Privacy Policy for GTSpins

Scope and Application

This privacy policy governs the processing of personal data by the operator of GTSpins. It applies to all visitors and registered users of the website and mobile applications operated by the operator. The operator acts as the data controller for all information collected through these services. Users should read this document to understand their rights and the obligations of the operator under the UK General Data Protection Regulation.

The scope of this policy extends to data collected during account registration, deposit transactions, gameplay activity and customer support interactions. It covers information gathered automatically through the use of cookies and similar tracking technologies. Specific details regarding these technologies are outlined in the separate cookies policy available on the website. Users who decline cookies may still access the service but some features may be unavailable.

We reserve the right to update this policy at any time. Notifications of material changes will be communicated via email or through a banner on the website. The version of the policy in force at the time of data processing is the version that applies. Users are encouraged to review this document periodically to remain informed of any updates or changes to our practices.

Data Collection Methods

The types of data collected are distinguished by the method of acquisition. Some data is provided voluntarily by the user during registration or support interactions. Other data is generated automatically through the user interaction with the platform and its services. This distinction is crucial because the legal basis for processing differs depending on whether the information was actively submitted or passively gathered through system logs.

When you register an account, you provide identity and contact details to establish a unique user profile. Without this information, we cannot verify your age or location, which are legal requirements for offering gambling services. Financial data is collected to process deposits and withdrawals in GBP, ensuring funds are handled securely through approved Visa, Mastercard, Sofort, Revolut, Google Pay, Apple Pay, MiFinity, Jeton, Bank Transfer, Bitcoin, Ethereum, USDT, Litecoin, Solana, Dogecoin, Cardano, USDC, Tron and Ripple. Gameplay records are generated to monitor gaming behaviour and ensure fair play across all 1,800 titles available on the platform.

Lawful Basis for Processing

Processing of personal data is grounded on specific legal bases defined by the General Data Protection Regulation. We rely on contract performance to deliver services, legal obligations for regulatory reporting, and legitimate interests for security. Consent is obtained separately for marketing communications and can be withdrawn at any time without detriment to the user. This structured approach ensures transparency and compliance with data protection laws. When you register an account, the service delivery relies on our contractual obligation to maintain your profile and process transactions.

If you choose to withdraw consent for marketing, we must immediately stop sending promotional materials but continue essential service communications. The trade-off here is that while you gain privacy, we cannot send updates about new games or bonuses. This ensures that our core operations remain unaffected while respecting your personal preferences. Legitimate interests allow us to prevent fraud without over-collecting data beyond what is necessary for platform security. For example, we monitor login patterns to detect unauthorised access, which protects your funds without requiring your explicit permission each time.

Processing Purposes and Bases

Data Sharing and Recipients

We do not sell personal data to third parties under any circumstances. Information is shared only with specific service providers who assist in the operation of the platform. Payment processors and identity verification agencies receive necessary data to complete transactions and confirm identity. These parties are contractually bound to strict confidentiality and data security standards that exceed industry norms.

Game suppliers may receive limited data to ensure proper functioning of the games, such as session tokens or result verification. Regulators and law enforcement agencies are provided data when required by law, such as in cases of suspected money laundering or criminal activity. All data processors act on the operator's instructions and must adhere to GDPR requirements regarding data handling.

International transfers are governed by appropriate safeguards such as Standard Contractual Clauses approved by the European Commission. These measures ensure that data transferred outside the United Kingdom or European Economic Area maintains equivalent protection standards. Users are informed of such transfers when they occur, maintaining full transparency about cross-border data flows.

The operator regularly audits third-party processors to confirm compliance with agreed-upon data protection standards. In the event of a data breach affecting any processor, the operator assumes responsibility and notifies relevant authorities within the required timeframe. This approach ensures accountability extends beyond our internal systems to all external partners handling personal data.

Data Retention Periods

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected. Account data is kept for the duration of the account plus a statutory period defined by regulatory requirements. This ensures compliance with anti-money laundering laws and responsible gambling obligations. Records are securely deleted or anonymised once the retention period expires unless further retention is required by law.

Transaction records are maintained for a minimum of five years following the last transaction date. This period satisfies statutory accounting requirements and enables regulators to audit financial flows if necessary. Customers cannot request deletion of these records during this period regardless of their account status.

Verification documents such as passport copies or utility bills are retained for five years after account closure. This timeline aligns with anti-money laundering directives that require identification records to be kept for regulatory inspection. Even after account deletion, these documents remain protected but are not accessible for operational purposes.

Marketing consent records are retained separately from operational data to track user preferences accurately. If a user withdraws consent, this decision is recorded and respected for all future communications. The retention of this record ensures that consent withdrawal is not inadvertently overlooked during automated marketing campaigns.

Your Data Rights

Users have specific rights regarding their personal data under the UK General Data Protection Regulation. These rights include access to held data, rectification of inaccuracies, and erasure where legally permissible. Users may also request restriction of processing, data portability, and objection to specific processing activities. We provide tools to exercise these rights through the user account dashboard or by contacting our data protection team. If you believe your data is incorrect, you can update it directly in your profile settings without needing to contact support first.

Some rights are limited where records must be retained by law for regulatory or legal reasons. For instance, we cannot delete transaction records required for tax or anti-money laundering reporting. This balance protects both your privacy and the integrity of the gambling environment. Even if you request erasure, certain data must be preserved to demonstrate compliance with the UK Gambling Commission. You will still be informed about what data remains and why it is retained for legal purposes.

Security and Complaints

We implement technical and organisational measures to protect personal data from unauthorised access and disclosure. These measures include encryption, access controls and regular security testing of our systems. Data is stored on secure servers with restricted physical and digital access. We monitor systems continuously for potential threats and respond immediately to any detected breaches.

All staff members are trained on data protection principles and confidentiality obligations before accessing personal information. Access rights are granted on a need-to-know basis to minimise exposure of sensitive data across the organisation. Regular security audits verify that these controls remain effective against evolving cyber threats and internal risks.

If you have concerns about how your data is handled, you may submit a complaint directly to our data protection team. We will investigate all complaints promptly and provide a written response within thirty working days. Should you remain dissatisfied with our response, you may escalate the matter to the Information Commissioner's Office.

Detailed contact information for submitting complaints or exercising data rights can be found on our contacts page. This page includes our registered office address, email address, and dedicated data protection contact details. Providing this information ensures you can reach us through your preferred method while maintaining clear documentation of all requests.