GGBET Keeps Player Data Six Years After Closure, a Year Beyond the AML Minimum It Cites

The privacy notice for GG.BET names River Entertainment B.V. as the company managing the website and two data controllers: ASG 360 Services Limited, incorporated in Cyprus, and River Entertainment B.V., registered in Curaçao. Questions go to a Data Protection Officer at privacy@gg.bet. The notice states that “All gambling services are licensed by River Entertainment B.V.” and names no regulator or licence number anywhere in its text.

• Six years after the account closes. Section 6 reads: “Your personal data will generally be stored for a period of six (6) years starting from the date of closure of your account and termination of your contract with GG.BET, unless a shorter retention period applies to a specific category of data or a longer retention period is required or permitted by applicable law.” The period rests on AML law, which the notice says requires at least five years, on limitation periods for legal proceedings, and on preventing repeated registration and abuse. Because a longer period may also be one the law merely permits, six years is the usual point of deletion and not a fixed end date.
• Is a self-exclusion record health data? The notice gives two answers. Section 2 says that when a player self-excludes, GGBET keeps the request, and that “Such data is not considered to be data that relates to health.” Section 3 lists self-exclusion status among the responsible-gambling information it processes and adds: “Where the information is treated as health-related data, we process it only where permitted by applicable law for substantial public interest, player protection or similar regulatory purposes.” A player cannot tell from the document which of the two statements governs their own self-exclusion record.
• Behavioural indicators of harmful gambling. Under responsible gambling and player protection, GGBET may process player-set limits, responsible gambling programme records and behavioural indicators of compulsive or harmful gambling patterns, on the basis of compliance with gambling laws. The notice names the data and the purpose, and does not say how the indicators are worked out or who acts on them.
• Rights, with a reason attached. Section 8 lists access, rectification, deletion, restriction, portability, objection and withdrawal of consent, and says: “You can exercise each of this rights by contacting our DPO or Customer Service by naming the right you wish to exercise and by stating a reason for such request, if applicable.” Deletion is described as not absolute because of legal duties to retain data for anti-money-laundering and crime prevention. A player asking to be forgotten is told in advance that those duties come first.
• A cookie that can keep a device out. The cookie section says cookies are used for fraud detection and anti-money-laundering purposes and to identify irregularities connected to a device and prevent the account being accessed from a different device. The named cookies include one holding a security token and one checking that the user is authorised. Whether a new phone or laptop can open the account may depend on what the cookies recognise, not only on the password.
• Disclosure on suspicion, and to a buyer. GGBET may share data with police, banks, financial integrity units and verification providers, and “Furthermore, we reserve the right to disclose your personal data to relevant third parties, such as regulators, financial integrity units, notably when we have reasonable grounds to suspect irregularities involving your account.” Data may also go to a third party if GGBET sells or transfers its business, or enters into negotiation to do so. Personal data can reach a prospective buyer before any sale is agreed.
• Changes and notice. Section 11 says the latest version is published with an effective date, that “If you continue to use the Website, it will be deemed as acceptance of the changes to the Privacy Notice”, and that “If there are substantial changes, you will be notified by email or other means of communication.” Only substantial changes come with a message, and the notice does not say who decides which changes are substantial.

The notice carries the rights a European reader expects and states where data is held. Its distinctive figure is time: six years after the account is closed, a former player’s identity documents, verification data and transaction history can still be on file.