As a licensed operator in Italy, we collect and manage personal and transactional data under stringent legal obligations. This policy outlines exactly how long we hold different categories of information, the legal reasons behind those periods, and the security measures that safeguard your data at every stage. We regularly balance our duty to retain records for fraud prevention and financial audits with the privacy rights you hold under Italian data protection law and the GDPR. Our schedules receive regular reviews so we keep fully compliant.

Legal Basis for Data Retention

Our retention approach relies on several legal duties that apply to gambling operators serving the Italian market. Anti‑money laundering rules from the Italian Financial Intelligence Unit require us to keep activity logs, identity verification documents and suspicious activity reports for a specific duration after the business relationship ends. Meanwhile, tax rules imposed by the Agenzia delle Entrate require we preserve financial records that substantiate taxable gaming revenue and player winnings. These duties override any general right to erasure during the mandatory period. For operational data that doesn’t fall under a fixed legal window, we base our approach on legitimate interest assessments where a valid reason exists, and we allow an opt‑out unless a compelling legal obligation stops us.

Consent‑Based Retention

Marketing preferences, newsletter sign‑ups and the behavioural analytics utilised for personalised offers stay only with your explicit consent. You can withdraw consent anytime through your account dashboard; once you do, we stop that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal is separated from active systems to block further use, but it is not deleted retroactively. Consent records themselves are kept for six years as proof of compliance. We never use this data for anything beyond the activity you agreed to.

International Data Transfers and Data Retention

Our primary infrastructure sits within Italy and the larger European Economic Area. Some supporting services, like fraud detection platforms and customer relationship tools, may transfer limited personal data to countries outside the EEA. In those cases, we guarantee an adequacy decision is in place or we put Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we assign to transferred data match those in this policy, and processors are contractually bound to erase or return data when the service ends. We keep a public register of sub‑processors, updated within fourteen days of any change, and we favour vendors with Italian data centres. Geo‑fencing rules maintain Italian user data inside European boundaries, validated through yearly audits.

Policy Changes and User Notifications

We review this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations. Minor clarifications are published silently with a revised effective date. Material changes that change retention periods, add new data categories or change the legal basis for processing are communicated directly to you by email at least thirty days before they become effective. You’ll also see an in‑platform banner notification when you log in during the notice period. Historical versions are kept and available on request, each with a version number and a validity date range. If an earlier version gave a shorter retention period for certain data, we stick to that promise for data collected under that version and apply new terms only going forward.

Data Security In Retention

Retained data is secured with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access requires multi‑factor authentication plus just‑in‑time privilege elevation that ends on its own. Every access event is logged into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to maintain our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard marks every dataset as it nears expiration.

Access Governance and Staff Training

Only employees whose roles demonstrably require access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records initiates a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and telling the difference between data we must keep under a legal hold and data we can delete straight away.

User Rights and Retention Interactions

When you send an erasure request, our system automatically checks each data category against its retention schedule. Anything past its mandatory window is erased without delay. For data still governed by a legal retention obligation, we restrict it right away so it’s excluded from active use and held only for compliance storage; we inform you which specific law is in effect and the date deletion becomes possible. Access requests are responded to within thirty days and provide a breakdown of what we keep, why, and the scheduled deletion date. If you question accuracy, we attach a note instead of changing the original record, so the audit trail remains intact. Portability requests are fulfilled in a structured, machine‑readable format even while data is still in its retention window.

Data Deletion Procedures

When a data class hits the end of its planned retention period, our automated lifecycle engine kicks off a secure deletion workflow. First, the data gets digitally detached from production databases. Next, physical storage blocks are rewritten with random data patterns to stop forensic recovery. Finally, a digitally signed log lands in a audit trail, giving traceable confirmation that purging happened on time. Backup copies refresh every ninety days, so any deleted data vanishes from all media within three months. When a litigation hold applies, we halt the deletion workflow only for the affected records, record the hold reason, and restart once the hold lifts.

Information Categories and Storage Durations

We organize all user data into clear categories, each connected to a retention schedule that corresponds to its purpose and legal context. That structured approach stops us from retaining things forever. Every year our Data Protection Officer assesses these groupings and adjusts the timelines whenever new guidance emerges from the Garante per la protezione dei dati personali. Below you’ll see how long each data type is kept in our live systems before being securely anonymized or deleted. Archived backups roll on a ninety‑day cycle because of technical constraints.

Identity and Monetary Records

Identity documents you provide during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, https://www.fanpage.it/sport/calcio/i-sospetti-nelle-chat-rivelatrici-del-caso-scommesse-puntati-milioni-su-serie-a-e-champions/ stay on file for ten years after you terminate your account, as anti‑money laundering law stipulates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are kept for ten years from the date of each transaction, meeting both AML requirements and Italian Civil Code limitation periods. We keep these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline expires, we remove all personal identifiers permanently; statistical trends may still be applied but never in a way that traces to any individual.

Account Activity and Help Desk Messages

Comprehensive records of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.

Safe Gaming and Self‑Exclusion Data

Upon activating self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.

Affiliate Program Data Retention

Affiliate partner information, including communication data, payment details and commission payout records, stays for the life of the active partnership plus a decade after the contract ends. That’s driven by tax duties on commission payments, which require long‑term financial archives. Affiliate performance statistics and aggregated referred‑player statistics get anonymised after half a decade. We strictly forbid affiliates from independently collecting or retaining private data about referred customers; they receive only anonymized, combined summaries. Our partner contracts include inspection rights to ensure compliance, and any violation is grounds for instant agreement cancellation and commission loss.

Popular Queries

Is it possible to ask for data deletion prior to the retention period’s conclusion?

Certainly, you can submit a deletion request at any moment. We promptly review every data category against its mandatory retention requirement. If no legal obligation applies, we erase it promptly. For any data we are required to retain, we limit it to storage‑only, inform you of the legal reason preventing immediate removal, and provide the anticipated deletion date. You can also view all your data categories with their scheduled deletion dates through your account dashboard. That partial approach respects your rights as far as Italian regulations allow.

What happens to my data if I self‑exclude permanently?

When you register for permanent self‑exclusion, your identity data moves to a dedicated exclusion register that stays live indefinitely with tightly controlled access. It is a legal obligation intended to block you from establishing new accounts. Your gameplay and transaction history, on the other hand, still follow the standard retention schedules and get deleted once those periods run out. The self‑exclusion entry is isolated from all marketing and operational systems, thus it fulfills solely the protective purpose for which it was gathered. No marketing communications will be sent to you.

How do you handle data belonging to inactive accounts?

After twelve uninterrupted months of no login, casinò rich royal condizioni affiliazione, an account is considered inactive. At that stage, we automatically disable marketing communications and transition the account to a dormant status with limited processing. The fundamental retention timelines continue based on the initial collection dates, not the inactivity date. Consequently, data from an inactive account is kept for the entire statutory duration applicable to its type and then removed in line with our usual processes. If you return following a lengthy hiatus, you might have to finish a fresh Know Your Customer assessment to re‑enable your account. The current status is always visible on your data dashboard.