General Provisions and Scope

This Privacy policy governs the processing of personal data in connection with the services made available through kingmaker-games.it.com and related operational channels. It applies to account registration, identity and payment verification, customer support interactions, responsible gambling controls, and security monitoring, insofar as such activities involve personal data. The document is drafted for a global audience and is intended to reflect generally applicable data protection standards, including principles aligned with the General Data Protection Regulation where relevant. Where local mandatory rules impose higher standards, those rules prevail to the extent of their applicability.

For the purposes of this document, Kingmaker casino acts as a data controller in relation to personal data processed for the provision and administration of the platform. Where third parties process personal data on behalf of the controller, they act as processors under contractual obligations and documented instructions. This document does not address third party websites that may be accessible via links, because those services operate under independent privacy terms. The scope is limited to processing activities that are reasonably connected to the platform’s operation and legal obligations.

Definitions and Interpretation

Personal data means any information relating to an identified or identifiable natural person, including identifiers that can reasonably be linked to an individual. Processing includes any operation performed on personal data, such as collection, recording, organisation, structuring, storage, use, disclosure, or deletion. Special categories of personal data are processed only where strictly required by law or where explicit consent is obtained, and such processing is treated with heightened safeguards. A data breach refers to a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

References to applicable law include data protection, anti money laundering, counter terrorist financing, taxation, consumer protection, and gaming regulatory requirements that may apply based on the location of the relevant processing context. Where the term consent is used, it refers to a freely given, specific, informed, and unambiguous indication of wishes, documented in a manner appropriate to the risk. References to legitimate interests refer to interests pursued by the controller or a third party, balanced against the rights and freedoms of data subjects. Time periods stated in this document are minimum standards and may be extended where legal holds, dispute resolution, or regulatory investigations require preservation.

Categories of Personal Data Processed

The platform processes identification and account data such as name, date of birth, username, password hash, nationality, and account status information. It also processes contact data such as email address, telephone number, and communications history with support, including call recordings where permitted by law. Financial and transaction data may include payment instrument tokens, partial card details, bank identifiers, billing address, deposit and withdrawal records, chargeback history, and anti fraud signals. For compliance purposes, verification data may include copies of identity documents, proof of address, and source of funds information, with collection constrained to what is necessary and proportionate.

The platform also processes technical and usage data, including device identifiers, browser and operating system data, IP address, login time stamps, session identifiers, and security logs. Geolocation may be inferred from IP data to enforce territorial restrictions and risk controls, and it is not treated as precise location tracking unless explicitly collected and disclosed. Responsible gambling related data may include self exclusion status, deposit limit settings, behavioural risk indicators, and interaction records relevant to player protection obligations. Where legally required for age or identity verification, the platform may process data relating to sanctions screening and politically exposed person checks, subject to strict access controls and auditability.

Operational Sources and Collection Methods

Data is collected through operational steps such as account creation, profile updates, verification submissions, payment initiation, and gameplay participation. When casino Kingmaker is used on web or mobile interfaces, the platform automatically records technical data to maintain session continuity, prevent unauthorised access, and troubleshoot service issues. Customer support interactions generate records that may include correspondence content, attachments, and internal case notes, which are retained according to defined operational and legal needs. Automated systems may also generate risk scores from observed signals, but such outputs remain subject to governance rules and human review where required.

Data may be received from third parties when necessary for compliance and service integrity, including payment service providers, identity verification vendors, fraud prevention networks, and analytics providers operating under contractual constraints. Public sources may be consulted for sanctions and adverse media screening where mandated by law and carried out in a proportionate manner. Referrals from affiliates, where present, are limited to technical referral identifiers and do not include sensitive content, unless the user independently provides additional information during registration. The platform aims to minimise data collected at source and to apply data protection by design and by default, including field level validation to reduce unnecessary submission.

Legal Bases for Processing

Regulatory framing governs the selection of lawful bases, with processing being limited to what is necessary for defined purposes and demonstrable accountability. This Privacy policy recognises that contract necessity applies where processing is required to create and administer accounts, process transactions, provide access to gameplay, and deliver customer support. Legal obligations apply to processing required for identity verification, anti money laundering controls, taxation, consumer complaint handling, and regulatory reporting, including the maintenance of audit trails for a specified minimum period. Consent applies where optional processing is undertaken, such as certain categories of cookies, optional communications, or specific profiling activities not strictly required for the contract.

Legitimate interests may apply to security monitoring, fraud prevention, network and information security, service improvement, and the establishment, exercise, or defence of legal claims. Where legitimate interests are relied upon, the platform conducts balancing assessments that consider the nature of the data, the reasonable expectations of data subjects, and the impact of processing, with mitigations such as pseudonymisation and access restrictions. Where automated decision making produces legal or similarly significant effects, appropriate safeguards are applied, including meaningful information about the logic involved where required by applicable law. Processing of special categories of personal data is avoided unless a clear legal basis exists, such as explicit consent or substantial public interest under applicable legislation.

Purposes of Processing and Use Limitations

The platform processes personal data to establish and manage user accounts, to authenticate access, and to provide the requested gaming services in a secure and reliable manner. It uses verification and compliance data to meet licensing, anti fraud, anti money laundering, and responsible gambling obligations, including the enforcement of age restrictions. Transaction data is processed to facilitate deposits and withdrawals, to prevent chargebacks and payment abuse, and to reconcile financial records. Technical and usage data supports system administration, performance monitoring, incident response, and the detection of anomalous activity.

Communications data is used to respond to inquiries, to manage complaints, and to maintain evidence of interactions, including dispute resolution and regulatory inspections. Casino Kingmaker may process limited behavioural data to identify patterns associated with problem gambling risk, consistent with player protection duties and proportionality principles. Marketing communications are not sent without an appropriate legal basis, and opt out mechanisms are maintained for channels where consent or legitimate interests are used. Personal data is not used for incompatible purposes, and any new purpose is subject to an assessment of compatibility, updated notices where necessary, and supplementary safeguards.

Cookies and Tracking Technologies

This Privacy policy covers the use of cookies and similar technologies that may store or access information on a device to enable essential functionality. Essential cookies support login, session management, security protections, and load balancing, and they are deployed on the basis of necessity for service delivery. Analytics technologies may be used to understand aggregate usage and to improve stability, but where consent is legally required, such tools are activated only after an appropriate preference signal. Advertising cookies are avoided unless explicitly implemented and legally supported, and any such implementation is subject to transparent configuration and consent management.

Cookie identifiers and related metadata may be treated as personal data when they can be linked to an individual, especially when combined with account or device information. Preference settings are retained for a defined period, typically 12 months, unless earlier deletion occurs through browser controls or a platform setting where available. Technical logs generated by cookie consent tools are retained to demonstrate compliance and may include time stamps and consent status, without collecting excessive content. Casino Kingmaker applies periodic reviews to ensure trackers remain proportionate, documented, and aligned with applicable regulatory expectations across jurisdictions.

Data Sharing, Disclosure, and Third Party Processing

Personal data may be disclosed to third party service providers where necessary to operate the platform, including hosting providers, payment processors, verification vendors, customer support tooling providers, and security monitoring partners. Disclosures are limited to the minimum necessary data fields and are governed by written agreements that impose confidentiality, security requirements, and restrictions on sub processing. Where professional advisers are engaged, such as auditors, accountants, or legal counsel, access is limited to what is required for the relevant engagement and subject to professional secrecy where applicable. The platform does not sell personal data as a standalone commercial activity.

Disclosures to competent authorities may occur where required by law, court order, or binding regulatory request, including gaming regulators, financial intelligence units, and law enforcement bodies. Before disclosure, the platform assesses legitimacy, scope, and proportionality where permitted, and it documents the legal basis and the data released. Aggregated or de identified data may be shared for reporting, analytics, or integrity monitoring, provided reasonable measures are applied to prevent re identification. Casino Kingmaker maintains internal records of third party disclosures and periodically tests vendor compliance expectations against security and privacy requirements.

International Data Transfers

Because services are offered to a global audience, personal data may be processed in jurisdictions other than the one in which the data subject resides. Transfers occur only where an appropriate transfer mechanism is in place, such as adequacy decisions, standard contractual clauses, or other legally recognised safeguards. Where required, transfer impact assessments are conducted to evaluate the legal environment of the destination and the effectiveness of contractual and technical protections. Supplementary measures may include encryption in transit and at rest, strict access controls, and segmentation of data environments.

Cross border access by support or security teams is restricted through role based permissions and controlled administrative tooling. Where a processor engages sub processors, it must provide transparency and impose equivalent safeguards, including onward transfer restrictions. Transfer documentation is retained and made available to competent authorities where legally required. This Privacy policy is intended to be interpreted in a manner consistent with cross border data protection expectations, including transparency, minimisation, and enforceable rights.

Data Retention and Deletion Standards

This Privacy policy adopts retention rules grounded in necessity, legal obligation, and accountability, with differentiated periods based on data type and risk. Account and transaction records may be retained for 5 years after account closure or last transaction, where required to satisfy anti money laundering and financial record obligations, subject to extensions for active investigations or disputes. Verification documents are retained only for as long as necessary to meet regulatory requirements and to demonstrate compliance, and they are securely deleted or irreversibly anonymised when no longer required. Customer support records are typically retained for 24 months to support service quality, dispute management, and compliance auditing, unless a longer period is justified by legal claims.

Security logs and access records may be retained for 180 days to support incident detection, forensic analysis, and security assurance, with longer retention applied to high risk incidents or regulatory reporting needs. Cookie preference records are retained in line with stated periods, commonly 12 months, to evidence consent choices and to reduce repetitive prompts, unless the legal context requires shorter retention. Deletion is executed through controlled workflows, including secure wiping, key destruction for encrypted data, and verified removal from active environments, with back up deletion occurring in accordance with the back up cycle. Casino Kingmaker periodically reviews retention schedules at least 2 times per year to confirm proportionality and legal alignment.

Information Security and Confidentiality Controls

Operational explanation is provided to describe the measures used to protect personal data against unauthorised access, alteration, disclosure, or destruction. The platform applies layered security controls, including encryption for data in transit using modern protocols and encryption at rest for sensitive repositories where feasible. Access to systems is restricted through role based access control, multi factor authentication for privileged accounts, and segregation of duties, with administrative actions logged for audit purposes. Vulnerability management includes patching, configuration hardening, and periodic testing, with remediation tracked under documented governance procedures.

Organisational safeguards include staff training, confidentiality commitments, least privilege enforcement, and incident response playbooks with defined escalation paths. Where measurable, the platform targets 99.5% service availability for core systems, but availability objectives do not reduce security requirements or legal duties. Data protection impact assessments are conducted for high risk processing, and privacy by design measures are integrated into development lifecycles, including review gates before deployment. Casino Kingmaker applies monitoring for suspicious activity and may temporarily restrict access where risk indicators suggest account compromise or fraud, subject to proportionality and record keeping.

Rights of Data Subjects and Exercise of Rights

Rights based framing applies to the handling of requests concerning access, rectification, erasure, restriction, portability, and objection, subject to applicable law and documented exceptions. Data subjects may request confirmation of whether personal data is being processed and may obtain a copy of relevant data, subject to verification of identity and the protection of third party rights. Requests for rectification are supported where data is inaccurate or incomplete, and the platform may request evidence where necessary to prevent unauthorised alteration. Requests for erasure are assessed against legal retention obligations, including regulatory recordkeeping duties, and data may be retained in a restricted state where deletion is not legally permissible.

Where processing is based on consent, withdrawal is supported at any time with prospective effect, and withdrawal does not affect the lawfulness of processing carried out before it. Where objection is raised to processing based on legitimate interests, the platform evaluates the grounds and may continue processing only where compelling legitimate grounds exist or where needed for legal claims. The platform aims to respond to verified requests within 30 days, with an extension of up to 60 days where requests are complex or numerous, and any extension is communicated with reasons where legally required. Casino Kingmaker maintains request logs to demonstrate compliance, including time stamps, verification steps, and outcome records.

Contact Channels and Data Request Procedures

This Privacy policy provides procedural information on how requests and inquiries are handled to ensure lawful, secure, and traceable processing. Requests may be submitted through the support channel available on kingmaker-games.it.com or by other contact routes published on the platform, and they are triaged according to request type and urgency. Identity verification is applied to prevent unauthorised disclosure, and verification measures are proportionate, typically requiring matching account information and, where necessary, additional proof. Where an authorised representative submits a request, evidence of authority is required, and the platform may contact the data subject directly to confirm the mandate.

Complaints may be escalated internally for review by privacy responsible staff, and records of the investigation are maintained in accordance with retention rules. Where applicable law provides a right to lodge a complaint with a supervisory authority, the platform supports that right and cooperates with lawful inquiries. Responses are provided in a durable format unless a different format is requested and feasible, with attention to confidentiality and secure transmission. Casino Kingmaker applies internal service standards for privacy case handling, including acknowledgement typically within 72 hours and substantive response within the applicable statutory timeframe.

Policy Updates, Accountability, and the Privacy policy Commitment

This Privacy policy sets out the accountability framework used to demonstrate compliance with applicable data protection standards for a global audience, including GDPR aligned principles where relevant. Governance includes documented records of processing activities, vendor due diligence, risk assessments, staff training, and periodic control testing, with corrective actions tracked to completion. Where processing changes materially, the platform assesses whether transparency updates are required, whether consent must be refreshed, and whether additional safeguards are necessary for high risk activities. The platform maintains version control and change logs to demonstrate when amendments were made and what operational areas were affected.

Amendments may be required due to changes in law, regulatory guidance, security practices, operational features, or the categories of third parties engaged. Where changes affect the legal basis of processing or the nature of rights available, reasonable notice is provided through the website and, where appropriate, through account communications, taking into account the urgency of security or compliance updates. The continued operation of services after an effective date may indicate acceptance where permitted by law, but no acceptance mechanism reduces statutory rights or mandatory transparency requirements. Casino Kingmaker confirms an ongoing commitment to lawful processing, proportional data use, and timely handling of data subject requests, and it will apply the amendment procedure consistently to keep this Privacy policy accurate, accessible, and aligned with evolving compliance obligations.