Every LugarBet Login Doubles as Consent to Store the Player's Location

The LugarBet privacy policy is issued by 3-102-951260 SRL and is followed on the same page by a cookie policy. It lists the rights a player has over their data in full. What it leaves open is how consent is given, how long data is kept and who receives it.

• A login is consent to location storage. "By logging in to the gaming site you give us the consent to collect and store the information on your location." The policy says this is needed to make sure the player is not in a restricted country, defined as one where gambling is legally prohibited or requires a local licence. The consent comes from the act of logging in, so there is no box to leave unticked.
• A deposit can be consent. Consent for certain processing activities is obtained at registration, by ticking a box, or implicitly when the player deposits. Processing can also rest on the contract, a legal obligation or LugarBet's legitimate interest, and a player who refuses to provide data cannot be given the service or parts of it. The policy does not say which activities a deposit consents to.
• Source of funds from an unstated amount. Copies of an ID, passport, driving licence, credit card and proof of address may be requested to verify identity, and "From a certain size of the transaction, we are also required to obtain a confirmation of your source of funds." No figure is given. A player cannot tell from the policy which transaction starts the check.
• Shared with gaming sites, sister casinos and Marketing Partners. To prevent fraud, player details may be checked against and shared with other online gaming sites, banks, credit card companies and fraud prevention agencies, and data may be shared internally within LugarBet's sister casinos. Marketing Partners may receive information and use it for direct email, post, SMS and telephone marketing, while LugarBet sends marketing only to players who have consented. Data may also go to officials, with or without notice, where LugarBet believes in good faith that it is legally compelled. None of the sister casinos or Marketing Partners is named.
• No retention period. Data is kept for the period needed for the purposes in the policy unless the law requires or permits longer, generally for at least the duration of the relationship and as required by the licensing authority. A player who objects to processing for gaming instructs LugarBet to close the account, and the data is then stored as far as the licensing authorities require. The licensing authority is not named in the policy, so the rule that decides the period is not given either.
• The rights, and one door for them. A player may withdraw consent, obtain a copy of their data, have inaccurate or unnecessary data corrected or erased, restrict processing while a request is pending, receive their data in a machine-readable format, and object to direct marketing at any time. Requests go to Customer Support, and a complaint can be lodged with a competent data protection authority. The policy gives no postal address, data protection officer or privacy email, so the only desk named for a data request is the one that runs the account.
• Cookies that pay affiliates. The cookie policy describes tracking and marketing cookies that record visits, pages and links followed, and explains: "We need to record this so that we can appropriately pay our Affiliates." It also says that disabling session cookies prevents logging in. The cookies that track a visit are also the ones that settle who is paid for it.

Card details are not stored on the website and the list of rights is complete. The length of time the data stays and the names of the companies it travels to are the two things the policy does not give.