. Changes to this Privacy Policy

We review this Privacy Policy regularly. Updates are reflected in a revised “Last Updated” date and version number at the top of this page. We encourage you to review this Privacy Policy periodically.