Carat Casino Treats Accepting Any Winnings as Consent to Advertise the Player's Name or Nickname

The Carat Casino privacy policy captured on 29 August 2026 is headed "Privacy Policy 1.0" and dated 31 August 2025. It forms part of the terms and conditions accepted at registration, lists the data collected and why, and sets out retention, sharing and cookies. It does not say which company holds the data.

• Any win is advertising consent. "Additionally, by accepting any contest prize or winnings from us, you consent to the use of your name and/or nickname for advertising and promotional purposes without additional compensation, except if otherwise agreed or where prohibited by law." The trigger is any winnings, not only a contest prize, so as written the consent reaches every player who has accepted a win.
• A web address as data controller. "As a data controller, www.caratcasino.com has a legal obligation under gambling regulations to collect and process certain personal data from players in order to allow them to participate in games and provide them with our services." No company name, postal address or licence number follows anywhere in the policy. A data request has an email address to go to, but no legal entity is named as answerable for it.
• The data protection officer shares the support inbox. The policy says a data protection officer has been appointed and gives support@caratcasino.com as the contact, the same address it gives for customer support and marketing opt-outs. It also states the right, under Article 77 of the GDPR, to complain to a supervisory authority. A question for the officer goes to the same inbox as any customer-support question.
• Five years, and no erasure before then. Under anti-money-laundering rules the policy keeps registration data and account data for a minimum of five years from the last player transaction or account closure. "Therefore, requests for erasure prior to the lapse of this period cannot be entertained." Closing the account starts the five-year clock, it does not end the record.
• Group companies and partners. Data may be passed to other entities in the group, including the parent company and its subsidiaries, and to business partners, and may be processed outside the European Economic Area, which the player accepts by browsing the website. None of these companies is named. The player cannot tell from the policy who else holds the data.
• Sale of the business. In a merger or acquisition, players' personal data will most likely be included in the transfer, and the policy commits to telling players by email before it happens. No way to object is described.
• Changes come with notice. "We may need to periodically make modifications to this policy and in that case, we will notify you to review this Privacy Policy." Continued use of the website after that confirms consent to the new version. The player is told, and staying counts as agreeing.
• The rights the policy lists. A player can withdraw consent at any time, confirm the accuracy of the data held, ask how it is used, stop direct marketing and correct their details, and marketing can be switched off in the account settings. No right to receive a copy of the data, or to move it elsewhere, is listed.
• Payments, cookies and 2FA. Most card transactions are processed by Paysafe under its own privacy policy. Advertising cookies set by partners track visits and registrations, and the policy recommends against blocking or deleting cookies. Two-factor authentication is available but optional.

The policy lists rights, a retention period and a data protection officer, and leaves out who stands behind them. The clause that reaches furthest is the one about winnings: a win accepted is a name or nickname offered for advertising.