Nokyc777 Keeps Data 10 Years After an Account Closes and Says an Email Address on Its Own Is Not Personal Data

The Nokyc777 privacy policy captured on 30 August 2026 names Digital NK777, registered in Costa Rica under number 3-202-188583, as data controller under applicable data protection legislation. It does not name that legislation, though it lists six legal bases for processing and a right to complain to any relevant data protection authority. Most of the document is standard in shape, and the clauses that matter are about how long data stays and which pieces never leave.

• What may be collected. Account details include first and last name, email address, residential address, gender, date of birth, ID number, phone number and occupation, and under KYC and anti-money-laundering rules Nokyc777 may also collect source of funds, identity, any connection to criminal authorities and utility bill copies. A government-issued ID or passport is required for certain features, and where reasonable, data may also be collected from public sources such as internet searches and social media. The policy says what it collects may include but not exceed this list and is not collected in every case, yet the account-details list ends in "etc.", so even the ceiling is open.
• Software and VPN checks. If the player downloads Nokyc777's software, the device may be checked for security and fraud prevention, and the policy gives this example: "For example, We may gather information with regard to other software which is running simultaneously with the Software for detecting if you are using software which is associated with fraudulent activity (e.g. robots, malware, AI, etc.) or checking if the connection you are using is via a VPN or proxy." A VPN is checked in the same sentence as malware and bots.
• Ten years after the relationship ends. Data is kept for as long as the player is a customer, and the policy states: "If you are no longer a customer of nokyc777, We will keep your data for 10 years as required to comply with the purposes set out in this policy." Records are kept even if the account is blocked, deactivated, deleted or otherwise no longer active, or cannot be deleted for technical reasons. Closing the account starts the ten years rather than ending them.
• Erasure, except the email and phone number. On request, Nokyc777 can delete personal data once the account is no longer active, except the email address and mobile number. It reserves the right to keep both to avoid the same details being used to register again, and adds that a standalone email or mobile number is not considered personal data. Data also cannot be deleted while an account is suspended at the player's own request, and the retention section keeps personal records even after an account is deleted. The account-details clause lists email address and phone number as personal details collected at registration, so the policy treats the same two items as personal data when collecting them and as something else when keeping them.
• Marketing affiliates and third parties. Personal information may be shared within the Nokyc777 group, with fraud prevention, credit reference and identity verification agencies, and with non-affiliated third parties such as KYC processors, and it may be transferred between countries. The policy states: "Our Marketing Affiliates may use this Personal Information for different marketing techniques, such as direct email, post, SMS and telephone marketing purposes." The document says who may call and text, and names no marketing opt-out of its own, only the general rights to withdraw consent and to object.
• Calls, publicity and anonymised data. Telephone and video calls with support are recorded for KYC, training and security. Gameplay information can be shared and published under the player's nickname or initials when a win is worthy of publicity, and anonymised or de-identified data can be disclosed to others without limitation and for any purpose, such as advertising. A win large enough to publicise becomes Nokyc777's to publish.
• Changes take effect on posting, material ones need consent. An amended policy is effective on posting, continued use counts as acceptance, and for material changes Nokyc777 will use reasonable endeavours to inform players in advance. A later paragraph states: "We will not enforce material changes to the Privacy Policy without your express consent." The document does not define material, so a player cannot tell which of the two rules covers a given change.
• Eight rights, two with exceptions. Withdrawing consent, complaining to a data protection authority, access, correction, erasure, portability, objecting to processing for legitimate interests, and contesting a fully automated decision with a request for human review are all listed. Two caveats qualify the list: erasure stops at the email and mobile number, and the policy warns that compelling grounds may override the right to object. Restriction of processing is the one familiar right missing, and the two that would stop data being kept or used both come with an exception.

What the policy collects is set out at length. Its reach is in time: a decade of records after the account is gone, and two contact details kept beyond any deletion request.