Betzard Counts Hobbies and Marital Status as Identity Data and May Refuse a Data-Rights Request It Can Reasonably Justify

The data controller is ARDENS S.Z. LTD of Cyprus, agent of FairGame G.P. N.V., and the policy processes personal data under the National Ordinance on the Protection of Personal Data and Regulation (EU) 2016/679, the GDPR. It follows the GDPR's structure closely. Where it departs is in how much it collects and in what it reserves for itself once the rights have been listed.

• Hobbies and marital status are identity data. The category reads: "Identity data (Ex: Name, Surname, address, date of birth, identity card/passport number, a photograph, gender, occupation, your marital status and family, hobbies)." The purposes listed against it include registration, identity checks, fraud prevention, security for card data and protection from gambling addiction. None of those purposes names hobbies.
• Activity data reaches browsing history, and Do Not Track is ignored. The policy records bets, winnings, bonuses, payments, some of a player's browsing history, time spent on pages, clicks, conversations with customer service and whether a player is self-excluded, and it may also collect data from web searches, company registers and broadcast media. The cookie section adds: "However, we do not recognize or respond to any browser-initiated Do Not Track signals, as the internet industry has not fully developed Do Not Track standards, implementations and solutions." The setting a player may rely on in the browser does nothing on this site.
• Five years is the floor. "For example, any data that can be deemed to be “transactional data” must be kept for at least five (5) years." Data needed to defend against claims, where the prescriptive period is usually five years, is kept for as long as necessary. The policy gives a minimum and, for claims, no end date.
• A rights request can be refused if the company can reasonably justify it. Erasure is limited where processing is needed for a legal obligation, as the GDPR allows. The policy then adds a wider sentence after the whole list: "It is important to note that notwithstanding such rights, The Company may still refuse such a request if it can reasonably justify such a decision." A complaint to a data protection authority stays open. Nothing in the sentence limits the refusal to one right, and the policy does not say what counts as reasonable.
• Automated checks, human decisions. Profiling is used against money laundering, tax evasion and suspicious betting patterns, and IP addresses and PEP status are checked automatically. "However, in all such cases the final decision is made by our human staff." The checks run on their own, and the policy commits that a person, not the check, decides.
• Accepting the policy is the consent to transfers outside the EEA. Data is stored and processed primarily within the EEA, but sub-processors, staff and agents outside it may access it under standard contractual clauses, and a copy of the safeguards is available on request. "By accepting this Policy, you specifically agree and opt-in for your personal data to be transferred outside of the EEA as outlined in this Policy." The policy describes no separate consent for the transfer.
• Encrypted in transit, not its responsibility in transit. Data is encrypted with TLS 1.2 during transmission and stored on encrypted hard drives. The same policy accepts no responsibility for the security of data in transit over the internet unless a law having effect in Curaçao makes it responsible. The encryption covers the journey that the liability clause excludes.
• The Data Protection Officer shares the support inbox. The policy gives support@betzard.com as the address at which the Data Protection Officer can be contacted directly. There is no separate address for a privacy request.

Personal data is never shared with third parties for their own marketing unless the player consents, and every GDPR right has its own section. What the policy collects goes past what identity checks need, and what it keeps has a five-year floor and, for claims, no stated end.