Your privacy at Spinshark Casino
This policy sets out what personal data we collect when you play at Spinshark Casino, why we hold it, who receives it and how you can exercise control over it. It applies to every visit to our website and every account you hold with us.
Data we collect
Categories of personal data
We collect only the data we need to run your account, meet our legal obligations and keep the site safe. The categories below cover everything we hold.
- Identity data: your name, date of birth, email address, phone number and residential address.
- Verification documents: photo ID, proof of address and proof of payment method, required before your first withdrawal.
- Transaction data: deposits, withdrawals, bets placed, winnings and payment method details.
- Technical data: IP address, device type, browser, operating system and session logs.
- Gameplay behaviour: games played, session duration, stakes, win and loss history.
- Marketing preferences: which channels you opted into and which messages you open or ignore.
How we use your data
Purposes of processing
Each purpose below is tied to a specific processing activity, not a catch-all. If we want to use your data for a new purpose, we tell you first and, where consent is required, we ask for it separately.
- Creating and administering your player account.
- Verifying your identity, age and source of funds under our KYC obligations.
- Processing deposits and withdrawals through your chosen payment method.
- Preventing fraud, bonus abuse, money laundering and multiple-account activity.
- Monitoring play for responsible-gambling indicators such as sustained losses or extended sessions.
- Sending promotional offers where you have consented, and honouring your opt-outs.
- Meeting legal and regulatory obligations, including tax reporting and licence conditions.
Our legal bases
Contract
We process identity, account and transaction data to perform the contract you enter with us when you register. Without this data we cannot open an account, process your payments or pay out winnings. Contract is also the basis for handling disputes about bets or bonuses.
Legal obligation
Anti-money-laundering and know-your-customer rules under our Curaçao Gaming Control Board licence oblige us to verify your identity, monitor transactions and retain records for a statutory minimum. Withdrawals cannot be released until verification is complete, and we cannot suspend these checks even at your request.
Legitimate interest
We rely on legitimate interest for fraud prevention, site security, aggregate analytics and improving our games and services. We weigh our interest against the impact on you and limit processing to what is necessary, for example flagging accounts that share a device or IP address with previously blocked players.
Consent
Marketing emails, SMS and personalised offers run only on your consent, given at opt-in and recorded with a timestamp. You can withdraw consent at any time by changing your communication settings or using the unsubscribe link in every message we send. Withdrawal never affects the lawfulness of messages sent before it.
How long we keep data
Retention by category
We hold each category only as long as the purpose requires or the law demands. After that, data is deleted or anonymised so it can no longer be linked to you.
| Data category | Retention period |
|---|---|
| Identity and account data | Life of the account plus 5 years |
| KYC verification documents | 5 years after account closure |
| Transaction and betting records | Minimum 5 years, as required for AML purposes |
| Technical and IP logs | 12 months |
| Gameplay behaviour data | 24 months, unless needed for responsible-gambling review |
| Marketing preferences | Until you withdraw consent or ask for deletion |
Closed accounts
When you close your account, marketing stops immediately. Transaction records stay in our systems for the statutory retention window in a restricted archive that only our compliance team can access, then they are destroyed.
Who we share data with
Categories of recipients
We never sell your data. We share it only with processors and authorities who need it for a defined purpose, under contracts that bind them to confidentiality and security standards at least equal to ours.
- Payment processors handling your deposits and withdrawals.
- KYC and AML verification providers checking your documents.
- Game and platform providers delivering the games you play.
- Regulators and law-enforcement bodies where legally compelled.
- Analytics providers helping us measure site performance in aggregate.
- Professional advisers such as auditors and lawyers, strictly on a need-to-know basis.
Your rights over data
What you can ask of us
You exercise every right below free of charge by emailing our data protection officer at [email protected]. We respond within one month and extend that by two months only for complex requests, in which case we tell you why within the first month.
- Access: a copy of the personal data we hold about you.
- Rectification: correction of inaccurate or incomplete records.
- Erasure: deletion where no legal retention duty applies.
- Portability: your data in a machine-readable format.
- Objection: objection to processing based on legitimate interest.
- Withdrawal of consent: opt out of marketing at any time.
- Complaint: you may complain to the Information Commissioner's Office at ico.org.uk.
Limits on erasure
Anti-money-laundering law overrides erasure for transaction and verification records, so a deletion request cannot remove data we are legally required to keep. Everything outside that scope goes, and we tell you exactly what was retained and why.
Cookies and tracking
Our site uses cookies to keep you logged in, remember your preferences, measure traffic and, with your consent, support marketing. You control which categories are active through the consent banner shown on your first visit, and you can change your choices at any time. Full details, including a category-by-category breakdown and how to block cookies in your browser, are set out in our dedicated Cookies Policy page.
How we protect data
Technical and organisational safeguards
All traffic between your device and our servers runs over TLS encryption, and stored verification documents sit in encrypted, access-controlled storage. Staff access follows role-based permissions, meaning a support agent sees your account details but never your ID documents. We log every access to sensitive records, review those logs routinely and train our team on data-handling rules annually.
If a breach happens
If a breach risks your rights, we notify the Information Commissioner's Office within 72 hours of becoming aware and tell affected players directly without undue delay. You would receive what happened, what data was involved and what we are doing about it.
Frequently Asked Questions
How do I request a copy of my data?
Email [email protected] from your registered address with the subject line 'Data Access Request'. We send your data in a machine-readable format within one month.
Can I stop marketing messages but keep my account?
Yes. Change your communication settings in your account profile or click unsubscribe in any email. Marketing stops immediately; your account and gameplay are unaffected.
Why can't you delete my KYC documents straight away?
Anti-money-laundering law requires us to keep verification records for at least five years after account closure. We hold them in a restricted archive and destroy them once the retention window ends.
Do you share my data with game providers?
Game providers receive only the data needed to deliver the session you play, such as your account ID and gameplay activity. They process it under contract and cannot use it for their own marketing.