Ask a compliance officer at an ADM-licensed casino what happens when a player invokes the right to be forgotten, and the answer is rarely a clean deletion. It is a negotiation between two legal regimes that pull in opposite directions: the GDPR, which rewards data minimisation and erasure, and Italy’s anti-money-laundering framework, which demands that identification and transaction records survive for a decade. The tension is built into the licence. Any operator offering a codice promozionale Netwin or running a Netwin bonus benvenuto campaign is collecting personal data at the very moment of registrazione, and from that point the same record serves two masters: the conto gioco and the AML file.
The entities involved make the split concrete. Netwin is operated by Netwin Italia S.p.A. Società Unipersonale, holds ADM GAD concession number 16035, and belongs to RB Holding, headquartered in Sant’Agata sul Sant’Il Senio… correction: Sant’Agata sul Santerno. A player who activates a Netwin promo code such as WELCOME2026, with its 100% first deposit match up to 500 euros on a minimum deposit of 20 euros and a 45x requisito di puntata to be cleared within 3 days, generates a trail of data: identity documents, payment records, bonus ledger entries, wagering progress. Some of that trail is deletable on request. Some of it is not, and no privacy notice can change that.
This deep-dive walks through the retention boundary line by line. It covers what ADM and EU AML rules require operators to keep for up to 10 years, which categories of data fall outside the erasure right, and how marketing consent, including sign-ups tied to a codice promo Netwin or any codice bonus, must be layered separately from the AML record so that a prelievo request or an erasure request does not collide with a saldo audit. The goal is practical: a retention schedule that satisfies both regulators at once.
The Dual Regulatory Framework: ADM Licensing and GDPR Obligations for Italian Gambling Operators
An Italian online casino operates under two rulebooks at the same time. The first comes from the Agenzia delle Dogane e dei Monopoli (ADM), which grants the concession and imposes anti-money-laundering and responsible-gambling duties. The second comes from the GDPR, which gives players rights over their personal data. Neither rulebook cancels the other, and the operators who get into trouble are usually the ones who treated them as separate projects run by separate teams.
Take a licensed brand as a working example. Netwin is operated by Netwin Italia S.p.A. Società Unipersonale and holds ADM GAD concession number 16035. That concession number is not decorative: it ties the operator to Italian AML rules, including the requirement to identify customers and keep records for up to ten years. The same company belongs to RB Holding, headquartered in Sant’Agata sul Santerno, so group-level data flows add another layer of documentation. A player who asks to be forgotten is asking a concession holder, not an anonymous website.
Why the two regimes overlap rather than compete
The GDPR does not override AML law. Article 17(3)(b) of the Regulation carves out processing that is necessary for compliance with a legal obligation, and Italy’s AML decree (D.Lgs. 231/2007, as amended by D.Lgs. 90/2017) is exactly that kind of obligation. So when an operator keeps a copy of a player’s identity document, tax code, and deposit history, it is not hoarding data for marketing convenience. It is executing a duty imposed by the state that licensed it.
This is where the practical confusion starts. A player registers, verifies identity, maybe enters a codice promozionale Netwin to claim a welcome offer, and later sends an erasure request. The operator now has to split the file. The KYC pack and transaction ledger stay. The marketing profile, the bonus-preference notes, the newsletter flag, and the promo-code redemption history used for targeting can go. Same customer, same database, two different legal bases and two different retention clocks.
Privacy notices should say this plainly. A generic line about “keeping data as long as necessary” is not enough when the actual answer is “ten years for AML records, until consent withdrawal for marketing.” The Garante per la protezione dei dati personali has repeatedly stressed that retention periods must be specific and justified, and an ADM concession holder has a very specific justification available. Use it in the notice, in the registration flow, and in the response to any access or erasure request.
There is also a governance point. The concession holder is the data controller for AML purposes, and that responsibility cannot be outsourced to a platform provider or an affiliate network. If a white-label partner handles registration, the contract must state who keeps the identification records, where they sit, and how a player’s GDPR request is routed to the entity that actually holds the file. Auditors ask this question, and so do data protection authorities when a complaint arrives.
One more distinction matters for the sections that follow. Consent is a lawful basis for marketing, not for AML retention. An operator cannot ask a player to “consent” to ten-year record keeping, because the retention is mandatory, not optional. Mixing the two in a single checkbox is a compliance defect that surfaces quickly during an inspection or a GDPR complaint. Keep the mandatory notice and the optional consent visually and legally separate, and the rest of the retention architecture becomes far easier to defend.
AML Retention Duties: Why KYC and Transaction Records Must Be Kept for Up to 10 Years
What ADM-Licensed Operators Must Retain and for How Long
Italian AML rules sit on top of the EU framework, principally Directive 2015/849 as amended by 2018/843, transposed into the Italian system through Legislative Decree 90/2017 and the Bank of Italy’s implementing provisions for gaming. For an ADM-licensed operator such as Netwin, which holds GAD concession number 16035 and is operated by Netwin Italia S.p.A. Società Unipersonale, the practical effect is a flat 10-year retention clock on identification and transaction records. The clock starts from the end of the business relationship or from the date of the occasional transaction, not from the date of registration.
What gets stored is broader than most players assume. Operators keep the identity document used at registration, proof of address, tax code, the outcome of the identity verification check, PEP and sanctions screening results, and the risk classification assigned to the account. On the transaction side, deposits, withdrawals, bets, bonus credits and balance movements are all logged with timestamps. Records of suspicious activity reports filed with the UIF, and the internal analysis behind them, follow the same 10-year rule but are held under stricter access controls.
The retention duty is not discretionary. Article 32 of Decree 90/2017 obliges intermediaries, including concessionaires, to preserve records for 10 years after the relationship ends, and the ADM concession agreement adds its own archival requirements. Deleting early is itself a compliance breach, which is why a privacy request that collides with an AML record ends in refusal rather than in a deletion.
How the 10-Year Rule Interacts with Player-Facing Processes
The retention obligation shapes what happens at every stage of the account lifecycle. During registrazione, the operator cannot open a conto gioco until identity is verified, so the KYC file exists before the first deposit. When a player claims a Netwin bonus benvenuto or enters a codice promozionale Netwin, the bonus itself, the wagering progress against the requisito di puntata and the resulting saldo adjustments become transaction data. They are retained for 10 years like any other movement, even though the promotional campaign may be long finished.
Withdrawals are the point where retention becomes visible to the player. A prelievo triggers a re-check of identity, and the operator must be able to reconstruct the full transaction chain from first deposit to payout. If a player closed the account five years earlier and now requests erasure, the KYC file and transaction ledger stay put. Only data that has no AML, tax or accounting purpose, such as marketing preferences or browsing analytics tied to a codice sconto campaign, falls outside the 10-year shield.
Two trade-offs are worth flagging. First, retention must be proportionate: keeping records for 10 years does not license keeping everything for 10 years, and data with no AML relevance should follow its own shorter schedule. Second, access must be restricted. Under GDPR Article 32 and the Bank of Italy provisions, AML archives need role-based permissions, audit logs and encryption, because a 10-year store of identity documents is a high-value target. Operators that treat retention as a storage problem rather than a security obligation tend to fail their next ADM inspection for reasons unrelated to the records themselves.
GDPR Erasure Requests vs AML Retention: What Can and Cannot Be Deleted
A player writes to support asking to be forgotten. The request lands in a queue that most operators handle through a privacy workflow, not the AML one. That separation is where mistakes happen. Under GDPR Article 17, erasure is a right, but it is not absolute. Article 17(3)(b) carves out processing necessary for compliance with a legal obligation. Italian anti-money-laundering rules, anchored in Legislative Decree 231/2007 and the Bank of Italy’s implementing provisions, oblige ADM-licensed operators to keep identification and transaction records for 10 years from the end of the relationship. When the two regimes collide, the AML obligation wins for the specific records it covers. Everything else stays fair game for deletion.
The legal basis distinction is what settles the argument. AML retention rests on Article 6(1)(c) GDPR, compliance with a legal obligation, and the obligation is specific, prescribed by law, and auditable. Marketing processing rests on consent under Article 6(1)(a), which the data subject can withdraw at any time. Once consent is withdrawn, there is no legal basis left to hold newsletter subscriptions, SMS opt-ins, or profiling segments built for promotional targeting. An operator that keeps a lapsed marketing list alive because “we might need it” is exposed to a Garante sanction and has no AML defence to invoke.
In practice, the split looks like this:
- Deletable on request: marketing consent records after withdrawal, newsletter and SMS contact data, promotional profiling and segmentation, bonus-preference data used only for targeting, website analytics tied to an identified user, and customer-service chat logs that contain no KYC or transaction content.
- Retained under AML obligation: identity documents, selfie and liveness checks, tax code and residence verification, proof of address, PEP and sanctions screening results, deposit and withdrawal records, game transaction logs, and the source-of-funds declarations collected above threshold.
- Retained but restricted: records that mix both purposes, such as an account history showing that a player claimed a Netwin welcome bonus. The financial fact stays; the marketing overlay (which campaign message was sent, which channel, which consent flag) can be stripped or anonymised.
- Retained for a different statutory reason: gambling account and balance data required by ADM reporting duties, and dispute records kept for the ordinary limitation period.
The mixed-record category is the one that generates complaints. A common scenario: a player registers, claims a codice promozionale Netwin, deposits, loses, then asks for full erasure including the bonus history. The operator can delete the marketing profile and stop all promotional contact, but the deposit, the wagering, and the identity verification stay in the AML archive until the 10-year clock expires. Telling the player “we deleted everything” in that case is inaccurate and, if it appears in a written response, becomes evidence against the operator. The correct reply names the retention obligation, cites the legal basis, and confirms what was actually removed.
Two operational points matter. First, erasure must be executed across backups and downstream systems within the periods set by the retention policy, not just in the primary CRM. Second, the right to restriction under Article 18 runs in parallel: a player disputing accuracy of KYC data can have processing restricted while the AML record itself remains intact. Documenting both the refusal ground and the scope of partial deletion is what separates a defensible file from a fine.
Practical Compliance for Operators and Players: Consent Layers, Promotional Data, and Retention Policies
Compliance only works when it is built into the flow of the account, not bolted on afterwards. The operators that stay out of trouble are the ones that treat consent as a set of separate layers, each with its own legal basis, its own retention clock, and its own deletion path. A player who types a codice promozionale Netwin into the registration form is doing two distinct things at once: opening a gaming relationship that triggers ADM and AML duties, and opting into marketing communications that fall squarely under the GDPR. Those two events must be captured separately in the database, even if they happen on the same screen.
In practice this means the registration form should carry a mandatory acknowledgement of the privacy notice and the AML identification duties, plus an optional, unticked marketing checkbox. Bonus sign-ups are the classic weak point. When a player enters a Netwin promo code or claims a Netwin welcome bonus, the platform records the code, the timestamp, the device, and the IP. Some of that is AML-relevant (proof the account was opened and funded by the declared person), and some is purely promotional. Tag each field at the point of capture with its purpose, so a later erasure request can be answered field by field instead of record by record.
A workable retention schedule for an ADM-licensed operator looks roughly like this:
- Identity and KYC documents (ID scans, selfies, address proof): 10 years from the end of the customer relationship, retained under AML obligations and not subject to erasure.
- Transaction and deposit records, including the first deposit that activated a Netwin bonus benvenuto: 10 years, same basis.
- Wagering and bonus history tied to the promotional code: keep for the contractual limitation period (typically 2 to 5 years) for dispute handling, then delete or anonymise.
- Marketing consent records, including the exact wording accepted and the timestamp: keep for the duration of consent plus the period needed to prove consent was given, then delete.
- Analytics and profiling data: pseudonymise after 12 to 24 months and delete when the purpose lapses.
The privacy notice must mirror this schedule in plain language. Vague statements like “we keep your data as long as necessary” fail both the GDPR accountability test and the ADM’s expectations. Name the categories, give the retention periods, and state explicitly that AML records survive an erasure request while marketing data does not. The same logic applies to the terms and conditions attached to a voucher or promo code: the bonus rules describe wagering requirements on the saldo, and the privacy notice describes what happens to the data created while wagering. Keep them in separate documents so players are not asked to consent to AML processing as a condition of a promotion.
For players, the practical checks are simple. Before depositing, read which entity operates the site and confirm the ADM concession number, because that tells you which retention regime applies. If you want your marketing data removed, ask specifically for the promotional profile to be deleted, not the whole account. Closing the conto gioco does not erase KYC records, and a request framed that way will be refused, correctly. Ask instead for withdrawal of consent to marketing and for deletion of profiling data, and keep the reply. Operators, for their part, should log every such request, the decision, and the legal basis relied on. That log is the single most useful document in an inspection, and it costs almost nothing to maintain.
If you run an ADM-licensed operation, the practical next step is a data map. List every field you collect at registrazione and primo deposito, tag each one with a legal basis (AML obligation, contract, marketing consent), and set a retention clock per tag. KYC documents and transaction logs tied to the conto gioco go on the 10-year schedule; promotional data tied to a codice promozionale Netwin or a Netwin welcome bonus sign-up does not need to sit there for a decade. Once the map exists, your privacy notice can state it plainly: what is kept, why, and for how long. That single document will answer most erasure requests before they become complaints.
For players, the takeaway is simpler. A GDPR erasure request will not remove the identity checks and deposit records the operator must hold for AML purposes, and it should not, because those records are what keep the platform inside its ADM GAD concession number 16035. What you can control is the marketing layer: withdraw consent for bonus and voucher communications, and that data becomes deletable. Check the termini e condizioni of any Netwin promo code or codice promo Netwin before you opt in, note the requisito di puntata and the window to clear it, and keep your own copy of deposit statements. If a prelievo is delayed, the retention trail is your evidence. Set a calendar reminder to review your consents every six months. Ten years is a long time to have data sitting somewhere you forgot about.