Player data and how it is kept

Spinchester Casino handles personal data of players who register on the platform and use its gambling services. This policy explains what we collect, why we hold it, how long it stays with us, and what rights you have as a data subject under UK GDPR and the Data Protection Act 2018.

The main drawback of any online gambling account is the sheer volume of information the operator must retain. Financial records, identity documents, gameplay logs and communications all sit on our systems for years after you stop playing. That is a legal obligation, not a commercial preference, but it is the honest starting point of this policy.

Who controls your data

Spinchester Casino is the data controller for the information you provide through the website and mobile application. Requests concerning your data are handled by our privacy team, reachable at the address listed at the end of this document.

We are not licensed by the UK Gambling Commission. The platform operates without a Gambling Act 2005 licence, which means UK players do not benefit from the statutory protections that a Commission-licensed operator provides. Stating this at the top matters more than any privacy assurance further down.

What we collect

Registration requires a full name, date of birth, residential address, email address, mobile number and a chosen password. During verification we ask for a government-issued identity document, a recent proof of address and, where relevant, evidence of the source of your funds.

Payment activity generates its own record: the method used, the amount, the currency, the timestamp and the counterparty details supplied by the payment provider. Gameplay activity generates another one: sessions opened and closed, games launched, stakes placed, outcomes recorded and bonus balances credited or forfeited.

Every visit to the site adds technical data. IP address, device type, browser fingerprint, operating system, referral URL and cookie identifiers are logged automatically. This happens whether you complete registration or leave after a single page view.

Stated clearly: we do not knowingly collect information from anyone under eighteen. If we discover such an account, we close it and delete the balance.

Why we hold it

Providing the service is the first reason. Without your identity, contact details and payment credentials we cannot open an account, process a deposit or send a withdrawal.

Legal compliance is the second. Anti-money laundering rules under the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017 force us to verify who you are, monitor how you fund the account and report suspicious activity to the National Crime Agency where the thresholds apply.

Fraud prevention is the third. Device fingerprints, IP history and behavioural patterns are checked against known abuse signatures to block bonus abuse, chargeback fraud, account takeover and multi-accounting.

Marketing is the fourth, and it is the only category that runs on your consent. You can withdraw that consent at any time by adjusting your account preferences or emailing the address below. The account itself continues to function whether you accept marketing or not.

Legal bases we rely on

Contract performance covers everything you need for the account to work: registration, deposits, gameplay, withdrawals, support. Legal obligation covers AML checks, tax reporting where applicable and responses to lawful requests from courts or regulators.

Legitimate interest covers fraud prevention, security monitoring and internal analytics that improve platform reliability. Consent covers direct marketing, non-essential cookies and any optional feature that goes beyond core service delivery.

Stated plainly: we do not sell personal data, we do not rent it, and we do not pass it to data brokers for profiling.

Who sees your data

Access inside Spinchester Casino is restricted by role. Compliance officers see verification files. Payments analysts see transaction records. Customer support sees contact history and account notes. Nobody sees the full picture unless a legitimate investigation requires it.

External recipients fall into three groups. Payment processors receive the data needed to complete deposits and withdrawals. Identity verification providers receive documents to confirm who you are. Game suppliers receive an anonymised session identifier so that gameplay is recorded correctly.

Where data leaves the United Kingdom, we rely on the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses. Copies of the safeguards can be requested from the privacy address below.

How long we keep it

Account records are kept for the duration of the relationship and for five years after closure. This is the AML retention period, and it applies whether you leave voluntarily, request closure or are terminated for breach of terms.

Verification documents follow the same five-year rule. Financial records are kept for six years to satisfy tax and accounting law. Marketing preferences are kept until you withdraw consent or the underlying account is deleted, whichever comes first.

The main drawback here is that closing your account does not delete your data. It cannot, because retaining it is a legal requirement. What we can do is stop using it for anything beyond the retention purpose.

Your rights

Under UK GDPR you can ask for a copy of the data we hold, request correction of errors, ask for deletion where retention is not legally required, restrict processing while a dispute is resolved and object to processing based on legitimate interest. You can also withdraw consent for marketing at any time without giving a reason.

Requests are answered within one calendar month. Complex requests may extend to three months, in which case we tell you before the first month runs out. If you are unhappy with the response, the Information Commissioner’s Office is the supervisory authority for the United Kingdom and takes complaints directly at ico.org.uk.

Security

Transport encryption protects data in transit. Storage encryption protects it at rest. Access is logged, reviewed and revoked when staff change roles or leave. Two-factor authentication is available on your account and we recommend enabling it.

No system is impregnable. Stating that honestly is more useful than promising perfect security. If a breach affects your data and creates a real risk to your rights, we notify you and the Information Commissioner’s Office within the seventy-two-hour statutory window.

Changes to this policy

We update this policy when the law changes, when the platform changes or when the way we handle data changes. Material updates are announced through the account interface and by email to registered players. Continued use after an update signals acceptance of the new version.