Casinostars Cites the GDPR Article by Article but May Let Third Parties Use Player Data for Marketing

The Casinostars privacy policy is short and built around the GDPR: what is collected, where it is stored, how it is used and shared, how long it is kept, and which rights a player can use. Its rights section is specific. Its sharing section is wider than the rights section suggests.

• Rights by article, with a named address. Access, rectification, erasure, restriction, objection and portability are each listed with their GDPR article, alongside the right to withdraw consent and to lodge a complaint with a supervisory authority. Requests go to dpo@wildblackfin.com, which the policy also gives as the Data Protection Officer's contact. A player has both the right and the address to send it to.
• No company named, and a different regulator. The policy speaks as "Casinostars.io" and never names the company that controls the data. Its opening paragraph names the GDPR together with applicable laws under the Curaçao Gaming Authority, while the casino's general terms name a licence from the Anjouan Gaming Board held by Wild Blackfin Limited SRL. The privacy policy and the general terms point to two different regulators.
• Five years after closure. "Typically, this means a retention period of five (5) years after account closure, unless longer retention is required." The retention is tied to anti-money-laundering and financial rules. Closing the account starts the five years rather than ending the processing.
• Transfer outside the EEA, agreed by submitting. Data may be stored outside the European Economic Area and handled there by staff of the casino or its suppliers, including for payment processing and support. "By submitting your personal data, you agree to this transfer, storing or processing." Third-party processors are contractually bound to GDPR standards. Consent to the transfer is given by signing up, not asked for separately.
• Third parties may market with the data. "We may also permit selected third parties to use your data to provide you with information about games, goods and services which may be of interest to you." Promotional messages from the casino can be stopped with the unsubscribe link or in the account settings. The unsubscribe route the policy describes is for the casino's own emails, and it names no separate one for those third parties.
• Data moves with the business. If the casino or substantially all of its assets are acquired, the personal data it holds about its customers is one of the transferred assets. The player's data goes to whoever buys the business.
• Changes by continued use. "We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices or legal obligations." Updates are posted on the page with a revised effective date, and "Continued use of our services constitutes acceptance of the updated policy." A new date on the page is the only notice the policy promises.

The rights section is the most specific part of the policy and the marketing clause the widest. A player can ask for every item of data by article number, and the same document says the casino may permit selected third parties to use that data to market to them.