HotSlots Puts 2FA on Every Login From a New Country and May Use AI Tools on ID Uploads

The controller is Forwell Investments B.V., at a Curaçao address, and the policy states that personal data is processed in compliance with Regulation (EU) 2016/679 — the GDPR — and the EU anti-money-laundering directive. Two provisions stand out: a second factor on any login from a new country, and checks on identity documents, some of which may be processed using AI-based tools.

• Two-factor authentication on a new country. Any attempt to log in from a new country is followed by a 6-digit token sent to the mobile number or email address provided at registration, and the code must be entered to continue. A password alone does not open the account on a login from a new country.
• Identity documents may be checked with advanced tools. The policy says HotSlots "may use advanced tools" to verify uploaded ID cards, passports and utility bills for authenticity — metadata, security features, and "signs of alteration or manipulation (e.g. AI-generated or forged content)". The policy adds that "some of these documents may be processed using AI-based tools to evaluate their effectiveness in enhancing our KYC controls".
• Non-customers' data may be processed, typically for up to five years. When a deposit is attempted with a payment method registered to a third party — prohibited under the terms — HotSlots may collect that cardholder's identification and payment data, on legal-obligation and legitimate-interest grounds, and keep it only as long as necessary, "typically up to 5 years from the end of the customer relationship".
• Gambling-risk profiling, with a person acting on it. An algorithm estimates each player's probability of gambling addiction so that staff can offer help, and the policy states that decisions based on those predictions are not made automatically without human intervention, and that no automatic offers are placed on the basis of in-game behaviour. The score exists; the policy commits that a person, not the score, acts on it.
• Opting out of marketing can take up to 48 hours. SMS, email, phone and push marketing can be switched off in the account settings, and the policy says the request can take up to 48 hours to be fully carried out. Two days of messages can follow the request to stop them.
• The rights list follows the regulation. Access, correction, erasure and objection are all set out, alongside the legal bases relied on for each kind of processing. The address is outside the European Union; the rulebook the policy binds itself to is the Union's.

A login from a new country, an uploaded scan, and a card that belongs to someone else each start a process the policy describes — and the last of those reaches a person who is not a customer at all.