As a authorized operator in Italy, we gather and manage personal and transactional data under strict legal obligations. This policy details exactly how long we hold different categories of information, the legal reasons behind those periods, and the security measures that protect your data at every stage. We continuously balance our duty to retain records for fraud prevention and financial audits with the privacy rights you hold under Italian data protection law and the GDPR. Our schedules get regular reviews so we remain fully compliant.

Policy Revisions and User Notification

We evaluate this Data Retention Policy every six months and whenever a major legal change affects Italian gambling operations. Minor clarifications are posted silently with a revised effective date. Material changes that change retention periods, introduce new data categories or alter the legal basis for processing are communicated directly to you by email at least thirty days before they become effective. You’ll also see an in‑platform banner notification when you log in during the notice period. Historical versions are stored and available on request, each with a version number and a validity date range. If an earlier version provided a shorter retention period for certain data, we stick to that promise for data collected under that version and apply leggo.it new terms only going forward.

Data Categories and Storage Durations

We categorize all user data into well-defined categories, each tied to a retention schedule that matches its use and legal context. That structured approach prevents us from keeping things forever. Every year our Data Protection Officer reviews these classifications and updates the timelines whenever new guidance arrives from the Garante per la protezione dei dati personali. Below you’ll see how long each data type stays in our live systems before being securely anonymized or destroyed. Archived backups follow a ninety‑day cycle because of technical restrictions.

Identity and Financial Records

Identity documents you upload during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, stay on file for ten years after you end your account, as anti‑money laundering law stipulates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are retained for ten years from the date of each transaction, meeting both AML requirements and Italian Civil Code limitation periods. We keep these records in encrypted, access‑restricted vaults and https://www.ilfattoquotidiano.it/2025/12/01/lotteria-scontrini-istantanea-ferma-notizie/8212776/ tamper‑proof ledgers. Once the retention deadline elapses, we strip away all personal identifiers permanently; statistical trends may still be used but never in a way that traces to any individual.

User Activity and Customer Support Interactions

In-depth reports of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.

Responsible Gambling and Self‑Exclusion Data

When you activate self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.

Affiliate Programme Data Retention

Partner relationship data, including contact details, payment information and commission payout records, remains for the entirety of the active partnership plus a decade after the contract ends. That stems from tax requirements on commission payouts, which require long‑term financial documentation. Partner performance data and aggregated player referral data get anonymized after half a decade. We explicitly prohibit affiliates from independently collecting or retaining personal data about referred players; they obtain only anonymous, consolidated summaries. Our partner contracts include inspection rights to verify compliance, and any infringement is reason for instant agreement cancellation and commission forfeiture.

Data Deletion Procedures

When a data class hits the end of its scheduled retention, our self-running lifecycle mechanism kicks off a protected erasure procedure. First, the data gets digitally detached from production databases. Next, physical storage blocks are overwritten with random data patterns to prevent forensic recovery. Finally, a cryptographically timestamped entry lands in a regulatory record, giving verifiable evidence that erasure happened on time. Backup copies refresh every ninety days, so any deleted data is removed from all media within three months. When a litigation hold applies, we pause the deletion workflow only for the affected records, record the hold reason, and restart once the hold lifts.

Data Transfers Abroad and Data Retention

Our primary infrastructure sits in Italy and the wider European Economic Area. Some supporting services, like fraud detection platforms and customer relationship tools, may transfer certain personal data to countries external to the EEA. In those cases, we guarantee an adequacy decision is available or we implement Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we use to transferred data reflect those in this policy, and processors are contractually bound to delete or return data when the service ends. We maintain a public register of sub‑processors, updated within fourteen days of any change, and we choose vendors with Italian data centres. Geo‑fencing rules maintain Italian user data inside European boundaries, confirmed through yearly audits.

Individual Rights and Retention Interactions

When you file an erasure request, our system automatically checks each data category against its retention schedule. Anything past its mandatory window is erased without delay. For data still governed by a legal retention obligation, we lock it down right away so it’s removed from active use and kept solely for compliance storage; we advise you which specific law is in effect and the date deletion becomes possible. Access requests are answered within thirty days and provide a breakdown of what we keep, why, and the scheduled deletion date. If you dispute accuracy, we append a note instead of modifying the original record, so the audit trail stays intact. Portability requests are honoured in a structured, machine‑readable format even while data is still in its retention window.

Legal Basis for Record Keeping

Our data management policy relies on several regulatory requirements that govern gambling operators serving the Italian market. Anti‑money laundering rules from the Italian Financial Intelligence Unit oblige us to keep transaction logs, identity verification documents and suspicious activity reports for a fixed term after the business relationship ends. Meanwhile, tax rules administered by the Agenzia delle Entrate oblige us to preserve financial records that support taxable gaming revenue and player winnings. These duties override any general right to erasure during the mandatory period. For operational data that isn’t covered by a fixed legal window, we rely on legitimate interest assessments where a valid reason exists, and we provide an opt‑out option unless a compelling legal obligation stops us.

Retention Based on Consent

Marketing preferences, newsletter sign‑ups and the behavioural analytics utilised for personalised offers are kept only with your explicit consent. You can retract consent anytime through your account dashboard; once you do, we stop that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal is removed from active systems to block further use, but it is not removed retroactively. Consent records themselves are kept for six years as proof of compliance. We never employ this data for anything beyond the activity you agreed to.

Frequently Asked Questions

Is it possible to ask for data deletion prior to the retention period’s conclusion?

Yes, casino rich royal partnership affiliata, you can file an erasure request any time. We immediately check each data category against its legal retention obligation. If there’s no legal hold, we delete it fast. For any data we are required to retain, we limit it to storage‑only, inform you of the legal reason preventing immediate removal, and provide the anticipated deletion date. You may also review all your data categories and their scheduled deletion dates from your account dashboard. Such a partial strategy respects your rights within the limits of Italian law.

What occurs with my data when I opt for permanent self‑exclusion?

When you register for permanent self‑exclusion, your identity data moves to a dedicated exclusion register that stays live indefinitely with tightly controlled access. This is a legal mandate designed to stop you from creating new accounts. Your gameplay and transaction history, on the other hand, still follow the standard retention schedules and get deleted once those periods run out. The self‑exclusion record is separated from all marketing and operational platforms, so it only serves the safeguarding role it was intended for. You will not receive any promotional messages.

How do you handle data belonging to inactive accounts?

An account becomes inactive after twelve straight months with no login. At that stage, we automatically disable marketing communications and transition the account to a dormant status with limited processing. The underlying retention periods remain active according to the original data collection dates, not the date of inactivity. That means data from an inactive account is still held for the full statutory period that applies to its category and then deleted according to our standard procedures. If you return following a lengthy hiatus, you might have to finish a fresh Know Your Customer assessment to re‑enable your account. Your data dashboard shows the current status at all times.

Data Security During Retention

Retained data is safeguarded with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access demands multi‑factor authentication plus just‑in‑time privilege elevation that terminates on its own. Every access event is recorded into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to maintain our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard identifies every dataset as it nears expiration.

Access Governance and Workforce Training

Only employees whose roles demonstrably need access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records prompts a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and differentiating the difference between data we must keep under a legal hold and data we can delete straight away.