Cashed Casino Asks for a Social Security Number at Sign-Up and May Identify Your Account to a Review Site You Complain On

The Privacy Notice covers registered players and visitors to the website, names the GDPR as the framework for its lawful bases, and gives dpo@cashed.com as the Data Protection Officer's address. It never names the legal entity behind it: "The operator of this website is the Data Controller of your personal data." The joint controller it mentions is not named either. A player can write to the data protection officer but cannot tell from the notice which company holds the data.

• A social security number at registration. "To create an account on our website, you need to provide us with your personal data, including your email address, date of birth, country, phone number, gender, full name, social security number, zip code, username." The IP address and location data arrive automatically on registering. The number is handed over before the first bet is placed.
• Source of wealth, bank ID and two national ID numbers. For due diligence and identity checks, Cashed collects the ID card, driving licence or passport number, proof of address, the social security number again, source of wealth or funds, bank ID and financial statements. For deposits and withdrawals it may also collect a CPR number and a CPF number, the personal identification numbers used in Denmark and Brazil, with the IBAN and payment details. KYC documents may be shared with payment providers so that they can meet their own anti-money-laundering obligations. The file a player builds for the casino may also be read by the company that moves the money.
• A public complaint can be answered with account data. "If you choose to submit a complaint, review, or query concerning our services to a third-party platform (such as a casino review site, gambling forum, or dispute resolution body), we may be required to respond directly to such platforms in order to clarify, investigate, or resolve the matter you have raised. In doing so, we may disclose personal data strictly limited to what is necessary to identify your account and respond appropriately." The legal basis is Cashed's legitimate interest in protecting its business reputation, and the notice says it does not start such a disclosure unless a submission or public allegation has been made by the player or on the player's behalf. What counts as necessary is decided by the side the complaint is about.
• Machine-learning game recommendations without consent. Under legitimate interest, the notice lists analysing gaming behaviour with machine-learning algorithms to recommend games and features a player might enjoy, and it may infer interests and game preferences from the pages viewed and the games played. Offers and promotions based on gaming history need the player's consent. The recommendations run unless the player objects, which the rights section allows for legitimate-interest processing.
• Data from outside the account. Cashed may gather personal data from public and government databases, social media, linked Facebook or Google accounts, commercially available databases, financial and credit institutions and fraud prevention agencies. What a player has made public elsewhere can become part of the file the casino keeps.
• No retention period in years. Data is kept while the account is open and to fulfil the purposes in the notice, and longer where anti-money-laundering or other regulatory rules require. "Once your account is closed and there is no longer a legal or business need to retain your data, your personal data will be either deleted or anonymized so that it can no longer be associated with you." The notice names no number of years, and the business need that ends the clock is the company's to judge.
• Changes are the player's to find. "It is your responsibility to review the amended Privacy Notice from time to time." The notice applies from the effective date shown on the website, October 2024 in this version. No notice of a change is promised, so a player learns of one only by rereading the page.

The rights section is complete, transfers outside the EU and EEA rely on adequacy decisions, the European Commission's standard contractual clauses or other legally recognised safeguards, and a buyer of the business may use the data only under this notice unless the player gives explicit consent to more. The two clauses that matter sit at either end of the relationship: a social security number before the first bet, and account details in a reply to a public complaint.