As a licensed operator in Italy, we collect and look after personal and transactional data under stringent legal obligations. This policy details exactly how long we keep different categories of information, the legal reasons behind those periods, and the security measures that protect your data at every stage. We continuously balance our duty to retain records for fraud prevention and financial audits with the privacy rights you possess under Italian data protection law and the GDPR. Our schedules receive regular reviews so we remain fully compliant.
Policy Changes and User Notifications
We assess this Data Retention Policy every six months and whenever a major legal change hits Italian gambling operations. Minor clarifications are posted silently with a revised effective date. Material changes that change retention periods, introduce new data categories or shift the legal basis for processing are communicated directly to you by email at least thirty days before they take effect. You’ll also notice an in‑platform banner notification when you log in during the notice period. Historical versions are kept and available on request, each with a version number and a validity date range. If an earlier version provided a shorter retention period for certain data, we follow that promise for data collected under that version and apply new terms only going forward.
Information Categories and Storage Durations
We organize all user data into distinct categories, each connected to a retention schedule that matches its use and legal context. That organized approach prevents us from retaining things forever. Every year our Data Protection Officer examines these categories and modifies the timelines whenever new guidance arrives from the Garante per la protezione dei dati personali. Below you’ll see how long each data type remains in our live systems before being securely de-identified or erased. Archived backups follow a ninety‑day cycle because of technical limitations.
Identity and Fiscal Records
Identity documents you submit during Know Your Customer checks, like passport scans, utility bills and tax ID numbers, stay on file for ten years after you end your account, as anti‑money laundering law requires. Deposit and withdrawal logs, payment method tokens and wallet balance histories are kept for ten years from the date of each transaction, fulfilling both AML requirements and Italian Civil Code limitation periods. We hold these records in encrypted, access‑restricted vaults and tamper‑proof ledgers. Once the retention deadline passes, we eliminate all personal identifiers permanently; statistical trends may still be utilized but never in a way that connects to any individual.
Account Activity and Help Desk Messages
Comprehensive records of game sessions, bets esports.gazzetta.it placed, outcomes and session lengths are kept for five years after each gaming event, matching the statute of limitations for civil disputes. Customer service transcripts, email threads and call recordings stay for three years from your last interaction, covering the typical complaint‑handling window. After those periods, raw logs and case attachments get permanently deleted. Aggregated, anonymised datasets can be kept indefinitely for product improvement and service quality analysis. All of this data lives in case management systems with role‑based access restrictions.
Ethical Play and Self‑Exclusion Data
Once you enable self‑exclusion, your identity data must be stored permanently in a locked‑down register to stop you from opening new accounts, a measure Italian gambling regulations explicitly permit. Other safer‑gambling markers, like expired voluntary deposit limits, are deleted two years after the limit lifts. We never use self‑exclusion register data for anything other than enforcing the exclusion. The register is completely walled off from marketing and operational systems, so it serves only its protective purpose.
User Rights and Retention Handling
When you submit an erasure request, our system automatically examines each data category against its retention schedule. Everything beyond its mandatory window gets deleted without delay. For data still governed by a legal retention obligation, we restrict it right away so it’s excluded from active use and kept solely for compliance storage; we notify you which specific law is relevant and the date deletion becomes possible. Access requests are answered within thirty days and include a breakdown of what we store, why, and the scheduled deletion date. If you dispute accuracy, we attach a note instead of changing the original record, so the audit trail remains intact. Portability requests are processed in a structured, machine‑readable format even while data is still in its retention window.
Data Security During Storage
Held data is safeguarded with AES‑256 encryption at rest, TLS 1.3 protocols in transit and isolated virtual private clouds. Access demands multi‑factor authentication plus just‑in‑time privilege elevation that expires on its own. Every access event is written into an immutable audit trail. We run quarterly penetration tests through CREST‑certified firms and continuous vulnerability scans to ensure our storage tight. Backups are encrypted and spread across Italian data centres, with strict controls that block accidental restoration of data past its deletion date. A dedicated lifecycle dashboard flags every dataset as it nears expiration.
Permission Management and Workforce Training
Only employees whose roles demonstrably require access to retained personal data get permissions, and those permissions go through monthly recertification audits. Any access to dormant user records triggers a managerial review within one business day. Every staff member who handles personal data completes mandatory annual training on Italian data protection law and our internal retention policies, including hands‑on exercises on spotting valid erasure requests and differentiating the difference between data we must keep under a legal hold and data we can delete straight away.
Data Removal Procedures
When a information type hits the end of its scheduled retention, our automated lifecycle engine kicks off a protected erasure procedure. First, the data gets logically removed from production databases. Next, physical storage blocks are rewritten with random data patterns to stop forensic recovery. Finally, a cryptographically timestamped entry lands in a audit trail, giving traceable confirmation that erasure happened on time. Backup copies cycle every ninety days, so any deleted data disappears from all media within three months. When a litigation hold applies, we pause the deletion workflow only for the affected records, note the hold reason, and restart once the hold lifts.
Affiliate Program Data Retention
Partner relationship data, including contact information, payment details and commission payment history, stays for the entirety of the active partnership plus ten years after the partnership concludes. That stems from tax duties on commission payments, which necessitate long‑term financial archives. Affiliate performance statistics and aggregated player referral data get anonymized after half a decade. We explicitly prohibit affiliates from separately gathering or retaining personal information about referred players; they obtain only anonymised, combined reports. Our partner contracts include audit rights to verify compliance, and any breach is reason for immediate contract termination and commission forfeiture.
Cross-border Data Transfers and Data Retention
Our primary infrastructure resides inside Italy and the larger European Economic Area. Some supporting services, like fraud detection platforms and customer relationship tools, may transfer certain personal data to countries beyond the EEA. In those cases, we ensure an adequacy decision exists or we put Standard Contractual Clauses in place together with a transfer impact assessment. The retention periods we apply to transferred data mirror those in this policy, and processors are contractually bound to delete or return data when the service ends. We maintain a public register of sub‑processors, updated within fourteen days of any change, and we prefer vendors with Italian data centres. Geo‑fencing rules keep Italian user data inside European boundaries, confirmed through yearly audits.
Legal Basis for Information Storage
Our storage strategy rests on several legal duties that affect gambling operators operating in the Italian market. Anti‑money laundering rules from the Italian Financial Intelligence Unit force us to keep transaction logs, identity verification documents and suspicious activity reports for a fixed term after the business relationship ends. Meanwhile, tax rules imposed by the Agenzia delle Entrate require we preserve financial records that support taxable gaming revenue and player winnings. These duties override any general right to erasure during the mandatory period. For operational data that falls outside a fixed legal window, we base our approach on legitimate interest assessments where a valid reason exists, and we offer an opt‑out unless a compelling legal obligation prevents it.
Consent‑Based Retention
Marketing preferences, newsletter sign‑ups and the behavioural analytics used for personalised offers are kept only with your explicit consent. You can retract consent anytime through your account dashboard; once you do, we halt that processing immediately and delete the connected profiles within thirty days. Data processed lawfully before withdrawal gets isolated from active systems to block further use, but it is not deleted retroactively. Consent records themselves are kept for six years as proof of compliance. We never use this data for anything beyond the activity you agreed to.
Frequently Asked Questions
Is it possible to ask for data deletion prior to the retention period’s conclusion?
Yes, ulteriori informazioni, you can file an erasure request any time. We immediately check each data category against its legal retention obligation. If there’s no legal hold, we delete it fast. For anything we must keep, we restrict it to storage‑only, tell you the legal basis stopping immediate deletion and give you the expected deletion date. You can also view all your data categories with their scheduled deletion dates through your account dashboard. That partial approach respects your rights as far as Italian regulations allow.
How is my data handled if I choose permanent self‑exclusion?
If you sign up for permanent self‑exclusion, your personal data is shifted to a dedicated exclusion register that operates indefinitely with highly restricted access. It is a legal obligation intended to block you from establishing new accounts. Your gameplay and transaction history, on the other hand, still follow the standard retention schedules and get deleted once those periods run out. The self‑exclusion record is cut off from all marketing and operational systems, so it serves only the protective function it was collected for. No marketing communications will be sent to you.
How do you handle data belonging to inactive accounts?
An account becomes inactive after twelve straight months with no login. At that stage, we automatically disable marketing communications and transition the account to a dormant status with limited processing. The underlying retention periods remain active according to the original data collection dates, not the date of inactivity. That means data from an inactive account is still held for the full statutory period that applies to its category and then deleted according to our standard procedures. If you come back after a long break, you might need to complete a fresh Know Your Customer check to reactivate. Your data dashboard shows the current status at all times.
