Privacy Policy

The data controller is Ludaro Limited (Malta C112810), 50 Triq Sant'Anna, Floriana, FRN 9020. Data protection queries: privacy@huzzlin.com.

Identity (name, date of birth, government ID), contact (email, phone, address), financial (payment method tokens, transaction history), gaming (sessions, bet history, bonus claims), technical (IP, device, browser, cookies) and KYC documentation. Legal basis: contract performance, legal obligation under MGA AML directives, and legitimate interest for fraud prevention.

KYC and transactional records are retained for at least 5 years after account closure as required by Maltese AML legislation. Marketing data is deleted within 30 days of an opt-out. You can request a copy of your data, correction or deletion (subject to legal retention) by writing to privacy@huzzlin.com.

Huzzlin collects personal data in four main categories. Identity data (name, date of birth, government ID) is collected to verify account eligibility, prevent underage gambling, and satisfy KYC obligations. Contact data (email, phone, address) is used to communicate account activity, send promotional messages to opted-in users, and deliver transaction confirmations. Financial data (payment method details, transaction history) is retained to process deposits and withdrawals and comply with anti-money laundering obligations. Technical data (IP address, device type, browser version, session logs) is collected automatically and used to maintain platform security, detect fraud, and improve the gaming experience.

Legal bases for processing under GDPR include: contractual necessity (processing your deposits and withdrawals), legal obligation (AML and KYC compliance), legitimate interests (fraud prevention, security), and consent (marketing communications). You can withdraw marketing consent at any time via the account settings or by emailing privacy@huzzlin.com.

Huzzlin uses first-party session cookies to maintain your logged-in state and remember game lobby preferences. Third-party analytics cookies (such as Google Analytics) measure aggregate visitor behaviour to improve the platform. Marketing cookies may be set by affiliate tracking systems to attribute your registration to a partner. You can manage cookie consent through the cookie preference panel, accessible from the footer of any page.

If you opt out of marketing communications, you will no longer receive promotional emails or SMS messages. You will still receive transactional communications (deposit confirmations, withdrawal updates, account security alerts) because these are necessary for the contract. Analytics data collected before an opt-out is retained in aggregate form and cannot be deleted retrospectively.

Under GDPR, players have the right to access a copy of all personal data Huzzlin holds about them. You also have the right to rectify inaccurate data, request erasure (subject to legal retention requirements), restrict processing, receive your data in a portable format, and object to processing based on legitimate interests. Exercising any of these rights can be done by contacting privacy@huzzlin.com with your account username and a description of the request.

Huzzlin's data retention policy: identity and financial records are retained for five years after account closure to comply with AML regulations. Technical logs are retained for 12 months. Marketing preferences are updated in real time upon opt-out. In the event of a data breach that poses risk to player rights, Huzzlin will notify affected players within 72 hours of the breach being identified, in accordance with GDPR Article 33 and 34 obligations. The Data Protection Officer is contactable at privacy@huzzlin.com.

Huzzlin Casino uses four categories of cookies and similar tracking technologies. Strictly necessary cookies are required for the website to function and cannot be disabled: they cover session management, login authentication, security tokens and the shopping cart functionality used for the cashier. Performance cookies collect anonymous data on how visitors use the site, including page load times, error rates and which game categories generate the most engagement. This data feeds into Google Analytics 4 and informs technical improvements. Functional cookies store user preferences such as language selection, preferred game lobby layout and notification settings so you do not need to re-enter these on each visit. Marketing cookies track your browsing activity across websites to enable targeted advertising. These require explicit consent at the cookie banner and can be withdrawn at any time via the cookie preference center accessible in the website footer. Withdrawing marketing cookie consent does not affect your ability to play or access any site functionality.

Huzzlin Casino relies on several third-party data processors. Cloudflare processes IP addresses and request metadata to deliver CDN services and protect the site from DDoS attacks and malicious traffic; data is processed under Cloudflare's DPA and standard contractual clauses for EU-US transfers. Google Analytics 4 processes anonymized behavioral data including page views, session duration, game category interactions and conversion events; GA4 data is stored in Google Cloud infrastructure and accessed only for aggregate analytics purposes. Mailchimp processes email addresses and marketing preference data to send promotional communications; subscription data is held in Mailchimp's US-based infrastructure under standard contractual clauses. Intercom processes support conversation data, including chat transcripts, account identifiers and browsing context, to operate the live chat support tool; Intercom data is stored on its US-based platform under standard contractual clauses. The full processor list with DPA references is available on request via the privacy team at privacy@huzzlin1.casino.

Under GDPR Article 6, each personal data processing activity requires a defined legal basis. Account registration and identity verification are processed under Article 6(1)(b) (contract performance) because they are necessary to provide the gaming service. Anti-money laundering checks and transaction monitoring are processed under Article 6(1)(c) (legal obligation) because they are required by the Fourth Anti-Money Laundering Directive and local implementing laws. Marketing communications are processed under Article 6(1)(a) (consent), which you provide when opting into marketing during registration or later via account settings and which you may withdraw at any time. Analytics and site improvement activities are processed under Article 6(1)(f) (legitimate interests), specifically the interest in maintaining a functional and competitive online gaming service. For data transfers to US-based processors (Google, Mailchimp, Intercom), standard contractual clauses approved by the European Commission under GDPR Article 46(2)(c) are in place. Players have rights to access, rectification, erasure, portability and objection under GDPR Chapter III, exercisable by contacting privacy@huzzlin1.casino.

Huzzlin Casino's data security architecture is designed around a layered defense model. All data in transit between the player's browser and our servers is encrypted using TLS 1.3, the current standard that eliminates known vulnerabilities in earlier versions. Stored sensitive data including payment information and identity documents is encrypted at rest using AES-256. Database access is restricted by role-based access controls, meaning support staff can access account information relevant to their function but cannot access payment instrument details or identity document images without specific elevated permissions logged and audited. In the event of a personal data breach, Huzzlin's response protocol follows GDPR Article 33 requirements: assessment within the first hour to determine scope and severity, notification to the Malta Information Technology Agency (the designated supervisory authority) within 72 hours if the breach is likely to result in risk to individuals, and direct notification to affected players without undue delay if the breach is likely to result in high risk to their rights. A post-incident report is produced within 30 days covering root cause, remediation steps and control improvements.

Personal data at Huzzlin Casino is retained only as long as necessary for its stated purpose. Account data including identity documents and transaction history is retained for five years post-closure in line with anti-money laundering regulatory requirements. Marketing data is deleted within 30 days of unsubscription. Technical logs including login IP and session data are purged after 90 days unless linked to an active compliance investigation. Support conversation data is retained for two years to enable follow-up and complaint handling. Huzzlin Casino is exclusively intended for adult players aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that data from a person under 18 has been collected, it is deleted immediately and the account closed. Age verification is mandatory during KYC: a government-issued ID confirming date of birth is required before any withdrawal is processed. Parental control software providers can contact us at privacy@huzzlin1.casino for domain categorization documentation to facilitate blocking by household filtering tools.