HitnSpin Keeps Account Data for Six Years After Closure and Names Its Brand as the Data Controller

HitnSpin's privacy notice, version 2.0 published on 12 February 2025, covers what is collected, why, for how long and who else receives it. It describes the site as operated by ICS Manpower Solutions Ltd., registered in Cyprus, with gambling services licensed by TwiceDice B.V., its parent company in Curaçao.

• Six years after closure. The retention section reads: "Data from our users who have an account on the Site: six (6) years from the date we close your account on the Site and terminate our agreement with you." Usage data is generally kept for a shorter period, with no figure given. Closing the account starts the six-year clock rather than ending the record.
• Verification can reach source of wealth and recorded calls. During verification a player is required to provide a copy or photo of an identity document, proof of the payment instrument, a photo of themselves, utility or phone bills, confirmation of the source of their wealth and funds, and, where verification is done by audio or video call, the record of that call. The notice sets no amount or trigger, so it does not say which players are asked for the fuller set.
• Biometric logins stay on the device. The notice reads: "Please note that your biometric data (e.g., facial recognition or fingerprint information) is processed solely on your device, and we do not access, store, or process this biometric data." Only the success or failure of the check is shared. The face or fingerprint never leaves the phone, only the yes or no.
• Seven rights, free, one month. Access, rectification, erasure, objection, restriction, portability and a complaint to a supervisory authority are listed, exercised by email to privacy@hitnspin.com. "You are not required to pay any charge for exercising your rights." A request is answered within one month, and the notice states: "We do not use automated processing and profiling which produces legal effects concerning you or similarly significantly affects you." The rights are the full European set, though the notice never names the regulation they come from.
• The controller is the brand. The notice names "Hitnspin" as the controller of personal data and calls it the Company, while naming ICS Manpower Solutions Ltd. as the operator and TwiceDice B.V. as the licence holder and parent. A complaint to a supervisory authority has to name a respondent, and the notice offers three candidates.
• Two documents, two licence numbers. The notice says gambling services are licensed by TwiceDice B.V. under licence 8048/JAZ2021-047. HitnSpin's general terms and conditions, captured the same day, name Twicedice B.V. as the owner and operator of hitnspin.com and state: "Twicedice B.V. is licensed and regulated by the Curaçao Gaming Control Board under license number OGL/2024/818/0448." They describe ICS Manpower Solutions as the agent that manages payments rather than the operator. A player checking the licence finds a different number depending on which page they read.
• Analytics data usually goes to the United States. The notice states: "The information generated by the cookie about your use of the Website is usually transmitted to a Google server in the USA and stored there." Hotjar keeps a pseudonymised profile of each visitor's device and behaviour, and Cloudflare may collect visitors' log data. Transfers outside the EEA go to countries with an adequacy decision, or the company may use standard contractual clauses or other recognised mechanisms. Opting out of Google Analytics is left to a browser add-on the player installs.
• Changes are posted, not announced. A new version is posted with a revised publication date, and the notice adds: "We recommend that you review the Privacy Notice each time you visit the Service to stay informed of our privacy practices." The only sign of a new version is the date at the top of the page.

Most of the notice follows the European rules, from the rights list to the transfer safeguards. Where it falls short is the part a player needs first when something goes wrong: which company holds the data, and under which licence.