Introduction
This Privacy Policy explains how Sirplay Sudamerica EIRL and Sirplay USA LLC (together, “Sirplay”, “we”, “us”) collect, use and share personal data when you visit https://sirplay.com/ or submit a B2B enquiry, demo or contact form.
Sirplay designs and supplies iGaming software (sportsbook, casino, Web3, crypto and optional No-KYC modules) to professional operators. This website is a corporate and commercial site. It is not a consumer casino or sportsbook. We do not accept player bets and we do not hold player wallets on this domain.
This policy covers the website and lead forms only. It does not cover player data processed by operators who license Sirplay software. Those operators are independent controllers of their player databases.
Data Controllers
Depending on which team handles your enquiry, Sirplay Sudamerica EIRL (Calle Coronel Inclán 237, oficina 703, Miraflores, Lima 18, Peru) and/or Sirplay USA LLC (48 Country Club, Bellport, NY 11713, United States) act as controller or joint controllers of website and lead data.
Single contact point for all privacy matters: legal@sirplay.com.
Personal data we collect
Identity and contact data you submit: name, company, job title, email, phone, country, message, and any files you attach.
Commercial context: product interest (sportsbook, casino, crypto white label, demo), language, source page.
Technical data: IP address, user agent, device, browser, approximate location derived from IP, referring URL, pages viewed, timestamps.
Cookie and similar identifiers, as described in the Cookie Policy, only after the consent required by the CMP for non-essential tools.
Communication records: emails and meeting notes related to your B2B enquiry.
We do not require government ID, payment cards or player KYC documents on this website. Do not send special-category data (health, biometric data, precise consumer geolocation) through the contact form.
Sources
Data comes from you (forms, email to legal@sirplay.com or sales mailboxes), from your device (logs and consented analytics), and from our processors acting on our instructions (hosting, CRM, email, analytics). We do not buy consumer gambling lists.
Purposes and legal bases
European / UK GDPR bases are cited for visitors in those regions. For Peru we apply Ley 29733 and its regulations. For the United States we apply applicable state laws, including the CCPA/CPRA where a visitor is a California resident. Bases:
Respond to B2B enquiries and provide a demo or proposal — pre-contract / contract (GDPR Art. 6(1)(b); equivalent contractual necessity under Peruvian and US commercial practice).
Operate, secure and debug the website — legitimate interests (Art. 6(1)(f)) and, where required, consent for non-essential cookies.
Measure traffic with Google Analytics and similar measurement tools — consent where required by ePrivacy, Peruvian data-protection rules and US state cookie/privacy rules; otherwise legitimate interests with IP anonymisation and no ads personalisation on this domain without a separate review.
Manage leads in the internal CRM — pre-contract and legitimate interests in running a B2B sales pipeline.
Send marketing emails about Sirplay software — consent (Art. 6(1)(a)) or soft opt-in where lawful for existing B2B contacts. Every message includes an unsubscribe link.
Comply with law, defend claims, prevent abuse — legal obligation (Art. 6(1)(c)) and legitimate interests.
Google Analytics, CRM and monitoring
We use Google Analytics (Google LLC / Google Ireland Limited, as applicable) to understand aggregated traffic: pages, countries, devices and campaigns. Analytics cookies or equivalent signals load only after opt-in via the Consent Management Platform, except where a strictly necessary measurement configuration is used without advertising features. We configure IP anonymisation / Google Consent Mode where available. Google may process data in the United States under its terms and transfer tools (including Standard Contractual Clauses).
Lead data is stored in Sirplay’s internal CRM used by authorised staff in Peru, the United States and other support locations under access control.
The CRM is used to follow up B2B opportunities, not to profile consumers as gamblers.
We may use additional monitoring and security tools (server logs, uptime, bot and fraud filters, tag manager). These process technical identifiers to keep the site available and to block abuse. They are not used to make automated decisions with legal effects on you.
Recipients and international transfers
- Hosting and CDN providers for sirplay.com.
- Google (Analytics and, if enabled, Tag Manager).
- Email and productivity providers used to answer legal@sirplay.com and sales mailboxes.
- Internal CRM and authorised Sirplay staff in Peru and the United States.
- Professional advisers (legal, accounting) under confidentiality.
- Authorities when legally required.
We do not sell personal data. Transfers from the EEA/UK to Peru or the United States rely on Standard Contractual Clauses, adequacy where available, and supplementary measures agreed in processor DPAs. Intra-group access between Sirplay Sudamerica EIRL and Sirplay USA LLC is limited to staff who need the lead to perform the contract or pre-contract.
Retention
- Unsuccessful leads: 24 months from last meaningful contact, unless a longer statutory period applies.
- Clients and signed MSA files: duration of the contract plus applicable limitation periods.
- Server logs: typically 12 months.
- Consent records for cookies and marketing: for the life of the consent plus an evidence period (minimum 24 months).
- Legal holds override deletion until the dispute or investigation ends.
Your Rights
Subject to local law you may request: access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and — for California residents — knowledge, deletion, correction and opt-out of “sale” or “sharing” as those terms are defined in the CPRA. Sirplay does not sell lead data for cross-context behavioural advertising of consumers.
How to exercise rights: submit the form at https://sirplay.com/data-request/ or email legal@sirplay.com. We may ask you to confirm the email domain used in the original enquiry. We acknowledge within 5 working days and respond within 30 days (extendable by 60 days if complex, with notice).
Complaints: you may lodge a complaint with the Autoridad Nacional de Protección de Datos Personales (Peru), a US state attorney general or the California Privacy Protection Agency if applicable, or an EU/UK supervisory authority if GDPR/UK GDPR applies to you. We invite you to contact legal@sirplay.com first.
Children
The site is intended for business users aged 18+. We do not knowingly collect data from minors. If you believe a minor submitted a form, write to legal@sirplay.com and we will delete the record.
Updates
We will post the new version on this page and update the “Last updated” date. Material changes that affect an existing consent will be communicated where required.
Last updated: 21 September 2026.