Privacy casinoisland.is

Effective Date: 25/05/2026
Data Controller: casinoisland.is
Privacy Enquiries: [email protected]

casinoisland.is is committed to handling your personal data with transparency, precision, and respect. This Privacy Policy is written in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and governs all personal data processing activities conducted by casinoisland.is in connection with our website, mobile platform, and related services. Unlike most privacy policies, this one puts your rights first — because understanding what you are entitled to is the most important thing you can take from this document.

1.0 — Your Rights Under GDPR

You hold seven legally enforceable rights over your personal data. These are not conditional on account status or tenure — they apply from your first interaction with casinoisland.is.

1.1 Right of Access

• You may request a full copy of all personal data we hold about you at any time
• Your request will include: what data we hold, how it is used, who it is shared with, how long it is kept, and where it came from
• We will respond within 30 calendar days of identity verification
• Submit requests to: [email protected]

1.2 Right to Rectification

• If data we hold about you is factually incorrect or out of date, you have the right to request correction
• We will complete verified corrections within 30 days
• Updates to verified identity documents require resubmission of current verification material

1.3 Right to Erasure ("Right to Be Forgotten")

• You may request deletion of your personal data where:
  • It is no longer needed for the purpose it was collected
  • You withdraw consent and no other legal basis applies
  • Processing has been unlawful
  • Deletion is required to comply with a legal obligation
• Important limitation: Data held under mandatory legal obligations — including AML records and regulatory transaction history — cannot be deleted until the statutory retention period expires. We will identify any such data when responding to your request.

1.4 Right to Restriction of Processing

• You may request that we pause processing of your data while:
  • The accuracy of the data is being contested
  • Processing is under review following an objection
  • Data is required for legal claims but no longer needed for service purposes
• During restriction, data is held in storage only and not actively used

1.5 Right to Data Portability

• Applies where processing is based on consent or contract and is automated
• You may receive your data in a structured, machine-readable format (such as JSON or CSV)
• You may request direct transmission to another controller where technically feasible
• Submit portability requests to: [email protected]

1.6 Right to Object

• You may object at any time to processing based on our legitimate interests, including profiling
• We must stop that processing unless we can demonstrate compelling grounds that override your interests
• You may object to direct marketing at any time — we will stop immediately upon receipt of your objection, without requiring justification

1.7 Right to Withdraw Consent

• Where processing is based on consent, you may withdraw it at any time
• Withdrawal does not affect the lawfulness of processing carried out before withdrawal
• To withdraw marketing consent: use the unsubscribe link in any communication, or email [email protected]
• To withdraw cookie consent: use the Cookie Settings panel in the platform footer

1.8 Right to Lodge a Complaint

• If you believe your data rights have been infringed, you have the right to complain to your national data protection supervisory authority
• You may also seek judicial remedy against casinoisland.is directly
• We encourage you to contact us first at [email protected] — we resolve the majority of concerns without escalation

2.0 — What Personal Data We Collect

2.1 Personal Identity Data

• Full legal name
• Date of birth
• Email address
• Country of residence
• Username and encrypted password
• Collected at: account registration
• Legal basis: performance of contract

2.2 Identity Verification Data (KYC)

• Government-issued photographic identification (passport, national ID, driving licence)
• Proof of current address (utility bill, bank statement — dated within 90 days)
• Selfie verification image, where required
• Collected at: account verification stage, prior to real-money transactions
• Legal basis: legal obligation (AML and gambling regulation)

2.3 Financial Data

• Payment method type and partial identifier (last four digits where applicable)
• Transaction amounts, currencies, and timestamps
• Payment provider reference numbers
• Deposit and withdrawal history
• Collected at: every deposit and withdrawal
• Legal basis: performance of contract; legal obligation
• Note: Full card numbers are never stored on casinoisland.is systems

2.4 Gameplay Data

• Games played, bet sizes, session durations
• Win and loss records
• Bonus activation and completion records
• Responsible gambling tool usage
• Collected at: every game session
• Legal basis: performance of contract; legitimate interests (player protection)

2.5 Technical Data

• IP address and geolocation derived from IP
• Device type, model, and operating system
• Browser type and version
• Session logs, error reports, page interaction data
• Collected at: every website or platform visit
• Legal basis: legitimate interests (security, fraud prevention, platform optimisation)

2.6 Communication Data

• Support chat transcripts and email correspondence
• Support ticket content and resolution records
• Survey or feedback responses
• Collected at: whenever you contact us
• Legal basis: legitimate interests (service quality and dispute resolution)

2.7 Marketing Preference Data

• Opted-in communication channels
• Campaign interaction data (email opens, link clicks)
• Promotional preference signals
• Collected at: consent opt-in and subsequent interaction
• Legal basis: consent

3.0 — Why We Use Your Data

3.1 Service Delivery

• Operate and maintain your account
• Process deposits and withdrawals
• Deliver game access and record results
• Manage bonuses and promotional credits
• Legal basis: contract performance

3.2 Legal and Regulatory Compliance

• Verify player identity and age before real-money activity
• Monitor transactions for money laundering indicators
• Maintain audit-ready records for gambling regulators
• Enforce responsible gambling obligations including self-exclusion
• Legal basis: legal obligation

3.3 Responsible Gambling Monitoring

• Analyse gameplay patterns for indicators of gambling-related harm
• Trigger proactive welfare contact where statistical risk indicators are identified
• Support voluntary limit-setting and self-exclusion tools
• Legal basis: legitimate interests (player welfare); legal obligation where regulatory duty applies

3.4 Fraud Prevention and Platform Security

• Detect unauthorised account access attempts
• Identify suspicious transaction patterns
• Prevent multi-accounting and bonus abuse
• Monitor for platform integrity violations
• Legal basis: legitimate interests

3.5 Marketing and Personalisation

• Send promotional offers, bonus announcements, and platform updates through consented channels
• Personalise on-platform promotional displays based on gameplay preferences
• Legal basis: consent (withdrawable at any time)

3.6 Platform Development

• Analyse aggregated, anonymised usage data to improve navigation and performance
• Diagnose and resolve technical errors
• Test new features in controlled environments
• Legal basis: legitimate interests

4.0 — Cookies

4.1 Cookie Categories

4.2 Managing Your Cookie Preferences

• Your consent choices are captured at first visit via the cookie consent banner
• You may update preferences at any time through the Cookie Settings panel in the platform footer
• Withdrawing consent for analytical or marketing cookies does not affect platform access or core functionality
• Strictly necessary and functional cookies cannot be disabled without preventing the platform from operating correctly

5.0 — Protections: Sharing, Retention, and Security

5.1 Who We Share Your Data With

We do not sell, rent, or trade your personal data. Sharing occurs only in these defined circumstances:

• Service providers (processors): Payment processors, identity verification providers, cloud hosting, email delivery, and customer support platforms — all operating under binding data processing agreements
• Regulatory authorities: Gambling regulators, financial intelligence units, and law enforcement where disclosure is a legal obligation or lawful requirement
• Responsible gambling registers: Where self-exclusion or multi-operator exclusion programmes require data sharing to the minimum extent necessary
• Business transfers: In the event of a merger, acquisition, or asset sale, player data may transfer as part of that transaction — affected users will be notified in advance

All third-party processors operating outside the European Economic Area are subject to Standard Contractual Clauses approved by the European Commission prior to any data transfer.

5.2 How Long We Keep Your Data

5.3 How We Secure Your Data

• Encryption in transit: TLS 1.2 or higher on all data transmissions
• Encryption at rest: AES-256 encryption for sensitive personal and financial data
• Access controls: Strict role-based access with full logging and quarterly audit
• Payment security: PCI DSS-compliant handling; full card numbers never stored
• Security testing: Regular independent penetration testing and vulnerability assessments
• Breach response: Supervisory authority notification within 72 hours; affected users informed without undue delay per GDPR Articles 33–34

6.0 — Contact and Complaints

For all privacy matters, data subject requests, or concerns about data handling at casinoisland.is, contact us directly:

casinoisland.is
[email protected]

We respond to all privacy enquiries within five working days and complete formal data subject requests within thirty calendar days. Where we cannot resolve a concern to your satisfaction, you retain the unconditional right to escalate to your national data protection supervisory authority.

This policy may be updated periodically. Material changes will be communicated to registered users by email, with an updated effective date published on this page.

7.0 — Automated Decision-Making and Profiling

7.1 What Automated Processing We Conduct

• Fraud detection: Automated systems flag transactions and login events that match patterns associated with account compromise or financial fraud. Flagged events are reviewed by a human operator before any account action is taken.
• Responsible gambling signals: Automated analysis of gameplay data identifies statistical risk indicators. Results inform — but do not automatically determine — any welfare intervention. A human welfare specialist reviews all flagged cases before contact is made or controls are applied.
• Marketing personalisation: On-platform promotional displays are personalised based on game preferences and session behaviour. This profiling does not produce legal or similarly significant effects.

7.2 Your Rights in Relation to Automated Processing

Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing where that decision produces significant legal effects concerning you. At casinoisland.is:

• No account closure, restriction, or legal determination is made by automated means alone
• Human review is embedded in every process that could result in a materially significant outcome for you
• You may request human review of any decision affecting your account by contacting [email protected]