Privacy Policy

Categories of information we handle

When you open an OnlySpins Casino account, we receive identifying details such as your full name, date of birth, residential address, email, and phone number. Verification documents like a passport or utility bill may also be requested.

Operational data is generated as you use the platform: deposits, withdrawals, game rounds, login timestamps, device fingerprints, IP addresses, and browser characteristics.

Voluntary information you provide during chats with our support agents, survey responses, or promotional preferences is also stored and linked to your profile.

Purposes for which we use your data

Primary uses include verifying your identity, processing transactions, preventing fraud and money laundering, and meeting reporting duties owed to the Tobique Gaming Commission and other competent authorities.

Behavioural information feeds our responsible gaming algorithms, which flag potentially problematic patterns and trigger personalised interventions or limit suggestions.

With your explicit consent, we may also use contact details to deliver promotional newsletters, tailored bonus offers, and product announcements. This consent can be withdrawn at any moment.

Sharing with third parties

Selected processors assist with payment handling, KYC verification, hosting, and customer analytics. Each is bound by contractual confidentiality clauses and data-protection commitments equivalent to our own.

Disclosures may also occur when a court order, regulator request, or anti-fraud investigation legally compels us. In every such case, we share the minimum data strictly necessary.

We do not sell personal information to advertisers or data brokers under any circumstances.

Storage periods and security

Records relevant to anti-money-laundering and licensing obligations are kept for a minimum of five years after account closure, as required by Canadian gaming regulations.

All sensitive data travels over TLS 1.3 encrypted connections, and stored credentials are hashed using industry-standard algorithms. Access inside our organisation is granted on a strict need-to-know basis with auditable logging.

Your rights as a data subject

Residents of Germany and the wider European Economic Area enjoy GDPR rights including access, rectification, erasure, restriction, portability, and objection. Requests can be sent to our Data Protection Officer.

You also have the right to lodge a complaint with your national supervisory authority. In Germany, this is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) or your federal state regulator.