Thank you — we’ve received your details. Our team will contact you shortly.
Oops! Something went wrong while submitting the form.
DATA PROTECTION
Player Data Protection for Outbound AI Campaigns
You stay the data controller. Bswan processes only the segment you transfer, only for the campaign you approved, on EU infrastructure, encrypted from upload through deletion.
Legal detail lives in the Privacy Policy and Terms. This page is the operational answer: who does what, where the data sits, and what happens if something goes wrong.
You remain the controller. Bswan acts as the processor
The split is written into the DPA before the first record moves.
Operator — data controller
Decides which players are contacted, on what legal basis, and with what offer. Holds the consent record and the licence obligations. Can require deletion at any time.
Bswan — data processor
Processes only the transferred segment, only on documented instructions, only for the agreed campaign. No independent use, no reuse across clients.
NDA signed during onboarding. DPA signed before the first data transfer.
Encrypted at upload, encrypted through the pipeline
No raw player data is exposed at any point in the campaign.
Encrypted on arrival
Data is encrypted from the moment of upload and stays encrypted throughout the campaign pipeline.
Field-level control
Phone numbers are encrypted by default. You choose which additional uploaded fields are encrypted.
EU processing
Infrastructure and processing sit in the EU under GDPR.
No cross-client reuse
Player data is never shared between clients and never used to run another operator’s campaign.
Single-purpose use
Campaign data is used only for the agreed campaign and not retained for any other purpose.
Audit trail
Full audit trail available on request. Independent security audit available on request.
RESPONSIBLE GAMBLING
Responsible gambling runs on both sides of the transfer
Registry filtering stays with you. Real-time signal detection on the call is ours.
Your side
Registry compliance stays on the operator side. GAMSTOP, CRUKS, Spelpaus, and OASIS are verified against your list, and RG-flagged players are removed, before the list arrives.
Bswan’s side
The AI monitors every conversation in real time for problem-gambling signals. When a signal appears the conversion script stops, the player moves to a permanent do-not-call list, the incident is logged, and it appears in your weekly compliance report.
Players who decline the call but stay active on the platform can receive messaging-only follow-up, tracked as a separate segment.
Nothing is kept longer than the campaign needs
Call recordings
Campaign data
Deletion on request
Data-subject requests
Deleted after the campaign on the agreed schedule.
Used only for the agreed campaign. Not retained for any other purpose.
As controller you can require deletion of the transferred segment at any time.
Routed through you as controller. Bswan acts on your documented instruction.
Retention detail: Privacy Policy §8 — Data Retention.
You hear about a data event within four hours
1
Detection
The event is identified in the campaign pipeline.
2
Containment
The affected campaign is paused.
3
Notification
Your named contact is notified within 4 hours.
4
Written record
The incident is documented and appears in your weekly compliance report.
MARKETS AND REGULATORS
Configured per market before anything goes live
Bswan runs campaigns for operators licensed by the UKGC, MGA, Spelinspektionen, KSA, ADM, and GGL.
Sender ID, caller ID, consent, and tracking requirements are configured per GEO.
Compliance rules are configured during onboarding, before anything goes live.
Offer messaging is aligned with ASA and MGA guidelines.
You hear about a data event within four hours
1
NDA
Signed during onboarding.
2
Security review
Security pack shared. Independent audit available on request.
3
DPA
Signed before the first data transfer.
4
Compliance configuration
Consent, suppression, sender ID and caller ID set per market.
5
Launch
A standard campaign goes live within 72 hours after the segment, offer, data format, and compliance requirements are confirmed.
Registry and consent compliance stays on the operator side: you prepare and filter the segment, verify self-exclusion registries, and confirm consent before transfer. Bswan handles compliance inside the campaign — market configuration, real-time responsible-gambling detection on calls, suppression, logging, and reporting. The split is documented in the DPA before the first transfer.
Are you a controller or a processor?
You are the data controller. Bswan acts as the data processor and processes the transferred segment only on your documented instructions, only for the agreed campaign.
How does Bswan protect our player data?
Data is encrypted from the moment of upload and stays encrypted through the campaign pipeline, so no raw player data is exposed at any point. Phone numbers are encrypted by default and you choose which additional fields are encrypted. Processing runs on EU infrastructure under GDPR, and data is never shared or reused across clients.
Can we choose which fields are encrypted?
Yes. Phone numbers are encrypted by default, and you select which other uploaded fields are encrypted before the transfer.
What happens when a player shows signs of problem gambling on the call?
The AI detects the signal in real time and stops the conversion script. The player is added to a permanent do-not-call list, the incident is logged, and it appears in your weekly compliance report.
How long are call recordings kept?
Recordings are deleted after the campaign on the schedule agreed with you before launch.
What if our platform restricts database exports?
Bswan can connect through an API for automated segment sync, or work with your team on controlled batch upload in a format your platform permits.
Can Bswan run inside our own infrastructure?
Yes. Enterprise operators can use a private deployment where campaign infrastructure runs in their own environment, giving full control over data and hosting.
Managed conversion infrastructure — AI voice & messaging for user activation, retention, and reactivation.
