Privacy Policy

This Privacy Policy explains how personal data is collected and used when you visit or use the Mr Rex online gambling services provided via mrreks.com. It is intended for players, registered account holders, and other visitors to our website and related services. Please read it carefully so you understand what information we process, why we do so, and how we protect your rights.

This Privacy Policy applies to all processing of personal data carried out in connection with Mr Rex on mrreks.com, including account registration, gameplay, payments, marketing, and customer support. It complements, and does not replace, any other notices we may provide to you at the point of data collection.

The primary legal framework governing our processing is the UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018, together with applicable UK e-privacy rules and gambling regulations. Where relevant, our practices are also aligned with the EU GDPR and with Mexican data protection principles to ensure comparable protections for affected users.

Effective date: 6 November 2025 (Last updated: 6 November 2025).

Who We Are

OBSERVE: Mr Rex on mrreks.com is operated for players in Great Britain and Northern Ireland by a licensed remote gambling operator. To ensure legal certainty, we identify the responsible legal entity and provide clear contact channels for privacy matters.

EXPAND: The Mr Rex service runs on the Aspire Global platform and is operated by the following company, which is responsible (as "controller" under the UK GDPR) for personal data processed in connection with your use of mrreks.com in the UK:

Operator / Controller: AG Communications Limited
Legal form: Limited company
Registered office / legal address: 135 High Street, Sliema, SLM 1548, Malta
Operational focus for this site: Provision of online casino and real event betting services to residents of the United Kingdom via mrreks.com under the Mr Rex brand
Gambling licence (UK): UK Gambling Commission ("UKGC") remote operating licence number 39483 (casino and real event betting), as listed in the UKGC public register

REFLECT: For privacy-specific queries, requests, or complaints, the controller provides a dedicated contact point so that you can exercise your rights efficiently and at no cost.

Data controller contact (general):
AG Communications Limited
135 High Street, Sliema, SLM 1548, Malta
Contact email for general support:
Website: https://mrreks.com
Data Protection Officer / Privacy contact:
Data Protection Officer (DPO), AG Communications Limited
Postal address: 135 High Street, Sliema, SLM 1548, Malta
Email:
Phone:

If you are unsure which contact to use, please write to the DPO email address indicated above with "Privacy request - Mr Rex" in the subject line.

What Personal Data We Collect

OBSERVE: To provide a secure and fully regulated remote gambling service through mrreks.com, we must process several categories of personal data. Some are provided directly by you, others are generated through your use of our services or obtained from third parties (such as verification providers).

EXPAND: We only collect data that is necessary for clearly defined purposes (see "Purpose of Processing") and in line with UK gambling, anti-money laundering (AML), and data protection laws. The main categories are:

Identification and contact data: Full name, date of birth, residential address, email address, phone number, username, unique customer/account identifiers, copies or data from identity documents (for KYC purposes), and verification status.
Account and transactional data: Account registration details, login credentials (stored in hashed form), account status, language and currency preferences, deposit and withdrawal history, bonus participation, and loyalty programme information.
Payment and financial data: Partial payment card details (tokenised where applicable), bank account details used for withdrawals, transaction identifiers, payment provider ID, wallet details, and records of chargebacks, refunds, and payment verification checks. Exact bank account details of our corporate bank are not disclosed publicly but may be processed in the context of settlements.
Technical and usage data: IP address, approximate location derived from IP, device type, operating system, browser type and version, screen resolution, connection timestamps, log files, pages viewed, referral URLs, clickstream data, session identifiers, and performance logs.
Gameplay and behavioural data: Betting and gaming history (games played, stakes, wins/losses, bet frequency, session duration), responsible gambling limits and self-exclusion data, communication preferences, interactions with support, and behavioural patterns used for anti-fraud and safer gambling monitoring.
Verification, compliance and risk data: Information obtained during "Know Your Customer" (KYC) checks, AML risk assessments, sanctions and politically exposed person (PEP) screenings, affordability and source-of-funds documents, as legally required in the UK.
Marketing and communication data: Newsletter subscriptions, opt-ins/opt-outs for email, SMS, push and other marketing channels, records of marketing communications sent and interactions with those communications (e.g. opens and clicks).
Cookies and similar technologies: Cookies, web beacons, pixels, and device identifiers used to remember your preferences, keep you logged in, analyse site performance, and - where permitted - deliver personalised offers and advertisements (see "Cookies & Tracking Technologies").

REFLECT: If we need to collect other types of data (for example, for a new feature or regulatory change), we will explain this at the point of collection and, where required, obtain your consent.

Legal Basis for Processing

OBSERVE: Under the UK GDPR we must have a valid legal basis for each type of processing. Because Mr Rex on mrreks.com operates in a heavily regulated sector, many processing activities are required by law or necessary for the performance of our contract with you.

EXPAND: We rely on the following legal grounds:

Performance of a contract: We process personal data to enter into and perform our agreement with you, including:
- Creating and managing your Mr Rex player account on mrreks.com;
- Processing deposits, wagers, wins and withdrawals;
- Providing customer support and resolving operational issues;
- Operating loyalty schemes, bonuses and promotions you participate in.
Compliance with legal obligations: The operator is subject to UK laws and regulations, including AML/CTF legislation, the UK Gambling Commission licensing conditions, taxation and accounting rules, and data protection law. We therefore process data for:
- Identity verification, age checks and KYC/AML screening;
- Monitoring transactions for suspicious or unlawful activity;
- Maintaining mandatory licence and transaction records for specified periods;
- Responding to lawful requests from regulators, courts and law enforcement.
Legitimate interests: Where our interests are not overridden by your rights and freedoms, we rely on legitimate interests to:
- Prevent fraud, abuse, cheating and security incidents;
- Improve and optimise the performance and user experience of mrreks.com;
- Conduct internal analytics, reporting and service development;
- Protect our legal rights, enforce our terms and defend legal claims.
We apply appropriate safeguards, including pseudonymisation and aggregation, wherever possible.
Consent: In specific cases we rely on your consent, for example:
- Sending direct electronic marketing (email, SMS, push) where consent is required;
- Using certain non-essential cookies for analytics and personalised advertising;
- Processing particular categories of data not strictly required for our core services.
You can withdraw your consent at any time - see "Your Rights".
Protection of vital interests and public interest: In rare, exceptional situations, we may process data to protect the vital interests of you or others (e.g. communicating information to authorities where there is a serious and imminent risk of harm) or to fulfil tasks carried out in the public interest where mandated by law.

REFLECT: For users located in Mexico or otherwise protected by Mexican privacy law, our legal bases and purposes are aligned with the principles and lawful processing grounds set out in the Mexican Federal Law on Protection of Personal Data Held by Private Parties, while maintaining UK law as the primary framework for Mr Rex.

Purpose of Processing

OBSERVE: We use personal data for clearly defined, legitimate purposes related to the provision and improvement of the Mr Rex gambling services on mrreks.com.

EXPAND: The main purposes include:

Providing and managing our services: Setting up and administering your account, allowing you to log in, place bets and play games, processing deposits and withdrawals, applying promotions, and providing technical and customer support.
Regulatory compliance and responsible gambling: Conducting KYC and AML checks, monitoring transactions and gameplay for suspicious patterns, assessing affordability and risk where required, enforcing self-exclusion and reality checks, and complying with UKGC licence conditions and legal reporting duties.
Fraud prevention and security: Detecting and preventing fraudulent transactions, account takeover attempts, bonus abuse, collusion, money laundering or other misuse, and protecting the integrity and security of our systems and other players.
Service improvement and analytics: Analysing aggregated and pseudonymised usage data to understand how mrreks.com is used, identifying technical problems, optimising site performance, and developing new features and offerings.
Marketing and personalisation: With appropriate legal basis (such as consent or soft opt-in), sending you targeted offers, bonuses and news about Mr Rex, managing your marketing preferences, and using cookies/analytics to tailor content on mrreks.com to your interests.
Legal protection and business administration: Handling disputes, enforcing our terms and conditions and bonus rules, responding to claims and regulatory queries, maintaining business records, conducting audits, and supporting mergers, acquisitions or corporate restructuring subject to appropriate safeguards.

REFLECT: We do not use your personal data for purposes that are incompatible with those listed above. If we intend to use data for a new purpose, we will update this Privacy Policy and, where required, notify you in advance or seek your consent.

Disclosure & Sharing

OBSERVE: To operate Mr Rex on mrreks.com efficiently and in compliance with UK law, we sometimes need to share personal data with carefully selected third parties. We do so under written agreements and require them to protect your data.

EXPAND: We may disclose personal data to:

Payment service providers and banks: Card processors, e-wallet providers, bank partners and other financial institutions that process deposits, withdrawals and payment-related security checks, including chargeback handling and AML monitoring.
Identity verification, KYC and AML partners: Third-party providers that verify your identity and age, perform sanctions and PEP screening, assess AML risk, and validate documents as required by UK law.
IT, hosting and platform providers: Companies that provide the gaming platform (including Aspire Global platform infrastructure), website hosting, cloud services, data storage, technical monitoring and support for mrreks.com.
Analytics, marketing and advertising partners: Subject to applicable consent and preferences, we may share limited identifiers and behavioural data with analytics providers, email/SMS platforms, and advertising networks to measure campaign performance and deliver relevant offers.
Regulators and public authorities: The UK Gambling Commission, tax authorities, law enforcement, courts and other governmental bodies in the UK or abroad when required by law, licensing conditions, or to protect our rights or the rights of others.
Affiliates and group companies: Other entities within the same corporate group (for example, within the Aspire Global / NeoGames / Aristocrat group) that provide shared services, risk management, compliance support, or technical infrastructure under strict confidentiality.
Professional advisers: Lawyers, auditors, consultants and similar professionals who need access to data in the course of providing advice or services to us, subject to confidentiality obligations.
Business transactions: In connection with a merger, acquisition, sale of assets or similar corporate transaction, where personal data may be transferred to a new operator, subject to continuity of protections and regulatory approvals.

REFLECT: We do not sell your personal data in the sense of transferring it in exchange for money. Where data is shared for marketing purposes with third parties, this is done only with a valid legal basis (usually your consent), and you can opt out at any time.

International Transfers

OBSERVE: Mr Rex is operated by a company established in Malta and supported by global service providers. As a result, your personal data may be transferred to and processed in countries outside the United Kingdom.

EXPAND: Typical transfer scenarios include:

Transfers within the European Economic Area (EEA), including Malta, where AG Communications Limited is established and many of our platform and support services are based;
Transfers to other countries where some IT, payment processing, analytics or customer support providers operate (which may include countries outside the UK and EEA).

When personal data is transferred outside the UK, we implement appropriate safeguards as required by the UK GDPR, such as:

UK adequacy regulations confirming that the destination country ensures an adequate level of protection; and/or
Standard contractual clauses and/or the UK International Data Transfer Agreement (IDTA) or Addendum approved by the UK Information Commissioner's Office; and
Technical and organisational measures, including encryption, access controls and data minimisation.

REFLECT: Where your data is processed in countries whose laws do not provide the same level of data protection as in the UK, we take additional steps (risk assessments, contractual commitments, security controls) to ensure that your privacy rights remain effectively protected.

Data Retention

OBSERVE: We keep personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, including meeting legal, regulatory and reporting obligations imposed on Mr Rex and its operator.

EXPAND: Retention periods vary depending on the type of data and the applicable legal requirements. As a general guideline:

Account and identification data: Typically retained for the duration of your active account and for up to 5 years after account closure, in line with UK AML, gambling and record-keeping obligations, or longer if required by law or to resolve ongoing disputes.
Transaction and gameplay data: Deposits, withdrawals, betting history, and game logs are generally stored for at least 5 years after the relevant transaction or account closure, in order to comply with AML/CTF requirements and UKGC licence conditions, and to handle any legal claims.
Compliance and verification records: KYC documents, source-of-funds information and AML assessments are kept for statutory minimum periods (usually 5 years from the end of the business relationship or the date of the occasional transaction), or as otherwise required by UK law.
Marketing data: Information about your marketing preferences and consents is retained while you remain subscribed to marketing communications and for a short period afterwards to ensure we respect your opt-out choices.
Technical logs and security data: Security logs, device and connection data are retained for shorter operational periods where possible, but may be kept longer for incident investigation, fraud prevention and legal defence.

When data is no longer needed, we either securely delete it, anonymise it (so it is no longer personal data), or segregate it and restrict access so it is used only for limited purposes such as regulatory compliance or legal claims.

REFLECT: If you exercise your right to deletion (where applicable), we will remove or anonymise your personal data unless we must retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.

Your Rights

OBSERVE: As a data subject, you have rights over your personal data under the UK GDPR and related UK law. Where relevant, we also respect similar rights set out in the Mexican Federal Law on Protection of Personal Data Held by Private Parties, especially for users located in Mexico.

EXPAND: Your main rights include:

Right of access: You can request confirmation as to whether we process your personal data and receive a copy of that data, together with information about the processing.
Right to rectification: You can ask us to correct inaccurate or incomplete personal data (for example, updating your address or contact details) so that our records remain accurate.
Right to erasure ("right to be forgotten"): You can request deletion of your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis. This right is limited where we must retain data to comply with legal obligations (such as AML or gambling regulations) or for legal claims.
Right to restriction of processing: You can ask us to restrict processing of your data in specific situations (for example, while we verify its accuracy or consider an objection you have raised).
Right to object: You can object to processing based on our legitimate interests and to processing for direct marketing. If you object to direct marketing, we will stop using your data for that purpose immediately.
Right to data portability: For certain data you have provided to us, and which we process by automated means on the basis of your consent or a contract, you can request to receive it in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller where technically feasible.
Rights related to automated decision-making: If we make decisions based solely on automated processing that produce legal effects or similarly significant effects (for example, some risk or fraud checks), you have the right to obtain human review, to express your point of view, and to contest the decision.
Marketing and cookie consent: Where processing is based on your consent (for example, certain marketing communications or non-essential cookies), you may withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

For individuals located in Mexico or otherwise protected by Mexican privacy law, these rights are broadly aligned with ARCO rights (Access, Rectification, Cancellation and Opposition) under the Mexican Federal Law on Protection of Personal Data Held by Private Parties and its Regulations. We handle such requests in a manner consistent with both UK and applicable Mexican requirements, as far as they apply to our activities.

Procedures and timeframes:

You can exercise your rights by contacting our DPO or privacy contact using the details in "Who We Are", clearly stating that your request concerns Mr Rex on mrreks.com and specifying the right you wish to exercise.
We may need to verify your identity to protect your account and prevent unauthorised access to your data.
We aim to respond to your request within one month (30 calendar days) of receipt. For complex or multiple requests, this period may be extended by up to a further two months, in which case we will inform you of the extension and reasons.
In general, we handle rights requests free of charge. However, where a request is manifestly unfounded or excessive (for example, repeated requests), we may charge a reasonable fee or refuse to act, as permitted by law.

REFLECT: If you are not satisfied with our response or believe we are processing your data unlawfully, you also have the right to lodge a complaint with a supervisory authority (see "Complaints & Contacts").

Cookies & Tracking Technologies

OBSERVE: Mr Rex uses cookies and similar technologies on mrreks.com to provide core functionality, improve the user experience and, where permitted, deliver tailored offers and advertising.

EXPAND: The main types of cookies and similar technologies we use include:

Strictly necessary (functional) cookies: Session and persistent cookies that are essential for the operation of mrreks.com, such as enabling you to log in, maintain an active session, manage your account and remember your privacy preferences. These cookies cannot be disabled through our systems because the site cannot function properly without them.
Performance and analytics cookies: Cookies (often set by us or approved third-party providers) that help us understand how visitors use the site, for example which pages are most frequently visited, whether users encounter errors, and how long sessions last. The information is typically aggregated and used to improve performance and usability.
Functionality cookies: Cookies that remember your preferences (such as language, display settings or saved details) to offer enhanced, more personalised features.
Advertising and targeting cookies: Subject to your consent, we may use first- or third-party cookies, pixels and similar technologies to deliver more relevant advertising on mrreks.com and on third-party sites, and to measure the effectiveness of marketing campaigns.

Managing cookies:

You can manage your cookie preferences via the cookie banner or settings panel presented when you first visit mrreks.com, and you can adjust these settings at any time.
Most web browsers also allow you to block or delete cookies through browser settings. However, blocking certain cookies may affect the functioning of the site and your ability to use some features.
For more detailed information about the specific cookies we use and their lifetimes, please consult our dedicated Cookie Notice on mrreks.com.

REFLECT: We only use non-essential cookies (such as analytics and advertising cookies) where we have a valid legal basis (generally your consent), and we honour your choices through our cookie management tools.

Data Security

OBSERVE: Because Mr Rex processes sensitive financial and behavioural data in a regulated environment, we implement robust technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

EXPAND: While no system can be guaranteed 100% secure, our security framework for mrreks.com includes, among others:

Encryption in transit and at rest: Data transmitted between your browser and our servers is protected by industry-standard TLS (Transport Layer Security) protocols (TLS 1.2 or higher). Where appropriate, stored data is encrypted or otherwise protected to reduce the risk of unauthorised access.
Access controls and authentication: Strict access management ensures that only authorised personnel and service providers can access personal data, based on role and business need. Administrative access requires strong authentication (including multi-factor authentication where appropriate) and is logged for audit purposes.
Secure development and testing: Our platform follows secure coding practices, vulnerability management and change control procedures. New features for Mr Rex are tested in controlled environments before deployment.
Network and infrastructure security: Firewalls, intrusion detection/prevention systems, anti-malware tools, and continuous monitoring help protect our infrastructure. Systems are regularly patched and hardened in line with best practices.
Data segregation and bank protections: Player funds are held in a separate bank account from corporate funds in line with UKGC requirements, and we work with financial and banking partners that apply strong security controls to protect financial data and transactions.
Staff training and confidentiality: Employees and contractors with access to personal data receive regular training on data protection, security and responsible gambling obligations and are bound by confidentiality commitments.
Incident response: We maintain incident detection, response and escalation procedures. In the event of a personal data breach, we assess the impact promptly and, where required by law, notify the UK supervisory authority and affected individuals without undue delay.

We design our controls with reference to recognised international information security frameworks (such as ISO 27001 and SOC 2) where appropriate, while taking into account proportionality and regulatory expectations for remote gambling operators.

REFLECT: You also play an important role in security: keep your login credentials confidential, use unique and strong passwords, enable any recommended security features, and notify us immediately if you suspect unauthorised access to your Mr Rex account.

Complaints & Contacts

OBSERVE: You have the right to raise questions or complaints about how Mr Rex processes your personal data. We aim to resolve issues directly but you may also approach competent supervisory authorities.

EXPAND: If you have any queries, concerns or wish to exercise your rights, please contact us using one of the following channels:

Data Protection Officer / Privacy contact (preferred):
Data Protection Officer, AG Communications Limited
135 High Street, Sliema, SLM 1548, Malta
Email:
Please state "Privacy request/complaint - Mr Rex" in the subject line and provide enough information for us to identify you and understand your request.
Customer support:
You may also contact our customer support team via the contact options provided on mrreks.com (live chat, contact form or email), who will liaise with the privacy team as necessary.
Postal correspondence:
AG Communications Limited - Privacy
135 High Street, Sliema, SLM 1548, Malta

Internal complaint handling procedure:

You submit your complaint or request via one of the channels above, clearly identifying that it relates to privacy or data protection.
We acknowledge receipt as soon as reasonably possible and, in any event, endeavour to do so within a few working days.
We investigate your complaint, which may include reviewing system logs, communications and applicable legal obligations.
We provide a written response within one month (30 calendar days) of receiving your complaint. Where the matter is complex and requires more time, we will inform you of any extension and expected timeframe.

Escalation to supervisory authorities:

United Kingdom: If you are located in the UK or your issue concerns our UK-based processing, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK data protection authority:
Website: https://www.ico.org.uk
Telephone (UK): +44 303 123 1113
Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.
Mexico: If you are located in Mexico and believe your data protection rights under Mexican law have been infringed, you may also contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI):
Website: https://www.inai.org.mx
Contact details and procedures are available on INAI's official website.

REFLECT: We encourage you to contact us first so we can work with you to resolve any concerns. Exercising your rights or filing a complaint will not affect your ability to use Mr Rex services, although we may need to restrict your account where required to comply with legal obligations.

Updates

OBSERVE: Laws, regulatory guidance and our services may evolve over time. We may therefore update this Privacy Policy to reflect changes in how Mr Rex processes personal data or to comply with new legal requirements.

EXPAND: When we make material changes, we will:

Post the updated Privacy Policy on mrreks.com, indicating the new "Last updated" date at the top;
Provide additional notice via email, on-site banners or messages in your account dashboard where changes are significant or required by law;
Where the change materially affects processing based on consent or your contractual rights, provide at least 30 days' advance notice where reasonably practicable, so you can review the changes before they take effect.

During any notice period, you may object to the changes that affect you. If you do not accept a material change that impacts the contractual terms or how we process your data, you may choose to close your Mr Rex account, subject to settlement of any outstanding balances and regulatory obligations.

REFLECT: The current version of this Privacy Policy is identified by the "Last updated" date below and supersedes all earlier versions for Mr Rex on mrreks.com.

Last updated: 6 November 2025.