As a regulated operator in Italy, casinò rich royal partnership affiliata, we obtain and look after personal and transactional data under strict legal obligations. This policy outlines exactly how long we hold different categories of information, the legal reasons behind those periods, and the security measures that shield your data at every stage. We regularly balance our duty to retain records for fraud prevention and financial audits with the privacy rights you possess under Italian data protection law and the GDPR. Our schedules receive regular reviews so we stay fully compliant.
Information Erasure Procedures
When a information type hits the end of its scheduled retention, our automated lifecycle engine kicks off a protected erasure procedure. First, the data gets logically removed from production databases. Next, physical storage blocks are rewritten with random data patterns to hinder forensic recovery. Finally, a digitally signed log lands in a compliance ledger, giving traceable confirmation that purging happened on time. Backup copies rotate every ninety days, so any deleted data is removed from all media within three months. When a litigation hold applies, we pause the deletion workflow only for the affected records, record the hold reason, and continue once the hold lifts.
Legal Basis for Information Storage
Our retention approach is based on several legal duties that affect gambling operators operating in the Italian market. Anti‑money laundering rules from the Italian Financial Intelligence Unit require us to keep transaction records, identity verification documents and suspicious activity reports for a set period after the business relationship ends. Meanwhile, tax rules administered by the Agenzia delle Entrate oblige us to preserve financial records that support taxable gaming revenue and player winnings. These duties override any general right to erasure during the mandatory period. For operational data that isn’t covered by a fixed legal window, we base our approach on legitimate interest assessments where a valid reason exists, and we allow an opt‑out unless a compelling legal obligation stops us.
Storage with Consent
Marketing preferences, newsletter sign‑ups and the behavioural analytics used for personalised offers remain only with your explicit consent. You can revoke consent anytime through your account dashboard; once you do, we stop that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal is separated from active systems to block further use, but it is not deleted retroactively. Consent records themselves are kept for six years as proof of compliance. We never use this data for anything beyond the activity you agreed to.
Individual Rights and Retention Management
When you submit an erasure request, our system automatically reviews each data category against its retention schedule. Anything past its mandatory window gets deleted without delay. For data still under a legal retention obligation, we lock it down right away so it’s excluded from active use and held only for compliance storage; we inform you which specific law is relevant and the date deletion becomes possible. Access requests are handled within thirty days and provide a breakdown of what we store, why, and the scheduled deletion date. If you challenge accuracy, we attach a note instead of modifying the original record, so the audit trail stays intact. Portability requests are honoured in a structured, machine‑readable format even while data is still in its retention window.
Policy Revisions and Player Notification
We assess this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations. Minor clarifications go up silently with a revised effective date. Material changes that alter retention periods, add new data categories or shift the legal basis for processing are communicated directly to you by email at least thirty days before they become effective. You’ll also notice an in‑platform banner notification when you log in during the notice period. Historical versions are archived and available on request, each with a version number and a validity date range. If an earlier version offered a shorter retention period for certain data, we follow that promise for data collected under that version and apply new terms only going forward.
Data Types and Retention Periods
We organize all user data into well-defined categories, each linked to a retention schedule that corresponds to its purpose and legal context. That organized approach keeps us from retaining things forever. Every year our Data Protection Officer examines these classifications and modifies the timelines whenever new guidance arrives from the Garante per la protezione dei dati personali. Below you’ll see how long each data type remains in our live systems before being securely de-identified or deleted. Archived backups operate on a ninety‑day cycle because of technical constraints.
Personal and Monetary Records
Identity documents you submit during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, remain on file for ten years after you end your account, as anti‑money laundering law mandates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are kept for ten years from the date of each transaction, satisfying both AML requirements and Italian Civil Code limitation periods. We keep these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline elapses, we eliminate all personal identifiers permanently; statistical trends may still be applied but never in a way that links back to any individual.
Account Activity and Help Desk Messages
Detailed logs of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.
Safe Gaming and Self‑Exclusion Data
Once you enable self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.
Affiliate Program Data Retention
Partner relationship data, including contact information, payout data and commission payment history, remains for the entirety of the active partnership plus 10 years after the partnership concludes. That’s driven by tax obligations on commission transactions, which necessitate long‑term financial records. Affiliate performance statistics and aggregated referred‑player statistics get made anonymous after five years. We explicitly prohibit affiliates from autonomously collecting or retaining personal data about referred players; they get only anonymised, consolidated statements. Our affiliate agreements include audit rights to check adherence, and any infringement is reason for immediate contract termination and payout forfeiture.
Popular Queries
Is it possible to ask for data deletion prior to the retention period’s conclusion?
Yes, you can file an erasure request any time. We immediately check each data category against its legal retention obligation. If no legal obligation applies, we erase it promptly. For anything we must keep, we restrict it to storage‑only, tell you the legal basis stopping immediate deletion and give you the expected deletion date. You may also review all your data categories and their scheduled deletion dates from your account dashboard. This partial method honors your rights to the extent permitted by Italian regulations.
What occurs with my data when I opt for permanent self‑exclusion?
Upon enrolling in permanent self‑exclusion, your identity information is transferred to a specialized exclusion register that remains active indefinitely under strictly controlled access. That’s a legal requirement built to prevent you from opening new accounts. Your gameplay and transaction history, on the other hand, still follow the standard retention schedules and get deleted once those periods run out. The self‑exclusion record is separated from all marketing and operational platforms, so it only serves the safeguarding role it was intended for. You will not receive any promotional messages.
How do you handle data belonging to inactive accounts?
An account is deemed inactive following twelve consecutive months without a login. At that point, we automatically switch off marketing communications and move the account to a dormant state with reduced processing. The underlying retention clocks keep ticking based on the original collection dates, not the inactivity date. This implies that data from a dormant account is still retained for the complete legal period relevant to its category and subsequently erased following our standard protocols. If you come back after a long break, you might need to complete a fresh Know Your Customer check to reactivate. The current status is always visible on your data dashboard.
Cross-border Data Transfers and Storage Periods
Our primary infrastructure sits in Italy and the wider European Economic Area. Some secondary services, like fraud detection platforms and customer relationship tools, may send some personal data to countries outside the EEA. In those cases, we make sure an adequacy decision is in place or we establish Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we use to transferred data match those in this policy, and processors are contractually bound to remove or return data when the service ends. We publish a public register of sub‑processors, updated within fourteen days of any change, and we choose vendors with Italian data centres. Geo‑fencing rules ensure Italian user data inside European boundaries, validated through yearly audits.
Data Safeguarding During Retention
Retained data is secured with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access demands multi‑factor authentication plus just‑in‑time privilege elevation that ends on its own. Every access event is logged into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to keep our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard flags every dataset as it nears expiration.
Access Governance and Staff Training
Only employees whose roles demonstrably require access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records triggers a managerial review within one business day. lista di controllo completa Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and differentiating the difference between data we must keep under a legal hold and data we can delete straight away.