I handle the privacy of every Sankra Casino user with utmost care sankra.no. As a data controller established in Norway, I process personal information in full alignment with the General Data Protection Regulation and the Norwegian Personal Data Act. A Data Subject Access Request enables you ask me exactly what personal data I hold about your account, how it is utilized, and who it is transmitted with. This guide explains how to submit a DSAR, what to anticipate, and how I protect your rights during the process.

Understanding Your Data Subject Access Request

A Data Subject Access Request is a structured mechanism created by Article 15 of the GDPR. It provides you the right to receive confirmation that I manage personal data about you and to get a copy of that data. You can also learn why I manage it, which categories of data are included, and the recipients or categories of recipients I share it with, such as payment providers and regulatory compliance bodies. The DSAR is a effective transparency tool.

The scope of a DSAR is deliberately broad. It encompasses all personal information directly or indirectly linked to your Sankra Casino account, including registration details, transaction logs, responsible gaming records, and correspondence. I deliver the data in a systematic, commonly used machine-readable format such as JSON or CSV, unless you ask for a simple document.

How to Submit a DSAR to Sankra Casino

Essential Information for a Valid Request

To process your request promptly, I need clear identification details. Provide your full name, the email address registered to your Sankra Casino account, and your username or account number. Describe the specific data you want to access. A general request is valid, but specifying it speeds up the process. Mention if you need the reply in a particular language or format.

Contact Channels and Address

Send your DSAR by email to our dedicated Data Protection Officer at dataprotection@sankra.no. Alternatively, you can mail a signed written request to Sankra Casino’s registered address in Norway. I advise using email for speed and security. All incoming DSARs are logged and acknowledged within two business days.

Your individual Legal Rights Under GDPR and Norwegian Law

The Right of Access Under Article 15

Article 15 of the GDPR, enforced in Norway through the Personal Data Act, provides every data subject the entitlement to ask for access to their personal data. I must confirm whether processing takes place, provide a copy of the data, and inform you of the objectives, categories, retention periods, and your connected rights. This legal foundation ensures you keep in control of your information while I maintain complete transparency.

Additional Rights That Support Your Access

In addition to access, you possess the authority to rectification, erasure, restriction of processing, and data portability. If you think your data is inaccurate or not full, you can ask me to rectify it. Under certain situations you can also request deletion. I note these because a DSAR is frequently the first step before using other rights. Knowing the full scope aids you make precise requests.

Identity Confirmation and Protection

Why I Need to Confirm Your Identity

Before releasing any personal data, I must be confident I am communicating with the genuine data subject. This safeguard prevents unauthorised access and identity fraud. GDPR mandates me to take suitable steps to verify your identity, notably when sensitive information is involved. I consequently ask for supporting documents, but I process them securely and erase the verification data as soon as the process completes.

Valid Documents for Verification

You can confirm your identity by sending a clear copy of a valid passport, national ID card, or driving licence. If your account details have changed, I may also ask for a recent utility bill showing your registered address. Please obscure unnecessary sensitive information such as passport numbers. I only require the photograph and full name for verification. Digital copies sent through encrypted email are recommended.

What Data You Will Receive

Categories of Personal Data I Maintain

My reply to your DSAR contains a detailed summary of the personal data I keep. This usually encompasses identity data, contact details, account transaction history, deposit and withdrawal records, responsible gambling markers, communication logs with support, and any documents you uploaded for KYC purposes. I also indicate if automated decision-making is used, such as risk profiling.

Layout and Transmission of Your Data

I provide the requested data in a portable electronic format, typically a password-protected PDF or a machine-readable CSV file. If you choose a printed copy sent by secure post, I can organize that upon request. The response also includes an explanatory cover letter that maps each piece of data to the processing purpose and the legal basis, making the information easy to understand.

Response Timelines and Possible Limitations

Under GDPR, I must respond to your DSAR without unnecessary delay, and at the latest within one month of obtaining the authenticated request. If your request is complex or you submit multiple requests, I may extend this period by up to two extra months. I will inform you of any extension within the first month, together with the grounds for the delay, so you are never left wondering.

Specific circumstances may prevent full disclosure, for example if sharing the data would violate others’ rights or disclose confidential business details. In such cases I edit or deny the relevant portion. I give the first response without charge, but if you make manifestly unfounded or excessive requests, I may impose a cost or choose not to act, always stating the reason and your right to complain to the Datatilsynet.

Frequently Asked Questions

May I request information about another individual, for example a relative?

Information is released solely to the person it relates to. To safeguard privacy, I cannot provide details about another person, including a relative. If you have legal authority like a power of attorney, provide that documentation. Otherwise the third party must submit their own DSAR.

What if I have forgotten my registered email address?

If you misplaced your email, reach out to support providing your full name, date of birth, and registered mailing address or phone number. I am able to authenticate your identity and restore account information, then handle the DSAR. This may add a few days, but I will keep you informed.

For how long is my data retained after account closure?

I hold personal data for the period stipulated by Norwegian anti-money laundering laws, generally five years after account closure. Following the retention period, data is safely erased unless a longer duration is required by law or necessary for legal proceedings. Detailed retention periods appear in my privacy notice.

Can I get a copy of my closed account data?

Certainly. Even following the closure of your Sankra Casino account, your access rights continue. You may file a DSAR for the information I still retain. The procedure is identical: supply identification and indicate the details you require. I will find the stored records and deliver them within the same statutory period.

What happens if I am unhappy with the reply?

If you believe I have not complied, contact me for clarification. The issue will be reviewed and an additional response will be given. Additionally, you are entitled to lodge a complaint with the Data Protection Authority. An independent inquiry will be made to determine if I satisfied my responsibilities.

Does making a DSAR influence my account status?

Not at all. Asserting your data protection rights carries no negative consequences for your account. I process access requests without bias and will not limit your account, end services, or modify loyalty perks due to your data request. Transparency is fundamental here, and I encourage you to use your rights.