Privacy Policy

Log in

Last updated: August 14, 2025

This Privacy Policy explains how Carletta N.V. handles Personal Data when you use the Website and the related Services.

It covers how Personal Data may be collected, used, stored, transferred, shared, protected, and retained. It also explains your rights, how you may exercise them, how cookies may be used, and what happens if required Personal Data is not provided.

Who provides the Services

The Website is owned and operated by Carletta N.V., a company registered under the laws of Curaçao.

Carletta N.V. has its office at Dr. Henri Fergusonweg 1, Curaçao and is registered under company registration number 142346.

Carletta N.V. has been licensed by the Curaçao Gaming Control Board since 24/Jun/2025 to offer games of chance under license number OGL/2024/580/0570 in accordance with the National Ordinance on Games of Chance (LOK).

When this Privacy Policy applies

This Privacy Policy applies when Personal Data is collected, used, or otherwise processed through:

• the Website;
• communications via [email protected];
• phone calls with us;
• support chat sessions with us.

Carletta N.V. acts as the controller of your Personal Data. This means that the Company determines the purposes and means of Processing Personal Data in connection with the Website and Services.

Important Terms Used in This Article

Account

An Account is a unique account created for you to access the Services or specific parts of the Services.

Account access may be subject to identity verification and Regulatory Compliance requirements.

Company

Company, we, us, or our means Carletta N.V., a company registered under the laws of Curaçao, with company registration number 142346 and official address at Dr. Henri Fergusonweg 1, Curaçao.

Service

Service means the Website, its functionalities, and related online gaming and interactive services provided by the Company.

Website

Website means this website, including any subdomains, associated platforms, or applications operated by the Company.

Personal Data

Personal Data means any information that relates to an identified or identifiable individual, as defined under the General Data Protection Regulation and the Curaçao Data Protection Framework.

Processing of Personal Data

Processing of Personal Data means any operation or set of operations performed on Personal Data, whether by automated or manual means.

This includes collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure, or destruction.

Regulatory Compliance

Regulatory Compliance means the Company’s legal obligation to process Personal Data in accordance with applicable laws, including the National Ordinance on Games of Chance and Anti-Money Laundering regulations.

Processing for Regulatory Compliance is based on legal requirements and does not rely on user consent.

How Data Handling Works in Different Situations

Download Pin-Up App

When you create or access an Account

To create, activate, secure, and manage an Account, the Company may process Personal Data needed to provide access to the Services.

The legal basis is performance of a contract or steps prior to entering into a contract under GDPR Article 6(1)(b).

Personal Data used for this purpose may include:

• email address and/or phone number;
• hashed password;
• chosen currency;
• account identifiers;
• basic device or access logs used to activate and secure the Account.

When identity, age, or compliance checks are required

To meet identity verification, age confirmation, KYC, AML/CFT, LOK, and NORUT requirements, the Company may process verification-related Personal Data.

The legal basis is compliance with legal obligations under GDPR Article 6(1)(c), including AML/CFT, LOK, and NORUT. Where applicable, the Company may also rely on legitimate interests in platform integrity under GDPR Article 6(1)(f).

Personal Data used for this purpose may include:

• passport;
• ID card;
• driver’s license;
• proof of address;
• date of birth or age attestation;
• selfies;
• liveness checks.

When payments are processed

To process deposits, withdrawals, refunds, and related payment operations, the Company may process financial and transaction-related Personal Data.

The legal bases are performance of a contract under GDPR Article 6(1)(b), compliance with legal obligations for financial record-keeping and AML under GDPR Article 6(1)(c), and legitimate interests in fraud prevention under GDPR Article 6(1)(f).

Personal Data used for this purpose may include:

• payment instrument data;
• transaction history;
• currency;
• payout channel confirmations.

When the platform is protected against fraud or abuse

To secure the Service, protect users, monitor for risks, and prevent fraudulent or unauthorized activity, the Company may process technical and device-related Personal Data.

The legal bases are legitimate interests in securing the Service and users under GDPR Article 6(1)(f), and legal obligations under AML/CTF under GDPR Article 6(1)(c).

Personal Data used for this purpose may include:

• IP address;
• device type;
• browser data;
• device and technical identifiers.

When responsible gaming measures apply

To support responsible gaming, player protection, cooling-off selections, play limits, and self-exclusion management, the Company may process Personal Data connected with account activity and player protection measures.

The legal bases are compliance with LOK / CGA Responsible Gaming requirements under GDPR Article 6(1)(c), and legitimate interests in player welfare and Regulatory Compliance under GDPR Article 6(1)(f).

Personal Data used for this purpose may include:

• self-exclusion status;
• self-exclusion duration;
• cooling-off selections;
• play limits;
• gameplay frequency;
• spend metrics indicative of risk;
• communications related to responsible gaming interventions.

When you contact support

When you contact support, the Company may process Personal Data needed to respond to service requests, resolve inquiries, maintain service quality, and support dispute resolution.

The legal bases are contract performance under GDPR Article 6(1)(b), and legitimate interests in service quality and dispute resolution under GDPR Article 6(1)(f).

Personal Data used for this purpose may include:

• support tickets;
• chat transcripts;
• email correspondence;
• call notes;
• account identifiers;
• transaction references tied to the inquiry.

When marketing communications are permitted

Where permitted by law, the Company may process Personal Data for marketing communications.

The legal basis for electronic marketing is consent under GDPR Article 6(1)(a). Where allowed by law, legitimate interests under GDPR Article 6(1)(f) may apply for similar-product soft opt-in.

Marketing communications are always subject to opt-out and responsible gaming restrictions.

Personal Data used for this purpose may include:

• email address;
• phone number;
• push token;
• marketing preferences;
• engagement metrics;
• non-sensitive bonus eligibility status.

When Website performance and analytics are measured

To operate, maintain, and improve the Website, the Company may process technical and usage-related Personal Data.

The legal bases are legitimate interests in operating and improving the Website under GDPR Article 6(1)(f), and consent under GDPR Article 6(1)(a) where required for non-essential cookies.

Personal Data used for this purpose may include:

• usage logs;
• cookie identifiers;
• browser type and version;
• traffic data;
• on-site interaction metrics.

When records are needed for reporting, audits, or disputes

To comply with regulatory reporting obligations, audits, legal proceedings, and dispute resolution, the Company may process relevant Personal Data.

The legal bases are legal obligation under GDPR Article 6(1)(c), including cooperation with the Curaçao Gaming Authority, FIU, tax authorities, and other authorities, and legitimate interests in establishing, exercising, or defending legal claims under GDPR Article 6(1)(f).

Personal Data used for this purpose may include records required for regulatory cooperation, compliance audits, legal proceedings, or dispute resolution, as permitted by applicable laws.

Where Personal Data Comes From

Information you provide directly

The Company collects Personal Data directly from you when you interact with the Services.

This may include information provided when you:

• create an Account;
• complete verification steps;
• make deposits;
• make withdrawals;
• communicate with the support team.

Information generated when you use the Services

Some Personal Data is generated through your use of the platform.

This may include:

• gameplay;
• transaction history;
• device information;
• log information;
• cookie data in accordance with the Cookie Policy.

Information from trusted third parties

The Company may use trusted third parties to support certain operational functions, including:

• compliance;
• security;
• identity verification;
• payment-related functions.

Information from public and legitimate sources

Where necessary, the Company may supplement information you provide with data from publicly available and legitimate sources.

This is done solely for:

• compliance;
• verification;
• risk management.

Information from authorities

In some cases, the Company may receive Personal Data from regulatory or law enforcement authorities in connection with legal and compliance obligations.

How Long Personal Data Is Kept

General retention approach

Personal Data is retained only for as long as necessary to fulfill the purposes for which it was collected and processed, or for as long as required under applicable legal and regulatory obligations.

What affects the retention period

Retention periods are determined by considering:

• the purpose of Processing, including provision of the Services, contractual obligations, and protection of legitimate interests;
• applicable statutory retention requirements, including Anti-Money Laundering, gaming, and tax regulations;
• the need to establish, exercise, or defend legal claims;
• audit and supervisory requirements.

What happens after the retention period

Once the relevant retention period expires, Personal Data is securely deleted, anonymized, or archived in a way that ensures it can no longer be associated with you, unless further retention is required by law.

Storage and International Transfers

Storage of Personal Data

Personal Data is stored on secure servers operated by the Company and by trusted service providers.

These servers may be located both within the European Economic Area and outside the European Economic Area, including Curaçao, depending on operational and regulatory requirements.

Transfers outside the EEA

When Personal Data is transferred outside the EEA, the Company ensures that such transfers comply with applicable data protection laws.

Safeguards used for transfers

Appropriate safeguards may include adequacy decisions and Standard Contractual Clauses.

An adequacy decision applies where the European Commission recognizes a country as providing an adequate level of data protection.

Where no adequacy decision exists, the Company uses Standard Contractual Clauses approved by the European Commission to help ensure that Personal Data remains protected.

When Personal Data May Be Shared

General rule for sharing

Personal Data may be shared only when necessary and for the purposes described in this Privacy Policy.

Any sharing is carried out in compliance with applicable data protection laws, contractual obligations, and security measures.

Regulatory and supervisory authorities

Personal Data may be shared with regulatory and supervisory authorities, including:

• Curaçao Gaming Authority;
• Financial Intelligence Unit;
• tax authorities;
• governmental bodies;
• law enforcement bodies.

Such sharing may be required by law or regulatory obligations, including AML and responsible gaming requirements.

Verification and compliance providers

Identity verification and compliance service providers may process Personal Data to help verify customer identity and comply with AML and Know Your Customer obligations.

Payment processors and financial institutions

Payment processors and financial institutions may receive Personal Data to enable deposits, withdrawals, refunds, and other payment-related services.

This may include:

• transaction details;
• payment method information;
• account identifiers.

Support and communication service providers

External service providers that facilitate email delivery, live chat, or other communication channels may process Personal Data to assist in providing customer service.

This may include:

• contact details;
• support messages.

Fraud prevention and security partners

Trusted service providers may process Personal Data to help protect platform security and integrity, including detecting and preventing potentially fraudulent or unauthorized activity.

Analytics and optimization platforms

Third-party services may help analyze Website usage, conduct A/B testing, and improve user experience.

Where possible, data used for these purposes is anonymized or pseudonymized.

Game content providers

Licensed third-party game providers may receive only the minimum Personal Data required to enable certain platform features.

This may include:

• player identifiers;
• game session data.

Internal tools and IT infrastructure providers

Secure hosting and productivity solutions may be used to store and manage data necessary for the operation of the Services.

Cookies and Similar Technologies

Purpose of cookies

The Website may use cookies and similar technologies to enhance user experience, enable essential Website functions, and analyze site performance.

Cookies are small text files stored on your device when you visit the Website. They allow the Website to recognize your device and store certain information about preferences or past actions.

Strictly necessary cookies

Strictly necessary cookies are essential for the functioning of the Website and cannot be switched off in the Company’s systems.

They support:

• page navigation;
• access to secure areas;
• user authentication.

Functional cookies

Functional cookies support enhanced functionality and personalization.

They may remember:

• language preferences;
• user settings.

They may be set by the Company or by third-party providers whose services are used.

Analytical or performance cookies

Analytical or performance cookies collect aggregated and anonymized data about how visitors use the Website.

This may include:

• page visits;
• click-through rates;
• traffic sources;
• on-site interaction metrics.

These cookies are used to measure and improve Website performance.

Advertising or targeting cookies

Advertising or targeting cookies may be set by the Company or advertising partners.

They may be used to:

• build a profile of interests;
• deliver relevant advertising on the Website or on other websites;
• limit how often an advertisement is shown;
• assess advertising effectiveness.

Session and persistent cookies

Session cookies expire when the browser is closed.

Persistent cookies remain on your device for a predetermined period or until deleted by you.

First-party and third-party cookies

First-party cookies are set by the Company.

Third-party cookies are set by third-party service providers acting on the Company’s behalf, including providers of analytics, customer support tools, or advertising networks.

Managing cookies

You may control and manage cookies through your browser settings.

Most browsers allow you to refuse or delete cookies. Restricting certain cookies may affect the availability or functionality of some parts of the Website.

Protection of Minors

Age requirement

The Services are strictly intended for individuals who are at least eighteen (18) years old or have reached the legal age defined by their respective jurisdiction, whichever is higher.

By accessing or registering for the Services, you confirm that you meet this age requirement.

Measures to prevent underage access

In alignment with the Curaçao Gaming Authority’s Responsible Gaming Policy introduced in February 2025, the Company has implemented measures intended to prevent underage access to the Services.

These measures include age verification, preventive monitoring, security reviews, and deletion of Personal Data submitted by individuals identified as minors.

Document verification

Users may be required to provide valid government-issued identification documents during registration.

This supports age verification and compliance with age restrictions.

Automated monitoring and security reviews

Automated monitoring may be used to detect inconsistencies or signs of underage access attempts.

If underage access is suspected, security reviews may be conducted. These reviews may include verification of registration data and financial transactions.

Data purging

Personal Data submitted by individuals identified as minors is deleted immediately.

Parental controls and education

Parents and guardians are encouraged to use available parental control tools and educate minors about responsible online behavior to prevent unauthorized access to the Services.

Responsible gaming commitment

The Company’s dedication to responsible gaming includes adherence to Curaçao Gaming Authority guidelines on player protection and age verification.

Policies are continually reviewed and enhanced to ensure that they meet or exceed regulatory standards.

Your Privacy Rights

Right of Access

Under Article 15 GDPR, you may request confirmation of whether the Company processes your Personal Data and obtain a copy of such data, along with information about how it is used.

Right to Rectification

Under Article 16 GDPR, you may request correction of inaccurate or incomplete Personal Data without undue delay.

Right to Erasure

Under Article 17 GDPR, you may request deletion of your Personal Data where certain legal grounds apply.

This may include cases where Personal Data is no longer necessary for the purposes collected, or where you withdraw consent and no other lawful basis applies.

Right to Restrict Processing

Under Article 18 GDPR, you may request that the Company limit the Processing of your Personal Data in specific situations.

This may apply where accuracy is contested or Processing is unlawful.

Right to Data Portability

Under Article 20 GDPR, you may request a copy of the Personal Data you provided to the Company in a structured, commonly used, and machine-readable format.

Where technically feasible, you may transfer that data to another controller.

Right to Object

Under Article 21 GDPR, you may object at any time to the Processing of your Personal Data for reasons related to your particular situation where Processing is based on legitimate interests.

You may also object to Processing for direct marketing purposes.

How to exercise your rights

To exercise your data protection rights, you may contact the Company through:

• email: [email protected];
• postal address: Dr. Henri Fergusonweg 1, Curaçao.

Consent, Complaints, and Required Data

Withdrawing consent

If Personal Data is processed based on your consent, you have the right to withdraw that consent at any time.

Withdrawal does not affect the lawfulness of Processing based on consent before its withdrawal.

To withdraw consent, contact the Company using the channels specified in this Privacy Policy.

After receiving the request, the Company will stop Processing the relevant Personal Data unless retention or continued Processing is required to comply with legal or regulatory obligations.

If withdrawing consent affects the ability to provide certain Services, the Company will inform you of the consequences before completing the withdrawal process.

Making a complaint

Under Article 77 GDPR, if you believe that your Personal Data is being processed unlawfully or your privacy rights have been violated, you have the right to lodge a complaint with:

• the supervisory authority in the EU Member State where you reside;
• the supervisory authority in the EU Member State where you work;
• the supervisory authority in the EU Member State where the alleged violation occurred;
• the Curaçao Gaming Authority;
• any other relevant data protection authority in Curaçao.

If you have concerns or unresolved questions about the Processing of your Personal Data, you are encouraged to contact the Company directly first.

The Company will make every reasonable effort to address concerns in a timely and lawful manner.

When providing Personal Data is necessary

Providing Personal Data may be required for legal, contractual, or service access reasons.

Certain data must be provided to comply with applicable laws and regulations, including Anti-Money Laundering obligations and responsible gaming requirements.

Some data is necessary to enter into and perform a contract with you, including enabling access to the Services and processing transactions.

Without required Personal Data, the Company may be unable to offer certain Services or fulfill contractual or legal obligations.

Consequences of not providing required data

Failure to provide required Personal Data may result in:

• inability to create or maintain an Account;
• restrictions on the use of the Services;
• termination of the contractual relationship;
• failure to comply with regulatory obligations, which may prevent the Company from providing Services.

Legal and Policy Information

Service availability and security

The Services operate on an “AS-IS” and “AS-AVAILABLE” basis without warranties or guarantees of uninterrupted or error-free performance.

While the Company takes reasonable precautions to protect Personal Data, absolute security cannot be guaranteed due to the complex nature of technology and evolving cybersecurity threats.

Limitations of liability

To the maximum extent permitted by law, the Company is not liable for:

• events beyond its direct control, including system failures, cyberattacks, or unauthorized access;
• indirect, incidental, consequential, or punitive damages arising from data breaches, unauthorized disclosure, or misuse of Personal Data;
• errors, inaccuracies, or security vulnerabilities on third-party websites linked from the platform.

By using the Services, you acknowledge and agree that the Company does not bear responsibility for external websites or services operated by third parties, even if they are linked from the platform.

Acceptance of this Privacy Policy

Your continued use of the Services signifies your explicit acceptance of this Privacy Policy.

This document serves as the entire and exclusive Privacy Policy and replaces any previous versions.

The Privacy Policy should be read together with the Terms and Conditions and any additional applicable notices posted on the platform.

Updates to this Privacy Policy

The Company reserves the right to modify this Privacy Policy at any time.

Any changes will be posted on the platform. Continued use of the Services after modifications constitutes acceptance of the revised Policy.

You are strongly encouraged to review this Privacy Policy regularly to stay informed about updates.

Language version

All versions of this Privacy Policy, except for the English version, are provided for informational purposes only.

The English version prevails in case of any discrepancies or conflicts between different versions.