Privacy policy

1. Controller

The controller is WellPlayed NV, San Victor Street, Orange Walk Town, Belize. For any privacy question or request: support@9to5.bet.

2. Data we process

• Applicants: name, e-mail, country, audience channels, website link and message you send with the application form.
• Affiliates: account data (e-mail, name, password stored as a one-way hash, two-factor settings), the details you declare (legal name, address, company, VAT number, phone), sign-in sessions (IP address, browser), crypto payout addresses (encrypted), commissions, payouts and support messages.
• Players referred by affiliates: pseudonymous identifiers, country, statuses and amounts sent by the brands. DEVOUR never receives players’ names, e-mails or phone numbers.
• Visitors of tracking links: a salted hash of the IP address (never stored in clear), country, device type and referring site.
• Contact form: name, e-mail, company and message.

3. Purposes and legal bases

• Reviewing applications and running the affiliate contract: accounts, tracking, commissions, payouts, support (performance of a contract).
• Security, fraud prevention and traffic quality controls (legitimate interest of DEVOUR and the brands).
• Accounting and tax records of commissions and payouts (legal obligation).
• Service e-mails about your account; no marketing e-mail is sent without your consent.

Fraud alerts are reviewed by a person: no decision with legal or similarly significant effect is taken by automated means alone.

4. Recipients

Data is accessible to DEVOUR staff on a need-to-know basis (each role sees only what it needs, every sensitive action is logged). Brands receive your affiliate ID with the players you refer, never your identity. Technical providers process data on our behalf: hosting, database and e-mail delivery. We do not sell personal data.

5. Retention

• Tracking data: the IP hash and referring site of each click are erased after 13 months; aggregated counts are kept.
• Rejected applications and contact requests: anonymized after 12 months.
• Affiliate accounts: for the duration of the relationship. On deletion, identity and contact details are erased.
• Commissions, payouts and the accounting ledger: kept without identity for the period required by accounting law.
• Security logs (audit trail): kept for security and legal defence.

6. Security

Passwords are hashed (Argon2id), two-factor authentication is available to affiliates and mandatory for staff, payout addresses and secrets are encrypted, IP addresses in tracking are hashed, and all traffic is encrypted in transit (HTTPS).

7. Your rights

You can access, correct, export, restrict or object to the processing of your data, and ask for its erasure. Affiliates can download all their data and ask for the deletion of their account directly from Settings → Your data; requests are answered within one month. Anyone else can write to support@9to5.bet. You can also lodge a complaint with your data protection authority.

8. Cookies

The platform uses only strictly necessary cookies: the session cookie that keeps you signed in. Tracking links record the click server-side and do not set advertising cookies.

9. Changes

When this policy changes, the version number above changes and affiliates are informed by e-mail or in their space.