Our Privacy Policy
This policy explains what personal data we collect at Spintexas Casino, why we collect it, who we share it with and how long we keep it. It applies to every visitor who registers an account, plays our games or contacts our support team on spintexas.com.
The Data We Collect
We collect only the data we need to run your account, meet our licence obligations under the Malta Gaming Authority (MGA/B2C/812/2025) and keep the site secure. The categories below cover everything we hold on you.
- Identity data: full name, date of birth, email address, phone number, residential address and country of residence.
- Verification documents: government-issued ID, proof of address no older than 3 months and proof of payment method, collected during KYC.
- Transaction data: deposits, withdrawals, bonuses, wagering records and payment method details.
- Technical data: IP address, device type, browser, operating system and session timestamps.
- Gameplay behaviour: games played, bet sizes, win/loss history, session duration and risk indicators used for responsible-gambling monitoring.
- Marketing preferences: which channels you opted into, which messages you opened and any opt-out decisions.
How We Use Your Data
Every use of your data maps to a specific purpose, and we do not reuse data collected for one purpose for an unrelated one. Here is the full list.
- Creating and managing your player account and VIP tier.
- Verifying your identity before your first withdrawal, with processing up to 48 hours.
- Processing deposits and withdrawals across Visa Debit, Trustly, PayPal and crypto options.
- Fraud prevention, bonus abuse detection and anti-money-laundering checks.
- Responsible-gambling monitoring, including deposit-limit enforcement and GAMSTOP checks.
- Marketing by email or SMS where you have given consent, and weekly cashback or tournament updates tied to your account.
- Meeting legal and regulatory obligations set by the MGA and applicable tax authorities.
The Legal Bases We Rely On
Contract. We process identity, transaction and gameplay data to deliver the account and gaming services you signed up for. Without this data we cannot operate your account or pay out winnings.
Legal obligation. Licence conditions under the MGA, AML rules and tax law require us to verify your identity, report suspicious activity and retain transaction records for at least 5 years. You cannot opt out of processing required by law.
Legitimate interest. We use device, IP and gameplay data to detect fraud, secure the platform and enforce our bonus terms. This interest never overrides your rights, and you may object to processing based on it.
Consent. Marketing communications and non-essential cookies run only on your consent. You withdraw consent at any time via account settings or the unsubscribe link, and withdrawal costs you nothing.
How Long We Keep It
Retention periods follow legal minimums and practical need, not convenience. Once a period expires we delete or anonymise the data.
| Data category | Retention period | |
|---|---|---|
| Identity and account data | For the life of your account, then 5 years after closure | |
| Verification (KYC) documents | 5 years after account closure | |
| Transaction and wagering records | Minimum 5 years under MGA rules | 5 years after account closure |
| Technical and log data | Up to 12 months | |
| Marketing preferences | Until you withdraw consent or delete your account | |
| Self-exclusion and GAMSTOP records | For the duration of the exclusion plus statutory retention |
Who We Share Data With
We share data only with processors and authorities who need it, under contracts that impose the same protection standards we apply ourselves.
- Payment processors handling your deposits and withdrawals, such as card acquirers, e-wallet providers and crypto gateways.
- KYC and AML verification providers that check your documents and screen transactions.
- The Malta Gaming Authority and other regulators or law-enforcement bodies when legally required.
- Analytics and hosting providers that operate under strict data-processing agreements.
- Game providers, who receive only the pseudonymised data needed to deliver game sessions.
Your Rights Over Your Data
Under the UK GDPR and applicable data-protection law you control your data, and we respond to every request within one month. Send requests to [email protected] from your registered email address.
- Access: get a copy of the personal data we hold on you.
- Rectification: correct inaccurate or incomplete records.
- Erasure: deletion where no legal retention duty applies.
- Portability: receive your data in a machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: stop marketing at any time.
- Complaint: escalate to the Information Commissioner's Office (ICO) or your local data-protection authority.
Cookies and Tracking
We use session cookies to keep you logged in, preference cookies to remember your settings and, with your consent, analytics cookies that show us how the site performs. Full details, including the cookie list and how to change your choices, sit on our dedicated Cookies Policy page.
How We Protect Your Data
All traffic between your device and our servers runs over TLS encryption. Stored verification documents sit in access-controlled storage, and staff see player data only on a need-to-know basis with role-based permissions and audit logs. We test our controls regularly and keep penetration-test records.
If a personal-data breach occurs, we notify the competent supervisory authority within 72 hours and inform you directly where the breach poses a high risk to your rights. Our incident-response team at Spintexas Gaming Ltd rehearses this process, so notification is a matter of procedure, not improvisation.
Contact Our Data Officer
Questions about this policy, a specific processing activity or a data-request status go to [email protected]. We answer within 5 working days. Written enquiries reach us at Spintexas Gaming Ltd, attn. Data Protection Officer, quoting your account ID.
Frequently asked questions
How do I request a copy of my data?
Email [email protected] from your registered address asking for a data-access request. We deliver your records in a machine-readable format within one month.
Can I delete my KYC documents early?
No. MGA licence rules require us to keep verification documents for 5 years after account closure, so we cannot delete them before that period ends.
How do I stop marketing emails?
Use the unsubscribe link in any email, adjust marketing preferences in your account settings or contact support at [email protected]. We stop sending immediately.