This policy explains what personal data Grand Salon Club processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). We collect only what we need to run your account, the games and your purchases. We do not use analytics or advertising trackers and we do not sell your data.
1. Who is responsible
The controller is TEST COMPANY, TEST ADDRESS STR. 1.
- Privacy questions and requests: [privacy email]
2. What we collect and why
2.1 Account data
What: your name, email address, the language you chose for the site (used for pages and emails), a one-way hash of your password (we never store the password itself), and the dates your account was created and last claimed a daily bonus. You can only create an account after confirming that you are 18 or older.
Why and legal basis: to create and run your account under our Terms of Service — necessary for the contract (Art. 6(1)(b) GDPR).
2.2 Game and wallet data
What: your Coins balance and a ledger of every change to it (welcome and daily bonuses, bets, winnings, purchases, corrections by our staff); every game round you play — game, stake, your choices, result, payout and time; and the provably-fair seeds and counters used to generate your results.
Why and legal basis: to run the games, show you your balance and history, let you verify results, and investigate errors or abuse — necessary for the contract (Art. 6(1)(b)) and our legitimate interest in a secure, fair service (Art. 6(1)(f)).
2.3 Purchase data
What: the package you bought, number of Coins, price, currency, payment provider, the provider's payment reference, status (pending, paid, failed or refunded), time of payment and the language the checkout was shown in (so the confirmation email is in the same language). For payment methods that require it, also your billing address: country, state or province (for some countries), city, street address and postcode. We do not receive or store your card number or other payment credentials.
Why and legal basis: to sell you Coins and handle problems and refunds — necessary for the contract (Art. 6(1)(b)); to keep accounting and tax records — legal obligation (Art. 6(1)(c)); and to prevent payment fraud — legitimate interest (Art. 6(1)(f)).
When your Coins are credited, we email you a confirmation of the purchase. If, before paying, you agreed that we deliver the Coins immediately and acknowledged that you thereby lose your right of withdrawal, we store the time of that consent with the purchase, so we can show that the right of withdrawal ended.
2.4 Technical data
What: while you are logged in or browsing, we store your session together with your IP address, browser user agent and the time of your last activity. Our web server and application also write technical logs, which can include IP addresses and requested pages.
Why and legal basis: to keep you logged in, protect forms against forgery, and keep the service secure and working — legitimate interest (Art. 6(1)(f)). The cookies involved are described in our Cookie Policy.
2.5 When you contact us
If you email us, we process your message and contact details to answer you — necessary for the contract or our legitimate interest in answering enquiries (Art. 6(1)(b) or (f)).
2.6 Your cookie choices
What: when you accept, reject or change optional cookies in our cookie banner or “Cookie settings”, we keep a record of that choice: a random identifier (also stored in your cookie-choice cookie), your account if you are logged in, the categories you allowed or refused, the version of our cookie settings, whether you clicked “Accept all”, “Reject all” or saved your own selection, and the time, plus a one-way keyed hash of your IP address (not the address itself).
Why and legal basis: to be able to prove that you gave or refused consent — a legal obligation (Art. 6(1)(c) with Art. 7(1) GDPR) — and, when you are logged in, to apply your choice on your other devices so we do not ask again. Details in our Cookie Policy.
2.7 Account blocks and self-exclusion
What: if you ask us to exclude you from playing, or if we suspend your account, we record the type of block (self-exclusion or suspension), when it starts and ends, a short note on why (for example “player's request by email”) and which member of our staff set it.
Why and legal basis: to honour your request and keep you from playing for the period you chose — necessary for the contract (Art. 6(1)(b)) and our legitimate interest in protecting players (Art. 6(1)(f)); for suspensions, our legitimate interest in enforcing our Terms and protecting other players (Art. 6(1)(f)).
3. Payment providers
Payments are handled on the hosted payment pages of the following providers. They process your payment details as independent controllers under their own privacy policies, and as our processors for the data we send them.
- Stripe — Stripe Payments Europe, Limited (Ireland). We send the purchase reference, amount, currency and package name. Privacy policy.
- Whitelark — [Whitelark legal entity and country]. We send the purchase reference, amount, currency, package description, your email address, billing address and IP address, which the provider uses for fraud prevention.
The provider tells us whether the payment succeeded, along with its own payment reference.
4. Who else receives data
- Hosting: [Hosting provider name] ([Data centre country]) runs the servers that store our database and logs, as our processor under a data processing agreement.
- Payment providers: as described above.
- Authorities and advisers: only where the law requires it, or where needed to establish or defend legal claims.
We do not share your data with advertisers, data brokers or other players. Other players never see your email address.
5. Transfers outside the EEA
We aim to keep data in the European Economic Area. Where a provider processes data outside it (for example a payment provider's group companies), the transfer is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Account, game and wallet data: for as long as your account exists. When your account is closed we delete it, or anonymise it where we still need statistics, unless we must keep it for one of the reasons below.
- Purchase records and billing addresses linked to a payment: [number of] years after the end of the year of the purchase, as required by accounting and tax law.
- Sessions (including IP address and user agent): until you log out or after 120 minutes of inactivity; expired sessions are then removed automatically.
- Technical logs: [number of] days, unless we need them longer to investigate a specific security incident.
- Emails with us: for as long as needed to deal with your request, and afterwards only as long as needed for possible legal claims.
- Cookie choice records: 24 months after each choice, then deleted automatically. A choice is applied for at most 180 days; after that we ask you again.
- Account blocks: for as long as the block applies. If you ask us to delete your account during a self-exclusion, we keep only your email address and the end date until it ends, so that you cannot sign up again before then; for a permanent self-exclusion, until you ask us in writing to delete them.
7. Your rights
You have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”) — this closes your account;
- restrict processing in certain cases;
- data portability — receive the data you gave us in a machine-readable format;
- object to processing based on our legitimate interests, on grounds relating to your situation.
To use these rights, email [privacy email] from the address registered on your account. We may ask you to confirm your identity. We reply within one month; this can be extended by two more months for complex requests, in which case we tell you why.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is [Lead data protection supervisory authority].
8. Security
Passwords are stored only as salted one-way hashes. Card data is entered on our payment providers' pages and never reaches our servers. Session cookies cannot be read by scripts on the page, and forms are protected against cross-site request forgery. Access to player data in our administration area is limited to authorised staff.
9. Children, profiling and marketing
- Grand Salon Club is only for adults aged 18 or older. If we learn that an account belongs to someone younger, we close it and delete its data.
- We do not make decisions about you based solely on automated processing, and we do not build advertising profiles.
- We do not send marketing emails. We only email you about your purchases and your account.
10. Changes to this policy
If we change how we use personal data, we update this policy and the “Last updated” date above. We will tell you about significant changes by email or in the service before they apply.