Privacy Policy

Doveshield makes software and terminals for betting shops and other venues. This policy says what we keep about people, from this website and from our products, SentinelGate, SentinelPay and SentinelKiosk: what it is, why we keep it, for how long, and who else sees it. We do not sell personal data, and we do not use it for marketing or advertising.

Who we are

Dove Shield Tech Limited, 511 Blackhorse Avenue, Cabra, Dublin 7, Ireland, D07X9T3, is the data controller for everything this policy describes, except where it says a bookmaker or a venue is: we decide why and how it is used. Email mark.finlay@doveshield.com with any question. Our data protection officer can be reached at dpo@doveshield.com.

If you bet with a bookmaker that uses our platform

Some bookmakers run their websites and shops on a betting platform we build and look after for them. Your account, your bets and the checks on your identity are that bookmaker's: it is the controller, and we handle them only on its instructions. Its own privacy policy, on its website, says what it keeps and how to reach its data protection officer. Ask the bookmaker first; we will help it answer you.

Visitors to this website

What we keep: Our servers note your internet (IP) address and the page you asked for, each time you load one. The cookies we set are listed in our cookie policy.
Why: To keep the site secure and working, which is in our legitimate interest (Article 6(1)(f) GDPR).
How long: 30 days, then deleted.

If you email us, we keep your message and address for as long as we need them to answer you, and any longer only where the law asks us to keep business records.

People with an account on this website

Accounts are for the staff of businesses that use our products. An account is made for you by us or by a colleague; there is no public sign-up.

What we keep: Your email address, your password in a form that cannot be turned back into it, which business you belong to and who invited you. When you do something that touches other people's data, such as holding an alert, issuing a release code or switching a gate's inspection mode on, we record that you did it, when, and the reason you gave.
Why: To provide the service your business uses, and to be able to show who did what with sensitive data. Both are in our legitimate interest and your business's (Article 6(1)(f) GDPR).
How long: Your account lasts until you or your business asks us to close it. The record of what you did is kept for 1 year, then deleted. If you tick "Keep me signed in", a cookie keeps you signed in for 2 weeks.

People at a venue that uses SentinelGate

SentinelGate is a camera at a betting terminal or entrance that does two things: it estimates whether someone looks old enough that staff need not check their ID, and it recognises people who have asked the venue to keep them out (self-exclusion). It sees everyone in front of it, children included.

On the terminal, at the venue

The camera's pictures are looked at and forgotten, picture by picture. No video is recorded.
A face that raises nothing is forgotten as soon as the person leaves the camera's view.
When staff are asked to check someone's ID because of their apparent age, the terminal keeps the time, the camera and an age band, such as "under 25", for 24 hours. It keeps no picture and never the age it estimated.
When someone is recognised as self-excluded, the terminal keeps a small picture of their face, the time and how close the match was, for 24 hours unless the venue sets otherwise, so staff can check it.

The terminal also records what staff do, such as enrolling someone or deciding an alert, with their staff number, for a year. Its program logs are kept for 30 days.

If you ask to be self-excluded

Staff at the venue take three to five pictures of your face. The terminal keeps only the numbers that describe your face, never the pictures, with a reference to your self-exclusion form (not your name), the dates it starts and ends, and which member of staff enrolled you. They are kept until your self-exclusion ends, a year by default, and then deleted. Copies made when the terminal is updated are kept for 30 days by default, and your face is removed from them within six hours of being deleted.

The same applies if, after showing your ID, you agree to be remembered so you are not asked again (an age pass), with a reference to your agreement. You can withdraw it at the venue at any time.

What a terminal sends to us

Alerts: Where the venue has set it up to, the terminal tells us each time staff need to check someone: which kind of alert, when, which camera, and either the age band or how close the match was. Where the venue has switched it on, the alert includes a small picture of the face, and a self-exclusion alert can include the reference of the self-exclusion. We keep alerts for 24 hours, encrypted with a key we destroy once they are deleted. Venue staff can keep one self-exclusion alert longer, for at most 30 days, by giving a reason, and the reason and their name are recorded.
Encounter reports: Where the venue has switched them on, the terminal sends the numbers that describe the face of each person it saw, whether or not anything was raised. We check them and discard them as they arrive, keeping only when, which camera and what the terminal decided, for 24 hours. While a gate is in inspection mode, which a named member of staff switches on for at most 24 hours, we keep the whole report, encrypted, for 24 hours, to find faults.
Release codes: When a code is typed in to unlock a terminal, the terminal asks us whether it is good. We keep a record of the question, without the code, for 24 hours.

Staff at the venue see alerts on this website, and the venue can have us post a short message to its own Slack: the kind of alert, the terminal, the camera and the time, with no picture and no name. The venue keeps those messages under its own rules.

A terminal can be set to lock its screen when it raises an alert, until staff have checked the customer's ID or the customer has left. The lock is automatic, but it is short and decides nothing about you: staff check your ID in person and serve you as usual. Whether that counts as a decision with legal or similarly significant effects under Article 22 GDPR is a question the venue is putting to the Data Protection Commission with its impact assessment. Whatever the answer, you have the safeguards that article gives: a person, not the terminal, decides what happens; you can put your side to staff on the spot; and you can contest the outcome by writing to us or to the venue's data protection officer.

Why, and on what legal basis

Recognising people who have asked to be self-excluded, and estimating age, keep them and under-18s from gambling, as the Gambling Regulation Act 2024 requires (Article 6(1)(c) GDPR). A face is biometric data, so for this we rely on substantial public interest (Article 9(2)(g)) in that duty. Irish law has not yet named this processing in regulations, so the venue is putting the question to the Data Protection Commission with its impact assessment, and we will change this notice if the answer requires it. We treat estimating age the same way, although it identifies nobody.
Enrolling you for self-exclusion, or for an age pass, relies on your explicit consent (Article 9(2)(a)).
Encounter reports and inspection mode check that terminals do this correctly, and rely on the same basis.

If you ask for an age-check code on your phone

Scanning the QR code on a terminal opens a page where you can ask staff for a code. Staff check your ID, or, where the venue offers it, you can choose to check it on your phone. A venue that offers the phone check may also share a link to the same page, so you can ask before you visit; there the check on your phone is the only way to a code, since staff do not see you. A member of the venue's staff always decides whether to send the code. For these codes the venue is the data controller and we act on its instructions. The page has its own notice, which says the same as this section, in short.

What we keep: Your first name and mobile number, so staff can find you, and the code once it is sent, all encrypted. Your first name and the terminal are posted to the venue's staff Slack.
How long: Until your request ends: 30 minutes if no code is sent (a week, if you asked from a link before your visit), or a day after the code stops working, which is a week after it is sent, or later if the venue's staff extend it. That day lets you ask, from the same phone, for the code to be extended, and the venue's staff are told as before. Then they are deleted within the hour.

If you check your ID on your phone

Instead of showing your ID to staff, you can take a photo of it and a selfie on your own phone. Sumsub, which checks IDs for us, checks that the ID is genuine, that a real person is in front of the camera, and that the face matches the photo on the ID. Comparing faces uses biometric data, so the page asks for your explicit consent before anything is sent to Sumsub. You do not have to agree: staff check your ID instead, and saying no changes nothing else.

What Sumsub collects: Photos of your ID; live photos of your face; a scan of your face's shape made from them, to compare with the photo on the ID; the details printed on the ID, such as your name, date of birth, nationality, the document's number and its expiry date; and your phone's internet address and the kind of phone and browser it is, which Sumsub uses to spot false documents and people pretending to be someone else.
What we keep: Whether the check passed, and the name and date of birth on your ID, with your request, encrypted. Never the photos. Staff see them on our website to decide whether to send your code; nothing from your ID is posted to Slack. We also keep a record that you consented, with the version of the wording you agreed to and when, Sumsub's reference for your check, a scrambled fingerprint of your mobile number, which cannot be turned back into it but lets us find your check if you ask us to delete it, and when each step happened (you consented, sent your ID, Sumsub answered) and which code you were sent, which staff see with the code. No name.
Why: The venue must keep under-18s from betting (Gambling Regulation Act 2024), which the law requires of it (Article 6(1)(c) GDPR). Comparing your selfie with your ID relies on your explicit consent (Article 9(2)(a)).
How long: The result, name and date of birth go with your request, when it ends. Sumsub keeps the photos, the face scan and the details from your ID for 30 days, in case the check is questioned or the document turns out to be false, and then we have them deleted. The record of your consent, the fingerprint of your mobile and the steps of the check go when they do; which code you were sent goes sooner, with the code, a day after it stops working.
Who decides: Sumsub's check is automatic, but it decides nothing about you: a member of the venue's staff looks at the result and decides whether to send the code, and checks your ID in person if it does not pass. That is not a decision based solely on automated processing (Article 22 GDPR).
Your consent: You can stop at any point before you send the photos, and withdraw your consent afterwards by writing to us with the mobile number you gave; we then have Sumsub delete the check at once. Withdrawing does not make unlawful what was done before.

The check runs in a window from Sumsub, inside our page, which may keep what it needs on your phone while the check runs. Our cookie policy says more.

Venue contacts

A venue gives us the name, email address and phone number of the person in charge at each site, and its terminals send them with every message. We keep them, encrypted, while the site uses SentinelGate, so we can reach someone there.

People using a SentinelPay or SentinelKiosk terminal

SentinelPay pays out betting tickets and changes cash. SentinelKiosk takes cash for bets placed on a bookmaker's website shown on the terminal; what you do on that website is the bookmaker's, under its own privacy policy. Neither terminal asks who you are or uses a camera.

What the terminal keeps: The notes and coins put in and paid out, with their times; the number of each ticket scanned or printed, what was printed on it and what was paid; and when staff opened the terminal's admin screens. Staff open them with a PIN or a staff card, whose number is stored on the terminal.
What reaches us: When a SentinelPay terminal checks a ticket with us, we see the ticket's number, amount and printed lines. Terminals also tell us every minute how much cash they hold, which is not about anyone. We are sent a daily total by email, and messages to our own Slack about tickets paid (the ticket number and amount) and faults. When a SentinelKiosk terminal has a fault, the error and the last lines of its log go to our error-reporting service.
Why: To pay out the right amounts, to put mistakes right, and to keep the terminals working and secure, which is in our legitimate interest and the venue's (Article 6(1)(f) GDPR).
How long: Records on the terminal are kept for a year and its logs for 30 days, then deleted.

Our engineers can reach a terminal remotely to fix it, and may then see its screen.

Who else handles personal data for us

These companies handle personal data on our behalf, under contracts that bind them to our instructions:

Amazon Web Services, in Ireland, which hosts this website and sends our terminals' emails.
Google, which runs our email.
Slack, in the United States, which carries our terminals' messages to our staff, and alerts to a venue's own Slack where it asks for them.
Sumsub (Sumsub Tech Ltd), in Cyprus, with data stored in Germany, which checks IDs and selfies when someone asking for an age-check code chooses to check their ID on their phone.
Bugsink, in the Netherlands, which receives SentinelKiosk error reports.
AnyDesk, in Germany, which we use to reach terminals remotely.

Where data goes to the United States, it is protected by the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework where the company is certified under it. We share personal data with anyone else only where the law requires us to, such as with the Gardaí or a regulator.

Your rights

You can ask us what we hold about you and for a copy of it, to correct it, to delete it, to limit how we use it, or to send it to you or someone else in a common format. You can object to our using it in our legitimate interest. Email our data protection officer at dpo@doveshield.com. We answer within a month.

What a SentinelGate terminal sends us is deleted within 24 hours, unless an alert is held, and nothing we keep after that can find your face, except a check of your ID on your phone, which Sumsub keeps for us for 30 days. To end a self-exclusion early or have your enrolment deleted, ask at the venue or write to us.

If you are not happy with our answer, you can complain to the Data Protection Commission in Ireland, at dataprotection.ie.

Changes to this policy

When what we keep changes, we update this page and the date at the top.