TornadoBet Keeps Player Data for 3 Years and Takes No Responsibility If It Is Stolen

TornadoBet states that it processes personal data in accordance with the GDPR, and names Media Entertainment N.V., headquartered in Curaçao, as the controller for residents of the European Union. Players can see their data, withdraw consent, ask to be forgotten and complain to a European data protection regulator. The provisions below set how long the data is kept, who else holds it and who carries the risk of losing it.

• Data is kept for 3 years, with no start date given. The policy says: "Your data is stored for 3 years unless specifically required to be stored longer by our gaming licence regulations." It does not say whether the three years run from the last bet, from account closure or from collection, so a player cannot tell from the document when the data goes.
• A self-exclusion record outlives a request to be forgotten. Self-exclusion data is stored indefinitely, and the policy says: "If you have self-excluded we will retain this information even if you have asked to be forgotten to ensure you are not able to gamble with us again as is required by our gaming licences." Here the retention works for the player, because the record that keeps an excluded player out is the one record erasure cannot remove.
• Access in 30 days, corrections in 7 business days. A request for a list of all stored data is answered within 30 days of receipt, and account changes are generally answered within 7 business days. A change of name or address needs new documentation, so updating either is a verification step rather than a form field.
• Theft or loss of data is disclaimed, twice. The security section says: "Although we strive to employ reasonable protections for your information that are appropriate to its sensitivity, we do not guarantee or warrant the security of the information that you share with us and we are not responsible for the theft, destruction, loss or inadvertent disclosure of your information or content." The disclaimer section adds: "Transmitting personal information is done at your own risk." The same document that collects passport details, a photograph and a utility bill places the risk of losing them on the player.
• Every bet is stored on third-party marketing software. The policy says it does not sell personal data or make it available to unrelated third parties, and lists the providers it does share with. Of the marketing tools it says: "Such 3rd party software is hosted by the providers who store your user name and your gaming history including all your bets on sports and casino games." Fraud tools see all entered personal information, and casino game providers see bets and the username. A player's full betting history sits outside the casino, next to the username that ties it to the account.
• Betting is profiled for rewards and marketing. TornadoBet profiles betting and gameplay "in order to provide you an optimised service", including rewards and the marketing sent to players who have agreed to receive it. The same history that is monitored for problem gambling is also what decides which promotions arrive.
• Do Not Track is ignored. The policy says TornadoBet does not recognise or respond to browser-initiated Do Not Track signals, and that cookies are managed through browser or device settings. The privacy choice a browser sends on its own is not one the casino acts on.
• Changes can be made at any time. The policy says: "TornadoBet reserves the right to modify this Privacy Policy at any time." Material changes come with a prominent notice, and a player who objects "should stop using the services and request for your account to be de-activated or deleted." The only answer the policy offers to a change a player disagrees with is to leave.

The policy states its timelines for keeping data, answering access requests and making corrections, which many casino privacy policies do not. What it does not take on is the risk of the data it collects being lost, and it hands that risk to the player in two separate sections.