Privacy Policy

This privacy notice explains how SpinyRush collects, stores and processes the personal data of visitors to this microsite and players on the operator platform. It is written in plain English and reflects the rights you have under the EU/UK GDPR and equivalent regulations.

Last updated: 30 June 2026
Data controller: Comentive LTD, Sea Urchin Street, San Pedro Town, Ambergris Caye, Belize (Reg. No. 000047924).
Payment agent (joint controller for transaction data): Norvelic LIMITED, Cyprus (Reg. No. HE 475930).
Contact: [email protected].

1. What data we collect

We collect only what is necessary to operate this microsite, run the operator platform and meet our legal obligations:

• Site analytics (this microsite): anonymised page views, country (from IP), device type, referrer, broad session duration.
• Account data (operator site): name, date of birth, email, phone number, country of residence, account currency and chosen username/password hash.
• KYC data (operator site): a copy of a government-issued ID, a recent utility bill or bank statement, and where relevant a source-of-funds declaration.
• Transaction data: deposits, withdrawals, bonus credits, the payment method used and reference IDs from Norvelic LIMITED.
• Gameplay data: wagers, results, bonus activity, sessions and any responsible-gambling tool you activate.
• Support data: chat transcripts and emails you exchange with our support team.

2. Why we process it (lawful basis)

• Contract - to open, maintain and close your account, process deposits and withdrawals, pay out winnings and run promotions you opt into.
• Legal obligation - AML, KYC, source-of-funds, fraud prevention and licence-reporting requirements under our Anjouan licence (ALSI-202505024-FI1) and applicable AML directives.
• Legitimate interest - analytics, fraud detection, network security, and product improvement, balanced against your privacy rights.
• Consent - marketing emails, SMS and push notifications. You can withdraw consent at any time from your account or by replying STOP to a message.

3. Who we share it with

• Norvelic LIMITED (payment agent) and our card acquirers, for processing deposits and withdrawals.
• Game suppliers (Pragmatic Play, NetEnt, Evolution, etc.) - only an anonymised player ID, never your name or email.
• KYC providers - for document verification and PEP/sanctions screening.
• Hosting and infrastructure providers located in the EEA and the UK.
• Regulators and law enforcement when legally compelled (Anjouan licensing authority, courts, financial intelligence units).

We do not sell personal data to advertisers or third parties.

4. International transfers

Where data is transferred outside the EEA/UK (for example to our headquarters in Belize), we rely on the EU Standard Contractual Clauses (2021/914) or the UK International Data Transfer Addendum, plus supplementary technical measures (encryption in transit and at rest).

5. How long we keep it

• Account & KYC records: 5 years after account closure (AML retention requirement).
• Transaction records: 7 years (tax and accounting).
• Gameplay logs: 12 months for player-protection review, then aggregated.
• Marketing data: until you withdraw consent or after 24 months of inactivity, whichever comes first.
• Microsite analytics: 14 months, IP-truncated.

6. Your rights

You have the right to access, rectify, erase, restrict, port or object to processing of your personal data, and to withdraw consent for marketing at any time. To exercise any of these, email [email protected] from your registered address. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority - in the UK, that is the Information Commissioner’s Office (ico.org.uk).

7. Cookies

This microsite uses essential cookies only (session, language, cookie-banner state). The operator site uses a richer set: strictly necessary, functional (remember-me, currency), analytics (privacy-respecting, IP-truncated) and, with your consent, marketing pixels. You can change cookie preferences at any time from the cookie banner footer link on the operator site.

8. Security

All traffic is encrypted with TLS 1.3. Passwords are stored hashed with bcrypt. Card data is never stored on our servers - it is tokenised at the acquirer. Our infrastructure is monitored 24/7 and undergoes annual independent penetration testing.

9. Changes to this policy

We will publish material changes here at least 14 days before they take effect and notify active accounts by email. The version date at the top of this page is always the canonical one.