Your personal information earns the same editorial precision as any other page on this site. Below, the operator explains which datapoints Savaspin actually needs, why each point matters and how the file is kept sealed against misuse. KoiRun N.V. runs the casino under Curaçao eGaming Licence No. 152341 and acts as the data controller for Danish residents. Furthermore, this notice is refreshed whenever a processing activity shifts; therefore, a quarterly re-read is a sensible habit for attentive members.
Legal Bases under GDPR
Savaspin anchors every processing activity to a named lawful basis from GDPR Article 6. In other words, nothing is collected “just in case” — every entry on the record of processing has an auditable justification. Moreover, Danish residents retain the right to challenge any basis they find excessive, and the data-protection officer reviews such challenges inside one calendar month. As a result, the balance between the operator’s duties and the member’s control sits squarely inside the European regime.
Most daily processing rests on three bases: contract performance, legal obligation and legitimate interest. For instance, running your cashier sits under contract, while AML record-keeping rests on legal obligation. Furthermore, fraud screens use legitimate interest, and marketing segmentation depends on explicit consent that you can revoke at any moment. In fact, the consent banner clearly separates these flavours so that a declined marketing opt-in never blocks basic account functionality.
Information Families We Process
Savaspin collects five data families to keep the platform safe, compliant and personalised. Each family respects the data-minimisation principle embedded in GDPR Article 5, so the file never grows beyond the stated purpose. The table below opens the panoramic view of what lands inside the account record.
| Family | Examples | Lawful Basis | Retention |
|---|---|---|---|
| Identifier records | Legal name, date of birth, residential address, CPR-linked ID scan | Contract and legal obligation | 5 years after closure |
| Cashier records | Card tokens, crypto wallet addresses, transaction IDs | Contract and AML duty | 7 years after last movement |
| Device signals | IP, user agent, device ID, consent cookies | Legitimate interest | 12 months |
| Play history | Game sessions, bet size, deposit cadence, bonus claims | Contract and legal obligation | 5 years after closure |
| Contact logs | Chat transcripts, email threads, telephone notes | Legitimate interest | 3 years from ticket close |
Inside Each Family
Identifier records power sign-up, the mandatory age check and every later KYC escalation. Specifically, the pack includes your legal name, date of birth, residential address and an ID scan that binds the profile to a real person. Moreover, the same file drives critical account notifications such as verification outcomes, batch payout alerts and security warnings. Marketing emails never flow from this base without a positive opt-in, so claiming a bonus does not commit you to promotional contact.
Cashier records are tokenised end-to-end, because the PCI DSS processor returns a reversible token instead of the raw card number. Therefore, even in the unlikely case of a breach, your card cannot be used to charge third parties. Furthermore, crypto wallet addresses and on-chain transaction IDs are kept so that AML screens can reconcile on-ledger movements against the account ledger. Indeed, this transparency is a core condition of the Curaçao licence framework.
Device signals arrive automatically through server logs on every session, while play history is written by the game engine after each round. For example, device data includes the IP, device fingerprint and browser string; play data covers session length, bet size and bonus status. Consequently, these two families feed fraud detection and duty-of-care checks without drifting into unrelated profiling. In summary, both sets stay inside their stated purpose and never feed external ad networks.
Why We Use Your Data
Your file serves six concrete purposes, and each one ties to a defined legal basis. In other words, nothing is collected speculatively; every processing activity has a documented rationale that auditors can verify. The list below summarises the use cases Danish residents should recognise inside their account.
- Contract delivery: running the cashier, settling deposits and paying withdrawals inside the published timelines.
- Regulatory duties: AML screens, sanctions checks and record-keeping obligations attached to the Curaçao licence.
- Fraud defence: device fingerprinting, duplicate-account detection and chargeback mitigation for settled deposits.
- Safer gambling: monitoring bet size, deposit frequency and session length to catch early warning patterns.
- Product personalisation: adjusting the lobby layout, bonus tiles and promotional feed to confirmed interests.
- Service improvement: analysing support tickets and on-site surveys to refine cashier and navigation flows.
Safeguards and Encryption
Security underpins every line of this notice, because confidentiality is the first guarantee a casino owes its members. Specifically, every connection to savaspin-denmark.com rides on TLS 1.3, which matches the encryption standard used by high-street banks. Moreover, files at rest sit behind AES-256 encryption, and session tokens are hashed with SHA-256 before any storage. As a result, a breach of the public site would not expose payment credentials or identity scans in readable form.
Our processing centres operate inside EU jurisdictions, which keeps processing under the GDPR regime by default. In addition, intrusion-detection sensors watch every node in real time, and independent penetration tests run at least twice per year. Multi-factor authentication protects admin consoles; consequently, no single engineer can pull a full player file without a second approver. Overall, layered technical controls reduce the chance of a meaningful leak to a demonstrable minimum.
Cookies and Tracking
Cookies sit at the core of any modern gaming site, and Savaspin is no exception to that pattern. In practice, a consent banner greets each new visitor, and non-essential cookies stay dormant until you tick the box. Moreover, the saved preference is stored against the device so that the banner does not reappear on every visit. You can revisit the panel at any time through the footer link labelled “Cookie preferences”.
Cookies Active on the Site
The register below names every cookie family that may fire on savaspin-denmark.com. Specifically, the analytics layer is self-hosted through Matomo inside EU infrastructure, which keeps the data inside the European regime rather than routing it across the Atlantic.
| Family | Purpose | Vendor | Lifespan |
|---|---|---|---|
| Session | Keep the player logged in and preserve the cart | Savaspin (first party) | Session only |
| Security | Detect suspicious login attempts and scripted traffic | Savaspin (first party) | 30 days |
| Analytics | Measure traffic and navigation paths | Matomo self-hosted | 13 months |
| Performance | Monitor load times and cashier latency | Cloudflare | 6 months |
| Marketing | Serve retargeting ads on partner networks | Meta Pixel, Google Ads | 180 days |
| Preferences | Remember language, theme and consent choice | Savaspin (first party) | 12 months |
Turning Cookies On and Off
You stay in charge of the cookie experience at every step. Specifically, the consent centre lets you toggle analytics, marketing and preference groups on or off without touching essential cookies. Furthermore, most browsers ship with a dedicated privacy panel that deletes cookies, blocks third-party tracking or wipes local storage on exit. However, switching off essential cookies can break the login or cashier, so we recommend tuning only the non-essential groups.
Processors We Engage
Savaspin works with a lean roster of processors, because every extra partner widens the exposure surface. Moreover, each partner signs a data-processing agreement modelled on GDPR Article 28, and re-use outside the commissioned task is contractually forbidden. The list below shows who receives which slice of the file and under what safeguard regime.
- Payment gateways: PCI DSS Level 1 processors that clear Visa, Mastercard, MobilePay and Apple Pay transactions on our behalf.
- Identity verifiers: specialised vendors that cross-check ID documents against global sanctions and PEP registers.
- Game studios: suppliers such as Hacksaw, Pragmatic Play and Nolimit City that host games behind a pseudonymised account token.
- Infrastructure partners: Cloudflare and EU-based cloud hosts that serve the site without access to payment data.
- Authorities: Curaçao Gaming Control Board, Datatilsynet and Danish law enforcement on receipt of a lawful documented request.
How Long We Keep Records
Retention lengths track the legal backbone of the operation rather than commercial convenience. Specifically, AML law obliges the casino to hold transactional records for seven years after the last movement on the account. In addition, player-protection evidence stays on file for five years, because a future regulator review may need to inspect that record. Nevertheless, inactive marketing consents are purged after twenty-four months to stop profile bloat.
Technical logs rotate through a twelve-month window, because their evidentiary value decays quickly. Consequently, older server logs are irreversibly destroyed on a rolling schedule managed by the security team. Support transcripts remain on file for three years after a ticket closes, to preserve the paper trail behind dispute decisions. In summary, the retention ladder is fully documented inside a Record of Processing Activities that auditors can inspect on request.
Rights You Can Exercise
Danish residents retain the full bundle of rights granted by the General Data Protection Regulation, and Savaspin welcomes requests under each heading. Therefore, a privacy request never costs the member anything and is not treated as a signal to close the account. The levers you can pull are listed below.
- Copy of records: receive a structured export of every datapoint held under the profile, together with the purposes behind each field.
- Correction: fix inaccurate entries such as a misspelled surname, an outdated address or a wrong phone number.
- Deletion: remove data that is no longer legally required, subject to the mandatory AML retention window.
- Portability: export the file in a machine-readable format so you can hand it to another service provider.
- Objection: halt marketing processing, profiling or legitimate-interest processing that you find intrusive.
- Restriction: freeze processing while a dispute about accuracy or lawfulness is being investigated.
Contacting the DPO and Datatilsynet
File privacy requests through [email protected] with the subject line “GDPR request” and the account username. The data-protection officer replies within one calendar month; however, complex cases can extend by another two months with written notice. Moreover, the same address handles breach alerts, policy questions and vendor-map queries. As a result, one channel covers every lifecycle stage of your personal record.
For formal escalations, Danish residents can contact Datatilsynet at Carl Jacobsens Vej 35, 2500 Valby, Copenhagen. Furthermore, the authority accepts complaints through its online portal and does not charge a fee for opening a case. Savaspin cooperates with every supervisory inquiry inside the statutory deadlines, and the privacy team keeps a log of such requests for auditability. Therefore, the accountability loop between the operator, the member and the supervisory authority remains fully closed.
This notice is refreshed whenever a processing activity, vendor list or legal duty shifts. Consequently, the version date at the top of the page marks the latest effective text, and the footer holds a short changelog of material updates. For routine questions, [email protected] replies inside one business day, and urgent security issues are escalated to the CISO within four hours. In summary, the privacy framework is designed to stay open, documented and genuinely navigable for every Danish resident who plays on the site.