CasinoOS privacy notice
Draft for review by counsel. This is not legal advice. Text in [square brackets] must be filled in or confirmed before publication.
Effective [date]. Version 0.1.
This notice explains how [CasinoOS legal entity] ("CasinoOS", "we") uses personal data about the people we deal with as a business: visitors to our website, people who ask us about the product, and contacts at our customers and suppliers.
If you are a player of a casino that uses CasinoOS, this notice is not the one you need. The casino decides how your data is used, and we process it only on its behalf. Read the casino's privacy notice, or contact the casino directly.
1. Who we are
[CasinoOS legal entity], registered in [country] under number [company number], at [registered address]. Contact us about privacy at [privacy contact]. [Our data protection officer is [DPO], reachable at the same address.] [Our representative in the EU is [EU representative]. Our representative in the UK is [UK representative].]
2. What we collect and why
| Who you are | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitor | Technical data your browser sends: IP address, browser type, pages requested, time. | To deliver the page and keep the site secure. | Legitimate interests (running a secure website). |
| Someone who makes an inquiry | Name, company, work email, operator size and your message. | To reply and discuss whether CasinoOS fits your business. | Legitimate interests (answering business inquiries), or steps before a contract. |
| Customer contact | Name, work email, role, and what you tell us in support and account conversations. | To provide the service, manage the account, bill and support you. | Contract with your employer, and legitimate interests. |
| Staff user of the hub | Name, work email, role, password hash, session data, actions in the audit trail. | We process this for our customer under the data processing agreement. The customer is the controller. | See your employer's notice. |
| Supplier contact | Name, work contact details. | To manage the relationship. | Legitimate interests. |
The inquiry form on our website does not yet send any data: it only confirms on the page. When it is connected, the data it collects is used as described above. [Remove this sentence once the form is connected, and name the tool that receives inquiries.]
We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell personal data.
3. Marketing
We send product news to customer contacts and to people who asked for it. Every email has an unsubscribe link. Where the law requires consent, we ask for it first.
4. Who we share data with
- Service providers who host our website and service ([hosting provider]), and send our email ([email provider]), under contracts that limit how they use the data.
- Professional advisers, auditors and insurers, where needed.
- Authorities, where the law requires it.
- A buyer or successor, if our business is sold, under the same protections.
Some of our pages load the Plus Jakarta Sans font from Google Fonts, so your browser sends your IP address to Google when it fetches the font. Our legal pages do not do this. See the cookie notice.
5. International transfers
Where we transfer personal data outside the UK or the EEA, we rely on an adequacy decision or on the standard contractual clauses approved by the European Commission and the UK addendum. Contact us for a copy.
6. How long we keep it
| Data | Kept for |
|---|---|
| Inquiries that do not lead to a contract | [24] months after the last contact |
| Customer account and contract records | The contract term plus [6] years, for legal claims and tax |
| Website server logs | [30] days |
| Marketing preferences | Until you opt out, then a suppression record so we do not contact you again |
7. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can object to direct marketing at any time. To use a right, contact [privacy contact]. We reply within one month.
You can complain to your data protection authority. In the UK this is the Information Commissioner's Office. In the EU it is the authority in your country. Our lead authority is [lead supervisory authority].
8. Security
We use access controls by role, encrypted connections, PII masking, and a tamper-evident audit log. No system is perfectly secure. If a breach affects you and the law requires it, we will tell you.
9. Changes
We will post changes here and change the date at the top. If a change is significant, we will tell customer contacts by email.