HotSlots Screens ID Uploads for AI Forgery and Puts 2FA on Every Login From a New Country

The controller is Forwell Investments B.V., at a Curaçao address, and the policy states that personal data is processed in compliance with Regulation (EU) 2016/679 — the GDPR — and the EU anti-money-laundering directive. Two provisions do work that most casino privacy policies leave out: a second factor on any login from a new country, and forgery screening on every identity document uploaded.

• Two-factor authentication on a new country. Any attempt to log in from a new country is followed by a 6-digit token sent to the mobile number or email address provided at registration, and the code must be entered to continue. A password alone does not open the account from anywhere it has not been before.
• Identity documents are checked for forgery, including AI-generated content. Uploaded ID cards, passports and utility bills are verified for authenticity — metadata, security features, and "signs of alteration or manipulation (e.g. AI-generated or forged content)". The player supplies the document; the tool decides whether it is real.
• Non-customers' data is processed for up to five years. When a deposit is attempted with a payment method registered to a third party — prohibited under the terms — HotSlots may collect that cardholder's identification and payment data, on legal-obligation and legitimate-interest grounds, and retain it "typically up to 5 years from the end of the customer relationship". The person processed longest under this policy is one who never agreed to it.
• Gambling-risk profiling, with a person acting on it. An algorithm estimates each player's probability of gambling addiction so that staff can offer help, and the policy states that decisions based on those predictions are not made automatically without human intervention, and that no automatic offers are placed on the basis of in-game behaviour. The score exists; the policy commits that a person, not the score, acts on it.
• Opting out of marketing can take up to 48 hours. SMS, email, phone and push marketing can be switched off in the account settings, and the policy says the request can take up to 48 hours to be fully carried out. Two days of messages can follow the click that stopped them.
• The rights list follows the regulation. Access, correction, erasure and objection are all set out, alongside the legal bases relied on for each kind of processing. The address is outside the European Union; the rulebook the policy binds itself to is the Union's.

Nothing in the policy reads as a trap. Its reach is the point: a login from a new country, an uploaded scan, and a card that belongs to someone else each start a process the policy describes — and the last of those reaches a person who is not a customer at all.