Privacy Policy Orovon Casino

1. Data Controller

Orovon Casino (hereinafter "we", "us" or "the casino") is the data controller within the meaning of the General Data Protection Regulation (GDPR) for the personal data processed in the context of the gambling services we offer. Our casino operates under a licence from the Kansspelautoriteit (KSA).

2. What data do we collect?

Account data

• Name and date of birth
• Email address and phone number
• Home address and postcode
• Username and password (encrypted)

Verification data (KYC)

• Copy of identity document (passport, driving licence or ID card)
• Proof of address (no older than 3 months)
• Payment method information for verification

Financial data

• Deposit and withdrawal history
• Payment methods used
• Transaction amounts and timestamps

Gambling behaviour data

• Games played and session duration
• Bets, winnings and losses
• Use of bonuses and promotions

Technical data

• IP address and device information
• Browser type and operating system
• Cookie data (see our cookie policy)

3. Purposes of data processing

We process your personal data for the following purposes:

• Performance of contract: creating and managing your account, processing payments and providing gambling services
• Legal obligations: age verification, KYC/AML checks, CRUKS check, reporting to KSA and compliance with the Wwft
• Responsible gambling: monitoring gambling behaviour and timely intervention in risk behaviour
• Customer service: answering questions and handling complaints
• Fraud prevention: detection and prevention of fraud and abuse
• Marketing: sending personalised offers (only with your consent)

4. Legal bases for processing

• Performance of contract (Article 6(1)(b) GDPR)
• Legal obligation (Article 6(1)(c) GDPR)
• Legitimate interest (Article 6(1)(f) GDPR) for fraud prevention and security
• Consent (Article 6(1)(a) GDPR) for marketing communications

5. Sharing data with third parties

We share your data with third parties only when necessary:

• Payment service providers for processing deposits and withdrawals
• KYC/AML verification partners for identity checks
• The Kansspelautoriteit (KSA) on the basis of legal obligations
• CRUKS for exclusion checks
• IT service providers and hosting partners

We never sell your data to third parties for commercial purposes.

6. Your rights

Under GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of incorrect data
• Right to erasure ("right to be forgotten"), unless legal retention obligation
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interest
• Right to withdraw consent (for marketing purposes)

You can exercise your rights by contacting our customer service. We will respond to your request within 30 days.

7. Retention periods

• Account data: up to 5 years after account closure (Wwft obligation)
• Transaction data: minimum 5 years (fiscal and KSA obligations)
• KYC documents: 5 years after termination of the business relationship
• Marketing data: until you withdraw your consent

8. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access:

• 256-bit SSL encryption for all data transmission
• Encrypted storage of passwords
• Access controls on personal data
• Regular security audits

9. Complaints

Are you not satisfied with the way we process your data? You have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority for data protection. However, we ask you to contact us first so that we can handle your complaint internally.

10. Changes to this policy

We reserve the right to amend this privacy policy. For significant changes, we will notify you by email or a prominent notice on our website. The most recent version of this policy is always available at kittawahpress.com/en/privacy-policy/.