Privacy Policy
We may amend or update this Privacy Policy from time to time. For that reason, we suggest that you review it periodically so that you stay informed about how your data is handled.
This Privacy Policy (the “Policy”) describes the ways in which we collect, use, disclose and protect your personal data in line with the applicable data protection legislation, which includes, without being limited to, the Personal Information Protection and Electronic Documents Act (PIPEDA) and the General Data Protection Regulation (GDPR).
1. General.
Metlait SRL (registered in El Guayaval, Residencial La Campina Casa Numero Q -11, Cartago, El Guarco, Tejar, 30801 – Costa Rica, reg. number 3-102-911867) is the operator of Spinrise (in this Policy, the “Casino” or “we”).
Because we determine the purposes for which, and the means by which, your data is processed under this Policy within our relationship with you, we act as the Data Controller.
If you have any concern about your personal data, or any question about this Privacy Policy, our Data Protection Officer (DPO) is available to assist you. You can reach the DPO at [email protected].
2. Data processing.
The personal data we collect and process is confined to what is adequate, relevant and necessary for the purposes for which it is processed.
We may collect and process the following categories of personal data:
1. Identity data: your full name, username, date of birth, gender, nationality and official identification numbers (for example, from a passport or ID).
2. Contact data: your residential address, documents serving as proof of address, email address, telephone number and other contact details.
3. Financial and transaction data: bank account information, payment card details, documents that verify your source of funds or source of wealth (such as income declarations or bank statements), and information about deposits, withdrawals and other financial transactions made on our platform.
4. Gaming activity data: details of the games you play, login and logout timestamps, wagering activity, use of bonuses and any responsible gaming interventions.
5. Technical data: IP address, location data, login credentials, browser type and version, operating system, time zone settings and other technical data concerning the devices you use to access our services.
6. Marketing and communication data: your marketing preferences and the communications you exchange with our support team or through other channels.
7. Other voluntary data: any additional personal data you choose to provide while using our services or contacting customer support.
To keep data accurate, comply with regulatory requirements and deliver our services securely, we obtain personal data from the following sources:
1. From you directly, when you sign up for our services, get in touch with us or submit information through your account.
2. From 3rd parties, where applicable, for example verification service providers, financial institutions and payment providers, AML and PEP databases, regulatory authorities and Responsible Gaming Databases, and marketing and affiliate partners.
Personal information is kept only for as long as is needed to achieve the purposes for which it was collected, or for as long as the law requires.
Such requirements include anti-money laundering rules (under which data is kept for a minimum of five years from the date your account is closed), tax obligations and the resolution of disputes. When the data is no longer required, we will securely delete, anonymize or de-identify it in line with established data protection standards.
Your personal data is processed only when a valid legal basis exists, and each processing activity is confined to specific, explicit and legitimate purposes:
1. Providing our services (legal basis: performance of a contract).
2. Meeting regulatory requirements (legal basis: our legal obligation under applicable laws, including Anti-Money Laundering (AML) regulations, Know Your Customer (KYC) checks, responsible gaming requirements, reporting and other duties). Verification data provided for KYC checks can be utilized across all websites and brands owned by Metlait SRL.
3. Preventing fraud and managing risk (legal basis: our legitimate interest in protecting our platform, our users and the integrity of our business).
4. Marketing and personalisation (legal basis: your consent or our legitimate interests in sending you relevant marketing communications, promotional content and advertising tailored to your preferences).
5. Analytics and service improvement (legal basis: our legitimate interests in monitoring how the platform performs, analyzing usage trends, resolving technical issues and improving the user experience as a whole).
6. Maintaining security and system integrity (legal basis: our legal obligation and our legitimate interest in monitoring and maintaining system security, detecting threats and protecting the confidentiality, integrity and availability of data).
7. Streamlining our workflows and improving our customer service through Artificial Intelligence (AI) (our customer messaging platform incorporates conversational AI tools supplied by 3rd parties. Relying on this legitimate interest, we use these tools to manage conversations, access tickets and profiles, analyze patterns in interactions and provide intelligent support responses.)
In order to provide our services, we may have to share your personal data with trusted 3rd parties.
Any sharing of data takes place in line with applicable data protection laws, and we make sure that third parties are bound by contract to use the data solely for specified, lawful purposes and subject to strict security obligations. These 3rd parties fall into the following categories:
1. Entities within our corporate group.
2. Game providers.
3. Payment providers.
4. Marketing partners.
5. Regulatory authorities.
6. 3rd-party service providers.
7. Conversational AI Service Providers: Anthropic, OpenAI, Gemini. These 3rd-party vendors act as data processors and receive limited access to our customer messaging workspace so that they can help us facilitate, automate and optimize our customer support and marketing operations.
8. AML and KYC verification tools.
9. Business consultants, such as lawyers, accountants, notaries and similar advisers.
10. Other trusted 3rd parties. For example, if a merger, acquisition or sale takes place, your personal data may be transferred, and we will let you know before that change happens.
3. Data transfers
Where we transfer your personal data internationally (for instance, for IT hosting, customer service or verification services), we make sure that appropriate safeguards apply, such as the European Commission’s Standard Contractual Clauses (SCCs) or transfers to countries that benefit from adequacy decisions. We see to it that personal information handled by our service providers in other jurisdictions receives comparable protection, and we remain accountable for how they handle your data.
4. Data subject rights.
You have certain rights in relation to your personal data. They allow you to understand, access and control how your information is used and, where applicable, to limit that use:
1. Access your personal data. A copy of your personal data can be obtained through the data export function in your personal account.
2. Have inaccurate or incomplete data corrected.
3. Ask for your data to be deleted, subject to legal retention requirements.
4. Restrict processing in certain circumstances.
5. Move your data to another provider (data portability).
6. Object to processing carried out on the basis of legitimate interest or for marketing.
7. Withdraw your consent at any time, where applicable.
8. Lodge a complaint with your local data protection authority.
As a rule, we do not rely on fully automated decision-making in our operations. Should such automated processes be used in certain situations, we will inform you separately, as applicable law requires.
5. Data protection of minors.
Only individuals who have reached the minimum legal gambling age in their respective jurisdiction (at least 18 years old) may access this website and its services. We do not knowingly collect or process personal data of anyone under the applicable legal age. If we learn that such information has been submitted, in particular through misuse of our platform, we will take appropriate steps to delete it and will act in accordance with the relevant legal requirements.
6. Data security
To prevent unauthorized and unnecessary disclosure of your Personal Data, we will implement the controls described below:
Access Controls: We strictly prevent unauthorized physical access to the facilities, buildings or rooms that house personal data processing systems. Our systems are hosted in secure data centers that meet high industry standards of physical and digital security. Only authorized personnel may access personal data.
System Access Controls: Every system that processes personal data is protected by passwords and authentication measures. Unique user IDs are issued for authentication.
Data Access Controls: Access to files and programs is granted on a “need-to-know” basis. Controls exist to prevent the unauthorized installation or use of hardware and software. This also covers the adoption of practices that ensure data no longer needed for processing purposes is deleted securely and permanently.
Organisational Requirements: We have put technical and organisational measures in place to prevent personal data from being accidentally mixed. To achieve this, we have designated a Data Protection Officer (“DPO”) and we also train our staff on data privacy and data security.