Privacy Policy

Log in

Last updated: August 14, 2025

Compliance Scope and Controller Information

Statement of responsibility

Carletta N.V. is responsible for the Processing of Personal Data connected with the Website and the Services made available through it.

The Website is owned and operated by Carletta N.V., a company incorporated under the laws of Curaçao, with its office at Dr. Henri Fergusonweg 1, Curaçao. The Company is registered under company registration number 142346.

Carletta N.V. has been licensed by the Curaçao Gaming Control Board since 24/Jun/2025 to offer games of chance under license number OGL/2024/580/0570 in accordance with the National Ordinance on Games of Chance (LOK).

For data protection purposes, Carletta N.V. acts as the controller of your Personal Data. As controller, the Company determines the purposes for which Personal Data is processed and the means used to carry out that Processing.

Processing channels

This Privacy Policy applies where Personal Data is processed in connection with:

• access to or use of the Website;
• communications sent to or received from [email protected];
• phone calls with us;
• support chat sessions.

Compliance objective

This document sets out how the Company processes Personal Data in a manner intended to comply with applicable data protection, regulatory, responsible gaming, AML, and record-keeping requirements.

It explains the categories of Personal Data processed, the purposes of Processing, lawful bases, retention approach, disclosure rules, international transfer safeguards, cookie use, minor protection measures, user rights, consent withdrawal, complaint channels, and legal limitations.

Definitions Applied in This Policy

Download Pin-Up App

Account

Account means a unique user account created to access the Services or particular parts of the Services.

Access to an Account may depend on identity verification and Regulatory Compliance requirements.

Company

Company, we, us, or our means Carletta N.V., registered in Curaçao under registration number 142346, with official address at Dr. Henri Fergusonweg 1, Curaçao.

Service

Service means the Website, its functions, and the related online gaming and interactive services provided by the Company.

Website

Website means this website, together with subdomains, associated platforms, and applications operated by the Company.

Personal Data

Personal Data means information relating to an identified or identifiable individual, as defined under the General Data Protection Regulation and the Curaçao Data Protection Framework.

Processing of Personal Data

Processing of Personal Data means any action or set of actions carried out with Personal Data by automated or manual means.

Such actions may include collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

Regulatory Compliance

Regulatory Compliance means the Company’s obligation to process Personal Data in accordance with applicable legal and regulatory requirements, including the National Ordinance on Games of Chance and Anti-Money Laundering regulations.

Processing performed for Regulatory Compliance is required by law and is not based on user consent.

Lawful Processing Framework

Contract-based Processing

Personal Data may be processed where this is necessary to enter into or perform a contract with you.

This applies, in particular, to Account creation, Account access, provision of the Services, customer support, and payment-related operations.

For Account registration and access to the Services, the Company may process:

• email address and/or phone number;
• hashed password;
• chosen currency;
• account identifiers;
• basic device or access logs used to activate and secure the Account.

The lawful basis is performance of a contract or steps prior to entering into a contract under GDPR Article 6(1)(b).

Legally required Processing

Certain Processing is necessary because the Company must comply with legal and regulatory obligations.

This includes identity verification, age confirmation, AML/CFT obligations, LOK requirements, NORUT requirements, financial record-keeping, regulatory reporting, audits, responsible gaming obligations, and cooperation with competent authorities.

For identity verification, age confirmation, AML / LOK compliance, and related KYC checks, the Company may process:

• passport;
• ID card;
• driver’s license;
• proof of address;
• date of birth or age attestation;
• selfies;
• liveness checks.

The lawful basis is compliance with legal obligations under GDPR Article 6(1)(c), including AML/CFT, LOK, and NORUT. Where applicable, legitimate interests in maintaining platform integrity under GDPR Article 6(1)(f) may also apply.

Legitimate interest Processing

The Company may process Personal Data where it has legitimate interests that are not overridden by applicable rights and freedoms.

Legitimate interest Processing may include fraud prevention, security monitoring, protection of platform integrity, service quality, dispute resolution, Website operation, Website improvement, responsible gaming support, and legal claim management.

For fraud detection, security monitoring, and prevention of platform abuse, the Company may process:

• IP address;
• device type;
• browser data;
• device identifiers;
• technical identifiers.

The lawful bases are legitimate interests in securing the Service and users under GDPR Article 6(1)(f), and legal obligations under AML/CTF rules under GDPR Article 6(1)(c).

Consent-based Processing

Where consent is required, the Company processes Personal Data only on that basis.

Consent may apply to certain marketing communications and to non-essential cookies where applicable law requires consent.

For marketing communications where permitted, the Company may process:

• email address;
• phone number;
• push token;
• marketing preferences;
• engagement metrics;
• non-sensitive bonus eligibility status.

Electronic marketing is based on consent under GDPR Article 6(1)(a). Where permitted by law, similar-product soft opt-in may rely on legitimate interests under GDPR Article 6(1)(f). Marketing activity remains subject to opt-out and responsible gaming restrictions.

Operational Processing Areas

Account administration

Personal Data is processed to register, activate, secure, and manage Accounts.

Account-related Processing supports access control, Account integrity, authentication, and operation of the Services.

The main data elements used for this purpose are contact credentials, hashed password, selected currency, Account identifiers, and basic device or access records required for activation and security.

Verification and regulatory checks

Verification-related Processing is used to confirm identity, verify age, complete KYC checks, and meet AML/CFT, LOK, and NORUT requirements.

This Processing is mandatory where legal or regulatory obligations apply. It may involve government-issued identification, proof of address, date of birth or age attestation, selfies, and liveness checks.

Payment handling

Payment Processing supports deposits, withdrawals, refunds, payout confirmations, and related financial operations.

The Company may process payment instrument data, transaction history, currency, and payout channel confirmations.

The lawful bases include contract performance under GDPR Article 6(1)(b), financial record-keeping and AML obligations under GDPR Article 6(1)(c), and fraud prevention interests under GDPR Article 6(1)(f).

Security controls

Security-related Processing helps detect suspicious activity, prevent unauthorized access, reduce platform misuse, and protect the Services and users.

The Company may process device and technical identifiers, including IP address, device type, and browser data, where needed for fraud prevention, security monitoring, and AML/CTF-related controls.

Responsible gaming controls

Responsible gaming Processing supports player protection, self-exclusion, cooling-off options, play limits, and risk-related interventions.

The Company may process:

• self-exclusion status;
• self-exclusion duration;
• cooling-off selections;
• play limits;
• gameplay frequency;
• spend metrics indicative of risk;
• communications related to responsible gaming interventions.

The lawful bases are compliance with LOK / CGA Responsible Gaming requirements under GDPR Article 6(1)(c), and legitimate interests in player welfare and Regulatory Compliance under GDPR Article 6(1)(f).

Support and communications

Customer support Processing is carried out to respond to service requests, resolve Account or transaction inquiries, maintain service quality, and handle disputes.

The Company may process support tickets, chat transcripts, email correspondence, call notes, Account identifiers, and transaction references connected with the inquiry.

The lawful bases are contract performance under GDPR Article 6(1)(b), and legitimate interests in service quality and dispute resolution under GDPR Article 6(1)(f).

Website analytics and performance

Website performance Processing helps operate the Website, measure interaction, improve functionality, and understand technical usage patterns.

The Company may process usage logs, cookie identifiers, browser type and version, traffic data, and on-site interaction metrics.

The lawful bases are legitimate interests in operating and improving the Website under GDPR Article 6(1)(f), and consent under GDPR Article 6(1)(a) where required for non-essential cookies.

Regulatory reporting and legal records

Personal Data may be processed where required for regulatory reporting, compliance audits, dispute resolution, legal proceedings, or cooperation with authorities.

This may include records required by the Curaçao Gaming Authority, FIU, tax authorities, or other competent bodies.

The lawful bases are legal obligation under GDPR Article 6(1)(c), and legitimate interests in establishing, exercising, or defending legal claims under GDPR Article 6(1)(f).

Personal Data Collection Sources

Information supplied by the user

The Company primarily obtains Personal Data directly from you.

This may occur during Account creation, verification, deposits, withdrawals, support communications, and other interactions with the Services.

Information generated by use of the Services

Some Personal Data is generated when the Services are used.

This may include gameplay, transaction history, device and log information, and cookie data handled in accordance with the Cookie Policy.

Information from service providers

Trusted third-party providers may support compliance, security, identity verification, and payment-related functions.

Where such providers are used, Personal Data may be processed to verify details, support risk management, or enable required operational activities.

Information from public sources

Where necessary, the Company may supplement user-provided information with data obtained from publicly available and legitimate sources.

This is limited to compliance, verification, or risk management purposes.

Information from competent authorities

In certain circumstances, Personal Data may be received from regulatory or law enforcement authorities.

Such receipt may occur where it relates to legal, regulatory, or compliance obligations.

Retention Compliance

Retention standard

The Company retains Personal Data only for the period necessary to fulfill the purpose for which it was collected and processed, unless a longer period is required by applicable legal or regulatory obligations.

Retention criteria

Retention periods may be determined by:

• the purpose of Processing;
• provision of the Services;
• contractual obligations;
• legitimate interests;
• AML requirements;
• gaming regulations;
• tax regulations;
• legal claims;
• compliance audits;
• supervisory requirements.

End-of-retention handling

After the applicable retention period expires, Personal Data is securely deleted, anonymized, or archived so that it can no longer be associated with you.

Further retention may continue only where required by law.

Storage and International Transfer Compliance

Secure storage

Personal Data is stored on secure servers operated by the Company and trusted service providers.

Server locations may depend on operational and regulatory requirements and may include:

• the European Economic Area;
• jurisdictions outside the European Economic Area;
• Curaçao.

Transfer requirements

Where Personal Data is transferred outside the EEA, the Company applies safeguards required by applicable data protection law.

Adequacy mechanism

Transfers may take place to countries recognized by the European Commission as providing an adequate level of data protection.

Contractual transfer safeguards

Where no adequacy decision applies, the Company uses Standard Contractual Clauses approved by the European Commission to support continued protection of Personal Data transferred outside the EEA.

Disclosure Compliance

Disclosure standard

The Company discloses Personal Data only where necessary and only for purposes described in this Privacy Policy.

Disclosures are handled in accordance with applicable data protection laws, contractual obligations, and security measures.

Authorities and regulators

Personal Data may be disclosed to regulatory and supervisory authorities where required by law or regulatory obligations.

Recipients may include:

• Curaçao Gaming Authority;
• Financial Intelligence Unit;
• tax authorities;
• governmental bodies;
• law enforcement bodies.

Such disclosures may relate to AML, responsible gaming, reporting, audit, or legal requirements.

Identity verification and compliance providers

Personal Data may be disclosed to providers that assist with identity verification and compliance with AML and Know Your Customer obligations.

Payment processors and financial institutions

Payment-related data may be shared with payment processors and financial institutions to enable deposits, withdrawals, refunds, and other payment services.

Shared information may include transaction details, payment method information, and Account identifiers.

Support and communication tools

External providers may process Personal Data for email delivery, live chat, or other communication channels.

This may include contact details and support messages required to provide customer service.

Fraud prevention and security partners

Trusted security providers may process Personal Data to help protect platform integrity and detect or prevent potentially fraudulent or unauthorized activity.

Analytics and optimization providers

Third-party analytics and optimization tools may support Website usage analysis, A/B testing, and user experience improvements.

Where possible, data used for these purposes is anonymized or pseudonymized.

Game content providers

Licensed third-party game providers may receive only the minimum data needed to enable certain platform features.

This may include player identifiers and game session data.

IT infrastructure and internal tools

Secure hosting, productivity tools, and internal infrastructure providers may process Personal Data necessary for the operation of the Services.

Cookie Compliance

Cookie purpose

The Website may use cookies and similar technologies to support essential Website functions, improve user experience, and analyze performance.

Cookies are small text files stored on your device when the Website is visited. They allow the Website to recognize the device and remember certain preferences or previous actions.

Strictly necessary cookies

Strictly necessary cookies support core Website operation.

They may enable page navigation, secure-area access, and user authentication.

These cookies cannot be disabled in the Company’s systems.

Functional cookies

Functional cookies support enhanced functionality and personalization.

They may remember language preferences or user settings.

These cookies may be placed by the Company or by third-party providers whose services are used.

Analytical or performance cookies

Analytical or performance cookies collect aggregated and anonymized information about Website use.

This may include page visits, click-through rates, traffic sources, and on-site interaction metrics.

The purpose is to measure and improve Website performance.

Advertising or targeting cookies

Advertising or targeting cookies may be placed by the Company or advertising partners.

They may be used to develop an interest profile, provide relevant advertising on this Website or other websites, limit advertisement frequency, and evaluate advertising effectiveness.

Session and persistent cookies

Session cookies expire when the browser is closed.

Persistent cookies remain on the device for a predetermined period or until deleted by you.

First-party and third-party cookies

First-party cookies are placed by the Company.

Third-party cookies are placed by service providers acting on behalf of the Company, including analytics services, customer support tools, or advertising networks.

Cookie management

Cookies may be managed through browser settings.

Most browsers allow users to refuse or delete cookies. Restricting certain cookies may affect the availability or functionality of some Website areas.

Minor Protection Compliance

Age restriction

The Services are intended only for individuals who are at least eighteen (18) years old or who have reached the legal age in their jurisdiction, whichever is higher.

By accessing or registering for the Services, you confirm that you meet the applicable age requirement.

Alignment with responsible gaming requirements

In alignment with the Curaçao Gaming Authority’s Responsible Gaming Policy introduced in February 2025, the Company applies measures designed to prevent underage access to the Services.

Verification controls

Users may be required to provide valid government-issued identification documents during registration.

This supports age confirmation and compliance with access restrictions.

Monitoring and review controls

The Company may use automated monitoring to detect inconsistencies or signs of attempted underage access.

Where underage access is suspected, security reviews may be carried out. These reviews may include verification of registration data and financial transactions.

Data submitted by minors

Personal Data submitted by individuals identified as minors is deleted immediately.

Parental control guidance

Parents and guardians are encouraged to use available parental control tools and to educate minors about responsible online behavior to prevent unauthorized access to the Services.

Responsible gaming commitment

The Company’s responsible gaming framework includes adherence to CGA guidance on player protection and age verification.

Policies are reviewed and enhanced to ensure that they meet or exceed regulatory standards.

Data Subject Rights

Access right

Under Article 15 GDPR, you may request confirmation of whether your Personal Data is processed.

You may also request a copy of that Personal Data and information about how it is used.

Rectification right

Under Article 16 GDPR, you may request correction of inaccurate or incomplete Personal Data without undue delay.

Erasure right

Under Article 17 GDPR, you may request deletion of Personal Data where legal grounds apply.

This may include circumstances where the data is no longer needed for the purposes for which it was collected, or where consent is withdrawn and no other lawful basis applies.

Restriction right

Under Article 18 GDPR, you may request restriction of Personal Data Processing in specific situations.

This may include cases where accuracy is contested or Processing is unlawful.

Portability right

Under Article 20 GDPR, you may request the Personal Data you provided to the Company in a structured, commonly used, and machine-readable format.

Where technically feasible, that data may be transferred to another controller.

Objection right

Under Article 21 GDPR, you may object to Processing based on legitimate interests for reasons related to your particular situation.

You may also object to Processing for direct marketing purposes.

Rights request channel

Requests to exercise data protection rights may be sent through:

• email: [email protected];
• postal address: Dr. Henri Fergusonweg 1, Curaçao.

Consent Withdrawal and Complaint Mechanisms

Withdrawal of consent

Where Personal Data is processed based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of consent-based Processing carried out before the withdrawal.

After a withdrawal request is received, the Company will stop the relevant Processing unless continued retention or Processing is required for legal or regulatory obligations.

If withdrawal affects the ability to provide certain Services, the Company will explain the consequences before completing the withdrawal process.

Complaint right

Under Article 77 GDPR, you may lodge a complaint if you believe your Personal Data is processed unlawfully or your privacy rights have been violated.

A complaint may be lodged with:

• the supervisory authority in the EU Member State where you reside;
• the supervisory authority in the EU Member State where you work;
• the supervisory authority in the EU Member State where the alleged violation occurred;
• the Curaçao Gaming Authority;
• any other relevant data protection authority in Curaçao.

Direct resolution

If you have concerns or unresolved questions about Personal Data Processing, you are encouraged to contact the Company directly.

The Company will make every reasonable effort to address such concerns in a timely and lawful manner.

Required Data and Non-Disclosure Consequences

Legal requirement

Certain Personal Data must be provided so that the Company can comply with laws and regulations, including Anti-Money Laundering obligations and responsible gaming requirements.

Contractual requirement

Some Personal Data is necessary to enter into and perform a contract with you.

This includes information required to provide access to the Services and process transactions.

Service requirement

Certain Services may not be available unless required Personal Data is provided.

Without required data, the Company may be unable to fulfill contractual or legal obligations.

Consequences of refusal or omission

Failure to provide required Personal Data may result in:

• inability to create or maintain an Account;
• restrictions on use of the Services;
• termination of the contractual relationship;
• failure to comply with regulatory obligations, which may prevent the Company from providing Services.

Legal Disclaimer and Policy Control

Service status

The Services are provided on an “AS-IS” and “AS-AVAILABLE” basis.

The Company does not provide warranties or guarantees of uninterrupted or error-free performance.

Security limitation

The Company uses reasonable precautions to protect Personal Data.

However, absolute security cannot be guaranteed because technology is complex and cybersecurity threats continue to evolve.

Liability limitation

To the maximum extent permitted by law, the Company is not liable for:

• events beyond its direct control, including system failures, cyberattacks, or unauthorized access;
• indirect, incidental, consequential, or punitive damages arising from data breaches, unauthorized disclosure, or misuse of Personal Data;
• errors, inaccuracies, or security vulnerabilities on third-party websites linked from the platform.

Third-party resources

External websites and services operated by third parties remain outside the Company’s responsibility, even where links to them appear on the platform.

By using the Services, you acknowledge and agree that the Company does not bear responsibility for such third-party websites or services.

Policy acceptance

Continued use of the Services constitutes explicit acceptance of this Privacy Policy.

This document is the entire and exclusive Privacy Policy and replaces previous versions.

Related documents and updates

This Privacy Policy should be read together with the Terms and Conditions and any additional applicable notices posted on the platform.

The Company reserves the right to modify this Privacy Policy at any time. Changes will be posted on the platform, and continued use of the Services after modifications constitutes acceptance of the revised Policy.

You are strongly encouraged to review this Privacy Policy regularly to stay informed about updates.

Language control

All versions of this Privacy Policy other than the English version are provided for informational purposes only.

The English version prevails in case of discrepancies or conflicts between different versions.