Sign in

GDPR Compliance

This notice explains when the EU General Data Protection Regulation applies to SpinVisor and how people can use rights such as access, erasure, portability, and objection.

Effective Date: 21st Sep 2026
Last Updated: 23rd Sep 2026

1. Purpose of This Notice

This GDPR Compliance & Rights Notice explains how SpinVisor addresses the requirements of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) where the GDPR applies to SpinVisor's processing of personal data.

This Notice supplements the SpinVisor Privacy Policy and should be read together with that policy.

The Privacy Policy provides the primary description of the personal information SpinVisor collects, why it is processed, how long it is retained and how SpinVisor operates its services.

This Notice focuses specifically on GDPR rights and compliance.

2. Data Controller

SpinVisor is operated by:

Dynemetry (Pty) Ltd
SpinVisor division
South Africa

For personal data processed for SpinVisor's own purposes, Dynemetry (Pty) Ltd generally acts as the data controller.

Privacy Email: support@spinvisor.com
Registered/Business Address: 10 Payne St, Penzance Estate, Cape Town, Western Cape, 7806

Where required by applicable law, additional contact information concerning a Data Protection Officer, EU representative or other privacy representative will be published here.

3. When the GDPR Applies

SpinVisor is established outside the European Economic Area (“EEA”).

The GDPR may nevertheless apply to SpinVisor's processing of personal data where the requirements for its territorial application are satisfied, including where SpinVisor offers services to individuals in the EEA or processes information in circumstances otherwise falling within the GDPR.

This Notice applies to individuals whose personal data is protected by the GDPR.

4. GDPR Principles

Where the GDPR applies, SpinVisor seeks to process personal data in accordance with the GDPR principles of:

  • lawfulness, fairness and transparency;
  • purpose limitation;
  • data minimisation;
  • accuracy;
  • storage limitation;
  • integrity and confidentiality; and
  • accountability.

SpinVisor seeks to collect and retain only personal information reasonably required for defined purposes and to maintain appropriate technical and organisational safeguards.

5. Categories of Personal Data

Depending on how a user interacts with SpinVisor, personal data may include:

Account and registration information

  • email address;
  • date of birth;
  • registration IP address;
  • internal account identifier;
  • SpinVisor handle;
  • account status;
  • subscription information;
  • registration timestamps;
  • authentication information; and
  • security information.

Optional profile information

Where voluntarily supplied:

  • first name;
  • last name;
  • country of residence; and
  • profile photograph.

Gameplay and session information

While associated with an identifiable or identifiable-by-reference SpinVisor account, gameplay telemetry and derived session information may constitute personal data.

This may include:

  • game/provider/casino information;
  • gameplay events;
  • wager values;
  • spin results;
  • win and loss values;
  • displayed balance information;
  • session records;
  • bonus/feature events;
  • multiplier information;
  • historical gameplay statistics; and
  • derived gameplay metrics.

Technical and security information

This may include:

  • IP addresses;
  • browser information;
  • operating-system information;
  • extension version;
  • installation identifiers;
  • API request logs;
  • authentication/session information;
  • error logs;
  • security events; and
  • diagnostic information.

Support information

Information voluntarily provided through SpinVisor support systems may constitute personal data.

Users are encouraged not to include unnecessary personal or sensitive information in support requests.

6. Legal Bases for Processing

Where the GDPR applies, SpinVisor processes personal data only where an appropriate legal basis exists.

Depending on the processing activity, this may include:

Performance of a contract

Processing may be necessary to:

  • create and maintain a SpinVisor account;
  • authenticate users;
  • provide extension functionality;
  • maintain gameplay/session history;
  • provide requested analytics;
  • provide subscription functionality;
  • provide support; and
  • otherwise deliver the SpinVisor Service.

Legitimate interests

SpinVisor may rely on legitimate interests where appropriate, including for:

  • securing SpinVisor systems;
  • preventing fraud and abuse;
  • maintaining service reliability;
  • diagnosing technical problems;
  • improving supported functionality;
  • protecting SpinVisor's legal rights; and
  • operating and improving the Service.

Where legitimate interests are relied upon, SpinVisor will consider the interests, rights and freedoms of affected individuals.

Consent

Consent may be used where required or appropriate, including for particular optional processing or communications.

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

Legal obligations

SpinVisor may process or retain information where necessary to comply with applicable:

  • tax requirements;
  • accounting obligations;
  • lawful regulatory requirements;
  • court orders; or
  • other legal obligations.

Legal claims

Information may be processed where necessary to establish, exercise or defend legal claims.

7. Gameplay Telemetry and GDPR

Gameplay telemetry may be associated with a user's SpinVisor account while the account remains active.

While telemetry can reasonably be connected to an identifiable user through SpinVisor's account systems, SpinVisor treats the relevant information as personal data where required by the GDPR.

The fact that gameplay information does not contain a user's real name does not necessarily make it anonymous.

SpinVisor therefore distinguishes between:

  • account-linked personal data;
  • pseudonymous information; and
  • genuinely anonymised information.

8. Pseudonymous Handles

SpinVisor uses pseudonymous handles to reduce unnecessary exposure of users' real-world identities.

A SpinVisor handle may be displayed in certain community functionality.

A pseudonymous handle does not automatically make information anonymous where SpinVisor can still associate that handle with the user's account.

SpinVisor therefore treats account-linked pseudonymous information as personal data where required by applicable law.

9. Commercial Gameplay Telemetry Datasets

SpinVisor's business model may include the commercial use, licensing or sale of gameplay telemetry event data and statistical datasets to third-party casino-industry or gameplay-data aggregators.

Commercial telemetry datasets are intended to contain gameplay event information rather than user-referenced information.

SpinVisor does not provide recipients of these commercial telemetry datasets with:

  • SpinVisor handles or nicknames;
  • anonymised or pseudonymised user handles;
  • SpinVisor account IDs;
  • email addresses;
  • dates of birth;
  • IP addresses;
  • first or last names;
  • profile photographs;
  • authentication information; or
  • other identifiers intended to associate telemetry events with a particular SpinVisor user.

User/account references are excluded from the commercial telemetry datasets supplied to such recipients.

SpinVisor may receive financial or other commercial consideration for supplying gameplay telemetry datasets.

If a commercial dataset could reasonably identify an individual despite removal of direct identifiers, SpinVisor will treat that information according to applicable data-protection requirements rather than relying solely on its description as anonymous or deidentified.

10. Anonymisation

When a SpinVisor account is deleted, SpinVisor may retain historical gameplay information only after applying its anonymisation process.

The purpose of this process is to irreversibly sever the relationship between retained historical gameplay information and the former user.

Information intended to be removed or severed from retained historical gameplay information includes, where applicable:

  • account identifiers;
  • email addresses;
  • IP addresses;
  • authentication identifiers;
  • original SpinVisor handles;
  • optional names;
  • profile information;
  • profile-image references;
  • support references; and
  • other information capable of reconnecting the historical dataset to the former account.

The former user identifier may be replaced with a generic statistical identifier that is not intended to enable the former account holder to be identified or reconnected.

Once information has been genuinely and irreversibly anonymised, SpinVisor cannot restore that information to a subsequently created account.

SpinVisor may retain genuinely anonymised statistical information indefinitely.

11. Right to Be Informed

Individuals have the right to receive clear information about the processing of their personal data.

SpinVisor provides this information through:

  • the SpinVisor Privacy Policy;
  • this GDPR Notice;
  • the Extension Data Collection Statement;
  • relevant user interfaces; and
  • other notices where required.

12. Right of Access

Where applicable, you may request confirmation of whether SpinVisor processes personal data concerning you.

You may also request access to your personal data and information concerning its processing, subject to applicable legal limitations.

This may include information about:

  • categories of personal data;
  • processing purposes;
  • recipients or categories of recipients;
  • applicable retention periods;
  • sources of information where relevant; and
  • applicable GDPR rights.

13. Right to Rectification

You may request correction of inaccurate personal data concerning you.

You may also request completion of incomplete personal data where appropriate.

Certain account information may be editable directly through SpinVisor's account functionality.

14. Right to Erasure

You may request deletion of personal data where the GDPR provides a right to erasure.

SpinVisor also provides account-deletion functionality.

Following account deletion, SpinVisor will remove account-linked personal information from active production systems in accordance with the SpinVisor Privacy Policy.

Historical gameplay information may be retained only after being genuinely anonymised so that it can no longer reasonably be associated with the former user.

The right to erasure may be subject to lawful exceptions, including where retention is required for:

  • compliance with a legal obligation;
  • establishment, exercise or defence of legal claims; or
  • another lawful basis permitting continued retention.

15. Right to Restriction of Processing

Where the GDPR provides this right, you may request that SpinVisor restrict the processing of your personal data.

This may apply, for example, while:

  • the accuracy of information is being verified;
  • an objection to processing is being assessed; or
  • another applicable GDPR condition for restriction exists.

Where processing has been restricted, SpinVisor will handle the affected information in accordance with applicable GDPR requirements.

16. Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided to SpinVisor in a structured, commonly used and machine-readable format.

Where technically feasible and legally required, you may also request that qualifying information be transmitted directly to another controller.

The right to data portability does not necessarily apply to all information generated or calculated by SpinVisor.

17. Right to Object

Where SpinVisor relies on legitimate interests as the legal basis for processing, you may have the right to object based on your particular situation.

SpinVisor will consider the objection in accordance with GDPR requirements.

Where personal data is processed for direct marketing, you may object to that processing.

SpinVisor's newsletter also provides an unsubscribe mechanism.

18. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent:

  • applies to future processing based on that consent;
  • does not make earlier lawful processing unlawful; and
  • does not necessarily require deletion of information that SpinVisor must lawfully retain under another legal basis.

19. Automated Processing

SpinVisor automatically processes gameplay telemetry to calculate and display statistics, metrics and historical analytics.

Examples may include:

  • observed RTP;
  • session profit/loss;
  • win rates;
  • average wager;
  • average win;
  • session statistics;
  • feature statistics;
  • variance-related metrics; and
  • other mathematical or historical measurements.

These calculations provide information about gameplay.

SpinVisor does not use these gameplay calculations to make decisions that determine whether a user may obtain credit, employment, insurance, government services or other comparable legal entitlements.

SpinVisor does not control casino RNG outcomes or make gambling decisions on behalf of users.

Users make their own decisions concerning their gambling activity.

Where SpinVisor introduces processing that constitutes solely automated decision-making producing legal or similarly significant effects within the meaning of the GDPR, SpinVisor will implement the additional protections required by applicable law.

20. Exercising GDPR Rights

GDPR rights requests may be submitted to:

Privacy Email: support@spinvisor.com

SpinVisor may request information reasonably necessary to verify that the person making the request is the relevant account holder or is otherwise authorised to make the request.

SpinVisor will not request unnecessary information merely for the purpose of responding to a privacy request.

Where the GDPR applies, SpinVisor will respond without undue delay and ordinarily within one month after receiving a valid request.

Where permitted by the GDPR, that period may be extended where necessary because of the complexity or number of requests. Where an extension applies, the individual will be informed as required by law.

21. Fees for Rights Requests

SpinVisor does not ordinarily charge users for exercising GDPR rights.

Where a request is manifestly unfounded or excessive, particularly because of repeated requests, SpinVisor may take action permitted by the GDPR, including charging a reasonable administrative fee or declining to act where legally permitted.

22. Identity Verification

SpinVisor must take reasonable steps to avoid disclosing personal data to an unauthorised person.

We may therefore request reasonable verification before fulfilling certain privacy requests.

Verification will be proportionate to the nature of the request and the information involved.

23. Retention

SpinVisor applies retention periods according to the purpose and category of information.

As described more fully in the Privacy Policy, these include:

  • account information while the account remains active, subject to SpinVisor's inactivity process;
  • account-linked gameplay/session information during the life of the account;
  • relevant technical and security logs generally for approximately 90 days to 12 months;
  • closed support tickets generally for approximately 30 days after closure;
  • newsletter information until unsubscribe, with a minimal suppression record retained where necessary to honour the opt-out;
  • subscription, accounting and tax information for applicable statutory periods; and
  • properly anonymised historical gameplay/statistical information indefinitely.

SpinVisor's account-inactivity process may result in account deletion after 60 days of qualifying inactivity, subject to the notifications and conditions described in the Privacy Policy.

24. Backups

Deleted personal information may temporarily remain within restricted backup systems after deletion from active production systems.

SpinVisor generally operates a rolling backup lifecycle as described in the Privacy Policy.

Residual backup copies containing deleted personal information are expected to expire or be overwritten through the normal backup lifecycle within approximately 60 days after deletion from the active production environment.

Backups are not intended to be used to restore an individual account following deliberate account deletion.

25. Security

SpinVisor uses technical and organisational measures intended to protect personal data against:

  • unauthorised access;
  • unlawful processing;
  • accidental loss;
  • destruction;
  • alteration; and
  • unauthorised disclosure.

Measures may include:

  • password hashing;
  • authenticated access;
  • access controls;
  • security logging;
  • infrastructure controls;
  • restricted administrative access;
  • backup procedures; and
  • monitoring and security processes.

Security measures are reviewed and adapted as appropriate to the nature of SpinVisor's processing and reasonably identified risks.

26. Service Providers

SpinVisor uses service providers to operate portions of its infrastructure.

These may include:

  • Vander Host;
  • Amazon Web Services (AWS);
  • Cloudflare;
  • payment/subscription service providers once selected; and
  • other operational providers where necessary.

Where a service provider processes personal data on SpinVisor's behalf, SpinVisor seeks to use appropriate contractual and organisational safeguards as required by applicable data-protection law.

SpinVisor's current infrastructure arrangements are described more fully in the Privacy Policy.

27. International Data Processing

SpinVisor is operated from South Africa and provides services to a global user base.

Personal data may therefore be processed, remotely accessed or stored outside the EEA.

SpinVisor does not guarantee that all personal data will remain exclusively within the user's country of residence.

Where GDPR-protected personal data is transferred internationally and the GDPR requires a transfer mechanism or safeguard, SpinVisor will use an applicable mechanism as required by law.

Depending on the circumstances, these mechanisms may include:

  • an applicable European Commission adequacy decision;
  • European Commission Standard Contractual Clauses;
  • other legally recognised safeguards; or
  • an applicable GDPR derogation where legally available.

SpinVisor will assess its actual infrastructure and processing arrangements when determining the appropriate transfer mechanism.

28. Personal Data Breaches

SpinVisor maintains processes intended to identify, investigate and respond to personal-data security incidents.

Where a personal-data breach triggers GDPR notification requirements, SpinVisor will notify the applicable supervisory authority within the period required by the GDPR.

Where the GDPR also requires notification to affected individuals because of the level of risk, SpinVisor will provide that notification in accordance with applicable requirements.

29. Data Protection by Design and Default

SpinVisor seeks to incorporate privacy considerations into the design and operation of the Service.

Examples include:

  • use of pseudonymous handles rather than requiring public real names;
  • limiting required registration information;
  • separating private account information from community displays;
  • excluding user identifiers from commercial telemetry datasets;
  • user-controlled browser permissions;
  • defined retention periods;
  • account deletion;
  • anonymisation of retained historical gameplay data; and
  • restricting access to personal information according to operational requirements.

30. Data Protection Impact Assessments

Where proposed processing is likely to result in a high risk to individuals' rights and freedoms and the GDPR requires a Data Protection Impact Assessment (“DPIA”), SpinVisor will conduct the required assessment before undertaking the relevant processing.

SpinVisor may also conduct privacy or risk assessments voluntarily when introducing significant new processing activities.

31. Data Protection Officer

The GDPR requires appointment of a Data Protection Officer (“DPO”) only in specified circumstances.

SpinVisor will appoint a DPO where legally required.

If SpinVisor appoints a DPO, applicable contact information will be published in this Notice and/or the Privacy Policy.

Privacy enquiries may currently be directed to:

support@spinvisor.com

32. EU Representative

Because SpinVisor is established outside the EEA, SpinVisor will assess whether Article 27 GDPR requires appointment of a representative in the European Union based on the nature, scale and circumstances of its processing activities.

Where an EU representative is legally required, SpinVisor will appoint one and publish the representative's contact information in this Notice.

33. Right to Lodge a Complaint

Where the GDPR applies, you may have the right to lodge a complaint with a competent data-protection supervisory authority.

You may generally contact the supervisory authority applicable to your habitual residence, place of work or the location of the alleged infringement, subject to the GDPR's applicable rules.

We encourage users to contact SpinVisor first where appropriate so that we have an opportunity to investigate and address the concern, but doing so does not remove your right to contact a competent supervisory authority.

34. No Reduction of GDPR Rights

Nothing in this Notice is intended to waive or restrict a right granted to an individual by the GDPR where that right applies.

Where this Notice conflicts with a mandatory GDPR requirement, the applicable legal requirement prevails.

35. Changes to This Notice

SpinVisor may update this GDPR Compliance & Rights Notice where:

  • processing activities change;
  • infrastructure changes;
  • legal requirements change;
  • regulatory guidance changes;
  • SpinVisor introduces new functionality; or
  • changes are otherwise required to maintain an accurate description of SpinVisor's practices.

The “Last Updated” date will be revised when this Notice changes.

Material changes will be communicated where required by applicable law.

36. Related SpinVisor Policies

This Notice should be read together with:

  • SpinVisor Privacy Policy;
  • SpinVisor Terms of Service;
  • SpinVisor Extension Data Collection Statement;
  • POPIA Compliance Notice;
  • CCPA/CPRA Privacy Notice;
  • Cookie Policy;
  • Responsible Gambling / Responsible Play Policy;
  • Subscription, Cancellation & Refund Policy; and
  • Gambling & Analytics Disclaimer.

37. Contact

GDPR and privacy enquiries may be directed to:

SpinVisor
A division of Dynemetry (Pty) Ltd
South Africa

Website: www.spinvisor.com
Business/Registered Address: 10 Payne St, Penzance Estate, Cape Town,Western Cape,7806

Where SpinVisor appoints an EU representative or Data Protection Officer, their applicable contact information will also be published.

← Back to home