How We Use And Protect Player Information
We use personal information to operate an account, process the activity connected with it and protect the casino environment. Slotornado acts as Data Controller for this information.
We handle personal data under the GDPR and PIPEDA framework named in our policy. A Data Protection Officer handles personal-data questions, giving privacy matters a defined route instead of leaving a player to decide which operational team should receive them.
The Information We May Process
The information connected with an account may include several categories:
- Identity and contact details used during registration and verification.
- Financial and transaction records that support deposits, withdrawals and related checks.
- Gaming activity, account settings and communications with our support team.
- Technical and security information that helps protect the service and investigate fraud.
- Marketing preferences where a player has provided the relevant consent.
Some data comes from the player, while other records arrive from verification providers, financial institutions, payment providers, responsible-gaming databases, marketing partners or affiliate partners.
How Privacy Updates Are Handled
Reviewing A Change Before It Takes Effect
We review our privacy wording when the way we process information changes or when the underlying requirements change. A revised policy sets out the current approach so that a player has one place to read the applicable data terms.
Keeping The Policy Readable
We use plain descriptions of the categories, purposes and routes involved. Privacy language still needs precision, but it should also make clear why an account detail, a transaction record or a support message belongs in the process.
Retention By Information Purpose
| Information area | Retention approach | Why we keep it |
|---|---|---|
| Account and identity records | At least five years after account closure where AML duties apply | Verification, compliance and account history |
| Financial and transaction records | For as long as needed or required by law | Payment processing, fraud prevention and record keeping |
| Support communications | For the period needed to address the request and meet applicable duties | Follow-up, security and service quality |
| Technical and security records | For the period needed for protection and monitoring | Detection and investigation of suspicious activity |
When the relevant retention period ends, we delete, anonymise or de-identify personal data as appropriate. Retention is not a reason to hold information indefinitely; it follows the purpose and the legal requirement attached to the record.
Your Data Rights And Requests
Players may use our support route to raise a privacy question or direct a request to the Data Protection Officer. A request that identifies the relevant account details gives us a secure way to locate the correct record before discussing it.
- Ask for information about the personal data connected with an account.
- Request that inaccurate or incomplete personal details receive review.
- Raise a question about the use, sharing or retention of a particular data category.
- Ask how a consent-based marketing preference is being handled.
We keep these requests distinct from ordinary payment or gameplay questions, even when they relate to the same account. That distinction helps us bring the request to the team responsible for the personal-data process.
The Purposes Behind Data Use
We use information to deliver the account service, meet KYC and AML responsibilities, prevent fraud, monitor security and manage player communications. Consent supports marketing where it applies; analytics helps us understand service use; and customer messaging may use third-party conversational AI tools within the messaging platform.
The practical aim is simple: the right record should support the right task, whether that is processing an account action, protecting against misuse or answering a privacy request. Last updated: 13 November 2026.