Ice Casino Names Two Data Controllers, in Curaçao and Cyprus, but Not the Authority That Hears a Complaint

Ice Casino's Privacy Notice is version 2.0, dated 29 January 2025, and covers what is collected, why, for how long and who else receives it. It names two companies as controllers, keeps account data for 6 (six) years after closure and lists seven rights that are free to use.

• Two controllers, one inbox. The notice states that the website is owned and operated by two controllers: Whitebox B.V., registration number 155412, at Korporaalweg 10, Willemstad, Curaçao, and T&C Whitebox CY Limited, registered number HE 419583, in Limassol, Cyprus. Both are then referred to together as the "Company", and every request goes to privacy@icecasino.com. The notice does not divide the data between them, so a player cannot tell which company holds a given record.
• Verification reaches source of wealth and call recordings. The data a player must provide during verification runs from an ID document and proof of the payment instrument to a photo of the player, utility or phone bills, confirmation of the source of wealth and funds, and the record of video or audio calls when verification is done that way. Support calls are recorded as contact data as well. No threshold is attached to the source-of-wealth item, so it reads as part of verification for any player asked to verify.
• Six years, counted from closure. "For the data of our users who possess an account on the Website: 6 (six) years starting from the date you closed your account on the Website and our contract with you is terminated." The clock starts when the account is closed, not when it was last used, so an account left open never starts it.
• Biometric login stays on the phone. Face ID and Touch ID can be used to log in, and the notice states: "Please note that your biometric data (e.g., facial recognition or fingerprint information) is processed solely on your device, and we do not access, store, or process this biometric data." It also states that no automated processing or profiling with legal or similarly significant effects is used. The casino receives a pass or a fail, never the face or the fingerprint.
• Seven rights, free, one month, no named regulator. Access, rectification, erasure, objection, restriction, portability and a complaint to a supervisory authority are listed, followed by "You are not required to pay any charge for exercising your rights." and "If you make a request, we have one month to respond to you." The complaint right reads: "You have the right to lodge a complaint with a supervisory authority if you believe that we have not complied with applicable data protection laws." No authority is named for either company. The right is written down, and the address for using it is not.
• Google Analytics data usually goes to the USA. The notice states: "The information generated by the cookie about your use of the Website is usually transmitted to a Google server in the USA and stored there." Hotjar keeps a pseudonymised profile of behaviour on the site, and Cloudflare may collect log data from visitors. Opt-out links are given for Google Analytics and Hotjar. Stopping the tracking is left to the player, through tools the notice points to.
• A new version is signalled by its date. "When we update the Privacy Notice, we will revise the “Date published” above and post the new Privacy Notice." The notice recommends reviewing it on every visit. The only sign that the rules have changed is the date at the top of the page.

The notice is clear about what it collects and generous with the rights it lists. What it leaves open is who stands behind it: two companies in two jurisdictions share one name and one inbox, and the authority a player would complain to is never identified.