Cazimbo May Disclose Account Data to the Forum or Review Site Where a Player Complains

The Privacy Notice covers registered players and visitors to the website, is effective from October 2024 and draws its lawful bases from the GDPR. It never names the legal entity behind it. The data controller is described only as the operator of the website, working with a joint controller the notice does not identify, and the contacts given are dpo@cazimbo.com and support@cazimbo.com.

• A social security number at registration. To create an account a player provides email address, date of birth, country, phone number, gender, full name, social security number, zip code and username, and the IP address and location are received automatically on sign-up. The number is collected when the account is opened, before any verification step asks for it again.
• Due diligence reaches wealth and bank records. For KYC, age and identity checks and anti-money-laundering purposes the notice collects an identity card, driving licence or passport number, proof of address, social security number, source of wealth or funds, bank ID and financial statements, and the financial-information section adds CPR and CPF numbers, IBANs and payment details for deposits and withdrawals. The notice lists everything that can be asked for and never says which request comes at which stage.
• KYC documents may go to payment providers. Name, date of birth, email, address, phone number and alias may be shared with payment providers, and the notice adds: "We may also share Your KYC documents with the payment providers in order for them to be able to comply with their legal and AML obligations." A passport scan uploaded to the casino may travel to whichever provider handles the money.
• A complaint on another platform opens a disclosure. If a player submits a complaint, review or query to a casino review site, gambling forum or dispute resolution body, Cazimbo may be required to respond directly to that platform. The notice continues: "In doing so, we may disclose personal data strictly limited to what is necessary to identify your account and respond appropriately." It does not start such a disclosure unless a submission or public allegation has been made by the player or on the player's behalf, and the disclosure rests on Cazimbo's legitimate interest in protecting its business reputation, not on the player's consent.
• No retention period in years. Data is kept for as long as the account exists and the notice's purposes require, may be kept longer where anti-money-laundering or other rules demand it, and is deleted or anonymised once there is no longer a legal or business need to keep it. A closed account's data has no end date a player can count to, because the business need is Cazimbo's to judge.
• Machine learning recommends games under legitimate interest. Analysing gaming behaviour with machine learning algorithms to recommend games and features sits under legitimate interest, while offers customised to gaming history need consent. A player who refuses personalised promotions still has games recommended by a model unless they use the right to object that the notice lists.
• Changes are the player's to find. "It is your responsibility to review the amended Privacy Notice from time to time." A new version applies from the effective date shown on the website, whether or not the player has read it.

The rights list runs from access and erasure to a complaint with a supervisory authority in the player's EU member state, and transfers outside the EU/EEA rely on adequacy decisions, Standard Contractual Clauses or other legally recognised safeguards. What the notice adds on top is reach: a national identity number at sign-up, identity documents passed to payment providers, and account data that may follow a player's complaint to the platform where it was made.