Privacy Policy

CandyLand Online Casino

Effective Date and Introduction

This Privacy Policy sets out the manner in which CandyLand, referred to throughout this document as “we”, “us”, or “the Company”, collects, processes, stores, shares, and protects the personal data of individuals who access or use our online casino platform and related services. CandyLand operates under a gaming licence issued by the Curacao Gaming Authority, and this policy has been drafted in accordance with the applicable data protection legislation of the United Kingdom, including but not limited to the UK General Data Protection Regulation as retained in domestic law by virtue of the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018. By accessing our platform, registering an account, or using any of our services, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. We are committed to ensuring the highest standards of privacy and data security in connection with all personal information entrusted to us by our users, employees, and third-party partners.

1. Who We Are

CandyLand is an online casino brand providing digital gaming entertainment services including but not limited to slot games, live dealer tables, card games, and promotional activities. The Company acts as the data controller in respect of all personal data collected through the platform. As data controller, we determine the purposes and means by which personal data is processed. Our operations are governed by the terms of our Curacao gaming licence, and we are additionally subject to the data protection obligations applicable to operators serving individuals located in the United Kingdom. Any queries relating to this Privacy Policy or to the processing of your personal data should be directed to our designated data protection contact, whose details are available through our official support channels.

2. Data We Collect

We collect a range of personal data from users in order to deliver our services effectively and in compliance with our legal and regulatory obligations. The categories of personal data we collect include the following:

• Registration data, including your full legal name, date of birth, residential address, email address, telephone number, and username selected during account creation.
• Government-issued identification documents such as passports, national identity cards, or driving licences, collected as part of our Know Your Customer and identity verification procedures.
• Financial information including bank account details, credit and debit card numbers, e-wallet account identifiers, and transaction history associated with deposits and withdrawals on the platform.
• Technical data such as your IP address, browser type and version, operating system, device identifiers, session duration, pages visited, and clickstream data gathered through automated tracking technologies.
• Cookie data collected through the use of essential, functional, and analytical cookies as further described in the Cookie Policy section of this document.
• Communications data, including records of correspondence between you and our customer support team, submitted through live chat, email, or telephone.
• Responsible gambling data, including self-exclusion requests, deposit limits, session time preferences, and any assessments conducted in connection with our safer gambling obligations.
• Behavioural and gameplay data, including game preferences, wagering patterns, bonus usage, and activity logs generated during your use of the platform.

3. How We Collect Your Data

We collect personal data through a variety of means, including directly from you at the point of registration, through your ongoing use of the platform, and through automated technologies embedded within our website and mobile applications. We may also receive personal data about you from third-party sources, including identity verification agencies, fraud prevention databases, payment processors, and publicly available sources, where we are permitted to do so under applicable law.

4. Purposes and Legal Bases for Processing

We process your personal data for a number of distinct purposes, each of which is supported by an appropriate legal basis under applicable data protection law. The primary purposes for which we process personal data are as follows:

• Account management and service delivery, including creating and maintaining your player account, processing transactions, and providing access to our gaming services, on the legal basis of contract performance.
• Identity verification and Know Your Customer procedures, carried out to confirm your identity, age, and eligibility to use our services, on the legal basis of legal obligation and legitimate interests.
• Anti-Money Laundering compliance, including the monitoring of financial transactions, the detection of suspicious activity, and the reporting of concerns to relevant authorities as required under the Proceeds of Crime Act 2002 and associated regulations, on the legal basis of legal obligation.
• Fraud prevention and platform security, including the analysis of technical data and transaction patterns to detect and prevent fraudulent activity, on the legal basis of legitimate interests.
• Marketing communications, including the delivery of promotional offers, bonus notifications, and personalised content, where you have provided your consent or where we have a legitimate interest in doing so, subject always to your right to opt out at any time.
• Responsible gambling obligations, including the implementation of safer gambling tools, the monitoring of at-risk behaviour, and compliance with self-exclusion schemes, on the legal basis of legal obligation and public interest.
• Customer support and dispute resolution, including the maintenance of records of communications and the resolution of complaints, on the legal basis of contract performance and legitimate interests.
• Legal compliance and regulatory reporting, including the fulfilment of obligations imposed by our gaming licence, data protection authorities, and other applicable regulatory bodies, on the legal basis of legal obligation.

5. Data Sharing and Disclosure

We do not sell your personal data to third parties. However, we may share your personal data with carefully selected third parties where such sharing is necessary for the purposes outlined in this policy or where we are required to do so by law. The categories of recipients with whom we may share your data include the following:

• Payment service providers and financial institutions, for the purpose of processing deposits, withdrawals, and related financial transactions.
• Identity verification and KYC service providers, who assist us in confirming the identity and eligibility of our users.
• Fraud prevention and anti-money laundering agencies, including credit reference agencies and shared fraud databases.
• Technology and platform service providers who supply software, hosting, analytics, and customer support infrastructure on our behalf.
• Regulatory and law enforcement authorities, including the Curacao Gaming Authority, the UK Information Commissioner’s Office, the National Crime Agency, and any other competent authority where disclosure is required by law or court order.
• Professional advisers, including legal counsel, auditors, and compliance consultants, where necessary for the conduct of our business.

All third parties with whom we share personal data are required to implement appropriate technical and organisational security measures and to process data only in accordance with our instructions and applicable law.

6. International Data Transfers

Where personal data is transferred outside of the United Kingdom, we ensure that appropriate safeguards are in place in accordance with the requirements of the UK GDPR. Such safeguards may include adequacy decisions, standard contractual clauses approved by the Information Commissioner’s Office, or other lawful transfer mechanisms. We take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. In particular, records relating to financial transactions and identity verification are retained for a minimum period of five years following the end of our business relationship with you, in accordance with anti-money laundering legislation. Gameplay and account data may be retained for longer periods where required for legal proceedings, regulatory investigations, or dispute resolution. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data retention procedures.

8. Your Rights

As a data subject under UK data protection law, you have a number of rights in relation to your personal data. These rights include the following:

• The right to access the personal data we hold about you, by submitting a subject access request through our official support channels.
• The right to rectification of inaccurate or incomplete personal data.
• The right to erasure of your personal data, subject to our legal and regulatory obligations to retain certain records.
• The right to restrict the processing of your personal data in certain circumstances.
• The right to data portability, enabling you to receive your personal data in a structured, commonly used, and machine-readable format.
• The right to object to processing carried out on the basis of legitimate interests, including direct marketing.
• The right to withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of processing carried out prior to withdrawal.
• The right to lodge a complaint with the Information Commissioner’s Office if you believe that your data has been processed in a manner that infringes applicable data protection law.

To exercise any of the above rights, please contact us through the support channels available on our platform. We will respond to all valid requests within the timeframes prescribed by applicable law.

9. Cookie Policy

Our platform uses cookies and similar tracking technologies to ensure the proper functioning of the website, to enhance user experience, and to gather analytical insights that assist us in improving our services. The categories of cookies we use are as follows:

• Essential cookies, which are strictly necessary for the operation of the platform, including session management, login authentication, and security functions. These cookies cannot be disabled without affecting the functionality of the website.
• Analytical cookies, which collect aggregated and anonymised data about how users interact with our platform, including pages visited, time spent, and navigation paths. This information is used solely to improve the performance and usability of our services.
• Functional cookies, which remember your preferences and settings to provide a more personalised experience.
• Marketing cookies, where applicable and subject to your consent, which may be used to deliver relevant promotional content and track the effectiveness of our marketing campaigns.

You may manage your cookie preferences through the cookie consent tool available on our website, or through the settings of your web browser. Please note that disabling certain categories of cookies may affect your ability to use some features of the platform.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and staff training on data protection obligations. While we take all reasonable steps to safeguard your information, no method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security.

11. Responsible Gambling and Data Processing

In fulfilment of our responsible gambling obligations, we process certain categories of personal data to identify and support users who may be experiencing gambling-related harm. This includes the monitoring of account activity for indicators of problem gambling behaviour, the implementation of voluntary and mandatory self-exclusion measures, and the maintenance of records in connection with exclusion schemes. Data processed for responsible gambling purposes is handled with the utmost sensitivity and is not used for marketing or profiling activities unrelated to player protection.

12. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time in response to changes in applicable law, regulatory requirements, or our operational practices. Any material changes will be communicated to you through the platform or by direct notification. Your continued use of our services following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this policy periodically to remain informed of how we protect your personal data.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, please contact our data protection team through the official support channels provided on the CandyLand platform. We are committed to addressing all enquiries promptly and in accordance with our obligations under applicable data protection legislation.