I take the confidentiality of every Sankra Casino user seriously sankra.no. As a data controller registered in Norway, I manage personal information in full alignment with the General Data Protection Regulation and the Norwegian Personal Data Act. A Data Subject Access Request enables you request me precisely what personal data I hold about your account, how it is used, and who it is transmitted with. This guide explains how to file a DSAR, what to look forward to, and how I safeguard your rights throughout the process.
Understanding Your Data Subject Access Request
A Data Subject Access Request constitutes a formal mechanism introduced by Article 15 of the GDPR. It grants you the right to receive confirmation that I process personal data about you and to obtain a copy of that data. You can also find out why I manage it, which categories of data are relevant, and the recipients or categories of recipients I disclose it with, such as payment providers and regulatory compliance bodies. The DSAR is a strong transparency tool.
The scope of a DSAR is intentionally broad. It includes all personal information directly or indirectly linked to your Sankra Casino account, including registration details, transaction logs, responsible gaming records, and correspondence. I provide the data in a organized, commonly used machine-readable format such as JSON or CSV, unless you request for a simple document.
Your individual Legal Rights Per GDPR and Norwegian Law
The Access Right Per Article 15
Article 15 of the GDPR, enforced in Norway by means of the Personal Data Act, grants every data subject the authority to demand access to their personal data. I am required to confirm whether processing occurs, supply a copy of the data, and notify you of the aims, categories, retention periods, and your associated rights. This legal foundation secures you stay in control of your information while I maintain complete transparency.
Further Rights That Underpin Your Access
Aside from access, you hold the right to rectification, erasure, restriction of processing, and data portability. If you suspect your data is inaccurate or not full, you can ask me to rectify it. Under certain circumstances you can also ask for deletion. I note these because a DSAR is frequently the first step before exercising other rights. Knowing the full scope aids you submit precise requests.
What Information You Can Expect
Types of Personal Data I Maintain
My response to your DSAR includes a comprehensive overview of the personal data I hold. This usually encompasses identity data, contact details, account transaction history, deposit and withdrawal records, responsible gambling markers, communication logs with support, and any documents you uploaded for KYC purposes. I also indicate if automated decision-making is used, such as risk profiling.
Format and Provision of Your Data
I supply the requested data in a portable electronic format, typically a password-protected PDF or a machine-readable CSV file. If you prefer a printed copy sent by secure post, I can set up that upon request. The response also includes an explanatory cover letter that maps each piece of data to the processing purpose and the legal basis, making the information easy to understand.
How to Submit a DSAR to Sankra Casino
Required Information for a Valid Request
To process your request promptly, I need specific identification details. Provide your full name, the email address registered to your Sankra Casino account, and your username or account number. Describe the specific data you want to access. A general request is valid, but focusing it speeds up the process. Indicate if you need the reply in a particular language or format.
Communication Channels and Address
Send your DSAR by email to our dedicated Data Protection Officer at dataprotection@sankra.no. As an option, you can mail a signed written request to Sankra Casino’s registered address in Norway. I advise using email for speed and security. All incoming DSARs are logged and acknowledged within two business days.
Identity Authentication and Safety
Why I Have to Authenticate Your Identity
Before sharing any personal data, I must be confident I am communicating with the actual data subject. This safeguard prevents illegal access and identity fraud. GDPR requires me to take reasonable steps to verify your identity, notably when sensitive information is involved. I therefore ask for supporting documents, but I manage them securely and erase the verification data as soon as the process completes.
Approved Documents for Verification
You can verify your identity by sending a clear copy of a valid passport, national ID card, or driving licence. If your account details have changed, I may also require a recent utility bill showing your registered address. Please remove unnecessary sensitive information such as passport numbers. I only require the photograph and full name for verification. Digital copies sent through encrypted email are ideal.
Response Timelines and Potential Restrictions
Under GDPR, I am required to answer your DSAR without unnecessary delay, and at the latest within 30 days of getting the verified request. If your request is complex or you file multiple requests, I may lengthen this period by up to two further months. I will inform you of any delay within the first month, together with the reasons for the delay, so you are always kept informed.
Restricted circumstances may hinder full release, for example if sharing the data would violate others’ rights or disclose confidential business data. In such cases I censor or refuse the affected portion. I offer the first response at no cost, but if you make manifestly unfounded or unreasonable requests, I may charge a fee or choose not to act, always clarifying the reason and your right to complain to the Datatilsynet.
Frequently Asked Questions
Can I request data about another person, such as a relative?
Information is released solely to the person it relates to. To safeguard privacy, I cannot provide details about another person, including a relative. Should you possess legal authority such as a power of attorney, please submit that paperwork. Otherwise the third party must submit their own DSAR.
What should I do if I lost my registered email address?
If you misplaced your email, reach out to support providing your full name, date of birth, and registered mailing address or phone number. I am able to authenticate en.wikipedia.org your identity and restore account information, then handle the DSAR. This may add a few days, but I will keep you informed.
What is the data retention period after I close my account?
Personal data is kept for the duration mandated by Norwegian anti-money laundering regulations, usually five years following closure. Following the retention period, data is safely erased unless a longer duration is required by law or necessary for legal proceedings. Detailed retention periods appear in my privacy notice.
May I receive a copy of information from my terminated account?
Yes. Your right to access persists even after your Sankra Casino account is closed. A DSAR can be submitted for the data I continue to keep. The procedure is identical: supply identification and indicate the details you require. The archived data will be retrieved and provided within the same legal deadline.
What should I do if the response does not meet my expectations?
If you feel I have not fulfilled my obligations, reach out for an explanation. The issue will be reviewed and an additional response will be given. You also have the right to complain to the Data Protection Authority. They will independently investigate whether I met my obligations.
Will filing a DSAR impact my account standing?
No, it does not. Asserting your data protection rights carries no negative consequences for your account. I process access requests without bias and will not limit your account, end services, or modify loyalty perks due to your data request. Clarity is key, and I encourage you to make use of your entitlements.