Privacy Policy

Information connected with your account

Your Smooth Spins account involves personal information such as your name, birth details, contact information and payment records. Financial checks may also involve income, employment, assets and affordability information. Your preferences, product use, feedback and transaction history can form part of your account records. These account data practices relate to your gambling service.

How information is obtained

You provide information when registering, making payments, using products, entering promotions, answering surveys or contacting support. Other information may come from public registers, news reports, social media and specialist verification providers. Open banking information may be received when you have consented to sharing it. Publicly available information can therefore contribute to checks alongside the details you submit yourself.

Purposes and permissions

Your information is used to administer the account, process payments, provide support, protect the service and meet regulatory duties. Processing can rely on your contract, legal obligations, consent or legitimate interests that do not override your rights. Crime prevention and AML checks are among those obligations. Usage analysis can help improve services and personalise content.

Marketing messages depend on your opt-in. Sharing your details outside the business for marketing requires express permission. You can stop direct marketing at any time, regardless of other reasons for retaining account information.

Sharing and overseas processing

Account information may be shared within the gambling operator’s group and with service providers, professional advisers, payment businesses, verification agencies and relevant authorities. Service providers must use it for specified purposes under instructions, rather than their own purposes. A business transfer may also involve transferring customer information.

Processing outside the European Economic Area requires safeguards such as recognised adequacy arrangements or approved contractual protections. Organisational and technical measures protect personal records against unauthorised use, loss and disclosure.

Retention periods

Basic customer records are retained for five years after your customer relationship ends. Self-exclusion creates a longer period. Seven years run from the end of the exclusion before the further five-year retention period starts. An investigation or litigation may require longer storage. Closing an account therefore does not automatically erase its records.

Choices and requests

You can seek access to your information, correction of inaccurate details and completion of missing details. You may request erasure when information is no longer needed, restriction in applicable circumstances and transfer of eligible data. Portability does not extend to information inferred or derived about you. Certain processing can be challenged, and a fully automated account decision can be reconsidered by a person with evidence you provide.

Send account privacy requests to the data protection officer. A response is due within 30 days after receipt. You may also complain to the Gibraltar Regulatory Authority about data protection matters.