Fireball Casino Privacy Policy — GDPR overview

What data is collected?

The data set is split into three categories. Each category has its own legal basis and retention period. Personal data is never sold to third parties — the only sharing is with regulators and payment processors as required by law.

• Identification data: name, date of birth, address, ID number (KYC requirement).
• Financial data: payment method, transaction history (AML compliance).
• Behavioral data: game history, login times (responsible gambling and security).

How long is data stored?

Under MGA license rules and EU AML standards the operator must retain account-related data for a defined period. After this period the data is anonymized or destroyed, depending on category.

1. KYC data: 5 years from account closure (MGA / AML requirement).
2. Transaction data: 7 years (financial compliance).
3. Marketing data: until consent withdrawal.
4. Cookie data: 12 months or until clearance.

Cookies and tracking

The site uses three cookie categories. The strictly necessary cookies are mandatory for site operation; the others are configurable. The cookie consent banner appears at the first visit and the choice is stored for 12 months.

Your rights under GDPR

Every player has the right to access their personal data, demand correction, request deletion (within legal boundaries) or restrict processing. These rights can be exercised via support email; the operator responds within 30 days.

• Right to access: copy of personal data.
• Right to rectification: incorrect data correction.
• Right to erasure: data deletion within legal limits.
• Data portability: data export in machine-readable format.
• Right to object: opt-out of marketing communications.

Data breach — the mandatory notification

Under GDPR, in the event of a data breach the operator must notify the supervisory authority within 72 hours and, in cases of serious risk, the affected user directly. This obligation is not optional — the Malta Data Protection Authority imposes fines for late or incomplete notification.