As a licensed operator in Italy, we obtain and safeguard personal and transactional data under rigorous legal obligations. This policy details exactly how long we hold different categories of information, the legal reasons behind those periods, and the security measures that safeguard your data at every stage. We regularly balance our duty to retain records for fraud prevention and financial audits with the privacy rights you maintain under Italian data protection law and the GDPR. Our schedules undergo regular reviews so we stay fully compliant.
Policy Revisions and Player Notification
We review this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations https://it-richroyal.it/legal-and-affiliates/. Minor clarifications go up silently with a revised effective date. Material changes that alter retention periods, add new data categories or change the legal basis for processing are communicated directly to you by email at least thirty days before they take effect. You’ll also see an in‑platform banner notification when you log in during the notice period. Historical versions are kept and available on request, each with a version number and a validity date range. If an earlier version gave a shorter retention period for certain data, we adhere to that promise for data collected under that version and apply new terms only going forward.
Information Protection During Storage
Held data is safeguarded with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access necessitates multi‑factor authentication plus just‑in‑time privilege elevation that expires on its own. Every access event is recorded into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to maintain our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard marks every dataset as it nears expiration.
Permission Management and Workforce Training
Only employees whose roles demonstrably necessitate access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records triggers a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and distinguishing the difference between data we must keep under a legal hold and data we can delete straight away.
Affiliate Programme Data Retention
Partner relationship data, including communication data, payment details and commission transaction history, is kept for the duration of the current agreement plus a decade after the partnership concludes. That stems from tax obligations on commission payments, which demand long‑term financial archives. Partner performance data and aggregated player referral data get anonymized after five years. We firmly disallow affiliates from separately gathering or storing personal data about referred customers; they get only anonymous, consolidated reports. Our partner contracts include audit rights to check adherence, and any infringement is grounds for immediate contract termination and payout forfeiture.
Legal Basis for Data Retention
Our retention approach rests on several regulatory requirements that affect gambling operators operating in the Italian market. Anti‑money laundering rules from the Italian Financial Intelligence Unit oblige us to keep activity logs, identity verification documents and suspicious activity reports for a specific duration after the business relationship ends. Meanwhile, tax rules imposed by the Agenzia delle Entrate demand we preserve financial records that back up taxable gaming revenue and player winnings. These obligations override any general right to erasure during the mandatory period. For operational data that falls rainews.it outside a fixed legal window, we rely on legitimate interest assessments where a valid reason exists, and we provide an opt‑out option unless a compelling legal obligation stops us.
Storage with Consent
Marketing preferences, newsletter sign‑ups and the behavioural analytics employed for personalised offers are kept only with your explicit consent. You can withdraw consent anytime through your account dashboard; once you do, we halt that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal is removed from active systems to block further use, but it is not deleted retroactively. Consent records themselves are kept for six years as proof of compliance. We do not use this data for anything beyond the activity you agreed to.
Data Subject Rights and Retention Handling
When you file an erasure request, our system automatically checks each data category against its retention schedule. Anything past its mandatory window gets deleted without delay. For data still governed by a legal retention obligation, we lock it down right away so it’s excluded from active use and kept solely for compliance storage; we advise you which specific law is relevant and the date deletion becomes possible. Access requests are answered within thirty days and include a breakdown of what we keep, why, and the scheduled deletion date. If you question accuracy, we attach a note instead of changing the original record, so the audit trail stays intact. Portability requests are processed in a structured, machine‑readable format even while data is still in its retention window.
Data Transfers Abroad and Retention
Our primary infrastructure is located inside Italy and the wider European Economic Area. Some secondary services, like fraud detection platforms and customer relationship tools, may transfer certain personal data to countries external to the EEA. In those cases, we guarantee an adequacy decision is available or we put Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we use to transferred data match those in this policy, and processors are contractually bound to erase or return data when the service ends. We publish a public register of sub‑processors, updated within fourteen days of any change, and we prefer vendors with Italian data centres. Geo‑fencing rules maintain Italian user data inside European boundaries, verified through yearly audits.
Information Erasure Procedures
When a information type hits the end of its planned retention period, our self-running lifecycle mechanism kicks off a protected erasure procedure. First, the data gets digitally detached from production databases. Next, physical storage blocks are overwritten with random data patterns to prevent forensic recovery. Finally, a cryptographically timestamped entry lands in a compliance ledger, giving auditable proof that deletion happened on time. Backup copies refresh every ninety days, so any deleted data is removed from all media within three months. When a litigation hold applies, we pause the deletion workflow only for the affected records, document the hold reason, and continue once the hold lifts.
Popular Queries
Can I request deletion of my data before the retention period ends?
Certainly, you can submit a deletion request at any moment. We immediately check each data category against its legal retention obligation. When no legal hold exists, we remove it quickly. For anything we must keep, we restrict it to storage‑only, tell you the legal basis stopping immediate deletion and give you the expected deletion date. You may also review all your data categories and their scheduled deletion dates from your account dashboard. That partial approach respects your rights as far as Italian regulations allow.
What occurs with my data when I opt for permanent self‑exclusion?
If you sign up for permanent self‑exclusion, your personal data is shifted to a dedicated exclusion register that operates indefinitely with highly restricted access. It is a legal obligation intended to block you from establishing new accounts. Your gaming and transaction history, however, still complies with standard retention schedules and is removed after those periods conclude. The self‑exclusion entry is isolated from all marketing and operational systems, thus it fulfills solely the protective purpose for which it was gathered. No marketing communications will be sent to you.
What is your approach to data from inactive accounts?
An account is deemed inactive following twelve consecutive months without a login. Then, we automatically halt marketing messages and place the account into a dormant condition with minimized processing. The underlying retention periods remain active according to the original data collection dates, not the date of inactivity. Consequently, data from an inactive account is kept for the entire statutory duration applicable to its type and then removed in line with our usual processes. If you come back after a long break, you might need to complete a fresh Know Your Customer check to reactivate. Your data dashboard displays the current status continuously.
Data Types and Retention Periods
We organize all user data into well-defined categories, each connected to a retention schedule that aligns with its use and legal context. That organized approach keeps us from keeping things forever. Every year our Data Protection Officer examines these classifications and adjusts the timelines whenever new http://documenti.camera.it/_dati/leg19/lavori/stampati/pdf/19PDL0013950.pdf guidance arrives from the Garante per la protezione dei dati personali. Below you’ll find how long each data type stays in our live systems before being securely anonymised or deleted. Archived backups operate on a ninety‑day cycle because of technical constraints.
Personal and Fiscal Records
Identity documents you provide during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, stay on file for ten years after you close your account, as anti‑money laundering law stipulates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are retained for ten years from the date of each transaction, meeting both AML requirements and Italian Civil Code limitation periods. We keep these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline expires, we strip away all personal identifiers permanently; statistical trends may still be applied but never in a way that connects to any individual.
Account Activity and Help Desk Messages
Comprehensive records of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.
Responsible Gambling and Self‑Exclusion Data
Upon activating self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.