As a regulated operator in Italy, termini e condizioni richroyalcasinò, we obtain and look after personal and transactional data under stringent legal obligations. This policy outlines exactly how long we keep different categories of information, the legal reasons behind those periods, and the security measures that safeguard your data at every stage. We continuously balance our duty to retain records for fraud prevention and financial audits with the privacy rights you hold under Italian data protection law and the GDPR. Our schedules undergo regular reviews so we stay fully compliant.
Data Types and Retention Periods
We organize all user data into clear categories, each tied to a retention schedule that corresponds to its purpose and legal context. That systematic approach stops us from retaining things forever. Every year our Data Protection Officer examines these categories and updates the timelines whenever new guidance comes from the Garante per la protezione dei dati personali. Below you’ll find how long each data type stays in our live systems before being securely anonymised or deleted. Archived backups roll on a ninety‑day cycle because of technical restrictions.
Identification and Monetary Records
Identity documents you upload during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, are kept on file for ten years after you end your account, as anti‑money laundering law stipulates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are kept for ten years from the date of each transaction, satisfying both AML requirements and Italian Civil Code limitation periods. We hold these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline passes, we remove all personal identifiers permanently; statistical trends may still be used but never in a way that connects to any individual.
User Activity and Customer Support Interactions
Detailed logs of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.
Safe Gaming and Self‑Exclusion Data
Once you enable self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.
Data Transfers Abroad and Storage Periods
Our primary infrastructure sits within Italy and the wider European Economic Area. Some ancillary services, like fraud detection platforms and customer relationship tools, may send limited personal data to countries external to the EEA. In those cases, we make sure an adequacy decision exists or we put Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we apply to transferred data mirror those in this policy, and processors are contractually bound to delete or return data when the service ends. We keep a public register of sub‑processors, updated within fourteen days of any change, and we favour vendors with Italian data centres. Geo‑fencing rules maintain Italian user data inside European boundaries, verified through yearly audits.
Data Security Throughout Preservation
Held data is protected with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access necessitates multi‑factor authentication plus just‑in‑time privilege elevation that ends on its own. Every access event is written into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to ensure our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard flags every dataset as it nears expiration.
Access Governance and Workforce Training
Only employees whose roles demonstrably require access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records prompts a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and distinguishing the difference between data we must keep under a legal hold and data we can delete straight away.
Data Subject Rights and Retention Management
When you file an erasure request, our system automatically checks each data category against its retention schedule. Anything past its mandatory window is erased without delay. For data still governed by a legal retention obligation, we secure it right away so it’s excluded from active use and stored only for compliance storage; we advise you which specific law applies and the date deletion becomes possible. Access requests are answered within thirty days and include a breakdown of what we keep, why, and the scheduled deletion date. If you question accuracy, we attach a note instead of altering the original record, so the audit https://www.repubblica.it/giochi-e-scommesse/lotto-10-e-lotto/2024/06/27/news/estrazioni_lotto_e_10elotto_i_numeri_di_giovedi_27_giugno-423312696/ trail stays intact. Portability requests are fulfilled in a structured, machine‑readable format even while data is still in its retention window.
Affiliate Programme Data Retention
Affiliate partnership data, including contact details, payout data and commission payment history, remains for the entirety of the active relationship plus a decade after the partnership concludes. That’s driven by tax requirements on commission transactions, which require long‑term financial documentation. Affiliate performance statistics and combined referred-player data get anonymized after five years. We strictly forbid affiliates from separately gathering or storing personal information about referred customers; they receive only anonymized, aggregated statements. Our affiliate contracts include audit rights to verify compliance, and any breach is reason for instant agreement cancellation and commission loss.
Policy Changes and User Notification
We review this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations. Minor clarifications are published silently with a revised effective date. Material changes that modify retention periods, add new data categories or shift the legal basis for processing are communicated directly to you by email at least thirty days before they come into force. You’ll also notice an in‑platform banner notification when you log in during the notice period. Historical versions are kept and available on request, each with a version number and a validity date range. If an earlier version gave a shorter retention period for certain data, we follow that promise for data collected under that version and apply new terms only going forward.
Legal Basis for Information Storage
Our retention approach rests on several regulatory requirements that affect gambling operators serving the Italian market. Anti‑money laundering regulations from the Italian Financial Intelligence Unit require us to keep transaction records, identity verification documents and suspicious activity reports for a specific duration after the business relationship ends. Meanwhile, tax rules enforced by the Agenzia delle Entrate demand we preserve financial records that substantiate taxable gaming revenue and player winnings. These requirements override any general right to erasure during the mandatory period. For operational data that falls outside a fixed legal window, we use legitimate interest assessments where a valid reason exists, and we allow an opt‑out unless a compelling legal obligation stops us.
Consent‑Based Retention
Marketing preferences, newsletter sign‑ups and the behavioural analytics used for personalised offers are kept only with your explicit consent. You can revoke consent anytime through your account dashboard; once you do, we halt that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal is separated from active systems to block further use, but it is not removed retroactively. Consent records themselves are kept for six years as proof of compliance. We do not use this data for anything beyond the activity you agreed to.
Data Removal Procedures
When a information type hits the end of its planned retention period, our self-running lifecycle mechanism kicks off a safe removal process. First, the data gets digitally detached from production databases. Next, physical storage blocks are replaced with random data patterns to stop forensic recovery. Finally, a crypto-stamped record lands in a regulatory record, giving traceable confirmation that deletion happened on time. Backup copies refresh every ninety days, so any deleted data is removed from all media within three months. When a litigation hold applies, we pause the deletion workflow only for the affected records, document the hold reason, and continue once the hold lifts.
Popular Queries
May I request data erasure before the retention period expires?
Certainly, you can submit a deletion request at any moment. We instantly examine each data category in relation to its legal retention duty. If no legal obligation applies, we erase it promptly. Regarding items we must preserve, we confine them to storage‑only, explain the legal basis blocking instant erasure, and share the projected deletion date. You can also view all your data categories with their scheduled deletion dates through your account dashboard. This partial method honors your rights to the extent permitted by Italian regulations.
What occurs with my data when I opt for permanent self‑exclusion?
Upon enrolling in permanent self‑exclusion, your identity information is transferred to a specialized exclusion register that remains active indefinitely under strictly controlled access. This is a legal mandate designed to stop you from creating new accounts. Your gaming and transaction history, however, still complies with standard retention schedules and is removed after those periods conclude. The self‑exclusion entry is isolated from all marketing and operational systems, thus it fulfills solely the protective purpose for which it was gathered. No promotional communications will reach you.
How do you handle data belonging to inactive accounts?
An account is deemed inactive following twelve consecutive months without a login. più opzioni Then, we automatically halt marketing messages and place the account into a dormant condition with minimized processing. The underlying retention periods remain active according to the original data collection dates, not the date of inactivity. Consequently, data from an inactive account is kept for the entire statutory duration applicable to its type and then removed in line with our usual processes. Should you return after an extended absence, you may be required to undergo a new Know Your Customer verification to reactivate. Your data dashboard shows the current status at all times.