Privacy Policy

CandyLand Online Casino

Effective Date and Scope

This Privacy Policy governs the collection, processing, storage, and sharing of personal data by CandyLand, an online casino brand operated under a gaming licence issued by the Curacao Gaming Authority. This policy applies to all individuals who access or use the CandyLand platform, including visitors to the website, registered account holders, and any person who interacts with our services through any digital channel. By accessing the CandyLand platform, registering an account, or engaging with any of our services, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy. CandyLand is committed to protecting the privacy and personal data of all users in accordance with applicable data protection legislation, including the UK General Data Protection Regulation as retained in domestic law through the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018. This policy is intended to provide full transparency regarding how we handle your personal information and to ensure compliance with our legal and regulatory obligations as a licensed iGaming operator serving users in the United Kingdom.

1. Data Controller Information

CandyLand acts as the data controller in respect of all personal data collected through the platform. As data controller, CandyLand determines the purposes and means by which personal data is processed. We are responsible for ensuring that all data processing activities comply with applicable legislation, including obligations arising under the UK GDPR and the Data Protection Act 2018. Users who have questions, concerns, or requests relating to their personal data may contact our dedicated Data Protection team using the contact details provided in the final section of this policy. CandyLand is committed to appointing appropriate data protection personnel to oversee compliance with this policy and applicable law.

2. Information We Collect

CandyLand collects a range of personal data in order to provide, maintain, and improve our online casino services. The categories of personal data we collect include, but are not limited to, the following:

• Registration data, including full legal name, date of birth, residential address, email address, and telephone number provided at the time of account creation
• Government-issued identification documents, including copies of passports, national identity cards, and driving licences submitted for identity verification purposes
• Payment and financial information, including bank account details, credit and debit card information, e-wallet account identifiers, and transaction history associated with deposits and withdrawals
• Source of funds documentation and financial statements provided in connection with anti-money laundering compliance and Know Your Customer procedures
• Technical data, including IP addresses, device identifiers, browser type and version, operating system information, session duration, and login timestamps
• Cookies and similar tracking technologies, including data collected through essential and analytical cookies as described in Section 9 of this policy
• Communications data, including records of correspondence between users and our customer support team via email, live chat, or telephone
• Behavioural and gameplay data, including betting history, game preferences, wagering patterns, and responsible gambling self-assessment responses
• Marketing preferences and consent records, including records of opt-in and opt-out decisions in relation to promotional communications

3. Legal Basis for Processing

CandyLand processes personal data only where a valid legal basis exists under the UK GDPR. The legal bases upon which we rely include the following:

• Performance of a contract, where processing is necessary to fulfil our obligations to you as an account holder and to provide the services you have requested
• Compliance with a legal obligation, where processing is required to meet our duties under anti-money laundering legislation, gambling regulation, tax law, and data protection law
• Legitimate interests, where processing is necessary for fraud prevention, platform security, responsible gambling monitoring, and the improvement of our services, provided such interests are not overridden by your fundamental rights and freedoms
• Consent, where you have provided explicit and freely given consent to the processing of your data for a specific purpose, such as the receipt of direct marketing communications

4. Purpose of Data Processing

CandyLand processes personal data for a range of clearly defined purposes that are directly connected to the operation of a licensed online casino platform. These purposes include:

• Account registration and management, including the creation, verification, and maintenance of user accounts
• Identity verification and Know Your Customer procedures, as required under applicable anti-money laundering and counter-terrorism financing regulations
• Anti-Money Laundering compliance, including ongoing monitoring of transactions and user activity to detect and report suspicious behaviour in accordance with the Proceeds of Crime Act 2002 and related legislation
• Payment processing, including the facilitation of deposits and withdrawals and the prevention of payment fraud
• Responsible gambling obligations, including the identification of at-risk players, the administration of self-exclusion requests, and compliance with social responsibility requirements applicable to operators serving UK-based users
• Customer support, including the resolution of account queries, complaints, and technical issues
• Marketing communications, including the delivery of promotional offers, bonus notifications, and product updates to users who have provided their consent to receive such communications
• Platform analytics and performance improvement, including the analysis of user behaviour and technical performance data to enhance the functionality and user experience of the platform
• Legal and regulatory compliance, including the fulfilment of reporting obligations to licensing authorities and law enforcement agencies where required by law

5. Data Sharing and Disclosure

CandyLand does not sell personal data to third parties. However, we may share personal data with selected third-party recipients where such sharing is necessary for the purposes described in this policy and is permitted under applicable law. The categories of third parties with whom we may share personal data include:

• Payment service providers and financial institutions engaged to process deposits and withdrawals on behalf of users
• Identity verification and Know Your Customer service providers engaged to authenticate user identities and assess risk profiles
• Anti-fraud and anti-money laundering technology providers engaged to monitor transactions and detect suspicious activity
• Regulatory and licensing authorities, including the Curacao Gaming Authority and, where applicable, UK regulatory bodies, to whom we are obliged to report in accordance with our licence conditions
• Law enforcement agencies and government authorities where we are required to disclose information by law, court order, or regulatory directive
• Third-party analytics and technology providers engaged to support the operation, security, and performance monitoring of our platform
• Legal and professional advisers, including solicitors and accountants, where disclosure is necessary for the provision of professional services

All third-party data processors engaged by CandyLand are required to process personal data only in accordance with our instructions and to implement appropriate technical and organisational security measures. We require all such parties to enter into data processing agreements that comply with UK GDPR requirements.

6. International Data Transfers

Where personal data is transferred outside the United Kingdom, CandyLand ensures that appropriate safeguards are in place to protect the data in accordance with UK GDPR standards. Such safeguards may include the use of standard contractual clauses approved by the UK Information Commissioner’s Office, adequacy decisions, or other legally recognised transfer mechanisms. Users may request further information about international data transfers by contacting our Data Protection team.

7. Data Retention

CandyLand retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law or regulation. In general, account data and transaction records are retained for a minimum period of five years following the closure of an account, in accordance with anti-money laundering legislation and gambling regulatory requirements. Technical logs and cookies data may be retained for shorter periods as described in our Cookie Policy. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data retention procedures.

8. User Rights

Under the UK GDPR and the Data Protection Act 2018, users have the following rights in relation to their personal data:

• The right to access personal data held about you, including the right to request a copy of your data through a Subject Access Request
• The right to rectification, including the right to request correction of inaccurate or incomplete personal data
• The right to erasure, also known as the right to be forgotten, including the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal and regulatory retention obligations
• The right to restrict processing, including the right to request that we limit the processing of your data in certain circumstances
• The right to data portability, including the right to receive your personal data in a structured, commonly used, and machine-readable format where processing is based on consent or contract
• The right to object, including the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests
• Rights in relation to automated decision-making, including the right not to be subject to a decision based solely on automated processing where such a decision produces legal or similarly significant effects

To exercise any of the above rights, users should submit a written request to our Data Protection team. We will respond to all valid requests within one calendar month of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further two months, in which case we will notify you accordingly. Users also have the right to lodge a complaint with the UK Information Commissioner’s Office if they believe that their personal data has been processed in a manner that is inconsistent with applicable data protection law.

9. Cookie Policy

CandyLand uses cookies and similar tracking technologies on its platform in order to ensure the proper functioning of the website and to improve the user experience. Cookies are small text files that are stored on your device when you visit our platform. The types of cookies we use include the following:

• Essential cookies, which are strictly necessary for the operation of the platform, including session management, authentication, and security functions, and which cannot be disabled without affecting the functionality of the website
• Analytical cookies, which are used to collect information about how users interact with the platform, including pages visited, time spent on the site, and technical errors encountered, for the purpose of improving platform performance and user experience
• Preference cookies, which are used to remember your settings and preferences, such as language selection and display options
• Marketing and targeting cookies, which may be used to deliver relevant promotional content to users who have provided their consent to receive marketing communications

Users may manage their cookie preferences through our cookie consent tool, which is displayed upon first accessing the platform. Essential cookies cannot be disabled as they are required for the platform to function. Users may withdraw consent for non-essential cookies at any time by adjusting their settings through the cookie management tool. For further information about the specific cookies used on our platform, please refer to our full Cookie Declaration, which is available on the CandyLand website.

10. Data Security

CandyLand implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include the use of encryption technologies, secure server infrastructure, access controls, and regular security assessments. Notwithstanding these measures, no method of electronic transmission or storage is entirely secure, and CandyLand cannot guarantee the absolute security of data transmitted over the internet. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, CandyLand will notify the relevant supervisory authority and, where required, affected individuals, in accordance with the timelines prescribed under applicable data protection law.

11. Responsible Gambling and Data Processing

CandyLand is committed to promoting responsible gambling and uses personal data to support the identification and protection of vulnerable users. Data relating to gameplay behaviour, wagering patterns, and account activity may be processed to identify signs of problem gambling and to take appropriate action, including the application of deposit limits, cooling-off periods, or self-exclusion measures. Users who wish to access responsible gambling tools or to self-exclude from the platform may do so by contacting our customer support team or by using the responsible gambling features available within their account settings.

12. Changes to This Privacy Policy

CandyLand reserves the right to update or amend this Privacy Policy from time to time in order to reflect changes in our data processing practices, applicable legislation, or regulatory requirements. Where material changes are made to this policy, we will notify registered users by email or through a prominent notice on the platform prior to the changes taking effect. The effective date at the top of this policy will be updated to reflect the date on which the most recent version was published. Continued use of the platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms.

13. Contact Information

Users who wish to exercise their data protection rights, raise a concern about the processing of their personal data, or obtain further information about the practices described in this Privacy Policy are invited to contact the CandyLand Data Protection team in writing. Contact details for our Data Protection team are available on the CandyLand website. Users who are not satisfied with our response to a data protection concern have the right to escalate their complaint to the UK Information Commissioner’s Office, which can be contacted through its official website at ico.org.uk.