Fortunica Privacy Policy for United Kingdom Players
Fortunica, operated by Winstar N.V. under an Anjouan Offshore Financial Authority licence (ALSI-202501022-F11), processes personal data to deliver its casino services. This privacy policy explains what information is collected, the purposes for processing, and how players in the United Kingdom can exercise their data protection rights. The platform operates outside the UKGC framework and the GamStop network, which affects certain regulatory protections available to players.
Personal Data Collected
Personal data means any information that can identify a player directly or indirectly. Fortunica collects several categories of data during registration, account verification, and ongoing platform use. This collection enables the operator to provide gaming services, process transactions, and fulfil legal obligations.
Identity data: full name, date of birth, gender, and copies of identification documents such as passports or driving licences submitted during verification. Contact data: email address, telephone number, and residential address provided during account creation. Financial data: payment card details, e-wallet account information for services like Skrill and Neteller, cryptocurrency wallet addresses, and transaction histories. Technical data: IP address, device type, browser version, operating system, and unique device identifiers collected automatically when accessing the platform.
Account data: username, password (encrypted), account preferences, and self-exclusion settings. Transaction data: deposit and withdrawal records, betting history, bonus usage, and balance information. Communication data: correspondence with customer support, including chat transcripts and email exchanges. Behavioural data: gaming patterns, session duration, and interactions with platform features collected to support responsible gambling measures.
Purposes of Data Processing
Fortunica processes personal data for specific, lawful purposes tied to operating an online casino platform. Each purpose has a corresponding legal basis under data protection principles. The operator does not process data in ways incompatible with these stated purposes.
Contract performance: Processing identity, contact, financial, and transaction data is necessary to create accounts, accept deposits via Visa, Mastercard, Skrill, Neteller, or cryptocurrency, process withdrawals, and deliver gaming services. Without this processing, players cannot use the platform.
Legal obligations: The operator must verify player identity to comply with anti-money laundering regulations, age verification requirements, and licensing conditions under the Anjouan Offshore Financial Authority. Transaction records are maintained for regulatory reporting purposes.
Legitimate interests: Technical and behavioural data support fraud prevention, platform security, service improvement, and responsible gambling interventions. These interests are balanced against player privacy rights. The operator also uses data to enforce terms and conditions, including the application of withdrawal fees where wagering requirements are unmet.
Consent: Where required, explicit consent is obtained for marketing communications, promotional offers, and certain cookie categories. Players may withdraw consent at any time without affecting the lawfulness of prior processing.
Cookies and Tracking Technologies
Cookies are small text files stored on a player’s device when accessing Fortunica. The platform uses several cookie types serving distinct functions. Players can manage cookie preferences through browser settings or the platform’s cookie management tools.
Essential cookies: These cookies enable core platform functionality, including account authentication, session management, and security features. Disabling essential cookies prevents the platform from functioning correctly. Performance cookies: Anonymous data about platform usage helps identify technical issues, measure page load times, and improve overall performance. Functional cookies: These remember player preferences such as language settings, display options, and previously selected payment methods for convenience.
Analytical cookies: Third-party analytics tools may collect aggregated, anonymised data about user journeys, popular games, and feature engagement. This data informs platform development decisions. Marketing cookies: Where consent is given, these cookies track interactions with promotional content and enable targeted advertising on third-party platforms. Players who decline marketing cookies still receive full gaming functionality.
Mobile applications available as APK for Android and IPA for iOS may collect additional device data including push notification tokens and app crash reports. Players can control app permissions through device settings.
Data Sharing and Third Parties
Fortunica shares personal data with third parties only when necessary for service delivery, legal compliance, or legitimate business operations. The operator does not sell personal data to third parties for independent marketing purposes.
Payment processors: Financial data is shared with card networks, e-wallet providers (Skrill, Neteller), and cryptocurrency payment processors to complete transactions. These processors operate under their own data protection obligations. Identity verification providers: Document verification services receive identity data to confirm player eligibility and comply with know-your-customer requirements. Game providers: Software suppliers may receive limited player data to deliver gaming content and resolve technical disputes.
Regulatory authorities: The Anjouan Offshore Financial Authority and other relevant bodies may receive data pursuant to licensing requirements or investigations. Professional advisers: Legal, accounting, and auditing firms may access data in connection with professional services. Corporate transactions: In the event of a merger, acquisition, or asset sale, player data may transfer to the acquiring entity under equivalent protection.
Some third parties operate outside the European Economic Area or jurisdictions with different data protection standards. The operator implements appropriate safeguards, including contractual clauses, for international data transfers.
Your Data Protection Rights
Players in the United Kingdom retain data protection rights under applicable law. These rights apply regardless of whether the platform holds a UKGC licence, though enforcement mechanisms may differ for offshore operators.
Right of access: Players may request confirmation of whether personal data is processed and obtain copies of that data. The operator aims to respond within one month of receiving a valid request. Right to rectification: Inaccurate or incomplete data can be corrected upon request. Players should update contact and identity information through account settings or customer support. Right to erasure: In certain circumstances, players may request deletion of personal data. This right is limited where retention is required for legal obligations, contract performance, or legitimate interests such as fraud prevention.
Right to restriction: Players may request that processing be limited while disputes about data accuracy or lawful processing are resolved. Right to data portability: Where processing is based on consent or contract performance, players may receive their data in a structured, commonly used format for transfer to another controller. Right to object: Players may object to processing based on legitimate interests. The operator will cease processing unless compelling legitimate grounds override player interests.
Rights related to automated decisions: Where significant decisions are made solely through automated processing, players may request human review. This includes decisions affecting account status, bonus eligibility, or withdrawal approval.
Data Security Measures
Fortunica implements technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No security system eliminates all risk, but the operator maintains industry-standard protections.
Encryption: Data transmitted between player devices and platform servers uses SSL/TLS encryption. Payment card details are processed through PCI-DSS compliant systems. Passwords are stored using one-way cryptographic hashing. Access controls: Staff access to personal data is limited to those with legitimate business needs. Access rights are reviewed regularly and revoked promptly upon role changes.
Infrastructure security: Servers are housed in secure facilities with physical access restrictions, environmental controls, and backup power systems. Network security measures include firewalls, intrusion detection systems, and regular vulnerability assessments. Incident response: The operator maintains procedures for identifying, containing, and reporting data breaches. Where a breach poses high risk to players, affected individuals will be notified without undue delay.
Players contribute to account security by maintaining strong, unique passwords, enabling two-factor authentication where available, and protecting login credentials from disclosure.
Data Retention Periods
Personal data is retained only as long as necessary for the purposes for which it was collected. Retention periods vary by data category and applicable legal requirements.
Account data: Active account information is retained throughout the player relationship and for a period after account closure to address potential disputes, chargebacks, or regulatory inquiries. Transaction records: Financial records, including deposit and withdrawal histories, are retained for the longer of the operator’s legal retention obligations or five years from account closure. Identity documents: Verification documents are retained as required by anti-money laundering regulations, typically for five years following the end of the business relationship.
Communication records: Customer support correspondence is retained for a reasonable period to resolve ongoing issues and for quality assurance purposes. Technical logs: Server logs and security data are retained for periods necessary to investigate incidents and maintain platform security. Marketing preferences: Consent records and opt-out preferences are retained to ensure marketing restrictions are honoured.
When retention periods expire, data is securely deleted or anonymised so that individuals can no longer be identified.
Contact and Complaints
Players may exercise data protection rights or raise privacy concerns by contacting Fortunica’s customer support through the platform’s communication channels. Requests should include sufficient information to verify identity and specify the rights being exercised.
The operator aims to respond to data protection requests within one calendar month. Complex requests or high volumes may extend this period by up to two additional months, with notification provided within the initial month. No fee applies for reasonable requests, though the operator may charge a reasonable fee or refuse excessive or manifestly unfounded requests.
Players who believe their data protection rights have not been adequately addressed may lodge complaints with relevant supervisory authorities. For United Kingdom residents, the Information Commissioner’s Office (ICO) handles data protection complaints, though enforcement against offshore operators may face practical limitations. Players should consider this when choosing platforms for online gaming activity.
This privacy policy may be updated to reflect changes in processing activities, legal requirements, or operator practices. Material changes will be communicated through the platform, and continued use following notice constitutes acceptance of updated terms.