Verde Casino Promises Seven Data Rights and a One-Month Answer but Never Names Its Data Controller

The Privacy Notice on Verde Casino's site sets out what data is collected, why, for how long and with whom it is shared, in thirteen headed sections. The rights it grants are the full list a European regulation would ask for. The one thing it does not say is who is granting them.

• No company is named. The definitions read: "For the purpose of this Privacy Notice, we are a Data Controller of your Personal Data." The contents list includes "About us", but no such section follows, and the text names Google, Cloudflare and Hotjar as service providers without ever naming the business that runs Verde Casino. The data controller is "we", and the notice never says who "we" is.
• Seven rights, free, answered within a month. The notice lists the rights to access, rectification, erasure, objection, restriction and data portability, and the right "to lodge a complaint with a supervisory authority if you believe that we have not complied with applicable data protection laws". Requests go to privacy@verdecasino.com, and the notice states: "You are not required to pay any charge for exercising your rights." It adds that the company has one month to respond. The complaint right names no authority, and without a named controller there is no way to work out which one.
• Six years after closure. For account holders, data is kept "6 (six) years starting from the date you closed your account on the Website and our contract with you is terminated", with further detail left to a separate FAQ on data retention. The clock starts at closure, so a player who keeps an account for five years is on file for eleven.
• Verification can mean a recorded video call. Verification data covers a copy or photo of an identity document, proof of holding the payment instrument, a photo of the player, utility or phone bills, confirmation of the source of wealth and funds, and a record of video or audio calls with the site's administration where verification is done that way. Contact data also includes the record of audio calls with support. A conversation with support is, under this notice, part of the player's file.
• Biometrics stay on the phone. Face ID and Touch ID are offered for login, and the notice states that biometric data "is processed solely on your device, and we do not access, store, or process this biometric data". Only the authentication result, success or failure, is shared with the casino. The fingerprint never leaves the player's device.
• A wide list of recipients, beside a promise not to disclose. Data may be shared with affiliated companies and subcontractors, hosting, marketing, IT, support, payment, KYC and anti-fraud providers, game providers, auditors, financial institutions and, for a physical prize, a courier. Google Analytics data "is usually transmitted to a Google server in the USA and stored there", and the notice links opt-outs for Google Analytics and Hotjar. In the middle of the data list sits the sentence: "The merchant will not sell, purchase, provide, exchange or in any other manner disclose Account or Transaction data, or personal information of the cardholder." The sharing section says transaction data goes to financial institutions, so the promise covers less than its wording suggests.
• A date the notice does not show. The closing section reads: "When we update the Privacy Notice, we will revise the “Date published” above and post the new Privacy Notice." No date appears anywhere in the text. A reader cannot tell which version they are looking at, or when it last changed.

On paper the rights are complete and the biometric clause is better than most. What the notice leaves out is the company those rights are held against.