Privacy Policy

Introduction and Data Controller

Welcome to SpinStag Casino (spinstag.co). Protecting your personal data is of the utmost importance to us. This Privacy Policy informs you in detail about how we collect, process, and use your personal data when you visit our website spinstag.co or use our online gambling services.

The data controller responsible for data processing in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is:

This site operates under an MGA licence and is not regulated by the UK Gambling Commission.

Principles of Data Processing

We process personal data in accordance with statutory provisions. Personal data refers to any information relating to an identified or identifiable natural person. The principles we observe include:

  • Lawfulness, fairness, and transparency: Processing is carried out on a lawful, transparent, and comprehensible basis.
  • Purpose limitation: Data is collected exclusively for specified, explicit, and legitimate purposes.
  • Data minimisation: Only data that is strictly necessary for the respective purpose is collected.
  • Storage limitation: Data is only stored for as long as necessary to fulfill the purposes or to comply with statutory retention periods.

Collection and Processing of Personal Data

3.1 When Visiting the Website (Server Log Files)

When you visit our website spinstag.co, our system automatically collects information that your browser transmits to us. These server log files include:

  • IP address of the accessing device (anonymised forms may be used).
  • Date and time of access.
  • Name and URL of the retrieved file.
  • Website from which access is made (referrer URL).
  • Browser and operating system used.

The legal basis for this processing is Article 6(1)(f) of the UK GDPR (legitimate interest in ensuring system security, stability, and troubleshooting).

3.2 Registration and Account Opening

To use the casino games and services on spinstag.co, you must create a user account. During this process, we collect the following data:

  • First and last name.
  • Date of birth and age (to verify that you are of legal age in accordance with UK gambling regulations).
  • Residential address and postcode.
  • Email address ([email protected] for support inquiries).
  • Telephone.
  • Login details (username and encrypted password).

The legal basis for this is the performance of a contract pursuant to Article 6(1)(b) of the UK GDPR, as well as legal obligations pursuant to Article 6(1)(c) of the UK GDPR in conjunction with anti-money laundering regulations and gambling laws.

Identity Verification and Player Protection (KYC & AML)

  • KYC (Know Your Customer): We require identification documents (e.g, passport or driving licence), proof of address (e.g, recent utility bills or bank statements), and, where applicable, proof of the origin of funds used (Source of Wealth / Source of Funds).
  • Player Protection and Self-Exclusion: To protect against problem gambling and comply with UK regulatory standards (such as participation in schemes like GAMSTOP), we process data for gambling addiction prevention. Note that this scheme does not cover this site: registering with it does not block an account here. This includes data matching with self-exclusion registers to protect vulnerable individuals.

The legal basis is Article 6(1)(c) of the UK GDPR (compliance with legal obligations) and Article 6(1)(e) of the UK GDPR in the public interest of player protection.

Payments and Payment Methods

For deposits and withdrawals on spinstag.co, we work with secure payment service providers. Depending on availability in the United Kingdom, players can use common payment methods such as debit cards (Mastercard, Visa), bank transfers, e-wallets (such as Skrill, Neteller, PayPal), or instant banking services (such as Trustly or Apple Pay).

  • Data transfer: When processing payments, we transmit the data necessary for the transaction (e.g, name, transaction amount, bank or card details) to the respective payment service provider.
  • Legal basis: Processing is carried out to perform the casino contract (Article 6(1)(b) of the UK GDPR) and to comply with statutory tax and commercial law obligations (Article 6(1)(c) of the UK GDPR).

Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies on spinstag.co to ensure the functionality of the website, optimise the user experience, and conduct statistical analyses.

  • Essential cookies: These are strictly necessary for the smooth operation of the website, account management, and the execution of transactions.
  • Analytical and marketing cookies: With your consent (via our cookie banner), we use analytics tools to understand how players use our platform. You can withdraw your consent at any time with effect for the future.

The legal basis for essential cookies is PECR and Article 6(1)(f) of the UK GDPR; for non-essential cookies, it is your consent pursuant to Article 6(1)(a) of the UK GDPR.

Disclosure of Data to Third Parties

We generally only transfer your personal data to third parties if:

  • You have given your explicit consent (Article 6(1)(a) of the UK GDPR).
  • The disclosure is necessary for the establishment, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding protection-worthy interest in the non-disclosure of your data (Article 6(1)(f) of the UK GDPR).
  • This is legally permissible and necessary for the performance of contractual relationships (e.g, payment service providers, IT service providers, identity verification providers acting as data processors under Article 28 of the UK GDPR).

Retention Period and Deletion of Data

We store your personal data only for as long as necessary to fulfill the purposes for which it was collected.

  • Statutory retention periods: Due to tax and anti-money laundering regulations (such as UK anti-money laundering legislation and company law), we are required to retain certain player and transaction data for a period of up to 5 to 10 years after account closure.
  • After these periods expire, the corresponding data is routinely deleted, unless its continued processing is required for limited purposes (e.g, legal disputes).

Your Rights as a Data Subject

As a data subject, you have comprehensive rights under the UK GDPR, which you can assert against us at any time:

  • Right of access (Article 15 of the UK GDPR): You have the right to request confirmation as to whether we process personal data about you and to obtain access to that data.
  • Right to rectification (Article 16 of the UK GDPR): You can request the correction of inaccurate data or the completion of your data stored with us.
  • Right to erasure (Article 17 of the UK GDPR): You have the right to request the deletion of your personal data, provided there are no statutory retention obligations or overriding legitimate interests on our part.
  • Right to restriction of processing (Article 18 of the UK GDPR): Under certain conditions, you can request the restriction of the processing of your data.
  • Right to data portability (Article 20 of the UK GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format or to request transmission to another controller.
  • Right to object (Article 21 of the UK GDPR): You can object to the processing of your data based on legitimate interests for reasons arising from your particular situation.
  • Withdrawal of consent (Article 7(3) of the UK GDPR): You can withdraw consent given at any time with effect for the future.

To exercise your rights or if you have any questions about data protection, you can contact our support team at any time by email at [email protected].

Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the UK GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority, such as the Information Commissioner's Office (ICO) in the United Kingdom.

Data Security

We implement up-to-date technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures, such as SSL/TLS encryption for data transmission, are continuously improved in line with technological developments.

Currency and Modification of this Privacy Policy

This Privacy Policy is currently valid (as of 2026). Due to the further development of our website spinstag.co or changes in statutory or regulatory requirements, it may become necessary to amend this Privacy Policy. The current version can be viewed and retrieved on our website at any time.