Rolletto Bars Data Erasure for Five Years After the Last Transaction and Names Wirecard Bank AG for Cards

The policy is dated 20 April 2020 and runs to twelve sections. It cites Article 77 of the GDPR and the EU's anti-money-laundering rules, names Santeda International BV Limited, at Pareraweg 45, Curaçao, as the company the website r0lletto.com is registered under, and ends with a list of countries where NetEnt games may not be offered.

• Five years of retention, and no erasure before then. Section 8 states "You are to note that due to anti-money laundering regulations in licensed gaming jurisdictions in the European Union, we are obliged to retain personal data of players submitted during registration and any data passed on during the operative period of a Player Account for a minimum of five years from last player transaction or account closure." The next sentence reads "Therefore, requests for erasure prior to the lapse of this period cannot be entertained." The five years start from the last transaction, so a player who keeps playing keeps the clock from starting.
• Card payments run under a bank's privacy policy. Section 7 lists the payment processors among the recipients of player data, "In particular, most banking card transactions are processed by Wirecard Bank AG whose privacy policy applies to such transactions". For a card transaction, the privacy policy that applies is the bank's, and this document does not reproduce it.
• A prize is consent to publicity. Section 4 states "Additionally, note that by accepting any contest prize or winnings from us, you consent to the use of your name and/or nickname for advertising and promotional purposes without additional compensation, except where prohibited by law." The same paragraph gives an opt-out for marketing messages and none for this.
• A complaint right, and no email for the officer who handles it. Section 10 states "In addition, as per Article 77 of the GDPR, you have the right to lodge a complaint related to your data processing to a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of an alleged infringement." Questions go to a data protection officer, and the address given for the officer is support.rolletto.com, a web address. The only email address in the policy, support@rolletto.com, is the one given for marketing opt-outs.
• Changes take effect by continued use. Section 1 states "We may periodically make modifications to this Policy. While we will do our best to notify you of such changes, we recommend that you revisit this Privacy Policy regularly. Your continued use of the Website and/or its services will constitute your consent to the Privacy Policy." Notice is a best effort, and logging in again is the acceptance.
• NetEnt bans sit in the privacy policy. Section 12 lists an absolute restriction on the United States of America, United Kingdom, Spain, France and Italy, plus blacklisted territories and separate lists for branded slots such as Jumanji, Vikings and Narcos. Rolletto's Terms and Conditions give a different absolute-restriction list, United States of America, Curacao and Netherlands, so the two documents disagree on where NetEnt is barred outright.

Two-factor authentication is offered as an option, and the policy says it does not sell or rent personal data. Its reach is set by time: data stays for five years after the last transaction, and a player cannot shorten that by asking.