Scope, status, and interpretative framework

This Privacy policy sets out the rules governing the processing of personal data in connection with access to and use of the services made available under nv-spin.eu.com. It is drafted for a global audience and is intended to reflect generally applicable privacy and confidentiality standards, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. Where a mandatory local law provides higher or conflicting requirements, such requirements apply to the extent they are applicable to the relevant processing activity. This document applies to data processed through web interfaces, mobile optimised interfaces, customer support channels, and operational systems used to deliver account, security, payment, and compliance functions. References to “personal data” and “processing” are construed consistently with common international usage and, where relevant, the General Data Protection Regulation concepts. NV Casino acts as a controller for most activities described herein, while certain vendors may act as processors under binding instructions.

Processing roles and accountability model

Regulatory framing requires that each processing activity is assigned a defined role and accountability pathway, including oversight for vendor management, security governance, and incident handling. NV Casino determines the purposes and means of processing for core operational data, including account administration, gameplay integrity checks, and responsible gambling controls. For narrowly scoped activities, third party providers may independently determine processing purposes, in which case they act as separate controllers and provide their own notices. Where processors are used, written agreements are maintained to require confidentiality, appropriate technical and organisational measures, and assistance with data subject requests. Internal access to personal data is limited to personnel with a verified need to know, and access is subject to periodic review at least every 12 months. The privacy governance function maintains records of processing activities to support auditability, and documentation is retained for a minimum of 6 years where required for legal defence or regulatory accountability.

Definitions and key concepts

For the purposes of this document, “personal data” means any information that identifies or can reasonably be used to identify an individual, directly or indirectly, including online identifiers. “Special category data” refers to data that may reveal health information or other protected attributes, which is processed only where a lawful condition applies and only to the extent necessary for the stated purpose. “Cookie identifiers” and similar technologies are treated as personal data where they are linked to an account, device, or behavioural profile. “International transfer” means a transmission, remote access, hosting, or other disclosure of personal data to a recipient in a country that may not provide equivalent legal protection. “Security incident” means any event leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This section is included to support clarity, limitations, and consistent interpretation across jurisdictions.

Categories of personal data processed

Operational explanation requires that data categories are tied to the service lifecycle, including onboarding, authentication, transactions, and compliance monitoring. NV Casino may process identification and contact data such as name, date of birth, residential address, email address, telephone number, and account identifiers, where such data is required for account creation and verification. It may also process financial and transactional data such as payment method tokens, deposit and withdrawal records, chargeback markers, and payment reference numbers; card numbers are not stored in full where compliant tokenisation is used. Technical and usage data may include IP address, device identifiers, browser characteristics, login timestamps, session durations, and basic interaction logs required for security and fraud prevention. Regulatory and verification data may include identity document references, age verification results, sanctions screening results, source of funds checks, and responsible gambling indicators, with safeguards proportionate to sensitivity. Communications data includes customer support correspondence, complaint records, and dispute communications, which may be recorded where lawful and proportionate. The processing described in this section is performed for casino NV operational integrity and regulatory compliance in jurisdictions where such measures are applicable.

Methods and sources of data collection

Data is collected through direct submission, automated capture, and authorised third party sources, and each method is limited by necessity and proportionality. Direct collection occurs when an individual provides information during registration, verification, payment initiation, customer support communication, or submission of a complaint. Automated collection occurs when systems log security events and maintain essential session records to protect accounts and maintain service availability. Where permitted by law, NV Casino may obtain verification or risk indicators from identity verification providers, payment service providers, anti fraud services, and screening databases, subject to appropriate contractual safeguards. Data may also be generated by operational processes, including responsible gambling assessments and fraud scoring, which are used to protect individuals and the integrity of the services. Where data is obtained from third parties, the data is limited to what is required for the stated purpose and is reviewed for accuracy and relevance. This section is stated separately to ensure that the Privacy policy is transparent regarding sources and acquisition channels.

Legal bases for processing

The legal basis for processing depends on the context, and NV Casino applies a documented mapping to ensure that each processing activity is linked to a lawful ground. Processing may be necessary for the performance of a contract, including creation and management of accounts, execution of deposits and withdrawals, and delivery of customer support. Processing may be required for compliance with legal obligations, including age verification, anti money laundering controls, record retention duties, and responses to lawful requests from competent authorities. Processing may also be conducted on the basis of legitimate interests, such as securing the platform, preventing fraud, maintaining network integrity, and improving reliability, provided that such interests are balanced against the rights and freedoms of the individual. Where consent is used, it is obtained through a clear affirmative action, and withdrawal is made as easy as giving consent; consent is not used where another lawful basis more appropriately applies. For limited scenarios involving special category data, processing is restricted to what is strictly necessary and is supported by an applicable condition under relevant law. These legal bases are reviewed periodically and updated when operational or regulatory circumstances change.

Purposes of processing under this Privacy policy

This Privacy policy describes purposes that are specific, explicit, and legitimate, and personal data is not processed in a manner incompatible with those purposes. Account administration purposes include registration, identity and age verification, authentication, account recovery, and prevention of unauthorised access. Transaction purposes include payment initiation, deposit and withdrawal processing, chargeback handling, reconciliation, and the prevention of payment fraud. Compliance purposes include anti money laundering checks, sanctions screening, responsible gambling controls, internal audits, and maintenance of records required by applicable regulation. Security purposes include detection of malicious activity, monitoring of unusual access patterns, protection against automated abuse, and maintenance of service availability and resilience. Service quality purposes include handling of customer support requests, dispute resolution, error diagnostics, and maintenance of operational logs required to investigate incidents. Each purpose is applied with data minimisation, and where a new purpose arises that is materially different, an appropriate notice mechanism is applied before such processing proceeds.

Cookies, device data, and tracking technologies

This section addresses the use of cookie identifiers and similar technologies used to support essential operations, security, and preference management. Certain cookies are strictly necessary to enable login sessions, protect against cross site request forgery, and maintain secure navigation; disabling such cookies may impair access to core functions. Analytics technologies may be used to evaluate performance and detect errors, and any metrics are configured to limit identifiability where practicable. Preference cookies may store selections such as language and session settings to avoid repeated entry, subject to applicable consent rules in the relevant jurisdiction. Advertising related tracking is not required for the delivery of essential services and, where used, is subject to jurisdictional consent requirements and vendor controls. Logs related to cookie identifiers may be retained for periods aligned to security needs, commonly between 30 days and 180 days, unless longer retention is required for investigation or legal defence. These practices are governed by this Privacy policy to the extent that the identifiers constitute personal data.

Data sharing, disclosure, and third party recipients

Personal data is disclosed only to the extent necessary for the purposes described, and recipients are selected using due diligence and contractual safeguards. Service providers may include hosting and infrastructure vendors, payment service providers, identity verification vendors, fraud prevention vendors, and customer support tooling providers, each bound by confidentiality and security obligations. Disclosures to professional advisers may occur where necessary for legal claims, audits, and compliance reviews, subject to professional secrecy obligations where applicable. Disclosures to competent authorities may occur where required by law or where necessary to respond to valid legal process, including requests relating to fraud, money laundering, or other unlawful activity. NV Casino does not sell personal data as an independent commercial activity, and any sharing for behavioural advertising is subject to local consent rules and opt out mechanisms where required. Where joint controller relationships arise, the allocation of responsibilities is determined in a documented arrangement and a summary is made available upon request. This section applies to casino NV operations and does not alter any independent privacy obligations imposed on third party controllers.

International transfers and cross border access

International transfers may occur because services are delivered to a global audience and because infrastructure, support, and compliance vendors may operate in multiple jurisdictions. Where personal data is transferred to a recipient in a country without an adequacy decision or equivalent legal mechanism, safeguards are implemented, such as standard contractual clauses and transfer risk assessments. Access from abroad by support teams or vendors is treated as a transfer where it results in remote access to personal data stored elsewhere. Encryption in transit and at rest is applied where appropriate to reduce transfer risks, and access is restricted through role based controls and multi factor authentication. Transfer records are maintained to evidence the basis for transfer, including the categories of data, recipient types, and implemented safeguards. If a transfer mechanism becomes invalid or is materially challenged by a legal development, NV Casino evaluates alternative safeguards and may suspend the affected processing where required to maintain compliance.

Data retention, storage limitation, and deletion

This Privacy policy applies storage limitation controls so that personal data is retained only for as long as necessary for the stated purposes and applicable legal obligations. Account and transactional records may be retained for a minimum of 5 years where required by anti money laundering or financial record keeping duties, and may be kept longer where needed for dispute resolution or legal claims. Security logs are retained for periods proportionate to risk, typically between 90 days and 12 months, unless a security incident requires preservation for investigation and remediation. Verification records may be retained for the duration of the account relationship and for an additional period required by applicable law, which may extend beyond closure where mandated by regulators. Customer support correspondence may be retained for 24 months to ensure continuity of service and to address recurring complaints, subject to earlier deletion where the data is no longer necessary. Where deletion is required, NV Casino applies deletion or irreversible anonymisation, and archived backups are cycled out in accordance with defined schedules and technical constraints.

Security measures and incident response

Security is implemented through a layered approach that combines technical controls, organisational governance, and continuous monitoring. Measures may include encryption, segmentation, secure key management, vulnerability management, and privileged access restrictions, alongside training and confidentiality commitments for staff and contractors. Authentication controls include strong password rules and multi factor authentication for administrative access, and security testing is performed according to a risk based schedule. For selected controls, NV Casino targets a minimum of 99.5% availability for critical systems, while recognising that availability commitments do not override legal duties in relation to integrity and confidentiality. Incident response procedures include triage, containment, eradication, recovery, and post incident review, with documentation preserved to support accountability. Where a personal data breach is likely to result in a risk to rights and freedoms, notifications may be made to competent supervisory authorities and affected individuals without undue delay, subject to applicable legal thresholds. This section describes safeguards under this Privacy policy and does not guarantee that all risks can be eliminated, as residual risk is inherent to networked systems.

Rights of individuals and procedural guarantees

Rights based framing applies in order to describe the controls available to individuals under applicable data protection laws, including GDPR aligned rights where relevant. Depending on jurisdiction and lawful basis, rights may include access, rectification, erasure, restriction of processing, objection to processing, and data portability. Where processing is based on consent, withdrawal may be exercised at any time without affecting the lawfulness of processing performed before withdrawal, although service availability may be impacted where processing is necessary for contract performance. Requests are verified using proportionate identity checks designed to prevent unauthorised disclosure, and verification data is used only to process the request and prevent misuse. NV Casino aims to respond to requests within 30 days, with permissible extensions applied where requests are complex or numerous, and the individual is informed of the extension and reasons. Where a request is refused, reasons are provided to the extent permitted by law, including where rights are limited by legal obligations, the rights of others, or the necessity of retaining data for legal claims.

Automated decision making and profiling

Automated processing may be used to detect fraud, enforce security controls, and support responsible gambling measures, and such processing may involve profiling based on behavioural and transactional indicators. Where applicable law grants rights related to automated decision making with legal or similarly significant effects, NV Casino implements review mechanisms to allow meaningful human involvement where required. Fraud and abuse signals may include repeated failed logins, unusual transaction patterns, device anomalies, or indicators provided by specialised vendors. Safeguards include minimisation of data inputs, periodic model and rule review, and documented oversight to reduce bias and error. Where automated measures restrict access or suspend transactions, an avenue for review is made available through the support channel, subject to compliance constraints. This subsection is provided to ensure that this Privacy policy remains transparent regarding risk based operational controls.

Complaints and supervisory authority engagement

Individuals may submit a complaint internally where there is concern about how personal data has been handled, and such complaints are reviewed by staff with designated responsibility. Where applicable, a complaint may also be lodged with a competent data protection authority in the individual’s place of habitual residence, place of work, or place of the alleged infringement. NV Casino maintains internal records of complaints and resolutions to support governance and to identify systemic issues. Retaliation against complainants is prohibited within organisational policy, and complaint handling is conducted under confidentiality controls. Response timelines for complaints are aligned to operational complexity, and substantive updates are provided within 30 days where possible. This subsection does not limit any statutory rights to seek judicial remedies where available.

Contact channels and data request handling

Operational procedures are implemented so that communications relating to personal data are captured, tracked, and resolved using consistent governance. Requests may be submitted through the contact options made available on nv-spin.eu.com, and the requester should provide sufficient detail to allow identification of the relevant account and the scope of the request. NV Casino may request additional information where needed to confirm identity, clarify the request, or locate data across systems, and such requests are limited to what is proportionate. For security reasons, account related requests may require confirmation through an authenticated channel, and sensitive information is not disclosed through unsecured communication methods. Where an authorised representative submits a request, evidence of authority may be required, such as a signed authorisation or proof of legal representation. Records relating to requests are retained for at least 2 years to demonstrate compliance and to support auditability, subject to longer retention where disputes arise.

Children’s data and age related restrictions

Processing is not intended for individuals who are below the minimum age required to lawfully access gambling services in their jurisdiction, and access controls are designed to prevent underage participation. Where age verification indicates that an individual is underage, NV Casino takes steps to restrict access and to prevent further processing beyond what is required to comply with legal obligations. Documentation relating to underage prevention may be retained to evidence compliance with regulatory expectations, subject to minimisation and access restrictions. Where a jurisdiction imposes an age threshold of 18 or higher, the applicable threshold is applied to the extent the service is offered in that jurisdiction. Any accidental collection of children’s personal data is handled with priority deletion or restriction, unless retention is legally required for reporting or enforcement. This subsection supports the broader compliance goals reflected throughout this Privacy policy.

Policy changes, effective management, and compliance commitment

This Privacy policy may be amended to reflect changes in applicable law, regulatory guidance, operational practices, vendor arrangements, or security standards, and amendments are applied only after internal review and approval. When material changes are made, an updated version is published on nv-spin.eu.com/privacy-policy, and the effective date is adjusted to reflect the date on which the new terms apply. Where required by law, NV Casino provides additional notice or obtains consent for changes that materially affect processing based on consent, and such actions are documented for accountability. NV Casino maintains a compliance programme that includes periodic assessments, vendor due diligence, staff confidentiality obligations, and governance controls designed to uphold lawfulness and transparency across jurisdictions. The commitment includes aligning processing to GDPR style principles where relevant, implementing risk based security controls, and maintaining mechanisms for individuals to exercise rights within required time limits such as the 30 day response standard described above. Where an amendment affects retention, sharing, or international transfer safeguards, the revised terms specify the practical impact and any transitional measures. This section confirms ongoing compliance intention and provides the procedural basis by which this Privacy policy is kept accurate, current, and aligned with data protection standards applicable to a global audience.