How did a betting company get your phone number?

Most often you supplied it: at registration, or through a mobile money payment linked to an account. A number can also reach a company by other routes, and any use of it must follow the Data Protection Act. You can ask the company for the source and object to marketing.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-11-05

The short answer

A betting company usually holds your number because you gave it, or because a payment tied to an account carried it. Other routes exist, and from the outside you cannot always tell which one applies. The practical step is to ask the company in writing where it got the number and what it uses it for.

This guide separates the routes that the rules clearly describe from those they do not. It does not say that any named operator did anything wrong. For the wider vocabulary, see the guide to personal data terms for gambling accounts, where you are the data subject and the operator is the data controller.

Routes by which a company may hold a number

What the rules say about use of the number

Holding a number and using it for marketing are different acts. Regulation 96 of the Conduct of Gambling Operations Regulations, 2026, says the collection and processing of data during gambling operations shall comply with the Data Protection Act (96(1)). A licensee may collect and process data only for purposes directly related to the administration of the gambling operation (96(2)). Personal data collected shall not be used for any form of marketing without the prior consent of the participant (96(3)).

The Gambling Control Act adds that the control system an online operator must provide for includes data protection measures under the Data Protection Act (section 68(2)(h)). So an operator is expected to be able to explain what it holds, why, and on what basis.

The Office of the Data Protection Commissioner lists these rights for a data subject: to be informed of the use to which personal data is to be put, to access personal data held by a controller, to object to the processing of all or part of it, and to correction and deletion of false or misleading data. The Act and the General Regulations are listed on the ODPC page on data protection laws, but the direct PDF links on that page did not open when checked for this guide, so section numbers beyond those named here are not given.

These points matter when you read a reply. A company that says "you gave consent" should be able to say when and how. A company that says the number came from a third party should name that party, so you can send your objection there as well. A reply that avoids both questions is itself something to keep for a complaint.

Steps to find out how your number was obtained

1. Note what arrived: the sender name or short code, the date and time, and whether it names an account. Keep screenshots.
2. Decide whether the text is genuine. If it asks for a PIN, a code or a link click, treat it as a scam and read the guide on recognising betting phishing SMS.
3. Check your own history: old registrations, a line you share with family, and past mobile money payments to betting paybills.
4. If the sender is a licensed operator, write to the contact for data matters in its terms. Ask what data it holds, the source of your number, the purpose and any third parties.
5. Object to marketing in the same message. The steps and wording are in the guide on stopping betting marketing SMS.
6. Ask for a copy of your data using the guide on requesting a copy of your data.

Illustrative example: a person receives a promotional text on the 3rd and writes to the company the same day. The company replies on the 9th that the number came from a registration made two years earlier. The person then checks the account, finds the registration was theirs, and objects to marketing. If the registration was not theirs, the same reply is useful evidence for a complaint.

If the company will not explain or keeps messaging

A data subject may complain to the Office of the Data Protection Commissioner under section 56 of the Data Protection Act. The ODPC page says to use the online form at cie.odpc.go.ke, attach evidence, and include an authorisation letter if filing for someone else. The office also lists the phone number 0207801800, open Monday to Friday, 8:00 AM to 5:00 PM. The full process is in the guide on reporting betting data misuse to the ODPC.

What this guide could not verify

The Communications Authority of Kenya site was opened to look for an official unsolicited-SMS or short-code opt-out route. The pages reached listed complaint channels but gave no opt-out procedure, so none is described. Check your mobile network's official site for what it offers. Gambling is addictive: gamble responsibly, and only if you are 18 or over.