Spindog Data Protection: Privacy, Cookies and Account Data describes which personal data may be processed at an online casino and which questions users can ask about it. Because no specific privacy policy from Spindog Casino is available for this explanation, the examples are general and do not confirm the provider's practices.
For users in the Netherlands, the General Data Protection Regulation and applicable rules on cookies are relevant, among other things. The provider's current privacy policy and cookie settings provide insight into the specific data flows, purposes and contact options.
Privacy of Spindog users
Personal data is information that can refer directly or indirectly to a person. A combination of technical characteristics and account information may also fall under this definition. The extent of processing depends on the functions used, applicable obligations and the choices of the data subject.
Who processes your data?
The data controller determines the purpose and means of processing. A processor acts on behalf of that controller, for example in providing technical support. The identity of the controller and any contact details of a data protection officer should be checked in the privacy policy; that identity has not been established here.
Which data is processed?
A provider may receive data directly through account use or communication and may collect other data automatically during a visit. Which categories are actually used should be clear from the applicable privacy information.
Personal data
Identifying information may include a name, date of birth and address. Such information may be necessary to distinguish one person from other account holders and to carry out applicable checks.
Contact information
An email address or phone number may be used for account notifications and responses to questions. Marketing communications require a separate assessment and should not automatically be treated in the same way as necessary service messages.
Account and profile data
Account data may consist of a username, settings and an overview of relevant account activity. A password should not be shared in readable form with an employee or any other person.
Verification documents
An identity document may be requested when identification or verification is required. The data subject can check why the document is needed, which parts must be visible and how it can be submitted securely.
Financial and transaction data
Financial data may relate to payment instructions, transaction status and checks on unusual activity. The exact data depends on the payment route used and the obligations of the parties involved.
Deposit information
For a deposit, an amount, time, transaction reference and status may be recorded. This data can help with administration and with investigating a missing or disputed payment.
Withdrawal data
A withdrawal request may contain information about the requested amount, destination and processing. Additional checks may be required before a payment is made depending on the circumstances and applicable rules.
Payment method data
A payment processor may receive certain payment data directly, while a provider may only see a reference or partial data. The privacy information of both parties can clarify who receives which data.
Technical data during website use
Technical information is generated when a device connects to a service. Not every technical data point is necessarily used for the same purpose; security, functionality and analysis each require their own assessment.
Browser information
A browser type, language setting or IP address may help with delivering pages and identifying technical problems. An IP address may, under certain circumstances, be personal data.
Device data
Information about the operating system or screen size may be used to adapt the display. The privacy policy may indicate whether device characteristics are also combined for recognition or security purposes.
Session and usage data
Session data may relate to visited sections, error messages and the course of a visit. The necessity and retention period differ by purpose and should be assessed separately.
Why does Spindog process data?
Processing must have a clear purpose and an appropriate legal basis. Possible bases include performance of a contract, a legal obligation, consent or a legitimate interest. In the latter case, the interests must be balanced against the rights and interests of the data subject.
Account management
Account information may be necessary to manage access, store settings and answer questions about the account. For necessary elements, performance of the contract may be an appropriate legal basis.
Processing payments
Transaction data may be used to process payment instructions and maintain administration. Depending on the purpose, contractual necessity and legal obligations may play a role.
Identity verification
Identity verification may be used to confirm that an account belongs to the correct person and to comply with applicable obligations. The provider should explain which data is required for this purpose.
Preventing fraud and money laundering
Checks may focus on suspicious transactions, misuse of accounts and compliance with applicable anti-money laundering rules. A legal obligation or legitimate interest may be relevant depending on the specific processing activity.
Responsible gambling
Data about restrictions or signals of potentially risky behaviour may be relevant for protective measures. The applicable privacy information should clarify which data is used, for which purpose and on which legal basis.
Cookies and tracking technology
Cookies are small data files that a browser can store; similar technologies can read or place information on a device. Prior consent is often required for non-essential technologies depending on the applicable rules and specific use.
Essential cookies
Essential cookies may be necessary for a requested function, such as maintaining a session or applying a security measure. The label alone does not prove that a cookie is actually necessary.
Functional cookies
Functional cookies may remember preferences, such as a language choice. Whether consent is required depends on the function and the consequences for privacy.
Analytics cookies
Analytics technologies may provide insight into usage and technical performance. The settings, data sharing and level of privacy protection partly determine which rules and consent requirements apply.
Marketing cookies
Marketing cookies may be used to tailor communications or measure the performance of advertisements. Where consent is required, refusal should be possible and previously given consent should be withdrawable.
Protection of personal data
Appropriate security may include access restrictions, encryption, system monitoring and incident procedures. Which measures Spindog Casino actually applies has not been established here. Users can contribute themselves by managing account access carefully and not trusting suspicious messages.
In addition to measures taken by a provider, the account holder can reduce risks themselves. The actions below focus on access, communication and careful sharing of data without assuming that specific security features are available.
- Unique password — A long, unique password for the account reduces the risk that a breach at another service will also provide access to this account. A password manager can help with this.
- Additional access security — If additional verification is available, the account holder can enable it and store recovery information securely. The availability and operation of this feature should be checked with the provider.
- Recognising suspicious messages — Unexpected messages asking for passwords or documents deserve extra scrutiny. The recipient can independently use the known contact point and should not send sensitive data in response to an unverified request.
- Sharing documents carefully — Before sending an identity document, the data subject can check which information is necessary and which secure submission channel is provided. Unnecessary information should not be shared without reason.
- Managing devices and sessions — Regular browser and device updates reduce known security risks. On a shared device, logging out after use is sensible and saving account details should be avoided.
- Checking preferences — By periodically reviewing privacy and cookie settings, the account holder can check which choices are active. Marketing consent can, where applicable, be withdrawn through the available settings or by submitting a request.
Sharing data with external partners
A provider may share data with payment processors, technical service providers, verification parties or competent authorities when an appropriate legal basis exists. The privacy policy should explain categories of recipients and any transfers outside the European Economic Area, including applicable safeguards. The sale of data cannot be confirmed or ruled out without specific information.
Data retention periods
Data must not be kept in identifiable form longer than necessary for the purpose unless an applicable obligation or another valid reason requires further retention. Periods may differ for account data, transactions and correspondence. Specific periods are not known here and should be checked in the privacy policy.
Privacy rights of users
The GDPR provides data subjects with various rights, including access, correction and, in certain cases, erasure. Applicability depends on the circumstances and legal basis. A request may be restricted when, for example, a legal retention obligation applies.
The following rights provide practical ways to exercise control over personal data. Not every right applies in every situation; the legal basis, purpose and any statutory exceptions determine how a request is assessed.
- Access and copy — A data subject can ask which personal data is processed and receive a copy. The request may also concern purposes, recipients and available information about the source.
- Correction and completion — If an address or other information is incorrect, the data subject can request correction. An explanation and, where necessary, appropriate supporting documents can help assess the change carefully.
- Erasure — When data is no longer necessary or another statutory condition applies, erasure can be requested. A retention obligation or other exception may mean that certain data must still be retained.
- Restriction of processing — During a dispute about the accuracy of data, restriction may be requested. The data generally remains stored while further use only takes place under applicable conditions.
- Portability — For data provided by the data subject and processed automatically on the basis of consent or a contract, a portable copy may be requested where the right applies.
- Objection — An objection can be made to processing based on legitimate interest with an explanation of the personal situation. A separate right to object applies to direct marketing.
- Withdraw consent — Previously given consent can be withdrawn through the available settings or by submitting a request to the privacy contact. Earlier processing based on valid consent does not automatically become unlawful as a result.
Accessing data
An access request can clarify which personal data is processed, for which purposes and with which recipients data is shared. A copy of the relevant personal data may also be requested.
Correcting data
Incorrect personal data can be corrected and incomplete data may, depending on the purpose, be supplemented. A clear description of the error helps with the assessment.
Requesting erasure
Erasure may be requested under certain conditions, for example when data is no longer necessary. Closing an account does not automatically result in immediate deletion of data subject to a retention obligation.
Restricting processing
Restriction may be requested in certain situations, for example while the accuracy of data is being checked. The data generally remains stored, but further use is restricted under certain conditions.
Objecting
Objection may be relevant, among other things, for processing based on legitimate interest. A separate objection can be made against processing for direct marketing; the provider must respect that objection.
Managing cookie preferences
A user can review the available cookie settings and refuse non-essential categories or withdraw previously given consent. Browser settings can delete or block stored cookies, but this may affect functionality and does not always replace a choice made with the provider.
Changes to the privacy policy
A privacy policy may change when purposes, service providers or legal requirements change. The user can check the current version and any modification date and ask what consequences a change has if anything is unclear.
Contact about privacy questions
A privacy request can be sent to the contact point stated in the privacy policy or through customer support. Specific contact details are not known here. If the matter is handled unsatisfactorily, the data subject can file a complaint with the Dutch Data Protection Authority.
A carefully prepared privacy request helps the controller assess the correct right and locate the relevant data. The following sequence provides a practical route, even when it is first necessary to determine which contact point is available.
- 1. Choose the request type — The data subject first determines which right is relevant, for example access, correction, erasure or objection. If there are multiple purposes, they can be mentioned separately so that it is clear which decision or information is being requested.
- 2. Make contact — The applicant then looks for the privacy contact or customer support in Spindog Casino's current privacy information. The request can be submitted through the channel listed there; specific contact details have not been established here.
- 3. Confirm identity — If there is reasonable doubt about identity, additional verification may be required. The applicant can ask which information is necessary and how it can be submitted securely without providing unnecessarily sensitive data.
- 4. Describe the request precisely — A clear description states the relevant account, the requested right and, where necessary, the data or period covered by the request. For correction, the applicant can indicate which information is incorrect and what the correct data should be.
- 5. Follow up or file a complaint — The applicant keeps a copy of the request and checks whether a response is received within the period required by applicable law. If the matter is handled unsatisfactorily, a complaint can be filed with the Dutch Data Protection Authority.