Privacy and data processing statement for Rolly Spin

Scope of this privacy policy

This privacy policy applies to the online casino service operated by Rolly Spin and explains how we collect, use and process personal data in connection with the provision of gaming services. It covers information collected when you register, fund your account, play games, or communicate with customer support. This document is controlled by the legal entity operating the casino and defines the obligations regarding your data within the jurisdiction of regulation.

We act as the data controller for the personal data we collect through our website and mobile applications. You can reach us at any time to clarify how specific data is processed by contacting our support team. This policy sets out the legal framework under which we process your data in compliance with applicable data protection laws. You should read this document carefully to understand your rights and our obligations regarding your information.

Our services are provided under a licence issued by the relevant gambling commission which sets strict rules on data handling. We maintain records of your activities and financial transactions to comply with these regulatory requirements and prevent fraud. This policy applies to all services provided by Rolly Spin regardless of the device or platform you use to access them.

We may update this policy from time to time to reflect changes in the law or our practices. The current version governs your use of the service and you should check it periodically for updates. If we make material changes we will notify you through the account dashboard or by email. Your continued use of the service after such changes means you accept the updated terms.

Types of personal data collected

We collect several categories of personal data to provide our services and meet legal obligations. These categories include identity and contact details you provide during registration and verification processes. We also collect financial and transaction data to process deposits and withdrawals efficiently for amounts starting at £20. Gameplay records and device information help us maintain account security and prevent fraud across all 1,800 available games.

Some data is provided directly by you during account creation and verification processes. Other data is generated automatically through your use of our services and monitoring systems. This distinction matters because different consent and legal bases apply to each category of information collected. For instance, when you upload a passport scan for verification, you actively provide sensitive personal information requiring explicit permission.

When you place a bet, the system automatically logs your device IP address and browser type without additional interaction. Understanding this difference helps you know which data requires your explicit permission versus what we can use based on legitimate interest. You face a trade-off between convenience and privacy when choosing how much information to provide during registration and gameplay activities.

Legal bases for processing your data

We process your personal data under specific legal bases depending on the activity and purpose defined in this policy. Performance of the contract covers account management and delivery of gaming services you have requested including game access and payment processing.

We process data to comply with legal obligations including anti-money-laundering and responsible gambling duties across all Visa, Mastercard, Sofort, Revolut, Google Pay, Apple Pay, MiFinity, Jeton, Bank Transfer, Bitcoin, Ethereum, USDT, Litecoin, Solana, Dogecoin, Cardano, USDC, Tron, and Ripple and Bank Transfer and Skrill. Legitimate interests apply to fraud prevention and security monitoring where you have not withdrawn consent for processing.

• Contract performance: Account management, game delivery, payment processing
• Legal obligations: Anti-money-laundering checks, regulatory reporting, tax compliance
• Legitimate interest: Fraud detection, security monitoring, platform integrity
• Consent: Marketing communications, promotional offers, third-party data sharing

Marketing activities require your explicit consent which you can withdraw at any time through your account settings. This consent does not affect the lawfulness of processing before withdrawal or other legal bases we rely upon for service delivery. You retain the right to opt out of marketing communications while still receiving transactional messages about your account.

When we process your data for fraud prevention under legitimate interest, we balance our security needs against your privacy concerns through strict access controls. This ensures we protect the platform without unnecessary surveillance of your everyday activities. You make a trade-off between enhanced security measures and some data processing that cannot be individually consented to.

Recipients of your personal data

We share personal data only with trusted third parties who provide specific services to us or are required by law to receive it. Payment providers receive transaction data to process deposits and withdrawals securely and efficiently. Identity verification and fraud prevention services receive necessary information to confirm your identity and protect the platform. These partners are bound by strict confidentiality agreements and may only use the data for the specified purpose. Our payment processors never access your gameplay history or device information beyond what is needed for transaction completion.

Game suppliers receive limited data necessary to verify your eligibility and deliver the gaming services you have purchased. Regulators and law enforcement agencies may receive information when required by law to investigate suspected illegal activities or regulatory breaches. Processors acting on our instructions handle specific technical functions such as data hosting and customer support services. Each recipient has contractual obligations ensuring they implement appropriate security measures and data protection standards equivalent to our own requirements.

Personal data is never sold to third parties for commercial purposes or marketing lists under any circumstances. We maintain a complete log of all data sharing activities to demonstrate compliance with our contractual and legal obligations. When data transfers occur internationally we rely on approved mechanisms such as standard contractual clauses or adequacy decisions. These safeguards ensure your personal information receives protection even when processed outside the original jurisdiction where it was collected.

How long we keep your data

We retain account data for five years after your last activity to comply with regulatory requirements set by gaming authorities. This retention period ensures we can respond to disputes, regulatory inquiries, and legal requests within the required timeframe. For example, if a player closes their account and we receive a regulatory inquiry three years later, we can still provide necessary information about their gameplay history and transaction records.

Transaction records are kept for seven years to meet anti-money-laundering and tax obligations imposed by financial regulators. These extended periods reflect the serious nature of financial crimes that authorities must investigate even years after activities occur. We maintain detailed logs of every deposit, withdrawal, and game transaction to support potential audits or investigations.

Verification documents are maintained for the duration of the account plus five years as a minimum requirement for compliance purposes. This extended retention ensures we can verify player identity if regulatory bodies request historical verification records for audit or investigation purposes. The trade-off is that you cannot have these documents deleted immediately after account closure despite our desire to protect your privacy.

Marketing consents are retained only until you withdraw them or they expire according to our policy settings. We respect your right to stop promotional communications while maintaining transactional messages essential for account management. This approach ensures we comply with your preferences while still meeting our legal obligations for account-related communications.

Your rights over personal data

You hold specific rights regarding your personal data under applicable data protection laws, and we are obligated to respect and facilitate them. These include the right to access your information, rectify any inaccuracies, or request erasure under strict conditions defined by regulations. We also provide mechanisms for restricting processing, enabling data portability, and objecting to processing activities when your situation warrants it. Withdrawal of consent is available for any processing based on your permission, including marketing communications and promotional offers sent via email or in-app notifications. If you exercise these rights, we may need to verify your identity through a secure process to prevent unauthorized access or fraud. This verification step is critical because we cannot share sensitive financial details or gambling history without confirming who is asking for it. We aim to respond to all valid requests within one month, though complex cases may require additional time for review.

Some rights may be limited where we must retain records to comply with legal obligations or protect legitimate interests. For example, we cannot delete transaction records before the seven-year legal requirement expires even if you request erasure. This limitation ensures we maintain compliance with anti-money-laundering laws and regulatory requirements for financial data. You should understand that while you control your personal information, certain data must remain in our systems to satisfy statutory duties imposed by gaming authorities. These retention periods exist to protect both the operator and the integrity of the gaming ecosystem from financial crimes and disputes.

Data security measures and complaints process

We implement technical and organisational measures to protect your personal data from unauthorized access and loss across all systems. These measures include encryption for data at rest and in transit, access controls limiting employee data access, and regular security audits to ensure data integrity and compliance.

Our staff receive comprehensive training on data protection requirements and are bound by strict confidentiality obligations covering all Rolly Spin operations. We monitor systems continuously using automated tools to detect and respond to security incidents promptly before they escalate. All employees handle your information with the highest standards of care and professional responsibility as part of our security culture.

You have the right to complain if you believe we have mishandled your personal data or violated your privacy rights. First contact our privacy team using the details on our contacts page to resolve issues informally and efficiently. We will investigate your complaint thoroughly and provide a written response within thirty days of receipt.

If you remain unsatisfied with our response, you may escalate your complaint to the relevant supervisory authority in your jurisdiction. We provide full cooperation with regulatory investigations and will implement corrective measures if we identify any shortcomings in our data handling. This complaint pathway ensures you have recourse if our initial resolution attempt does not fully address your concerns.