Introduction
Yaspa is building on its open-banking payments software to develop an AI-based platform that ensures players can make quick and easy deposits while real-time data analysis and modelling identifies those at risk. Working with academic experts in the Safer Gambling and AI fields, Yaspa will deliver a world-class level of analysis to this data that will meet operator needs and exceed regulatory requirements, while providing a secure, frictionless and risk-based experience that will transform the gambling industry's ability to identify and help vulnerable players. This project has been part funded by the UK Government's Innovate UK Department (find out more about the project submission here).
As part of the data analysis for this project, Yaspa will process your data (bank transaction data and special category data inc Problem Gambling Severity Index (PGSI) data). A PGSI is a nine-question instrument to measure gambling harm. This will enable our machine learning model to predict individuals' risk levels, helping gambling operators identify individuals whose gambling behaviour may put them at risk of harm.
Using our academic research, Yaspa will match our financial risk assessment (based on bank transaction data) with the PGSI instrument. This will enable Yaspa to model and assess the extent to which there is a relationship between bank transaction data and PGSI instruments, which can help identify individuals whose gambling behaviour may put them at risk of harm.
Yaspa will collaborate with the Behavioural Insights Team (BIT), a social purpose consultancy, which will collect and share with us research participants' PGSI data.
In addition to our project, BIT is carrying out its own research project which aims to evaluate an approach to communicating spending behaviour to consumers, specifically regarding their gambling behaviour.
The BIT privacy notice can be found here.
What personal data will be collected?
Yaspa will collect directly from you the following personal data:
- Bank transaction data (Bank Account Name, Transaction Data, Account Sort Code, Account Number and Account Balance) - obtained through Open Banking Limited Standards, which is regulated by the Financial Conduct Authority.
All of the data collected as part of this project will be on a pseudonymised basis as set out below. This means that while we know the personal data relates to an individual, we do not know who this individual is.
As part of our collaboration with the BIT team, we will also receive a unique Customer ID, which will be used to link the banking data with the PGSI (a nine-question instrument to measure gambling harm).
Lawful basis for collecting this data: Legitimate interests (Article 6(1)(f)):
We process certain personal data on the basis of our legitimate interests, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
As part of this project, Yaspa will collect bank transaction data and process special categories of personal data, pertaining to the PGSI. In addition to the legal basis mentioned above, data protection law requires us to meet additional conditions for processing this type of personal data. The additional conditions for this project are:
Research purposes
Yaspa will process your special category personal data on the grounds that such processing is necessary for scientific or statistical research purposes. When relying on this basis, we ensure that appropriate safeguards are in place, including minimizing the use of personal data, pseudonymizing the data where possible, and ensuring the research does not cause substantial harm or distress. Furthermore, the research will not be used to make specific decisions or take actions that directly impact you.
Commercial purposes
Yaspa will refine and enhance our machine learning model, mentioned in the ‘Introduction’, using data collected from this project we will productise a secure, frictionless and risk-based experience that will transform the gambling industry's ability to identify and help vulnerable players. No data collected as part of this project will be shared with gambling companies; the data will only be used to refine our machine learning model.
1. Intended use of bank transactions and PGSI data
Data is processed and used for the sole purpose of assessing and categorising people whose gambling behaviour may put them at risk of harm.
2. Data storage and retention
Bank transaction and PGSI data will be stored securely in encrypted cloud storage and sensitive or personal PGSI data will be encrypted additionally. Access to this data will be strictly limited to authorised personnel only.
Where we process information about you and the transactions carried out through our services, we process this for six years. This data will be stored in AWS eu-west-1 - Ireland.
3. Security measures
We employ robust security measures, including encryption, access controls, and regular audits, to protect data from unauthorised access, alteration, or loss.
4. Participants’ individual rights:
You have certain rights in relation to the processing of your Personal Data, including the:
Right to be informed
You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it.
Right of access (commonly known as a 'Subject Access Request')
You have the right to receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
Right to restrict processing
You have the right to restrict our use of your Personal Data.
Right to portability
You have the right to ask us to transfer our Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Right to lodge a complaint
You have the right to lodge a complaint with the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at:
Contact us | ICO
0303 123 1113
5. How to contact us
If you wish to contact us in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows:
Yaspa Limited, 1 St Katharine's Way, London, E1W 1UN
dpo@yaspa.com
We have also appointed a Data Protection Officer (‘DPO’). Our DPO, Evalian Limited, can be contacted as follows:
Unit 5 West Lodge Nobs Crook, Colden Common, Winchester, England, SO21 1TH
dpo@evalian.co.uk
03330 500111
Please mark your communications FAO the ‘Data Protection Officer’. You can view Yaspa’s Privacy Notice for consumers here.