Who controls what, on each route
Data protection roles are not the same on White Label as they are on Turnkey Platform. This page sets out who is controller, who is processor, whom we use, and where data goes.
Two relationships, kept apart
There are two relationships here and they are easy to confuse. One is between you and us, about the platform. The other is between you and your players.
For this website we are the controller. If you send an enquiry through a form on this site, we decide why it is held and for how long, and the privacy policy sets that out in full.
For the platform the answer depends on the route. On Turnkey Platform you hold the licence and the player relationship, so you are the controller and we act as your processor. On White Label the brand trades under our licence, so we carry obligations of our own as the licensee alongside yours, and the contract states the split rather than leaving it implied.
Nothing on this page replaces the addendum. It is the plain reading of it, published so the questions can be asked before a contract rather than after one.
Roles on each route
White Label
Brand trades under our licence
- Controller for player personal dataWho decides why player data is processed and how.
- Shared, because we carry licensee obligations alongside yours
- Our role for the platform itself
- Controller for what the licence makes ours, processor for the rest
- Controller for website enquiry dataAnything sent through a form on this website, on either route.
- Us
- Who a player writes to about their own data
- Your team, with us behind it as licensee
- Who signs the data processing addendum
- Included
- Who is notified before a sub-processor changes
- You are, with time to object
Turnkey Platform
You hold the licence
- Controller for player personal dataWho decides why player data is processed and how.
- You
- Our role for the platform itself
- Processor, acting on your documented instructions
- Controller for website enquiry dataAnything sent through a form on this website, on either route.
- Us
- Who a player writes to about their own data
- Your team, with our assistance
- Who signs the data processing addendum
- Included
- Who is notified before a sub-processor changes
- You are, with time to object
This is the reading the contract states. Where a specific deployment differs, the signed addendum is the document that governs, not this page.
International transfers
The licensed entity is registered in Saint Lucia, and Saint Lucia is not the subject of a European Commission adequacy decision. That matters, so we say it plainly rather than leaving it to be discovered during a review.
Where personal data originating in the European Economic Area or the United Kingdom is transferred to us, or onward to a processor outside those areas, the transfer relies on the European Commission's Standard Contractual Clauses, with the United Kingdom addendum applied where the data originates there. A transfer risk assessment is carried out for each recipient, and supplementary measures are applied where that assessment calls for them.
The register below names each processor and what it does. Where a processor's processing location or transfer mechanism is not yet fixed for your deployment, it is settled in the signed addendum rather than assumed here. Ask us for the current position and we will send it in writing.
The sub-processor register
Published rather than released on request. You are told before one is added or replaced, and you have a reasonable period to object on data protection grounds.
CloudWalker
Provides the infrastructure a platform deployment runs on, which is where player records for that deployment are stored.
Processing location: Set in the signed addendum for your deployment
GitHub
Stores the content of this website and the editorial history behind it. It holds no player data and no enquiry data.
Processing location: United States
GitHub websiteMiFinity
Processes fiat deposits and withdrawals, and the account data a payment needs in order to settle.
Processing location: Set in the signed addendum for your deployment
MiFinity websiteNOWPayments
Processes crypto deposits and the transaction data that confirms them against a player wallet.
Processing location: Set in the signed addendum for your deployment
NOWPayments websiteResend
Delivers the internal notification and the acknowledgement email that follow an enquiry sent through a form on this site.
Processing location: United States
Resend websiteSlotegrator
Carries game aggregation, and the session data a game round needs in order to be settled against a player account.
Processing location: Set in the signed addendum for your deployment
Slotegrator websiteSumsub
Runs identity verification, source of funds checks and AML screening for players on a brand hosted on the platform.
Processing location: Set in the signed addendum for your deployment
Sumsub websiteTugi Tark
Provides TUGI AI player support, and processes the content of a player conversation with it, including anything the player types.
Processing location: Set in the signed addendum for your deployment
Vercel
Hosts this website and the endpoint a form posts to, and delivers the pages you are reading. It sees the technical data any web request carries.
Processing location: United States
Vercel websiteRegister last reviewed on . Where a processing location is not yet fixed for your deployment, it is settled in the signed addendum rather than assumed here.
Rights, and how to exercise them.
These are the rights of a person whose data we hold, whether that person is an operator contact or a player on a brand we host.
The rights you can exercise
Access
A copy of the personal data we hold about you, and the reasons we hold it.
Rectification
Correction of anything inaccurate, and completion of anything incomplete.
Erasure
Deletion, where we have no overriding legal or regulatory reason to keep it.
Restriction
A pause on processing while an accuracy or objection question is settled.
Portability
The data you gave us, in a structured, commonly used, machine readable form.
Objection
An objection to any processing we carry out on the basis of legitimate interests.
Withdrawal of consent
Withdrawn as easily as it was given, without affecting what was lawful before.
Complaint to a supervisory authority
To the authority in the country where you live, work, or where the issue arose.
How a request is handled
Write to the data protection contact
One address, published on this page and again in the privacy policy.
We reply within one month
Extended by up to two further months only for a genuinely complex request, and we tell you if that happens.
We may ask you to confirm who you are
Only where we genuinely cannot tell, and only for as much as the check actually needs.
There is no charge
Unless a request is manifestly unfounded or excessive, in which case we say so and explain why.
Ask for the addendum before the contract, not after it.
If your legal team needs a redline against your own template, send the template.
