Data Protection at Spindog: How Your Privacy Is Protected describes which personal data may play a role in your account and which rights you have.
Below you can read why data may be needed, how cookies work and how you can submit a privacy request.
Your privacy at Spindog in brief
Personal data is information that can be linked to you directly or indirectly. The GDPR gives you rights regarding its processing, including access and objection.
Who manages your data at Spindog?
The data controller determines the purpose and means of processing. You can ask us which party fulfils that role for your data.
Which data Spindog asks from you
When using an account, identification data, transaction data and messages sent to us may be relevant. Which data is required depends on the action you perform.
Data when opening your account
For an account, we may ask you for information that makes you identifiable and contactable, such as your name and date of birth. Incorrect information may make a later check more difficult.
Documents for identity verification
An identity document may be required to verify your identity or age. Only share such a document through a designated channel and do not include document details in a public message.
Data for payments and payouts
For a payment, information about the amount, transaction and payment account involved may be required. This information helps process and verify a transaction.
Data Spindog records automatically
A connection to an online service may generate technical data. Together with other information, this data may be traceable to a person.
Technical data from your device
An IP address and browser type may be needed to establish a connection or investigate a technical problem. Under the GDPR, an IP address may be personal data.
Data about your gambling behaviour
Data about use and configured restrictions may be relevant to the operation of your account and to responsible gambling measures.
Why Spindog needs your data
Processing must have a purpose and a legal basis. Depending on the purpose, this may be a contract, legal obligation, consent or legitimate interest.
To make your account and games work
Account data may be needed to give you access and link your actions to the correct account. Performance of a contract may be a legal basis for this.
To comply with legal checks
A legal obligation may require identity or transactions to be checked. In that case, consent is not the legal basis for that mandatory processing.
To prevent fraud and misuse
Transaction and technical data may help investigate suspicious actions. When relying on legitimate interest, your interests and rights must also be taken into account.
To protect players
Data about gambling behaviour and restrictions may help with protective measures. The applicable legal basis depends on the purpose and any legal obligations.
Cookies and similar technologies
Cookies are small files that a website can place on your device. Similar technologies may store or read information to support functions or measure usage.
Types of cookies on the website
Functional cookies may remember a necessary setting. Analytics and marketing cookies have other purposes; prior consent is generally required for non-essential cookies.
Adjusting your cookie preferences
You can withdraw consent for non-essential cookies through the available cookie settings. You can also remove stored cookies or restrict future placement through your browser.
Who Spindog shares data with
Data may be shared with parties that provide a service, such as payment or technical service providers, or with competent authorities where legally required. A processor may only process data under appropriate arrangements.
How long Spindog keeps your data
Data may not be kept in identifiable form longer than necessary for the purpose unless a legal retention obligation or another valid reason requires further retention. Different data may therefore have different retention periods.
How Spindog protects your data
The GDPR requires appropriate technical and organisational security measures tailored to the risks. Access restrictions and encryption are examples of measures that can protect data against unauthorised access.
In addition to appropriate data security, you can take measures yourself to protect your account and personal information against unwanted access or misuse.
- Choose a unique password — Use a strong password for your account that you do not use anywhere else so that a breach at another service creates less risk.
- Keep your device updated — Install security updates for your device and browser so that known vulnerabilities are less easily exploited to steal data.
- Check messages carefully — Be alert to messages asking for your password or identity document and do not share such information through a public message.
- Secure your connection — Avoid entering sensitive information on an unsecured public network and log out when using a shared device.
- Limit the information you share — For a privacy question, only send information necessary to understand your request and wait to provide identity documents until they are requested.
Your rights under the GDPR
You can ask us to exercise your rights. Some rights only apply under certain conditions; a legal retention obligation may, for example, limit deletion.
The following requests allow you to influence how your personal data is handled. State in your request which right you mean and which data it concerns.
- Access — Ask us which personal data we process about you and request a copy so that you can check whether the information is correct.
- Correction — Tell us which information is incorrect or incomplete and provide the correct information so that we can assess your request.
- Erasure — Ask us to delete data and explain why you want it removed; a legal retention obligation may limit this right.
- Restriction — Ask us to restrict processing if, for example, you dispute the accuracy of data while we investigate your objection.
- Portability — Request data that you provided to us in a structured, commonly used and machine-readable format where the GDPR grants this right.
- Objection — Object to processing based on legitimate interest and describe your situation; you can always object to direct marketing.
- Withdraw consent — Withdraw previously given consent for processing based on that consent; this does not make earlier processing based on that consent unlawful.
Accessing and correcting your data
With an access request, you can ask which information about you is being processed. If information is incorrect or incomplete, you can request correction or completion.
Having your data deleted
You can request deletion where a GDPR ground applies. Closing your account does not automatically mean that data subject to a retention obligation is deleted immediately.
Objecting to marketing
You can object to the processing of your personal data for direct marketing. After such an objection, your data may no longer be processed for that purpose.
Submitting a complaint
If you are dissatisfied with how your privacy request has been handled, you can submit a complaint to the Dutch Data Protection Authority. Keep your request and any response as supporting documentation.
Turning off newsletters and offers
You can withdraw consent for marketing or object to direct marketing. Use the unsubscribe option in a message or send us a clear request.
Protection of minors
Age verification can help prevent minors from accessing gambling services. A date of birth or identity document may be relevant for such a check.
Changes to the privacy policy
If a processing activity changes, the information you receive about it must remain accurate and understandable. The GDPR sets requirements for informing data subjects about their data.
Asking questions about your privacy
You can contact us through support with a question about your data or submit a privacy request. State which right you want to exercise and which data you mean.
With these steps, you can send us a privacy request and make clear what you are asking from us. You can also submit a complaint if you are dissatisfied with how it is handled.
- Choose your request — First decide whether you want to request access, correction, erasure, restriction, portability or objection. If it concerns consent, state which processing activity you want to withdraw it for so that we can handle your request specifically.
- Contact us — Send your request through our support or an available privacy channel. State that it concerns a GDPR request and indicate how we can reach you without sending your password or other unnecessary sensitive information.
- Confirm your identity and describe your request — If we have reasonable doubt about your identity, we may ask for additional information. Then describe as precisely as possible which data and period your request concerns so that we can find and assess the correct information.
- Follow up or submit a complaint — Keep a copy of your request and our response. We will handle your request within the period required by applicable law; if you are dissatisfied with the handling, you can submit a complaint to the Dutch Data Protection Authority.