Privacy Policy
Spinchester Casino operates under a licence issued by the Curaçao Gaming Control Board. This policy explains what personal data we collect, why we collect it, and what you can do about it. Read it before you register. Gambling with an offshore operator carries a specific data footprint, and you should understand that footprint before it is created.
What personal data we collect
We ask for full name, date of birth, residential address, email address, telephone number, and a chosen username. We collect financial information tied to your deposits and withdrawals: card numbers in tokenised form, e-wallet identifiers, cryptocurrency wallet addresses, and bank details where relevant. During identity verification we retain scans or photographs of government-issued documents, proof of address, and, where required, source-of-funds evidence. Every session generates technical data: IP address, device identifiers, browser fingerprint, geolocation at country level, session timestamps, and pages visited. Every wager, deposit, withdrawal, bonus claim, and support conversation is logged in full. That is the scope. Nothing informal about it.
Why we hold this data
The legal basis is contract performance for anything tied to running your account. Anti-money-laundering and licensing obligations under Curaçao regulation give us a separate legal basis for identity checks, source-of-funds review, and record retention. Legitimate interest covers fraud prevention, platform security, and internal analytics. Consent covers marketing communications and non-essential cookies, and consent is withdrawable at any point without affecting the account itself. We do not sell personal data. We do not rent it.
Sharing your data
Payment processors receive what they need to move money. Identity verification providers receive what they need to confirm you are who you say you are. Game suppliers receive session data so that games render and results settle correctly. Regulators receive whatever they demand under lawful order, and the Curaçao Gaming Control Board is one of them. Law enforcement agencies receive data on lawful request. Cloud infrastructure providers process data on our instructions under written contracts. That is the full disclosure list. Any other transfer would be a breach on our part, not a footnote.
Where your data goes
Servers sit inside and outside the European Economic Area. Some processors operate from jurisdictions that do not offer equivalent protection to UK GDPR standards. We rely on Standard Contractual Clauses and, where relevant, supplementary technical measures such as encryption in transit and at rest. This is worth stating plainly: an operator licensed in Curaçao is not bound by UK GDPR in the same way a UK-licensed operator would be. We aim to apply the same standards regardless.
How long we keep it
Account data stays live for the duration of the account. After closure we retain financial records, identity documents, and gambling activity logs for a minimum of five years to satisfy anti-money-laundering requirements. Marketing preferences and consent logs are kept for the duration necessary to prove compliance. Support conversations are retained for two years. Once retention periods expire, data is deleted or anonymised.
Your rights
You can request access to the personal data we hold on you. You can ask us to correct inaccuracies. You can ask for erasure, subject to the retention obligations described above, which override deletion requests for regulated records. You can object to processing that relies on legitimate interest. You can withdraw marketing consent from within your account or by writing to us. You can lodge a complaint with the data protection authority in your jurisdiction of residence. Requests are handled within thirty days.
Security
We use TLS encryption on every connection, tokenisation of card data, segregation of duties for staff with data access, and mandatory two-factor authentication for internal administrative systems. No system is unbreachable. If a breach occurs and it poses risk to you, we will notify you and the relevant authority in line with regulatory timelines.
Changes to this policy
We update this policy when the law changes or our processing changes. Substantial changes are communicated through the account. Continued use after notification counts as acknowledgement.