Your Privacy at Instaspin Casino
Operating since our launch in 2023, we process personal data for every registered player. This page explains exactly what we collect, the legal grounds we rely on, how long we hold each record and how to exercise your rights. We keep it factual and specific, because your data deserves nothing less.
Data We Collect From You
When you register an account, deposit funds or play a game on insta-spin.org.uk, you hand us several categories of personal data. We collect only what the service genuinely needs, and each category below serves a purpose described in the next section.
- Identity data: your full name, date of birth, email address, telephone number and residential address.
- Verification documents: government-issued photo ID, proof of address no older than 3 months and payment method verification, submitted during KYC checks before your first withdrawal.
- Transaction data: deposits, withdrawals, bet stakes, winnings, bonuses claimed and payment method details, including crypto wallet addresses where used.
- Technical data: IP address, device type, operating system, browser version, language settings and session timestamps.
- Gameplay behaviour: games played, session duration, betting patterns, win and loss history, and responsible-gambling indicators such as loss limits reached.
- Marketing preferences: which channels you opted into (email or SMS), when you consented and how you interacted with our offers.
How We Use Your Data
Every processing activity traces back to a concrete operational need. Here is the full list of what we do with your data and why.
- Creating and maintaining your player account, including authentication and account settings.
- Verifying your identity under our KYC obligations, with document review typically completed within 24 to 48 hours.
- Processing deposits and withdrawals across Visa Debit, Mastercard, Trustly, PayPal, Skrill, Neteller, MiFinity and crypto (BTC, ETH, USDT, DOGE), with crypto payouts within 1 hour.
- Preventing fraud, bonus abuse, multi-accounting and underage gambling through automated and manual checks.
- Monitoring play against responsible-gambling measures you set, such as deposit limits, loss limits and session reminders.
- Sending marketing messages, but only where you have given consent, and honouring your GAMSTOP self-exclusion status.
- Meeting legal and regulatory obligations owed to the Curaçao licensing authority, including record-keeping and reporting.
Our Legal Bases for Processing
We rely on four legal bases under GDPR. Contract covers everything needed to deliver the service you signed up for: account creation, deposits, withdrawals and gameplay. Without this data we cannot perform our side of the agreement, so processing is necessary for the contract.
Legal obligation grounds our KYC, anti-money-laundering and record-keeping duties. Regulations tied to licence 8048/JAZ2023-045 require us to verify identity and retain transaction records for at least 5 years, and we cannot contract out of these duties even at your request.
Legitimate interest supports fraud prevention, security monitoring and service improvement. We balance this against your expectations and keep the data involved to a minimum. Device and IP logs, for example, exist to detect abuse, not to profile you for unrelated purposes.
Consent governs all marketing communications and any non-essential cookies. Consent is freely given, specific and withdrawable at any time through your account settings or the unsubscribe link in every message, and withdrawal never affects the lawfulness of earlier processing.
Records We Keep and Why
We do not keep data indefinitely. Each category has a defined retention period, after which it is deleted or anonymised. Regulatory rules require the longer periods, and we apply them strictly.
Retention periods in full:
Retention at a Glance
| Data category | Retention period | Basis |
|---|---|---|
| Identity and account data | Until account closure, then 5 years | Contract and regulation |
| KYC verification documents | 5 years after your last transaction | AML legal obligation |
| Transaction and payment records | Minimum 5 years | Regulatory requirement |
| Gameplay and betting logs | 5 years | Fraud prevention and regulation |
| Device, IP and security logs | 12 months | Legitimate interest, security |
| Marketing consent records | Until you withdraw consent | Consent |
Frequently asked questions
How do I request a copy of my data?
Email [email protected] or contact support via 24/7 live chat. We respond within 30 days and provide your data in a portable, machine-readable format.
Can I close my account and have everything deleted?
Yes, request erasure at any time. We delete marketing preferences immediately, while transaction and KYC records are retained for the statutory 5 years in anonymised or minimal form where regulation requires it.
Does Instaspin Casino sell my data?
No. We share data only with the processor categories listed above, strictly to run accounts, payments, verification and security, and never for third-party advertising sales.
How do I stop marketing emails?
Withdraw consent through your account settings or click the unsubscribe link in any message. Opting out takes effect immediately and does not affect your account or bonuses.
What happens if there is a data breach?
We notify the supervisory authority within 72 hours of becoming aware of a qualifying breach and inform affected players directly where the risk to you is high.