PRIVACY POLICY
Last updated: August 14, 2025
ABOUT THIS GUIDE
This Privacy explains how your Personal Data is handled when you use this Website, create or manage an Account, complete verification, process payments, contact support, or interact with the online services provided through the Website.
The Website is owned and operated by Carletta N.V., a company registered under the laws of Curaçao with company registration number 142346 and registered office at Dr. Henri Fergusonweg 1, Curaçao. Carletta N.V. has been licensed by the Curaçao Gaming Control Board since 24/Jun/2025 to offer games of chance under license number OGL/2024/580/0570 in accordance with the National Ordinance on Games of Chance (LOK).
This guide applies when you interact with us through:
the Website;
communications sent to or received from [email protected];
phone calls with us;
support chat sessions.
Carletta N.V. acts as the controller of your Personal Data. This means that we are responsible for determining how and why your Personal Data is collected, used, stored, disclosed, and protected in connection with your use of the Website and Services.
This guide is intended to help you understand what information may be processed, why it is needed, how long it may be retained, who it may be shared with, and what choices and rights are available to you.
KEY TERMS USED IN THIS GUIDE
To make this guide easier to follow, the main terms used in it are explained below.
Account
An Account is the unique account created for you to access the Services or specific parts of the Services. Access may be subject to identity verification and Regulatory Compliance requirements.
Company, we, us, or our
These terms refer to Carletta N.V., registered in Curaçao under company registration number 142346, with registered address at Dr. Henri Fergusonweg 1, Curaçao.
Service
The Service means the Website, its features, and related online gaming and interactive services provided by the Company.
Website
The Website includes this website, as well as any subdomains, associated platforms, or applications operated by the Company.
Personal Data
Personal Data means any information relating to an identified or identifiable individual, as defined under the General Data Protection Regulation (GDPR) and the Curaçao Data Protection Framework.
Processing of Personal Data
Processing means any action performed with Personal Data, whether manually or automatically. This includes collecting, recording, organizing, storing, changing, retrieving, using, disclosing, restricting, deleting, or destroying Personal Data.
Regulatory Compliance
Regulatory Compliance means the Company’s legal obligation to process Personal Data under applicable laws, including the National Ordinance on Games of Chance (LOK) and Anti-Money Laundering (AML) regulations. Processing for these purposes is based on legal requirements and does not rely on user consent.
HOW YOUR DATA IS USED WHEN YOU CREATE AND USE AN ACCOUNT
When you register and access the Services, certain Personal Data is required to create, activate, secure, and manage your Account.
Purpose
Account registration and access to the Services.
Legal basis
Performance of a contract or steps taken before entering into a contract under GDPR Article 6(1)(b).
Personal Data used
We may process your email address and/or phone number, hashed password, chosen currency, account identifiers, and basic device or access logs used to activate and secure the Account.
This information is necessary because without it we may not be able to create or maintain your Account or provide access to the Services.
HOW YOUR IDENTITY AND AGE ARE VERIFIED
Because the Services are subject to regulatory requirements, we may need to verify your identity, confirm your age, and complete checks connected with KYC, AML/CFT, LOK, and NORUT obligations.
Purpose
Identity verification, age confirmation, and AML / LOK compliance.
Legal basis
Compliance with legal obligations, including AML/CFT, LOK, and NORUT, under GDPR Article 6(1)(c). Where applicable, we may also rely on legitimate interests in platform integrity under GDPR Article 6(1)(f).
Personal Data used
We may process government-issued identification documents such as a passport, ID card, or driver’s license, proof of address, date of birth or age attestation, selfies, or liveness checks.
These checks help us meet legal and regulatory obligations and prevent access by users who do not meet the applicable requirements.
HOW PAYMENT DATA IS PROCESSED
When you make deposits, withdrawals, refunds, or other payment-related transactions, Personal Data may be processed to complete and record those transactions.
Purpose
Payment processing, including deposits, withdrawals, and refunds.
Legal basis
Performance of a contract under GDPR Article 6(1)(b), compliance with financial record-keeping and AML obligations under GDPR Article 6(1)(c), and legitimate interests in fraud prevention under GDPR Article 6(1)(f).
Personal Data used
We may process payment instrument data, transaction history, currency, and payout channel confirmations.
Payment-related information may also be required for regulatory reporting, financial audits, and dispute resolution.
HOW SECURITY AND FRAUD PREVENTION WORK
We process certain technical and activity-related information to keep the Services secure and to prevent fraud, unauthorized activity, and platform abuse.
Purpose
Fraud detection, security monitoring, and platform abuse prevention.
Legal basis
Legitimate interests in securing the Service and protecting users under GDPR Article 6(1)(f), and legal obligations under AML/CTF rules under GDPR Article 6(1)(c).
Personal Data used
We may process device and technical identifiers, including IP address, device type, and browser data.
This processing helps protect the integrity of the platform and supports compliance with applicable legal obligations.
RESPONSIBLE GAMING AND PLAYER PROTECTION
Some Personal Data is processed to support responsible gaming measures, including self-exclusion, cooling-off options, limits, and player protection interventions.
Purpose
Responsible gaming, player protection, and self-exclusion management.
Legal basis
Compliance with LOK / CGA Responsible Gaming requirements under GDPR Article 6(1)(c), and legitimate interests in player welfare and Regulatory Compliance under GDPR Article 6(1)(f).
Personal Data used
We may process self-exclusion status and duration, cooling-off selections, play limits, gameplay frequency, spend metrics indicative of risk, and communications related to responsible gaming interventions.
This information is used to comply with responsible gaming obligations and to support safer use of the Services.
WHEN YOU CONTACT CUSTOMER SUPPORT
If you contact us, we process the information needed to understand your request, respond to you, and resolve the matter.
Purpose
Customer support and service communications.
Legal basis
Performance of a contract when responding to service requests under GDPR Article 6(1)(b), and legitimate interests in service quality and dispute resolution under GDPR Article 6(1)(f).
Personal Data used
We may process support tickets, chat transcripts, email correspondence, call notes, account identifiers, and transaction references linked to the inquiry.
You can contact support at [email protected].
MARKETING COMMUNICATIONS
Where permitted by law, we may process certain contact and preference information to send marketing communications.
Purpose
Marketing communications where permitted.
Legal basis
Consent under GDPR Article 6(1)(a) for electronic marketing. Where allowed by law, legitimate interests under GDPR Article 6(1)(f) may apply for similar-product soft opt-in. All such communications remain subject to opt-out and responsible gaming restrictions.
Personal Data used
We may process contact details such as email address, phone number, or push token, marketing preferences, engagement metrics, and non-sensitive bonus eligibility status.
You may opt out of marketing communications where applicable.
WEBSITE PERFORMANCE, ANALYTICS, AND COOKIES
When you use the Website, certain technical information may be collected through cookies and similar technologies.
Purpose
Website performance, analytics, and cookies.
Legal basis
Legitimate interests in operating and improving the Website under GDPR Article 6(1)(f), and consent under GDPR Article 6(1)(a) where required for non-essential cookies.
Personal Data used
We may process usage logs, cookie identifiers, browser type and version, traffic data, and on-site interaction metrics.
Cookies help the Website function, remember certain settings, analyze performance, and, where permitted, support advertising or targeting activities.
REGULATORY REPORTING, AUDITS, AND LEGAL MATTERS
Some Personal Data may be processed or retained where required for regulatory cooperation, audits, dispute resolution, or legal proceedings.
Purpose
Regulatory reporting, audits, and dispute resolution.
Legal basis
Legal obligation under GDPR Article 6(1)(c), including cooperation with the Curaçao Gaming Authority, FIU, tax authorities, and other authorities. We may also rely on legitimate interests in establishing, exercising, or defending legal claims under GDPR Article 6(1)(f).
Personal Data used
We may process records required for regulatory cooperation, compliance audits, legal proceedings, or dispute resolution, as permitted by applicable laws.
WHERE YOUR PERSONAL DATA COMES FROM
Most Personal Data is collected directly from you. However, some information may also come from your use of the Services or from trusted third parties and competent authorities.
Directly from you
This includes information you provide when creating an Account, completing verification, making deposits or withdrawals, or communicating with support.
From your use of the Services
This includes data generated through activity on the platform, such as gameplay, transaction history, device information, log information, and cookie data in accordance with the Cookie Policy.
From third-party verification and compliance services
Trusted third parties may support compliance, security, identity verification, and payment-related functions.
From publicly available and legitimate sources
Where necessary, information may be supplemented with data from publicly available and legitimate sources, solely for compliance, verification, or risk management purposes.
From regulatory and law enforcement authorities
In some cases, we may receive data from competent authorities in connection with legal and compliance obligations.
HOW LONG PERSONAL DATA IS KEPT
Personal Data is retained only for as long as necessary for the purposes for which it was collected and processed, or as required by applicable legal and regulatory obligations.
Retention periods are based on:
the purpose of processing, including providing the Services, meeting contractual obligations, or protecting legitimate interests;
statutory retention requirements, including AML, gaming, and tax regulations;
the need to establish, exercise, or defend legal claims;
audit, supervisory, and regulatory requirements.
Once the relevant retention period expires, Personal Data is securely deleted, anonymized, or archived so that it can no longer be associated with you, unless further retention is required by law.
WHERE PERSONAL DATA IS STORED AND TRANSFERRED
Personal Data is stored on secure servers operated by us and by trusted service providers. These servers may be located within the European Economic Area and outside the EEA, including Curaçao, depending on operational and regulatory requirements.
When Personal Data is transferred outside the EEA, appropriate safeguards are applied in accordance with applicable data protection laws. These safeguards may include:
Adequacy Decisions
Transfers may be made to countries recognized by the European Commission as providing an adequate level of data protection.
Standard Contractual Clauses
Where no adequacy decision exists, we use Standard Contractual Clauses approved by the European Commission to help ensure that Personal Data remains protected.
WHO MAY RECEIVE YOUR PERSONAL DATA
Personal Data may be shared only when necessary and for the purposes described in this guide. Sharing is carried out in compliance with applicable data protection laws, contractual obligations, and security measures.
The following categories of recipients may receive Personal Data:
Regulatory and supervisory authorities
This may include the Curaçao Gaming Authority, the Financial Intelligence Unit, tax authorities, and other governmental or law enforcement bodies where required by law or regulatory obligations, including AML and responsible gaming requirements.
Identity verification and compliance service providers
These providers help verify customer identity and support compliance with AML and Know Your Customer obligations.
Payment processors and financial institutions
Personal Data such as transaction details, payment method information, and account identifiers may be shared to enable deposits, withdrawals, refunds, and other payment-related services.
Customer support and communication tools
External service providers that support email delivery, live chat, or other communication channels may process contact details and support messages to help provide customer service.
Fraud prevention and security partners
Trusted providers may help protect the security and integrity of the platform, including detection and prevention of potentially fraudulent or unauthorized activity.
Analytics and optimization platforms
Third-party services may help analyze Website usage, conduct A/B testing, and improve user experience. Where possible, data is anonymized or pseudonymized.
Game content providers
Licensed third-party game providers may receive only the minimum data required to enable certain platform features, such as player identifiers and game session data.
Internal tools and IT infrastructure providers
Secure hosting, internal tools, and productivity solutions may be used to store and manage information necessary for the operation of the Services.
HOW COOKIES ARE USED
Cookies and similar technologies may be used to improve user experience, support essential Website functions, and analyze Website performance. Cookies are small text files stored on your device when you visit the Website. They help the Website recognize your device and remember information about preferences or previous actions.
Strictly Necessary Cookies
These cookies are required for the Website to function. They support core functions such as page navigation, access to secure areas, and user authentication. They cannot be switched off in our systems.
Functional Cookies
These cookies support enhanced functionality and personalization, such as remembering language preferences or user settings. They may be set by us or by third-party providers whose services we use.
Analytical or Performance Cookies
These cookies collect aggregated and anonymized information about how visitors use the Website, including page visits, click-through rates, traffic sources, and interaction metrics. They help measure and improve Website performance.
Advertising or Targeting Cookies
These cookies may be set by us or by advertising partners to build a profile of your interests and deliver relevant advertising on this Website or on other websites. They may also help limit how often an advertisement is shown and measure its effectiveness.
Session and Persistent Cookies
Session cookies expire when you close your browser. Persistent cookies remain on your device for a predetermined period or until you delete them.
First-Party and Third-Party Cookies
Cookies may be set by us as first-party cookies or by third-party service providers acting on our behalf as third-party cookies. These providers may include analytics, customer support, or advertising networks.
Managing Cookies
You may manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Restricting certain cookies may affect the availability or functionality of some parts of the Website.
PROTECTION OF MINORS
The Services are intended only for individuals who are at least eighteen (18) years old or who have reached the legal age in their jurisdiction, whichever is higher.
In line with the Curaçao Gaming Authority’s Responsible Gaming Policy introduced in February 2025, measures are in place to help prevent underage access.
Age affirmation
By accessing or registering for the Services, you confirm that you meet the applicable age requirement.
Document verification
Users may be required to provide valid government-issued identification documents during registration.
Automated monitoring
User activity may be monitored to detect inconsistencies or signs of underage access attempts.
Security reviews
Where underage access is suspected, registration data and financial transactions may be reviewed.
Data purging
Personal Data submitted by individuals identified as minors is deleted immediately.
Parental controls and education
Parents and guardians are encouraged to use available parental control tools and educate minors about responsible online behavior to prevent unauthorized access to the Services.
Commitment to responsible gaming
Our approach includes adherence to CGA guidelines on player protection and age verification. Policies are reviewed and enhanced to meet or exceed regulatory standards.
YOUR RIGHTS OVER YOUR PERSONAL DATA
Under the GDPR, you have rights in relation to your Personal Data.
Right of Access — Article 15 GDPR
You can request confirmation of whether your Personal Data is processed and obtain a copy of such data together with information about how it is used.
Right to Rectification — Article 16 GDPR
You can request correction of inaccurate or incomplete Personal Data without undue delay.
Right to Erasure — Article 17 GDPR
You can request deletion of your Personal Data where legal grounds apply, such as where data is no longer needed for the purposes collected or where consent is withdrawn and no other lawful basis applies.
Right to Restrict Processing — Article 18 GDPR
You can request that processing of your Personal Data be limited in specific situations, including where accuracy is contested or processing is unlawful.
Right to Data Portability — Article 20 GDPR
You can request a copy of Personal Data you provided to us in a structured, commonly used, machine-readable format and transfer it to another controller where technically feasible.
Right to Object — Article 21 GDPR
You can object to processing of your Personal Data based on legitimate interests or for direct marketing purposes for reasons related to your particular situation.
HOW TO EXERCISE YOUR RIGHTS
To exercise your data protection rights, you may contact us using either of the following channels:
email: [email protected];
postal address: Dr. Henri Fergusonweg 1, Curaçao.
WITHDRAWING CONSENT
Where Personal Data is processed based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To withdraw consent, contact us using the channels provided in this guide. After receiving your request, we will stop processing the relevant Personal Data unless continued retention or processing is required to comply with legal or regulatory obligations.
If withdrawing consent affects our ability to provide certain Services, we will inform you of the consequences before completing the withdrawal process.
HOW TO MAKE A COMPLAINT
Under Article 77 GDPR, if you believe that your Personal Data is being processed unlawfully or that your privacy rights have been violated, you may lodge a complaint with:
the supervisory authority in the EU Member State where you reside, work, or where the alleged violation occurred;
the Curaçao Gaming Authority or any other relevant data protection authority in Curaçao.
Before lodging a complaint, you are encouraged to contact us directly with any concerns or unresolved questions. We will make every reasonable effort to address concerns in a timely and lawful manner.
WHEN PROVIDING PERSONAL DATA IS REQUIRED
Providing Personal Data may be necessary for legal, contractual, or service access reasons.
Legal requirement
Certain data must be provided to comply with laws and regulations, including AML obligations and responsible gaming requirements.
Contractual requirement
Some data is required to enter into and perform a contract with you, including enabling access to the Services and processing transactions.
Service access requirement
Without the required Personal Data, we may be unable to offer certain Services or meet contractual or legal obligations.
Consequences of not providing required data
Failure to provide required Personal Data may result in:
inability to create or maintain an Account;
restrictions on use of the Services;
termination of the contractual relationship;
inability to comply with regulatory obligations, which may prevent us from providing Services.
IMPORTANT LEGAL INFORMATION
The Services operate on an “AS-IS” and “AS-AVAILABLE” basis without warranties or guarantees of uninterrupted or error-free performance.
Although reasonable precautions are taken to protect Personal Data, absolute security cannot be guaranteed due to the complex nature of technology and evolving cybersecurity threats.
To the maximum extent permitted by law, we are not liable for:
events beyond our direct control, including system failures, cyberattacks, or unauthorized access;
indirect, incidental, consequential, or punitive damages arising from data breaches, unauthorized disclosure, or misuse of Personal Data;
errors, inaccuracies, or security vulnerabilities on third-party websites linked from our platform.
By using the Services, you acknowledge and agree that we are not responsible for external websites or services operated by third parties, even where they are linked from the platform.
ACCEPTANCE AND UPDATES
Your continued use of the Services signifies your explicit acceptance of this Privacy Guide and the Privacy Policy it explains.
This document serves as the entire and exclusive Privacy Policy and replaces any previous versions.
The Privacy Policy should be read together with the Terms and Conditions and any additional applicable notices posted on the platform.
We reserve the right to modify the Privacy Policy at any time. Any changes will be posted on the platform. Continued use of the Services after modifications constitutes acceptance of the revised Policy.
You are encouraged to review this Policy regularly to stay informed about updates.
LANGUAGE VERSION
All versions of this Policy other than the English version are provided for informational purposes only. If there is any discrepancy or conflict between different versions, the English version shall prevail.