Privacy Policy

CandyLand Online Casino

Effective Date and Scope

This Privacy Policy governs the collection, processing, storage, sharing, and protection of personal data by CandyLand, hereinafter referred to as “the Company,” “we,” “us,” or “our,” in connection with the operation of the CandyLand online casino platform. This policy applies to all individuals who access, register with, or otherwise interact with our website and associated digital services, hereinafter referred to as “you,” “the user,” or “the data subject.” By registering an account, accessing our platform, or using any of our services, you acknowledge that you have read, understood, and consented to the practices described in this Privacy Policy. The Company operates under a gaming licence issued by the Curacao Gaming Authority, and we are committed to ensuring that all personal data processed in connection with our services is handled in accordance with applicable data protection legislation, including the United Kingdom General Data Protection Regulation as retained in domestic law by virtue of the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018.

Information We Collect

The Company collects a range of personal data categories in order to deliver, maintain, and improve our online casino services. The categories of data we collect include, but are not limited to, the following:

• Registration data, including your full legal name, date of birth, residential address, email address, telephone number, and username selected at the time of account creation.
• Financial and payment information, including bank account details, credit and debit card numbers, e-wallet identifiers, transaction histories, and records of deposits and withdrawals processed through our platform.
• Identity verification documents submitted in connection with our Know Your Customer procedures, including copies of government-issued photographic identification, proof of address documentation, and source of funds evidence where required.
• Technical data collected automatically when you access our platform, including your Internet Protocol address, browser type and version, device identifiers, operating system information, session duration, pages visited, and clickstream data.
• Cookie data and similar tracking technologies that record your preferences, session state, and behavioural patterns across our website and any affiliated digital properties.
• Communications data, including records of correspondence exchanged between you and our customer support team, live chat transcripts, and any complaints or requests submitted through our official channels.
• Responsible gambling data, including self-exclusion requests, deposit limit settings, cooling-off period applications, and any other information provided in connection with our player protection tools.
• Marketing preference data, including your opt-in or opt-out status with respect to promotional communications, bonus eligibility records, and responses to marketing campaigns.

Legal Basis for Processing

The Company processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases upon which we rely include the following:

• Performance of a contract, where processing is necessary to create and manage your account, process financial transactions, and deliver the gaming services you have requested.
• Compliance with a legal obligation, where processing is required to fulfil our regulatory duties under anti-money laundering legislation, gambling regulations, and applicable tax and financial reporting requirements.
• Legitimate interests pursued by the Company, including fraud prevention, platform security, responsible gambling monitoring, and the improvement of our services, where such interests are not overridden by your fundamental rights and freedoms.
• Your consent, where you have freely, specifically, and unambiguously indicated agreement to the processing of your data for a particular purpose, including the receipt of marketing communications.

Purpose of Data Processing

The Company uses the personal data it collects for a range of clearly defined and lawful purposes directly connected to the operation of our online casino services. These purposes include the following:

• Account management and service delivery, including the creation, verification, and ongoing administration of your player account and associated gaming activity.
• Payment processing and financial administration, including the execution of deposits, withdrawals, bonus credits, and the maintenance of accurate financial records.
• Identity verification and Know Your Customer compliance, including the verification of your identity, age, and eligibility to participate in our services in accordance with our regulatory obligations under the Curacao gaming licence and applicable United Kingdom standards.
• Anti-money laundering and counter-terrorism financing compliance, including the monitoring of transactions for suspicious activity, the filing of regulatory reports where required, and the implementation of enhanced due diligence measures where risk indicators are identified.
• Fraud detection and prevention, including the analysis of account activity, login patterns, payment behaviour, and technical data to identify and mitigate fraudulent conduct, bonus abuse, and unauthorised account access.
• Responsible gambling obligations, including the monitoring of player behaviour for signs of problem gambling, the administration of self-exclusion and limit-setting tools, and the referral of at-risk players to appropriate support resources.
• Marketing and promotional communications, where you have provided your consent, including the delivery of personalised offers, bonus notifications, newsletters, and promotional updates via email, SMS, or other approved channels.
• Customer support and dispute resolution, including the handling of enquiries, complaints, and technical issues raised through our support channels.
• Platform analytics and performance improvement, including the use of aggregated and anonymised data to assess user behaviour, optimise service performance, and develop new features.
• Legal and regulatory compliance, including the retention of records as required by applicable law and the fulfilment of our obligations to regulatory and law enforcement authorities.

Data Sharing and Disclosure

The Company does not sell your personal data to third parties. However, we may share your personal data with selected categories of recipients in circumstances where such disclosure is necessary, lawful, and proportionate. These recipients include the following:

• Payment service providers and financial institutions responsible for processing deposits, withdrawals, and other financial transactions on our platform.
• Identity verification and Know Your Customer service providers engaged to authenticate your identity, verify documents, and screen against sanctions lists and politically exposed persons databases.
• Anti-fraud and risk management service providers who assist us in detecting and preventing fraudulent activity, money laundering, and other forms of financial crime.
• Regulatory authorities, including the Curacao Gaming Authority and, where applicable, United Kingdom regulatory bodies, to whom we are required by law to disclose information in connection with our licensing obligations, investigations, or compliance audits.
• Law enforcement agencies and government bodies where we are legally compelled to disclose personal data in response to a lawful request, court order, or statutory obligation.
• Third-party technology providers and platform operators who provide hosting, software, security, and infrastructure services necessary for the operation of our online casino.
• Professional advisers, including legal counsel, accountants, and auditors, where disclosure is necessary for the provision of professional services to the Company.

All third parties with whom we share personal data are required to process such data in accordance with applicable data protection law and are subject to appropriate contractual safeguards.

Data Retention

The Company retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Account data and transaction records are generally retained for a minimum period of five years following the closure of your account, in accordance with anti-money laundering legislation. Where longer retention periods are mandated by law or regulation, we will retain data accordingly. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Your Rights as a Data Subject

As a data subject under applicable United Kingdom data protection law, you are entitled to exercise the following rights in connection with your personal data:

• The right to access the personal data we hold about you, including the right to request a copy of that data in a structured and commonly used format.
• The right to rectification of inaccurate or incomplete personal data held by the Company.
• The right to erasure, also known as the right to be forgotten, subject to applicable legal and regulatory retention obligations that may override this right in specific circumstances.
• The right to restrict the processing of your personal data in circumstances where you contest its accuracy, object to its processing, or require it to be retained pending the resolution of a legal claim.
• The right to data portability, enabling you to receive your personal data in a machine-readable format and to transmit it to another data controller where technically feasible.
• The right to object to the processing of your personal data for the purposes of direct marketing or where processing is based on our legitimate interests.
• The right to withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of processing carried out prior to withdrawal.
• The right to lodge a complaint with the Information Commissioner’s Office, which is the supervisory authority for data protection matters in the United Kingdom.

To exercise any of the above rights, please contact our data protection team using the contact details provided in the designated section of our website. We will respond to all verified requests within the timeframes prescribed by applicable law.

Cookie Policy

The Company uses cookies and similar tracking technologies on our platform to support essential functionality, enhance user experience, and gather analytical data. The following categories of cookies are used:

• Essential cookies, which are strictly necessary for the operation of our website and cannot be disabled without impairing core functionality. These cookies manage your session state, maintain your login status, and ensure the security and integrity of your account interactions.
• Analytical and performance cookies, which collect information about how users interact with our platform, including pages visited, time spent on site, error messages encountered, and navigation paths. This data is used in aggregated and anonymised form to improve platform performance and user experience.
• Preference cookies, which store your selected settings and preferences, such as language choice and display options, to personalise your experience on return visits.
• Marketing and targeting cookies, which may be used where you have provided consent to track your activity across our platform and deliver relevant promotional content.

You may manage your cookie preferences at any time through the cookie settings panel available on our website. Please note that disabling essential cookies may affect your ability to use certain features of our platform.

Data Security

The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include data encryption, access controls, secure data storage protocols, and regular security assessments. Notwithstanding these measures, no method of electronic transmission or storage is entirely secure, and the Company cannot guarantee absolute security of data transmitted over the internet.

Changes to This Privacy Policy

The Company reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, or our operational practices. Any material changes will be communicated to registered users through our platform or via email notification. Your continued use of our services following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this policy periodically to remain informed of how we process your personal data.

Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our data protection team through the official contact channels listed on the CandyLand website. We are committed to addressing all enquiries promptly and in accordance with our obligations under applicable data protection legislation.