At VipLuck Casino, we know that handling data responsibly is what establishes trust with players and affiliates. This article describes how we gather, process, and safeguard personal data under the General Data Protection Regulation as applied in Belgium. We operate with full transparency, clear policies, and strong technical measures, so every person who interacts with our system, whether through gameplay or our affiliate program, can enforce their privacy rights without friction. Our dedication goes beyond compliance duties. It is integrated into our company culture and daily activities.
Our Responsibility to Information Security and the GDPR Framework
VipLuck Casino handles data protection as a key business principle. We have developed a privacy programme that complies with both the GDPR and the Belgian Act of 30 July 2018. It covers a dedicated Data Protection Officer, detailed records of processing activities, and Data Protection Impact Assessments for high-risk operations. We see compliance as a living process, one we keep improving through audits, staff training, and feedback from data subjects.
Our entire infrastructure adheres to privacy by design and by default. Before we launch any new feature, we assess its data protection implications and make sure only the minimum necessary personal data gets collected. This same proactive approach extends to our affiliate programme. We require partners to commit to equivalent data protection standards before joining our network, and we regularly review their compliance through documentation checks and, where needed, on-site audits.
The GDPR’s territorial scope implies any processing of personal data belonging to individuals in Belgium comes under its protection, regardless of where the data controller is established. VipLuck Casino fully respects this principle and enforces the regulation uniformly across all operations. We also adhere to guidance issued by the European Data Protection Board and the Belgian Data Protection Authority, keeping our interpretations and practices current and grounded.
Transparency sits at the heart of the GDPR, and we take it seriously. This article is one part of a broader transparency framework that covers our dedicated Privacy Policy, cookie notices, and just-in-time notifications. We encourage you to read these materials carefully and reach out to our DPO if anything remains unclear. Our goal is simple: you should never wonder how your personal data is being used.
Individual Data We Gather and the Purpose of Processing
We obtain several types of personal information to provide our gaming services, manage accounts, and operate our affiliate programme. The information we request stays at the minimum necessary for the intended purpose. Before collecting any new data type, we verify that it is vital to the operation or legal compliance of our platform. This data minimization cuts risk and stays true to the GDPR’s core tenets.
- Identification and contact data: full name, date of birth, address, email, phone number, and government-issued identification document particulars for verification.
- Economic and transfer details: payment method information, deposit and withdrawal amounts, currency preferences, and transaction identifiers.
- System and activity data: IP address, device identifiers, browser type, page interactions, login timestamps, and cookie data.
- Profile and gameplay details: username, game history, wagers, bonus interactions, responsible gaming limits, and self-exclusion flags.
- Referral data: referral tracking codes, commission agreements, performance reports, and payment details for partner accounts.
We process this information for clearly defined purposes: account creation, identity verification, transaction processing, fraud prevention, responsible gaming monitoring, and affiliate commission tracking. Technical data maintains the security of our systems, while affiliate-specific data enables precise referral attribution and payment of commissions. Each purpose relates to a specific legal basis, which we describe in the next section.
Just as significant is what we do not collect. We do not ask for special categories of personal data, such as health information, biometric data, or data revealing political opinions. We steer clear of collecting any information that is not directly related to providing our gaming and affiliate services. If a player or affiliate voluntarily provides such information, we make efforts to discard it securely unless retention is required by law.
When we have to share data with third-party service providers, payment processors or hosting providers, ad.nl for example, we do so only under binding data processing agreements. These agreements state that the processor may act only on our documented instructions and must implement adequate security measures. We never sell personal data to anyone, and we do not share it with unaffiliated third parties for their own marketing purposes.
Security Measures, Cross-Border Transfers, and Retention
Security is integrated in every layer of our framework. We use AES-256 encryption for data at rest and TLS 1.3 for data in transit, guaranteeing all personal details is protected during sending and saving. Permission to user details is strictly controlled through role-specific access, two-factor authentication, and comprehensive security screenings on employees. Our systems are tracked 24/7 by a specialized security operations team, and we conduct intrusion tests and vulnerability scans at set times.
When private information is sent beyond the European region, we rely on authorized data movement tools such as the EU’s contractual agreements. We review the regulations of the receiving country to guarantee they do not compromise the safeguards provided by the GDPR. If needed, we implement supplementary technical measures, such as encoding with access keys solely in the EEA. Our data handlers and affiliates are formally obligated to maintain these same levels, and we check them for compliance.
Data storage is regulated by a strict company timetable. Usually, we store account information for the period of the player’s activity and for a maximum of ten years after account termination to fulfill AML and taxation rules. Transaction records and gaming records adhere to analogous storage times. Partner data, including commission statements and financial records, is stored for the term of the contract and up to 7 years after termination. Once retention limits are attained, we safeguardedly erase or irrevocably de-identify the details.
Statutory Basis for Handling Player and Affiliate Data
Every processing activity at VipLuck Casino is anchored in one of the six legal grounds set out in Article 6 of the GDPR. For most of our core operations, account management, game provision, and payment processing, processing is necessary for the execution of a contract to which the data subject is party. This includes the contract formed when you register an account or when an affiliate joins our program.
We also process personal data to meet legal obligations. Anti-money laundering regulations, for instance, oblige us to verify your identity and keep transaction records for a statutorily required period. Similarly, we may be required to share specific data with authorities upon a legal request. These obligations supersede any contrary preference, but we always notify you where possible and process only to the extent necessary by law.
Our legitimate interests constitute the basis for certain processing activities, such as maintaining network security, discovering and blocking fraud, and analyzing aggregated, anonymized trends to enhance our services. Before basing on legitimate interests, we perform a balancing test to ensure that your fundamental rights are not unduly impacted. The results of these tests are documented and can be made available to our DPO or the supervisory authority.
Where processing is not included by contract, law, or legitimate interests, we acquire your explicit consent. This concerns direct marketing emails and non-essential cookies. You can withdraw consent at any time via your account settings. For affiliate partners, data processing is primarily based on the contractual agreement, though we may also get consent for certain analytics reports. We document each basis thoroughly in our records of processing.
Your Data Subject Rights and How to Exercise Them
You are granted a comprehensive set of rights regarding the personal data we hold. These rights are enshrined in Chapter III of the GDPR and are fully honored at VipLuck Casino. They include the option to access your data and obtain a structured, commonly used machine-readable copy; the option to rectify inaccurate information; the right to erasure when data is not needed or if you retract consent; the option to suspend processing in certain circumstances; and the right to oppose to processing based on justified interests or direct marketing.
To enforce any of these rights, contact our Data Protection Officer at dpo@vipluck-casino.eu or send a request through the privacy portal in your account. We will authenticate your identity to stop unauthorized disclosure and respond within one month. If the request is complex, we may extend this period by two extra months, but we will advise you of the extension within the first month. There is no cost for these requests unless they are manifestly unfounded or excessive.
If you think our response is not acceptable or that our processing breaches the GDPR, you have the option to file a complaint with the Belgian Data Protection Authority. We urge you to first contact us so we can settle the issue quickly, but you are free to contact the supervisory authority at any time. Affiliates have the same rights, and we have created dedicated procedures to handle their requests promptly, including data portability for affiliate performance data.
Affiliate System: Data Disclosure and Compliance Obligations
This affiliate programme utilizes distinctive tracking links that place a first-party cookie on the visitor’s device when they click. That cookie includes a tracking ID, timestamp, and technical data such as IP address and browser agent, which allows us to attribute subsequent registrations. The cookie lifespan is outlined in the affiliate terms and may be checked in our cookie policy. We ensure players are informed about this tracking and are able to adjust their cookie preferences at any time.
We disclose only aggregated or pseudonymized data with affiliates for commission calculation and reporting. Individual player identities are never disclosed. Affiliates get masked usernames, transaction identifiers for reconciliation, and summary performance statistics. The affiliate agreement includes a data processing addendum that explicitly outlines the scope of permitted data use. Affiliates are barred from attempting to re-identify individuals or using the data for any purpose beyond what is required to meet the programme’s operational requirements.
VipLuck Casino and our affiliates and our affiliates are bound to the GDPR as independent controllers for their respective processing. We insist that affiliates maintain their own privacy policies, apply adequate security measures, and disclose any data breaches that may affect shared data within a specified timeframe. We perform periodic reviews of affiliate compliance and hold the right to suspend or terminate relationships with partners who fail to uphold these data protection standards. This shared responsibility model ensures the entire referral ecosystem secure and transparent.
Frequently Asked Questions
What personal data does VipLuck Casino gather from Belgian users?
We obtain identification data such as name, date of birth, and address, along with contact details, financial data for payments, technical data like IP addresses and device identifiers, and gaming activity logs. This data is essential to create accounts, verify identities, process transactions, and comply with anti-money laundering obligations. We always confine collection to what is strictly necessary for the intended purpose and never request sensitive special categories of data.
What duration does VipLuck Casino keep my personal data?
Keeping periods differ by data type. Account records remain active during your relationship with us and are archived for up to ten years after account closure to meet legal duties such as anti-money laundering and tax laws. Marketing consent records stay until you withdraw consent. Affiliate data follows similar legal schedules, up to seven years after contract termination. Once retention concludes, we irreversibly anonymize or securely delete the data.
Can I request the deletion of my data under GDPR?
Indeed, you hold the right to demand erasure when data is no longer needed for its original purpose, when you cancel consent, or when processing is unlawful. We evaluate each request and reply within one month. If legal retention duties prevent full deletion, for illustration, mandatory record-keeping for overseers, we will advise you, restrict further processing, and detail which data persists and why, along with your right to reach the Belgian Data Protection Authority.
By what means does VipLuck Casino protect affiliate data?
Affiliate data is safeguarded using the same rigorous security measures applied to player data: encryption at rest and in transit, strict access restrictions, and continuous monitoring. We share only pseudonymized or aggregated data required for tracking commissions. Binding data processing agreements require affiliates to maintain GDPR-compliant practices. Regular audits and compliance checks help ensure that partners handle data securely, and we promptly handle any unauthorized use or breach of personal data.
What person is the Data Protection Officer and how can I reach them?
Our Data Protection Officer supervises GDPR compliance, serves as a point of contact for data subjects, and works with supervisory authorities. You can contact the DPO directly at dpo@vipluck-casino.eu or via the confidential contact form on our website. We aim to flashscore.com confirm all questions within two business days and offer a substantive response inside the legal timeframe. The DPO can assist with rights requests, grievances, or any inquiries regarding our data handling procedures.