1. Our commitment
Boadman is committed to protecting the confidentiality, integrity, and availability of the information we hold on behalf of players, spectators, and brand partners. This policy summarises how we do that. It is a public summary of our internal Information Security Policy, not the full internal document.
2. What this covers
This policy applies to all personal, financial, and platform data processed through Boadman's website, apps, and supporting infrastructure. For details on what data we collect and why, see our Privacy Policy.
3. How we protect data
- Encryption of data at rest and in transit across our infrastructure.
- Access control on a least-privilege basis — access to sensitive data is limited to named roles, logged, and reviewed regularly. Multi-factor authentication is required for all administrative and production access.
- Identity verification proportionate to risk, with fuller checks required before higher-value account activity.
- Vulnerability management, including regular security testing and a risk-based remediation programme.
- Secure development practices, including code review and automated testing before any change reaches production.
4. Our third-party providers
We work with a defined set of infrastructure, payments, and identity-verification providers, each bound by a data-processing agreement and assessed for security posture before onboarding. We share only the minimum data necessary for each provider to do its job. See our Privacy Policy for the full list.
5. Incident response
If a security incident occurs that is likely to affect your data, we will investigate promptly, take steps to contain it, and notify affected users and the relevant regulator where legally required — including notifying the UK Information Commissioner's Office within the timeframe required by law.
6. Reporting a vulnerability
If you believe you've found a security issue, please tell us before telling anyone else.
Email: [email protected]
Please provide enough detail for us to reproduce the issue, and avoid accessing, modifying, or extracting data beyond what's needed to demonstrate it. We will acknowledge your report and keep you updated as we investigate.
7. Questions
For any question about this policy, contact [email protected] or our Data Protection Officer at [email protected].
This policy describes our security practices in general terms. It does not disclose specific technical details that could assist an attacker. Our internal Information Security Policy, which this summarises, is reviewed at least annually.