BitStarz Lists Seven Data Rights, Free Access Among Them, and Names No Law They Come From

The BitStarz Privacy Policy, effective and last updated 25 June 2025, is a single page covering what is collected, why, who sees it, the rights a player has and cookies. It speaks of "full compliance with relevant data protection laws" and does not name one.

• Seven rights, written down (Data Subject Rights). The policy sets out the right to be informed, of access ("free of charge, a copy of your personal data"), to rectification, to object, to erasure, to data portability and to withdraw consent "at any time without affecting prior lawful processing". Requests are made "in writing". Objection holds "unless we can demonstrate overriding legitimate grounds" and erasure applies "where there is no legal basis to retain it". Objection and erasure each carry a condition.
• Five years for financial records, no period for the rest (Data Collection). "Financial and transactional data will be retained for a minimum of five years as required by AML regulations." For everything else the policy gives no period and says data is kept "only for as long as necessary for legal, regulatory, and business purposes". A minimum is not a maximum and "business purposes" has no end date. Erasure is available only where no legal basis to keep the data exists, and the AML requirement is a legal basis for the financial records.
• What is collected (Data Collection). Registration data (full name, date of birth, identification documentation, residential address, email and contact details), bank details and payment card information, gameplay activity, wager details and win/loss history, IP address, geolocation and device data, and identity verification documents. Data also comes "From Third Parties including financial institutions, regulators, and fraud prevention Agencies". The list ends with "Other information needed to deliver gaming experience", so the list of categories is open.
• Who sees the data (Data sharing). Recipients are service providers ("such as IT or storage, marketing services, legal counsels, etc."), public authorities and third parties in corporate transactions such as mergers or a sale of assets. Staff with access include the Data Protection Officer, Money Laundering Reporting Officer, payments and anti-fraud analysts, customer support agents, customer retention specialists, VIP player managers and "other designated personnel". International sharing is covered by "data transfer agreements or verifying that the destination country meets the required privacy regulations". The confidentiality commitment is written for employees only: "All employees with access to, or involved in the processing of, player personal information are bound by confidentiality agreements".
• Marketing and optional services on consent, the rest on three other grounds (Processing). Processing rests on contractual necessity, legal obligation and legitimate interest, and "Consent – Obtained for marketing and optional services." Legitimate interest covers platform security, fraud prevention, user experience and "conduct business analytics etc." Promotional offers are sent "subject to user consent". The purposes that need a yes are marketing and optional services, and the analytics purpose rests on the casino's own interest.
• Cookies, minors and changes (Cookies, Protection of minors, Policy Updates). The casino "collects a small piece of information sent from Your browser, called a cookie", cookies can be turned off in the browser, and doing so "may restrict Your use of the Website". No individual cookie is named and no lifetime is given. Services are restricted to people aged 18 or older, and data collected from minors is deleted "promptly" once the casino becomes aware of it. The policy "may be updated periodically" and users "will be notified of significant modifications".

The policy is short and lists seven rights. What it leaves out is the legal source of those rights, the company responsible for the data and any date after which most of it must go.