Privacy policy

1. Introduction

At SlotsMines Casino (“We,” “Us,” “Our,” or the “Website”), safeguarding your personal information is a core commitment.

This Privacy Policy (“Policy”) explains how we, along with our affiliated entities, collect, use, share, and protect your personal data in alignment with applicable data protection laws, including the General Data Protection Regulation (GDPR) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

This Policy applies to all interactions you have with us, whether through our website or related services we provide.

2. Age Restrictions

Please bear in mind that our services are strictly intended for individuals 18 years of age or older. We do not knowingly collect data from minors. Should we discover that data from an underage individual has been collected, we will take immediate steps to delete it in accordance with applicable legislation.

3. Who We Are

The Website is owned and operated by Aveazure SRL, a company incorporated under the laws of Costa Rica, with registration number 3-102-848946 and registered address at Ofident, Oficina 3, 200 mts norte y 50 mts este del Centro Cultural Norteamericano, Barrio Dent, San José, Costa Rica. We operate under License number 940 issued on May 3, 2023 by the Kahnawake Gaming Commission.

As the operator of this platform, Aveazure SRL is the Data Controller responsible for determining the purposes and methods of processing your personal information.

We have appointed a Data Protection Officer (DPO). If you have questions or wish to exercise your legal rights under data protection laws, you may contact the DPO at [email protected] .

4. Contact Us

If you have questions or concerns about this Policy or how your data is handled, you can contact our Data Protection Officer at [email protected] .

For general support, please reach out to our Customer Service Team via support email or chat on the website.

5. Categories of Processed Data, Processing Purposes and Legal Basis for processing

We collect and process personal data to provide our services, comply with legal requirements, and ensure a safe gaming environment. Each category of data is collected for specific purposes and processed under a certain legal basis.

1) Identity Data

What data we collect: Full name, username, date of birth, gender, nationality, government-issued identification (e.g., ID card or passport).Purpose: To verify your identity, comply with regulatory requirements, and ensure account security.Legal Basis: Performance of a contract and compliance with legal obligations (e.g., KYC and AML).

2) Contact Details

What data we collect: Residential address, documents confirming proof of address, email address, phone number, and other communication channels you use.Purpose: To communicate with you, verify your address, send notifications, and ensure the delivery of account-related and promotional information.Legal Basis: Performance of a contract and, for marketing communications, your consent or our legitimate interest.

3) Financial Data

What data we collect: Bank account numbers, payment card details, documents confirming the source of funds or wealth (e.g., income statements or bank records).Purpose: To process deposits and withdrawals, detect fraudulent activity, and comply with financial regulations.Legal Basis: Performance of a contract and compliance with legal obligations (such as AML).

4) Transaction Data

What data we collect: Records of deposits, withdrawals, used bonuses, and other payment-related activity on your account.Purpose: To maintain accurate financial records and detect misuse or fraud.Legal Basis: Performance of a contract and compliance with legal obligations (such as AML).

5) Gaming Data

What data we collect: Details about the games you play, your gameplay activity (including wagering and session times), bonus history, and usage of responsible gaming options.Purpose: To personalize your gaming experience, monitor for responsible gaming.Legal Basis: Legitimate interest and compliance with legal obligations.

6) Technical Data

What data we collect: IP address, geolocation data, browser type and version, time zone settings, device type, operating system, and other technical identifiers used to access our platform.Purpose: To secure the platform, detect unauthorized access, improve service performance, and analyze usage trends.Legal Basis: Legitimate interest in maintaining security and optimizing platform performance.

7) Marketing and Related Communication Data

What data we collect: Marketing preferences, opt-in status, communication history, and engagement with promotional materials.Purpose: To provide you with relevant offers, updates, and personalized content, based on your preferences.Legal Basis: Your consent and/or our legitimate interest in offering relevant services.

8) Communication Data

What data we collect: Any additional information you voluntarily share with us through customer support or other communications.Purpose: To provide Customer Support.Legal Basis: Performance of a contract

9) Google Account Data

What data we collect: Email address and its verification status, display name, profile picture, and the unique identifier assigned by Google — received only where you choose to sign in using Google Sign-In.

Purpose: To create and authenticate your account and to recognise you when you return.

Legal Basis: Performance of a contract.

Notice on AI-Assisted Communications: We utilize third-party conversational AI tools within our messaging workspace to optimize our support operations. These tools help us manage conversations, access support tickets, retrieve customer profiles, analyze interaction trends, and provide intelligent support responses.Legal Basis: Legitimate interest.

6. Where We Get Your Data

We gather your data directly from you or from other sources to ensure functionality and regulatory compliance:

• Verification providers
• Financial institutions (AML/PEP, Sanctions searches)
• Regulatory and gaming safety databases
• Business partners and analytics providers
• Google LLC — where you choose to create an account or sign in using Google Sign-In, and only to the extent you authorise in the Google consent screen.

7. Data Retention

We retain your data only as long as necessary for its intended purpose or as required by law.

Under anti-money laundering regulations, we must retain personal data for a minimum of 5 years following the closure of your account. We are unable to process data deletion requests that conflict with legal retention obligations.

8. Data Sharing

We may share your personal information with the following categories of recipients:

• Game Providers: Game providers like NetEnt may access select personal data to deliver games and support.
• Payment Providers: Payment service providers are given access to the necessary data to process deposits, withdrawals, and other transactions.
• Marketing Partners: If you have given consent, your contact details may be shared with third-party marketing partners for promotional purposes.
• Governmental and Regulatory Authorities: We may share your data with authorities for compliance with legal obligations, including AML requirements.
• AML & Fraud Verification Tools: Third-party suppliers used for fraud prevention and verification purposes.
• Client communication software: We use a third-party software to help us communicate with you. This software enables us to send you emails and chat with you on live chat whenever you have queries.
• Business consultants, lawyers, advisors, notaries who we may engage from time to time to manage risks, obtain professional advice, or to establish and defend our legal claims, whether in court or in an out-of-court procedure.
• Conversational AI Service Providers (Anthropic, OpenAI, Gemini): We engage these third parties as Data Processors. They are granted strictly limited access to the data within our customer messaging workspace solely to operate, improve, and optimize our customer support and marketing workflows.

All third-party data processors are bound by contractual agreements to ensure your personal data is handled lawfully, securely, and solely for the intended purpose.

9. Signing in with your Google Account

Signing in with your Google Account. You may choose to create an account or sign in using Google Sign-In. If you do, Google asks for your permission before sharing any information with us, and we receive only the data covered by the permissions you grant. Using Google Sign-In is optional: you can always register and sign in with an email address and password instead.

What we receive. When you sign in with Google, we receive from your Google Account: your email address, whether that address has been verified by Google, your display name, your profile picture, and the unique identifier Google assigns to your account. We do not receive your Google password, and we do not request access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or any other Google service.

How we use it. We use this data solely to create and authenticate your account, to recognise you when you return, to contact you about your account, and to meet our legal and regulatory obligations as a licensed operator, including age and identity verification and anti-money-laundering checks. Signing in with Google does not by itself complete account verification: we may still ask you for the identity documents described elsewhere in this Policy. Where we send you marketing communications, we do so on the basis of your separate consent, which you may withdraw at any time in your account settings.

How we store and share it. Data obtained from your Google Account is stored on the same basis and for the same retention periods as the equivalent data you provide to us directly, as described in the data retention section of this Policy. We share it only with the recipients listed in this Policy, and only where necessary for the purposes set out above.

Limited use of Google user data. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• use data obtained from your Google Account for serving advertisements, including personalised, retargeted or interest-based advertising;
• sell, rent or licence data obtained from your Google Account to any third party;
• transfer data obtained from your Google Account to third parties, except as necessary to provide and secure the service, to comply with applicable law or a lawful request, or in connection with a merger or acquisition with prior notice to you;
• use or transfer data obtained from your Google Account to develop, train or improve artificial intelligence or machine learning models, including the conversational AI tools described elsewhere in this Policy;
• allow humans to read such data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

Disconnecting your Google Account. You may unlink your Google Account at any time in your account settings, after which you can continue to sign in with an email address and password. You may also revoke our access directly in your Google Account at myaccount.google.com/permissions. Disconnecting stops any further sharing of data by Google, but does not by itself delete data we have already received. To request deletion, see the section of this Policy describing your rights, bearing in mind the minimum retention periods imposed on us by anti-money-laundering law.

10. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA) or Canada, we ensure it is protected through:

• Standard Contractual Clauses (SCCs)
• Transfers to jurisdictions recognized by the European Commission or the Office of the Privacy Commissioner of Canada as providing adequate protection

11. Your Rights

Data protection law gives you, as a data subject, certain rights in certain circumstances. In accordance with law, you have a right to:

• Request access to your personal data - This means that you have a right to request, free of charge, a copy of the personal data we hold about you;
• Request the correction of your personal data – This means that if any personal data we hold about you is incomplete or incorrect, you have a right to have this corrected. Keep in mind, however, that we may need you to provide evidence and documentation (such as your ID documentation or proof of address) to support your request. It can be declined due to our legal obligations
• Request the erasure of your personal data - This means that you may request the erasure of your personal data where we no longer have a legal basis to continue processing it or retaining it. Please be aware that this right is not absolute – meaning that we are not able to satisfy your request where we are obliged under a legal obligation to retain the data or where we have reason that the retention of data is necessary for us to defend ourselves in a legal dispute;
• Object to the processing of your personal data where we rely on our legitimate interests (or those of a third party) to process your data, and you feel that our processing of your data in such a manner impacts your fundamental rights and freedoms. However, in some cases, we may be able to demonstrate that we have a compelling, legitimate ground to process your data, which may override your rights and freedoms. You may submit your objections to the processing of your personal data on the grounds of the above-mentioned legitimate company interests by contacting our DPO;
• Request the restriction of the processing of your personal data – You may ask us to temporarily suspend the processing of your personal data in one of the following scenarios: (a) where you want us to establish the accuracy of the data, (b) where our use of the data is unlawful but you do not wish for us to delete it, (c) where you need us to retain your data even when we no longer need it in order for you to establish, exercise, or defend legal claims, or (d) where you have objected the use of your data but we need to verify whether we have to override legitimate grounds to use it;
• Request the transfer of your personal data (i.e. data portability) – This means you may request us to provide you with certain data we process about you so you may transfer it to another controller. This right only applies to data acquired through automated means, which you initially provided consent for us to use, or where we used the data to perform our obligations under a contract with you;
• Withdraw your consent at any time when we rely on your consent to process the data. You may withdraw your consent at any time through the account profile settings on the website;
• Lodge a complaint with a supervisory authority;
• Right to disconnect a linked account: if you signed in using Google, you may unlink your Google Account at any time in your account settings, or revoke our access in your Google Account at myaccount.google.com/permissions.

In order to exercise your rights, as explained above, we may need to request specific information about you to help us verify your identity. This is a security measure to ensure that we are certain that the person to whom we disclose your personal data is really you.

We will do our utmost to respond to all legitimate requests within a one-month timeframe from the submission of a request. If your request is particularly complex, or if you have made multiple requests in a certain time period, it may take us a little longer. In such a case, we will notify you of this extension.

12. Automated Decision-Making

We do not make decisions solely based on automated processing that would produce legal effects or significantly affect you. All actions are checked by humans. If this changes, we will inform you and, where applicable, provide safeguards and options to contest such decisions.

13. Security Measures

We implement a range of physical, electronic, and organizational controls to protect your personal information. These include:

• Physical Access ControlWe take stringent measures to prevent unauthorized physical access to locations where personal data is processed. All systems are hosted within secure data centers that comply with recognized industry standards for both physical and cybersecurity. Only authorized individuals are granted entry or access to personal data.
• System Access ControlSystems that handle personal data are protected through secure authentication protocols, including password protection. Every user is assigned a unique ID to ensure traceable and secure system access.
• Data Access ControlAccess to data and software is granted strictly on a need-to-know basis. Controls are implemented to block unauthorized use or installation of hardware and software. We also maintain secure procedures for the permanent deletion of data that is no longer necessary.
• Organizational SafeguardsWe apply robust technical and organizational safeguards to prevent accidental data mingling or breaches. A designated Data Protection Officer (DPO) oversees compliance, and all employees receive training in data privacy and information security best practices.

14. Updates to This Policy

This Privacy Policy may be revised periodically to reflect legal or technological changes. We will notify you of material updates where required by law. The most recent version is always available on our website.