Most people who browse Spinmama Casino follow the privacy notice and ignore its content. They figure it’s only a tedious legal protection. I see my role from another perspective. I intend to explain exactly what happens behind that link, so you can understand why every data point we collect serves a concrete purpose — from age verification to affiliate programme reporting — and how Belgian and European law shapes every choice we make.
The method We Secure and Store Your Information
I treat security as a ongoing project, not a single checklist. Encryption secures your data both while it transfers between your device and our servers and when it resides in our databases. I use TLS 1.3 for transmission and AES-256 encryption for storage, and I change encryption keys according to a timetable that matches current industry standards.
Our main data centres are based within the European Union and are audited against ISO 27001. I have inspected the facilities myself to validate the physical safeguards: biometric access controls, 24-hour surveillance and redundant power supplies. Infrastructure engineers perform penetration tests at least twice a year, and any critical vulnerability is patched within a set remediation window.
Data holding periods are as vital as technology. I use different schedules for different data types. Payment records remain for the legally required seven years, while customer service chat logs are typically deleted after twelve months unless a dispute stays open. I regularly clean inactive accounts and orphaned data that no longer serve a lawful purpose.
In the unlikely event of a personal data breach that represents a risk to your rights and freedoms, I am obliged to notify the Belgian Data Protection Authority within 72 hours. If the risk is significant, I will also inform you directly without undue delay, describing what happened, what we are doing about it and which steps you should take to protect yourself.
The Purpose of KYC Checks in Information Processing
Know Your Customer procedures are not a business decision; they are a legal obligation imposed by Belgian anti-money laundering legislation and our gaming licence conditions. When I ask you to submit a copy of your identity card, a recent utility bill or a bank statement, I am performing a duty that protects both you and the wider financial system.
I manage those documents with special attention. Copies of ID cards are encrypted at rest and in transit, and I hold them on access-controlled servers within the European Economic Area unless a specific derogation applies. Only our compliance officers can access those files, and only when a manual check is needed or a supervisory authority requests an audit trail.
I also implement data minimisation principles to KYC files. If a passport photo page is adequate to verify identity, I do not need the pages showing previous travel stamps. Similarly, a bank statement can be modified to show only your name, address and the issuing institution. I encourage my team to guide you on safe redaction before you send any document.
Once verification is done, I do not keep the raw documents indefinitely. Our retention schedule aligns with the five-year period recommended by anti-money laundering guidelines, after which the files are irreversibly erased or irreversibly anonymised. I will not hold your identity documents a day longer than my legal obligations demand.
In what manner Affiliate Programmes Create Shared Data Flows
Affiliate partnerships are a vital part of our growth, but they also introduce data flows that I take seriously. When you arrive at Spinmama Casino through an affiliate link, a click identifier is stored in a first-party cookie. That identifier reveals which affiliate referred you, but it does not, by itself, expose your name or personal details.
Once you sign up and deposit, our system matches the affiliate tag to your account event. I then share certain non-personal metrics with the affiliate partner: typically a hashed or anonymised user ID, registration date, deposit amount and net gaming revenue assigned to that account. I never share your real name, contact information or full payment details to an affiliate.
Before we bring on any affiliate, I demand a signed data processing agreement that mirrors the standards of our own privacy policy. The agreement prevents the affiliate from re-identifying users or combining our data with other sources in a way that would circumvent GDPR protections. I periodically review compliance and cut ties with partners who violate these rules.
I also make sure that you are informed about this sharing before it happens. Our cookie consent layer clearly marks affiliate tracking as a subcategory of functional or marketing cookies, depending on its configuration. You retain the right to refuse non-essential cookies, but please be aware that blocking affiliate tracking will simply mean we cannot credit your registration to any partner, which may influence any promotional offers you expected.
The Legal System Defining Your Data Rights
When offering guidance on privacy issues in Belgium, I consistently begin with the General Data Protection Regulation. The GDPR applies directly to any entity processing the personal data of individuals in the European Economic Area, and Spinmama Casino is no exception. It provides you with rights that override any contractual term we could try to impose.
Belgium adds its own layer through the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. This law fills in the gaps where the GDPR allows member state discretion, for instance regarding the processing of national identification numbers. We must respect that national layer alongside the European text.
I also keep the Belgian Gambling Act and its royal decrees readily available. The Act requires operators to confirm identity before granting access to real-money play. That obligation provides us with a clear legal basis to request and process identity documents, which means your consent is not the only basis we rely on for KYC data.
The ePrivacy Directive also affects how we use cookies and similar tracking technologies. The Belgian implementation, overseen by the BIPT, mandates informed consent before we place non-essential trackers. I see to it that our cookie banner and consent management platform reflect that requirement with genuine granular choice.
Your Rights Under the General Data Protection Regulation
I aim you to be confident exercising your GDPR rights with us. The right of access permits you to demand a copy of all personal data we hold about you at any time. When such a request reaches my desk, I check your identity, gather the information in a structured, commonly used format and reply within one month.
If you discover inaccuracies, the right to rectification permits you to fix them. I ask you to point out outdated address details or spelling errors promptly, because inaccurate data can delay withdrawals and make difficult KYC re-verification. I then revise our systems and advise any third parties to whom the data was disclosed, unless that is impossible or disproportionate.
The right to erasure, often known as the right to be forgotten, is not absolute in the casino context. I must offset it against our obligation to maintain records for AML supervision and responsible gaming measures. While I can remove marketing profiles and unused accounts quickly, core transaction logs will stay for the mandatory retention period. I always explain any refusal to erase based on legal grounds.
You also have the right to restrict processing and the right to data portability. Restriction makes sense when you dispute accuracy or oppose to processing while we examine. Portability signifies I can send your basic account data directly to another controller if you decide to switch platforms, as long as the transfer does not compromise the security of our systems or the privacy of others.
What Information We Collect and For What Reason
When you open an account at Spinmama Casino, I wonder whether each data field is truly necessary. Registration commonly requires your name, date of birth, address, email and phone number. I need those to ensure you are of legal age, to get in touch with you and to comply with anti-money laundering rules that require accurate customer identification.
Beyond registration, our systems track technical data every time you visit https://spinmamas.eu/fr-be/legal-and-affiliates/. I can access your IP address, browser type, device fingerprint and the pages you view. This information assists me in detecting fraud, diagnosing performance issues and understanding how our site is used. I under no circumstances use it to construct invasive behavioural profiles for unrelated marketing.
Payment processing involves financial data. Depending on your chosen method, we may gather bank account details, card numbers or e-wallet identifiers. I instruct our payment team to encrypt sensitive card data immediately, so that full numbers never stay in our own database longer than necessary. The token is of no use outside our designated payment gateway.
I also aim to be candid about game logs and betting history. Every wager, win, loss and session timestamp is documented. This data is essential for dispute resolution, responsible gaming alerts and regulatory reporting. I limit access to these logs to staff who need them for a specific purpose, and I review that access regularly.
What makes a Casino Privacy Policy Is Not Just a Formality
I commonly hear that privacy policies are solely meant to shield companies from lawsuits. The reality has greater subtlety. A carefully composed policy represents a commitment to you. It establishes the parameters for what we can and cannot do with your personal information, and it offers you the ability to hold any operator accountable if something malfunctions.
For a licensed casino targeting Belgian players, that promise is not optional. The Belgian Gaming Commission and the Data Protection Authority expect clear, accessible documentation. When I examine a privacy notice, I seek concrete details about retention periods, international transfers and the legal basis for processing. Vague language raises a warning sign.
In my experience, a open privacy policy also reduces friction. When you appreciate why we need a copy of your identity card or why a cookie follows an affiliate link, you are far less likely to imagine abuse. That trust enables us to operate a smoother operation and ensures our regulatory obligations remain under control.
Finally, a well-constructed privacy policy serves as an internal guide. It compels each department — marketing, payments, customer support — to harmonize its daily operations with the same data protection principles. Without that formal benchmark, even well-meaning teams can slide into problematic zones.
Časté dotazy
Does Spinmama Casino share my personal information to external entities?
No. I don’t rent your personal information for commercial gain. The exclusive third-party shares we carry out are to vendors governed by strict data processing agreements — payment providers, KYC verification platforms and hosting providers. These companies are unable to employ your data for their own goals, and I monitor their conformity through regular audits and contractual obligations.
What period do you retain my identity papers after KYC?
I hold records of ID documents and residence proof for 5 years after the termination of our commercial relationship, in accordance with Belgian anti-money laundering requirements. Once that holding timeframe ends, the documents are securely removed from our encrypted vault. If you end your account before that, the clock begins from the closure date, but the lowest legal holding still remains in effect.
Am I able to request deletion of my account and all associated data?
You are able to ask for deletion, and I will remove all data that is not subject to a legal storage requirement. This generally means your marketing profile, preferences and any extraneous metadata are deleted promptly. That said, transaction logs, KYC records and responsible gaming markers must be kept for the periods stipulated by gambling and AML regulations. I will provide you a comprehensive list of what remains and the reason.
What occurs with my data if I sign up through an affiliate link?
When you click an affiliate link, a first-party cookie saves a referral identifier. If you register and deposit, the affiliate receives a hashed user reference, registration date and aggregated wagering metrics — in no way your name, email or payment details. This sharing is governed by a data processing agreement that forbids re-identification, and you can reject affiliate tracking cookies via our consent banner without impacting core site functionality.
Who oversees data protection complaints in Belgium?
The Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) is in charge of enforcing the GDPR at national level. You can submit a complaint with them at Drukpersstraat 35, 1000 Brussels, or via their website, if you believe I have mishandled your information. I also encourage you to contact our Data Protection Officer first, so we can address the issue directly.