As a regulated operator in Italy, Rich Royal Casino accordo utente, we gather and manage personal and transactional data under strict legal obligations. This policy spells out exactly how long we retain different categories of information, the legal reasons behind those periods, and the security measures that shield your data at every stage. We regularly balance our duty to retain records for fraud prevention and financial audits with the privacy rights you possess under Italian data protection law and the GDPR. Our schedules receive regular reviews so we stay fully compliant.
Regulatory Foundation for Information Storage
Our data management policy rests on several legal obligations that apply to gambling operators operating in the Italian market. Anti‑money laundering directives from the Italian Financial Intelligence Unit require us to keep transaction records, identity verification documents and suspicious activity reports for a specific duration after the business relationship ends. Meanwhile, tax rules imposed by the Agenzia delle Entrate demand we preserve financial records that back up taxable gaming revenue and player winnings. These obligations override any general right to erasure during the mandatory period. For operational data that doesn’t fall under a fixed legal window, we rely on legitimate interest assessments where a valid reason exists, and we allow an opt‑out unless a compelling legal obligation overrides it.
Consent‑Based Retention
Marketing preferences, newsletter sign‑ups and the behavioural analytics utilised for personalised offers remain only with your explicit consent. You can withdraw consent anytime through your account dashboard; once you do, we cease that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal gets isolated from active systems to block further use, but it isn’t retroactively deleted. Consent records themselves are kept for six years as proof of compliance. We never use this data for anything beyond the activity you agreed to.
Cross-border Data Transfers and Data Retention
Our core infrastructure resides within Italy and the broader European Economic Area. Some secondary services, like fraud detection platforms and customer relationship tools, may pass certain personal data to countries outside the EEA. In those cases, we ensure an adequacy decision exists or we establish Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we use to transferred data match those in this policy, and processors are contractually bound to delete or return data when the service ends. We publish a public register of sub‑processors, updated within fourteen days of any change, and we prefer vendors with Italian data centres. Geo‑fencing rules ensure Italian user data inside European boundaries, confirmed through yearly audits.
Information Categories and Holding Times
We organize all user data into distinct categories, each connected to a retention schedule that aligns with its use and legal context. That organized approach prevents us from retaining things forever. Every year our Data Protection Officer assesses these classifications and updates the timelines whenever new guidance arrives from the Garante per la protezione dei dati personali. Below you’ll find how long each data type stays in our live systems before being securely de-identified or erased. Archived backups roll on a ninety‑day cycle because of technical limitations.
Personal and Monetary Records
Identity documents you upload during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, remain on file for ten years after you close your account, as anti‑money laundering law stipulates. Deposit and withdrawal logs, payment method tokens and wallet balance histories are held for ten years from the date of each transaction, fulfilling both AML requirements and Italian Civil Code limitation periods. We hold these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline passes, we remove all personal identifiers permanently; statistical trends may still be utilized but never in a way that connects to any individual.
Account Actions and Help Desk Messages
In-depth reports of game sessions, bets placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.
Responsible Gambling and Self‑Exclusion Data
Upon activating self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.
Policy Updates and User Notification
We assess this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations. Minor clarifications are posted silently with a revised effective date. Material changes that modify retention periods, add new data categories or change the legal basis for processing are communicated directly to you by email at least thirty days before they become effective. You’ll also notice an in‑platform banner notification when you log in during the notice period. Historical versions are kept and available on request, each with a version number and living.corriere.it a validity date range. If an earlier version provided a shorter retention period for certain data, we stick to that promise for data collected under that version and apply new terms only going forward.
Data Safeguarding During Retention
Retained data is safeguarded with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access necessitates multi‑factor authentication plus just‑in‑time privilege elevation that ends on its own. Every access event is logged into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to maintain our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard flags every dataset as it nears expiration.
Access Governance and Workforce Training
Only employees whose roles demonstrably need access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records initiates a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and distinguishing the difference between data we must keep under a legal hold and data we can delete straight away.
User Rights and Retention Handling
When you file an erasure request, our system automatically examines each data category against its retention schedule. Anything past its mandatory window is erased without delay. For data still governed by a legal retention obligation, we secure it right away so it’s taken out of active use and kept solely for compliance storage; we inform you which specific law is relevant and the date deletion becomes possible. Access requests are responded to within thirty days and include a breakdown of what we hold, why, and the scheduled deletion date. If you challenge accuracy, we append a note instead of modifying the original record, so the audit trail is preserved. Portability requests are honoured in a structured, machine‑readable format even while data is still in its retention window.
Data Removal Procedures
When a data class hits the end of its planned retention period, our automated lifecycle engine kicks off a safe removal process. First, the data gets virtually eliminated from production databases. Next, physical storage blocks are replaced with random data patterns to stop forensic recovery. Finally, a digitally signed log lands in a regulatory record, giving traceable confirmation that deletion happened on time. Backup copies cycle every ninety days, so any deleted data is removed from all media within three months. When a https://www.napolitoday.it/social/lotteria-italia-2023-2024-biglietti-vincenti.html litigation hold applies, we halt the deletion workflow only for the affected records, note the hold reason, and resume once the hold lifts.
Partner Program Data Retention
Partner relationship data, including contact details, payment information and commission payout records, is kept for the duration of the current agreement plus ten years after the contract ends. This is due to tax requirements on commission transactions, which demand long‑term financial records. Affiliate performance statistics and aggregated referred‑player statistics get anonymised after half a decade. We explicitly prohibit affiliates from autonomously collecting or storing personal information about referred players; they receive only anonymized, consolidated summaries. Our affiliate contracts include inspection rights to ensure compliance, and any breach is reason for prompt contract ending and payout forfeiture.
Common Questions
Is it possible to ask for data deletion prior to the retention period’s conclusion?
Yes, you can file an erasure request any time. We promptly review every data category against its mandatory retention requirement. If no legal obligation applies, we erase it promptly. For anything we must keep, we restrict it to storage‑only, tell you the legal basis stopping immediate deletion and give you the expected deletion date. You can also view all your data categories with their scheduled deletion dates through your account dashboard. Such a partial strategy respects your rights within the limits of Italian law.
What occurs with my data when I opt for permanent self‑exclusion?
Upon enrolling in permanent self‑exclusion, your identity information is transferred to a specialized exclusion register that remains active indefinitely under strictly controlled access. That’s a legal requirement built to prevent you from opening new accounts. Conversely, your gameplay and transaction records continue to adhere to the usual retention timelines and are erased when those durations expire. The self‑exclusion entry is isolated from all marketing and operational systems, thus it fulfills solely the protective purpose for which it was gathered. You will not receive any promotional messages.
What is your approach to data from inactive accounts?
An account becomes inactive after twelve straight months with no login. Then, we automatically halt marketing messages and place the account into a dormant condition with minimized processing. The underlying retention clocks keep ticking based on the original collection dates, not the inactivity date. This implies that data from a dormant account is still retained for the complete legal period relevant to its category and subsequently erased following our standard protocols. Should you return after an extended absence, you may be required to undergo a new Know Your Customer verification to reactivate. The current status is always visible on your data dashboard.
