HorusCasino Treats Handing Over Personal Data as Agreement to Its Transfer Outside the EEA

The HorusCasino privacy policy is short and follows the GDPR's outline: what is collected, where it is stored, how it is used and shared, how long it is kept and which rights a player has. It speaks as "HorusCasino" throughout and names the GDPR together with applicable laws under the autonomous island of Anjouan. Its rights section is the most precise part of it, and its transfer and sharing clauses are the widest.

• Transfer outside the EEA, agreed by submitting. Data may be transferred to and stored at a destination outside the European Economic Area and processed there by staff working for the casino or for its suppliers or licensors, including for payment details and support. "By submitting your personal data, you agree to this transfer, storing or processing." The policy adds that the casino will take all steps reasonably necessary to treat the data securely and that third-party processors are contractually bound to GDPR standards. The player's agreement to the transfer is the registration itself.
• Five years after closure. Data is kept only as long as needed for the purposes in the policy or as required by law, naming anti-money-laundering and financial rules. "Typically, this means a retention period of five (5) years after account closure, unless longer retention is required." Closing an account does not close the file, which typically stays for five more years.
• Rights by article, sent to an address with no company named. The policy lists access (Art. 15), rectification (Art. 16), erasure in certain circumstances (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), plus withdrawing consent and lodging a complaint with a supervisory authority. Requests go to dpo@moonseeker-srl.com, the same address the policy gives for its Data Protection Officer. No company is named anywhere in the policy as the controller of the data. A player knows where to send a request but not which company receives it.
• Selected third parties may market with the data. "We may also permit selected third parties to use your data to provide you with information about games, goods and services which may be of interest to you." The opt-out the policy describes is the unsubscribe link in the casino's own emails or the account settings. No route is named for switching off the third parties.
• Data moves with the business. If the casino buys or sells a business, personal data may go to the prospective buyer or seller, and if HorusCasino or substantially all of its assets are acquired, customer data is one of the transferred assets. Data may also be shared with other companies for fraud protection and credit risk reduction, and the policy states that information will be disclosed to the regulator and other authorities in cases of fraud or an inquest. The player's data goes to whoever buys the casino.
• The risk of sending it sits with the player. Payments and personal information are sent with SSL encryption and kept on secure servers, but the policy states that the casino cannot guarantee the security of data transmitted to the website and that any transmission is at the player's own risk. The protection promised starts only once the data has arrived.
• Changes by continued use. "We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices or legal obligations." Updates are posted on the page with a revised effective date, and "Continued use of our services constitutes acceptance of the updated policy." A player who keeps playing has accepted every later version, whether or not they have read it.

A player can name every right by its article number. Where the data is stored and who may market with it are both settled by the act of signing up, and the file typically outlasts the account by five years.