Casombie May Disclose Personal Data to the Review Site or Forum Where a Player Complains

Casombie's privacy notice, effective since October 2024, covers registered players and website visitors and sets out its lawful bases, recipients, rights and transfers in the terms of the GDPR. Two provisions reach beyond the account itself: what the casino may say about a player who complains on another platform, and who else receives the identity documents a player uploads.

• A complaint on another platform can be answered with personal data. If a player submits a complaint, review or query about the casino to a third-party platform, such as a casino review site, gambling forum or dispute resolution body, the notice says Casombie may be required to respond directly to that platform. "In doing so, we may disclose personal data strictly limited to what is necessary to identify your account and respond appropriately." The ground is the casino's legitimate interest in protecting its business reputation, and no disclosure is started unless the player, or someone acting for the player, has made a submission or public allegation. How much of the account is necessary to answer the complaint is decided by the side being complained about.
• A social security number at sign-up. The registration list names email address, date of birth, country, phone number, gender, full name, social security number, zip code and username, and the IP address and location arrive automatically. The same number appears again in the due-diligence list. It is part of opening the account, not something held back for the first withdrawal.
• Source of wealth, with no trigger stated. For identity and anti-money-laundering checks the notice lists an identity card, driving licence or passport number, proof of address, social security number, source of wealth or funds, bank ID and financial statements, and for deposits and withdrawals it adds CPR and CPF numbers, IBAN and payment system details. The notice gives the list but not the moment: it does not say at what stage or amount any of it is requested.
• Identity documents can go to the payment provider. "We may also share Your KYC documents with the payment providers in order for them to be able to comply with their legal and AML obligations." The recipient list also includes brands within the same entity or operator, marketing partners, game providers and data aggregators. An identity document uploaded to the casino once can be held by more than one company.
• The controller is not named. "The operator of this website is the Data Controller of your personal data." The notice also refers to a joint controller, but names neither company and gives no registered address and no licensing authority, only a data protection officer reached by email. A player can write to that officer but cannot learn from the notice which company answers.
• No retention period. Data is kept while the account is open and for the purposes the notice lists, and may be kept longer where anti-money-laundering or other regulatory rules require it, with no number of years given. "Once your account is closed and there is no longer a legal or business need to retain your data, your personal data will be either deleted or anonymized so that it can no longer be associated with you." Deletion waits until the casino sees no business need, and the notice sets no outer limit.
• Game recommendations without consent, offers with it. Analysing gaming behaviour with machine learning algorithms to recommend games and features is listed under legitimate interest, while offers built on gaming history and targeted advertising are listed under consent. A player can refuse the offers by withholding consent, but stopping the analysis takes an objection.
• The regulation's rights list, with a business carve-out. Access, correction, erasure, restriction, portability, objection, withdrawal of consent and a complaint to a supervisory authority in the player's EU member state are all listed, and transfers outside the EU and EEA rely on adequacy decisions, Standard Contractual Clauses or other recognised safeguards. Erasure applies only where there is no compelling legal or business reason to keep processing. The business reason that decides how long data is kept also decides when erasure can be refused.
• Changes are the player's to find. The notice may be updated as technology evolves and as the law requires, and it applies from the effective date shown on the website. "It is your responsibility to review the amended Privacy Notice from time to time." A new version binds from a date the player is expected to go and look for.

Most of the notice restates the regulation. The one provision written for a particular kind of player is written for the one who complains in public, and that post is the event the notice names as the reason the casino may answer with the account's details.