How long your data is kept
Every field has a retention period, and the period is set by the reason the data exists. The legal ones are the longest, and they are the reason an erasure request cannot reach everything. This page maps the clocks by category and shows how to ask what period applies to a field you care about.
Field 01Storage limitation: kept only as long as the purpose needs
The rule behind retention is storage limitation: data should be kept no longer than necessary for the purpose it was collected for. In practice it is a balance against counter-duties — anti-money-laundering and licensing rules set minimum periods, and a consumer-protection or tax rule can set another. The result is a set of clocks that differ by category: the identity and transaction record sits on legal floors, the marketing profile lives only while consent does, and login logs age out on a short security schedule. A privacy notice should state the periods, or the criteria that decide them.
Field 02The legal floors are the longest, and they are fixed
The categories with multi-year floors are the ones tied to duties: identity and verification records, the transaction and payment record, and the source-of-funds evidence. These periods are set by the anti-money-laundering and licensing framework that applies to the operator, and they are a minimum — the operator must keep the record for at least that long, and cannot lawfully delete it early just because you asked. This is why an erasure request is a test of purpose, not a delete button: it can reach data whose purpose has ended, and it stops at data whose purpose the law keeps alive.
Identity, transaction and source-of-funds records, held for the minimum the licensing and AML framework sets.
Support tickets, chat logs and correspondence are usually kept for a shorter, policy-set window.
Marketing profiles and preferences die when you withdraw consent — no legal floor attaches.
Field 03The short-lived data: sessions, logs and derived profiles
Much of what an operator holds is not on a legal floor at all, and this is the part your rights reach most easily. Session and device logs exist for security and fraud detection and usually age out on a weeks-or-months schedule. Derived profiles — preference flags and segments built for personalisation — are storage whose purpose ends the moment you object or withdraw consent. When you look at a retention reply, the interesting question is not the legal floors, which are fixed, but which of the shorter clocks is longer than its purpose justifies. That is the ground on which an objection or an erasure request actually bites.
| Category | Typical basis for the period | Reach of a later request |
|---|---|---|
| Identity | Licensing and AML minimum | undefined |
| Transactions | AML and dispute windows | undefined |
| Source of funds | The specific duty it was collected for | undefined |
| Sessions & logs | Security and fraud policy | undefined |
| Marketing profile | Consent | undefined |
| Safer-gambling | Kept on purpose, to keep working | undefined |
Field 04Some data is kept on purpose, and that is lawful
The clearest example is a self-exclusion marker. It is retained beyond an ordinary period precisely so that it keeps applying — deleting it on request would defeat the control it exists to enforce, and licensing rules often require it be kept. The same logic covers vulnerable-customer notes and dispute records held for a possible complaint. This is not an operator disobeying a data request; it is a right meeting a duty, and the operator should say so. The distinguishing test is whether the operator names the ground. A retention that names the duty that requires it is a lawful refusal; a retention that names nothing is the kind worth challenging.
Kept on purpose, in one line
A self-exclusion marker is retained so it keeps working — that is a duty, not a data-hoarding choice, and an erasure request should not remove it.Field 05How to ask which period applies to a field
Retention periods are one of the items a subject access request is entitled to. The precise ask is: “For each category of personal data you hold about me, please state the retention period, or, if no fixed period applies, the criteria used to determine it.” That phrasing puts the operator on the terms of the rule rather than on a marketing sentence about “as long as necessary”. If the reply is only “as long as necessary”, ask again for the criteria, and treat a second non-answer as the start of an escalation rather than an end to the exchange.
How to make an access request
Retention is part of what an access request must return; this page shows how to ask so the answer is usable.
Affiliate disclosure and risk warning
Every affiliate link on this page and in the header is a sponsored link to a partner operator, and we may be paid if you open an account through it, at no extra cost to you. That link pays us; it does not improve any decision, it is not a ranking, and it is never a recommendation to play. Nothing on this page is legal, financial, tax or data-protection advice, and nothing here is a prediction about any event or market, or a view on any operator. 18+ only. Every stake is money at risk and can be lost in full. The data rights explained here — access, rectification, erasure, portability, objection, restriction, consent and retention — are general descriptions of how the mechanisms usually work, not a statement of the law that applies to you: data-protection and record-keeping rules differ between countries, states and provinces and change over time, and an operator may lawfully hold data that a rights request cannot remove, because a licence or anti-money-laundering duty requires it. This page does not name any operator and is not a substitute for that operator’s privacy notice or for advice from a data-protection authority or a qualified adviser. Never stake money you cannot afford to lose, never borrow to play, and never chase losses with a larger stake. Gambling can cause serious financial harm, including debt and damage to relationships and mental health. Free and confidential support is available in most countries through national gambling-harm helplines, for players and for the people around them.