Privacy Policy

Who We Are

Spinlander Casino operates as an online gaming service under an eGaming Licence issued by The Autonomous Island of Anjouan, Union of Comoros. The website is owned by a legal entity registered in the Republic of Cyprus at Kasou 18, Office 41, 1086, Nicosia, with gambling services provided by the parent company registered in Hamchako, Mutsamudu, Anjouan. This Privacy Policy explains what personal data we handle when players from Norway, Denmark, Poland, Switzerland, Germany, Canada, New Zealand, and Hungary use the Spinlander Casino website.

Put simply, we act as the data controller for account information, payment records, gameplay logs, and communications tied to your profile.

Personal Data We Collect

We collect identity data during registration: first name, surname, date of birth, nationality, residential address, email, and phone number. Payment providers pass us transaction metadata, card BINs or wallet identifiers, deposit and withdrawal amounts, and timestamps of each operation. Our servers log device fingerprints, IP addresses, browser type, session duration, and gameplay history for every login.

Worth noting: identity documents uploaded during KYC — passports, national IDs, driving licences, utility bills, selfies — reach us through an encrypted channel and stay in a separated verification vault.

Legal Bases for Processing

We rely on contract performance to run your account and process bets. Legal obligation covers anti-money-laundering checks under the Anjouan National Ordinance, Cypriot AML law, and the AML frameworks that apply in each player’s home country. Legitimate interest supports fraud detection, security monitoring, and network protection. Consent applies to marketing emails, push notifications, and non-essential cookies.

Put simply, each processing activity maps to one lawful ground, and we can name that ground on request.

Purposes of Processing

We use personal data to verify your age, confirm your identity, credit deposits, settle bets, pay out winnings, and enforce responsible-gambling limits. Fraud teams review betting patterns, chargeback signals, and multi-account indicators. Support agents read message threads only when a ticket names your account. Marketing teams segment players who opted in for tailored bonus offers.

Worth noting: automated decisions on bonus eligibility and risk scoring run against fixed rules, and every player may request human review of any output that blocks funds.

Data Sharing and Recipients

Payment providers process card, e-wallet, bank, and cryptocurrency transactions on our behalf and receive the data those transfers demand. Wirecard Bank AG handles most card operations for Spinlander Casino. Game studios such as Evolution, Pragmatic Play Live, Bgaming, and Hacksaw receive session tokens that let their servers stream game outcomes to your device. KYC vendors verify identity documents. Regulators, tax authorities, and law-enforcement bodies receive data when a court order or a licence condition demands it. Ramtinar Techconsult Limited coordinates AML oversight for the group.

International Transfers

Player data crosses borders between Cyprus, Anjouan, and the servers of our service providers in the European Economic Area, the United Kingdom, and Canada. EU transfers rely on adequacy decisions where available and Standard Contractual Clauses in every other case. Canadian transfers follow PIPEDA accountability principles, and Quebec residents get the extra safeguards Law 25 demands. New Zealand transfers follow the IPP 12 rules of the Privacy Act 2020. Swiss transfers apply the FADP transfer regime.

Retention Periods

We keep account data for the whole life of your account and for 5 years after closure, because AML law in the Union of Comoros and the European Union both set that period. Marketing consent records live for 3 years past the last interaction. Session logs stay for 12 months, and unverified registration attempts drop after 90 days. Complaint files sit in the archive for 6 years to satisfy Cypriot civil-limitation rules.

Put simply, no dataset stays longer than the law and the licence require.

Your Rights

Every player may request access to their data, ask for corrections, seek erasure within legal limits, restrict processing, object to marketing, and receive a portable export. We answer inside 30 days from a valid request; complex cases may take another 60 days, and we tell you when they do.

Worth noting: erasure requests during an active AML review pause until that review closes, since the licence forbids destroying evidence.

Country-Specific Rights

Norwegian players may complain to Datatilsynet. Danish players may complain to Datatilsynet under the Data Protection Act. Polish players may reach Urząd Ochrony Danych Osobowych. Swiss players fall under the FADP and can contact the Federal Data Protection and Information Commissioner. German players may contact the state supervisory authority for the Land where they live. Canadian players may complain to the Office of the Privacy Commissioner or to a provincial regulator such as the OPC of Quebec, the IPC of Ontario, or the OIPC of Alberta or British Columbia. New Zealand players may reach the Office of the Privacy Commissioner. Hungarian players may complain to Nemzeti Adatvédelmi és Információszabadság Hatóság.

Security Measures

Databases run inside encrypted volumes, transport uses TLS 1.3, and payment card data flows through PCI-DSS-certified processors. Access to identity documents follows the least-privilege model, and each read leaves an audit trail. Penetration tests run twice a year, and vulnerability scans run every 30 days.

Cookies and Tracking

Cookies and similar technologies operate under a separate Cookie Policy that lists categories, third-party recipients, and consent controls. Marketing cookies fire only after opt-in through the consent banner.

Children and Age Verification

Nobody under 18 may hold an account with Spinlander Casino, and every jurisdiction we serve enforces the same minimum. Accounts flagged as underage during KYC face immediate closure, and any deposit returns to the source method after we confirm the sender.

Changes to This Policy

Material updates trigger an in-account notice and a fresh consent screen where consent is the legal basis. Small clarifications reach players through the updated version on the website.

Contact

For any privacy question, write to [email protected]. The Data Protection function coordinates responses across all eight markets.