Privacy Policy

This notice sets out which personal data Arctic Casino records, the legal grounds we rely on, and the choices available to you as the person that data describes. It applies to the website, the mobile lobby, and every message exchanged with our support desk.

Categories of information we hold

Registration details include your name, date of birth, residential address, email, telephone number, and chosen currency. Without them we cannot confirm eligibility or process a payout.

Verification records cover identity documents, proof of address, and evidence of the source of funds where anti-money-laundering thresholds are reached. These files are stored in encrypted form and accessed only by our compliance unit.

Technical and behavioural data is captured automatically: IP address, device fingerprint, browser version, login timestamps, wager history, bonus participation, and the pages viewed before a deposit.

Why we process it and on what basis

Contract performance covers everything needed to run your account — crediting deposits, settling bets, and paying withdrawals.

Legal obligation covers the record keeping imposed on Arctic Casino by the Malta Gaming Authority under licence MGA/B2C/748/2019, together with anti-money-laundering and counter-terrorist-financing law.

Legitimate interest covers fraud screening, bonus abuse detection, network security, and the aggregated reporting we use to decide which game categories to expand.

Consent covers optional marketing by email or SMS and any non-essential cookie. Consent can be withdrawn at any moment without affecting the lawfulness of processing already carried out.

Sharing, transfers, and safeguards

Game studios receive only the technical session data required to render a round. Payment providers receive the transaction details needed to move funds. Neither group receives your full profile.

Regulators, auditors, and law enforcement receive data where a lawful request compels disclosure. Arctic Casino does not sell personal data, and we do not trade contact lists with affiliates.

Where a processor operates outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses supplemented by encryption at rest and in transit.

How long records are kept

Account, transaction, and verification records are retained for a minimum of five years after the relationship ends, as licensing and anti-money-laundering rules require.

Self-exclusion entries persist for the declared period and, where the exclusion is permanent, indefinitely, because deleting them would defeat their protective purpose.

Marketing preferences and non-essential analytics identifiers are cleared within twelve months of your last interaction with the site.

Exercising your rights

Under the General Data Protection Regulation you may request a copy of your data, correct inaccuracies, object to profiling for marketing, ask for portability in a machine-readable file, or request erasure where no retention duty overrides the request.

Send requests to our Data Protection Officer using the address below. We answer within one month and may extend that period by two further months for unusually complex cases, telling you why.

If our answer does not satisfy you, a complaint can be lodged with the Information and Data Protection Commissioner in Malta or with the supervisory authority in your own country of residence, which for players in Sweden is Integritetsskyddsmyndigheten.

This notice is published for transparency and may be revised when law, licensing conditions, or our processing activities change. The version dated above is the one currently in force; material amendments are announced by email before they take effect.