Privacy Policy at WinSpirit Casino
An account at a casino holds more sensitive material than most online profiles: identity documents, payment records, a residential address and a full history of transactions. The WinSpirit privacy policy governs that material as an internal part of the Terms and Conditions, and it runs under three layers of law at once - the GDPR, the Canadian Personal Information Protection and Electronic Documents Act, and the data-protection regulations applicable to the operator in Curaçao. This page restates the policy in plain language: what is collected, for which purposes, which cookies run in the background, who else can see the data, how it is secured and what a player may demand at any moment.
The operator appears in the policy as the controller and the player as the data subject, and the roles matter: the controller decides purposes and means, the subject holds the rights. Registration admits nobody under 18, and the policy applies to the website and its services as a single system.
What the platform collects
The collection list is broad but bounded, and every item on it has a functional purpose:
- Account data - e-mail address, nickname, date of birth, sex, postal address, phone number.
- Technical data - location and time zone, site language settings, browser and IP address, referring website.
- Activity data - history of gaming activity, behaviour across games, tournaments and lotteries, support requests.
- Financial data - transaction history, documents confirming payments made by the client.
Two absences matter as much as the list itself. Credit card details are not stored, and sensitive categories - racial or ethnic origin, political opinions, religion, biometric or health data - are prohibited from processing. Automated decision-making and profiling are not used, which removes a whole class of hidden data processing from the platform.
Why the data is processed
The purposes are enumerated, and none of them is decorative: KYC identity verification, account maintenance and service improvement, security authentication, marketing communications by email, SMS or telephone, answering questions, compliance with legal obligations, action against suspected unlawful activity, defence of legal claims, the affiliate programme, market research and statistical analysis of aggregated data. Newsletter subscriptions run through a double opt-in with a confirmation email, and the registration stores the subscriber's IP address and the date and time of sign-up solely for the newsletter itself.
Retention follows purpose: personal data is stored only as long as the purpose requires, and once the purpose lapses the data is routinely blocked or erased. Marketing consent can be withdrawn, and account administration messages are sent regardless of marketing opt-out status, which is a distinction worth remembering when pruning a mailbox.
Cookies and third parties
Three cookie families run on the site, and their jobs are distinct:
| Cookie type | What it does |
|---|---|
| Required | Enable navigation and basic functionality, protect form input across page refreshes, keep member areas accessible |
| Functional | Remember session keys, language and region so settings survive between visits |
| Advertising | Measure content marketing effectiveness, track site visits and registrations from advertising |
Advertising cookies share visit data with partners but not names or email addresses, and third-party service providers set additional cookies for services they deliver. Browsers accept cookies automatically; blocking or deleting them is possible but the policy warns it may restrict use of the site.
Disclosure rules sit beside the cookies: personal data is not sold or rented. It may reach affiliated companies and vetted non-affiliated parties - service providers under non-disclosure agreements, fraud-verification services, legal and regulatory authorities - and processing may occur outside the EEA, with the operator taking reasonable steps to keep that processing consistent with the policy. Aggregated or de-identified data may be shared freely, since it cannot reasonably identify anyone.
Security and the 72-hour rule
The security section is concrete. Data in transit is protected by TLS 1.2 transport encryption with AES 256-bit encryption at the application layer, undefined third parties receive nothing, and everyone who does handle data for the platform - game providers, payment services, affiliates - works under a non-disclosure agreement covering the processing. Secrecy of the username and password stays the holder's own responsibility.
The most specific promise in the policy is the breach notice: if personal data leaks or a security system breaks down, the operator informs the supervisory data-protection body and the affected data subjects as soon as possible, and in any case within 72 hours of discovery. That commitment is measured in hours, not weeks, and it is the clause that turns a security policy into an obligation.
Rights of the data subject
Seven rights run under the applicable law, and the policy is written to uphold them:
- To be informed about the collection and use of personal data.
- To access the personal data held about the holder.
- To rectify inaccurate or incomplete data.
- To be forgotten - erasure on request, within the limits of legal retention duties such as anti-money-laundering legislation.
- To restrict processing and to object, including to marketing use.
- To data portability - a copy of the data to reuse elsewhere, free of charge unless a request is manifestly unfounded or excessive.
- To rights around automated decision-making and profiling.
A right to complain to a supervisory authority sits above the list, and questions about the policy or a data request go to the support email published on the site. A clear query speeds every one of these rights up, particularly where the request concerns what data is actually held.
Three questions about the policy
Does the casino keep my card number?
No. Credit card details are not stored, with exceptions only where law compels disclosure, consent was given for a specific use, or the account was caught in fraud or money laundering.
What happens if my data leaks?
The operator informs the data-protection regulator and every affected data subject within 72 hours of discovery, and works to minimise the consequences of the incident.
Who else can see my personal data?
Vetted parties only: service providers under non-disclosure agreements, fraud-verification services, payment processors, game providers and authorities acting under legal compulsion. Data is never sold or rented, and processing outside the EEA follows the same policy standard.