Effective Date: 25/05/2026
Data Controller: casinoiceland.is
Data Protection Contact: [email protected]
PART A — SCOPE AND CONTROLLER IDENTITY
Chapter 1: Application and Legal Basis of This Notice
This Privacy Notice ("Notice") is issued by casinoiceland.is ("the Controller," "we," "us") and governs all processing of personal data conducted by the Controller in connection with the operation of its online gaming platform, website, mobile applications, and ancillary services. This Notice has been prepared in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("the General Data Protection Regulation" or "GDPR"), and applicable national data protection legislation in force in the jurisdictions in which casinoiceland.is operates.
This Notice applies to all natural persons who interact with the Controller's platform in any capacity, including prospective players browsing the website, registered account holders, and former players whose data is retained in accordance with statutory obligations. Legal persons and entities are not data subjects within the meaning of this Notice. By accessing the Controller's platform, you acknowledge that you have been presented with this Notice and that its contents govern the processing of your personal data. Where processing is based on consent, separate and specific consent will be sought at the appropriate point of collection.
The Controller is responsible for determining the purposes and means of personal data processing as described herein. All enquiries regarding this Notice, requests to exercise data subject rights, or complaints relating to data processing should be directed in writing to [email protected]. The Controller will acknowledge all such communications within five working days and provide a substantive response within the timeframes prescribed by GDPR.
PART B — DATA COLLECTION
Chapter 2: Categories of Personal Data Collected
The Controller collects personal data across four principal categories, each arising from a distinct aspect of the player relationship. The first category, personal identity data, encompasses information provided at registration and during account management, including full legal name, date of birth, email address, country of residence, and account credentials. This data is collected for the purpose of establishing and maintaining the contractual relationship between the player and the Controller. The second category, identity verification data, is collected in fulfilment of the Controller's obligations under applicable anti-money laundering legislation and gambling regulatory requirements. It comprises government-issued photographic identification, documentary proof of address, and where required, biometric verification material such as a selfie image submitted alongside identification documents. This data is processed by the Controller's regulated identity verification partner under a binding data processing agreement that restricts use to the purpose of verification only.
The third category, financial data, is generated at each transactional interaction with the platform, including deposits, withdrawals, and bonus transactions. Financial data collected includes payment method identifiers, transaction amounts, timestamps, currency designations, and payment provider reference numbers. The Controller does not retain full payment card numbers on its systems at any point; card data is handled exclusively through a Payment Card Industry Data Security Standard ("PCI DSS") compliant processing environment maintained by the Controller's payment service provider. The fourth category, technical and behavioural data, is collected automatically during each visit to or session on the Controller's platform. It encompasses Internet Protocol addresses, device identifiers, browser characteristics, operating system information, session logs, page interaction records, referral source data, and gameplay records including games accessed, wager amounts, session durations, and win and loss outcomes. Additionally, the Controller collects communication data arising from support interactions, including chat transcripts, email correspondence, and support ticket records.
PART C — PURPOSES AND LEGAL BASES OF PROCESSING
Chapter 3: Lawful Processing Purposes
The Controller processes personal data exclusively for purposes that are supported by a defined lawful basis under Article 6 GDPR, and where applicable, Article 9 GDPR. Processing for the delivery of contractual services — including account operation, transaction processing, game access, and bonus administration — is conducted on the basis of the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) GDPR. Processing undertaken to fulfil regulatory and statutory obligations, including identity verification, transaction monitoring for money laundering indicators, and the maintenance of records required by gambling licensing conditions, is conducted on the basis of compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.
Processing activities directed at the prevention of fraud, unauthorised account access, and platform abuse are conducted on the basis of legitimate interests pursued by the Controller pursuant to Article 6(1)(f) GDPR, having regard to the balancing test required by Recital 47 of the Regulation. The Controller has assessed that its security and fraud prevention interests are not overridden by the interests or fundamental rights of data subjects in this context, given the proportionality of the measures applied and the direct benefit to players of maintaining platform integrity. Processing for responsible gambling monitoring — including the analysis of gameplay patterns to identify statistical indicators of disordered gambling behaviour and the delivery of welfare interventions — is similarly conducted on the basis of legitimate interests, with the Controller having determined that this processing is necessary to protect the vital and fundamental interests of players and does not materially prejudice individual privacy where human review is applied to all welfare decisions. Processing of personal data for direct marketing communications is conducted solely on the basis of freely given, specific, informed, and unambiguous consent pursuant to Article 6(1)(a) GDPR.
PART D — COOKIES
Chapter 4: Deployment and Governance of Cookies
The Controller deploys cookies and analogous tracking technologies on its platform in four defined categories. Strictly necessary cookies are deployed without consent as they are essential to the technical functioning of the platform, providing session management, login authentication, and security token services; these cookies expire at session termination or within twenty-four hours. Functional cookies preserve user preferences including language selection and display settings and persist for a period of up to twelve months; these cookies do not require consent as they are necessary for the provision of the service as requested by the user. Analytical cookies collect aggregated and anonymised performance and error data to support platform improvement and are deployed only upon receipt of the user's affirmative consent; they are retained for a period of up to thirteen months. Marketing cookies support personalised promotional content and affiliate attribution and are likewise deployed only upon consent; they persist for up to twenty-four months. Users may review and modify their cookie consent preferences at any time through the Cookie Settings panel accessible in the footer of the Controller's platform. Withdrawal of consent for non-essential cookies does not impair access to core platform functionality.
PART E — THIRD-PARTY SHARING
Chapter 5: Disclosure of Personal Data to Third Parties
The Controller does not sell, licence, or otherwise commercially transfer personal data to third parties. Personal data is disclosed only in the following defined circumstances. Data processors engaged by the Controller to deliver platform services — including payment processing providers, identity verification services, cloud infrastructure providers, customer support software operators, and marketing delivery platforms — receive personal data to the minimum extent necessary to perform their contracted function, and are bound by data processing agreements that prohibit secondary use of personal data and require GDPR-compliant handling standards. Regulatory authorities, gambling supervisory bodies, financial intelligence units, and law enforcement agencies receive personal data where such disclosure is required by applicable law or a lawful regulatory demand; the Controller does not disclose data to such authorities beyond the scope of the legal obligation. Multi-operator responsible gambling registers receive the minimum personal data necessary to give effect to player self-exclusion requests under applicable regulatory frameworks. In the event of a corporate restructuring, merger, acquisition, or asset sale involving the Controller, personal data may be transferred as part of the transaction subject to written notification to affected data subjects in advance of the transfer. All processors and recipients operating outside the European Economic Area are subject to appropriate safeguards, including Standard Contractual Clauses adopted pursuant to Article 46(2)(c) GDPR, prior to any international transfer.
PART F — RETENTION AND DELETION
Chapter 6: Data Retention Framework
The Controller retains personal data only for the duration necessary to fulfil the purpose for which it was collected, or as mandated by applicable law. Account identity and KYC records are retained for five years following permanent account closure in accordance with anti-money laundering regulatory requirements. Financial transaction records are retained for seven years from the date of the relevant transaction in accordance with applicable tax and financial legislation. Gameplay records are retained for three years from session date. Support correspondence is retained for two years from the date of resolution. Technical log data is retained for twelve months from generation. Marketing preference data is retained until consent is withdrawn. Upon expiry of the applicable retention period, personal data is permanently and securely deleted from the Controller's systems and those of its processors. Where a data subject exercises the right to erasure prior to the expiry of a mandatory retention period, the Controller will delete all data not subject to legal retention obligations and will clearly identify any data that cannot be deleted with the applicable legal basis.
PART G — DATA SUBJECT RIGHTS AND SECURITY
Chapter 7: Rights of Data Subjects Under GDPR
Data subjects have the right to access personal data held by the Controller (Article 15); to rectify inaccurate or incomplete data (Article 16); to request erasure where applicable grounds exist (Article 17); to request restriction of processing during disputes (Article 18); to receive data in portable format where processing is automated and consent- or contract-based (Article 20); to object to processing based on legitimate interests or for direct marketing (Article 21); and to withdraw consent at any time without detriment to prior lawful processing (Article 7(3)). Requests to exercise any of these rights should be submitted in writing to [email protected] with sufficient identifying information to permit verification. The Controller will respond within thirty calendar days. No fee is charged for standard requests. Where the Controller cannot fulfil a request due to a conflicting legal obligation, it will provide a written explanation identifying the applicable basis. Data subjects who are unsatisfied with the Controller's response retain the unconditional right to lodge a complaint with the competent national supervisory authority and to seek judicial remedy.
Chapter 8: Security Measures
The Controller maintains a multi-layered technical and organisational security programme encompassing Transport Layer Security (TLS 1.2 or higher) for all data in transit; AES-256 encryption for sensitive data at rest; role-based access controls with comprehensive access logging and periodic audit; PCI DSS-compliant payment data handling; regular independent penetration testing and vulnerability assessment; and a documented data breach response protocol providing for supervisory authority notification within seventy-two hours and individual notification without undue delay, in accordance with Articles 33 and 34 GDPR respectively.
casinoiceland.is | [email protected]