Privacy Policy

Last updated: 12 November 2025

This privacy policy applies to:

• Our website: https://bonusandspins.com
• Our mobile application: Bonus & Spins (iOS)

Mobile app users should also read Section XI: Mobile Application Privacy Addendum.

Olikaone Limited Privacy Policy

Introduction

Welcome to the Olikaone Limited’s privacy policy.

Olikaone Limited respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

I. Important information and who we are

Purpose of this privacy policy

This privacy policy aims to give you information on how Olikaone Limited collects and processes your personal data through your use of this website, including any data you may provide through this website when you sign up bonusandspins.com.

This website is not intended for any person under the age of 18 years old and we do not knowingly collect data relating to underage persons.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Controller

Olikaone Limited is the controller and responsible for your personal data (collectively referred to as "Olikaone Ltd", the “Company”, "we", "us" or "our" in this privacy policy).

Olikoane Limited is a group of companies with a subsidiary in the United States of America (Olikaone Incorporation). This privacy policy is issued on behalf of the Olikoane Group so when we mention “Olikaone’, "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the Olikaone Group responsible for processing your data.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact us in the following ways:

Full name of legal entity: Olikaone Limited

Email address: [email protected]

Postal address: Unit 310 Screenworks 22 Highbury Grove, London, N5 2ER

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated on 16/02/2023. Historic versions can be obtained by contacting us using the contact details set above.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

II. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, username or similar identifier.
• Contact Data includes email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data includes your username and password, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Other information.  You may choose to provide other information directly to us or we might require other information from you.  For example, we may collect other information when we handle a complaint submitted by you.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

III How is your personal data collected?

Olikaone will collect information directly from you when you use our services or visit our websites. 

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity or Contact Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you:
  • apply for our services;
  • create an account on our website;
  • subscribe to our service or publications;
  • request marketing to be sent to you; or
  • give us feedback or contact us.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.
• Third parties or publicly available sources. We will receive personal data about you from various third parties as set out below

(a)       analytics providers such as Google based outside the UK; and

(b)       advertising networks such as Google, Microsoft Bing and Facebook based inside and outside of the UK; and

(c) search information providers based or inside outside the UK.

• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the UK.
  

IV. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• When contacting you in regards to a vacancy position or a question you may ask us using our contact form.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Visit the Glossary section, lawful basis, below to find out more about the types of lawful basis that we will rely on to process your personal data.

Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us and you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by checking or unchecking relevant boxes to adjust your marketing preferences.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service experience or other transactions.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see the Cookie Policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

V. Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table Purposes for which we will use your personal data above.

• Internal Third Parties as set out in the Glossary.
• External Third Parties as set out in the Glossary.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

VI. International transfers

We share your personal data within the Olikaone Group. This will involve transferring your data outside the UK.

Many of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it. This is because we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

VII. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

VIII. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see your legal rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

IX. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of the rights set out below, please contact us at [email protected].

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us at [email protected].

XI.MOBILE APPLICATION PRIVACY

Introduction to Mobile App Data Collection

This section provides additional information about data collection and processing when you use the Bonus & Spins mobile application (the "App"), available on iOS devices via the Apple App Store. This addendum should be read in conjunction with our main Privacy Policy above.

The App is operated by Olikaone Limited and is subject to the same data protection principles, security measures, and your legal rights as described in the main Privacy Policy. Where mobile-specific practices differ from or supplement our website practices, they are explained below.

Overview of App Features and Associated Data Collection

The Bonus & Spins App provides three distinct features, each with specific data collection requirements:

1. Play Slots - Social casino games using Game Coins (virtual currency with no real-world value)
2. Play for Real - Casino offer comparison service with Reward Points program (redeemable for Amazon eGift Cards)
3. Lucky Wheel - Daily prize feature

Data collection varies depending on which features you use. This privacy addendum explains what data we collect for each feature and how we use it.

Overview of App Features and Associated Data Collection

The Bonus & Spins App provides three distinct features, each with specific data collection requirements:

1. Play Slots - Social casino games using Game Coins (virtual currency with no real-world value)
2. Play for Real - Casino offer comparison service with Reward Points program (redeemable for Amazon eGift Cards)
3. Lucky Wheel - Daily prize feature

Data collection varies depending on which features you use. This privacy addendum explains what data we collect for each feature and how we use it.

Additional Data We Collect Through the Mobile App

When you download, install, and use the Bonus & Spins mobile app, we collect the following additional data types beyond what is collected on our website:

App-Specific Technical Data

• Device Information: Device model, operating system version (iOS version), unique device identifiers
• App Version: The version of the Bonus & Spins app you have installed
• Mobile Network Information: Mobile carrier name, connection type (WiFi, cellular)
• App Installation Data: Date and time of app installation, installation source (App Store)
• Session Data: App launch times, session duration, feature usage within the app
• Screen Resolution: Display specifications for optimal game rendering

Account and Profile Data

• Registration Information: Name, email address, date of birth (for age verification)
• Phone Number: If provided for phone validation to earn Reward Points
• Account Preferences: Notification settings, favourite offers, preferred game settings
• Profile Completion Status: Whether you have validated email, phone, or completed your profile
• Account Creation Date: When your account was registered
• Last Login Date: Most recent app access timestamp

Play Slots Section - Game Data

• Game Coins Balance: Current balance of Game Coins in your account
• Game Coins Transactions: History of Game Coins earned, spent, and purchased
• Gameplay Data:
  • Games played and session duration
  • Spins completed and outcomes
  • Bet amounts and win/loss records
  • Game preferences and settings
• Level Progression Data:
  • Current level (1-100)
  • Game Coins spent toward next level
  • Level-up history and dates
  • Rewards earned from levelling
• Daily Coins Claims: Record of when daily bonuses were claimed
• Game Performance Metrics: Win rates, play patterns, session frequency

Play for Real Section - Casino Interaction Data

• Casino Offer Views: Which casino offers you viewed, clicked, or bookmarked
• Casino Partner Referrals: When you clicked through to a casino partner website
• Referral Tracking Codes: Unique identifiers to track your referrals to casino partners
• Casino Registration Data:
  • Confirmation that you registered at a casino via our App
  • Date and time of registration
  • Casino partner name
  • Registration status (completed, pending verification)
• Deposit Verification Data (see detailed section below)

Reward Points Data

• Reward Points Balance: Current total of Reward Points in your account
• Reward Points Transaction History:
  • Points earned and the action that earned them
  • Date and time of each reward
  • Point expiration dates
  • Points redeemed and redemption dates
• Redemption History:
  • Amazon eGift Cards requested
  • Redemption amounts and dates
  • Delivery status and tracking
  • Email address used for eGift Card delivery
• Reward Points Eligibility:
  • Email validation status and date
  • Phone validation status and date
  • Profile completion status
  • Referral activity

Lucky Wheel Data

• Spin History: Dates and times of wheel spins
• Prizes Won: Record of prizes won from the Lucky Wheel
• Spin Eligibility: When your next spin becomes available
• Prize Claims: Whether prizes were claimed and when

Push Notification Data

• Push Notification Tokens: Device-specific tokens required to send you push notifications
• Notification Preferences: Your settings regarding which types of notifications you wish to receive
• Notification Interaction Data: Whether you opened, dismissed, or interacted with push notifications
• Notification Frequency Settings: Your chosen frequency for different notification types

In-App Purchase Data

• Virtual Currency Transactions: Records of Game Coins purchased through Apple's In-App Purchase system
• Purchase History: Dates, amounts, and types of in-app purchases made
• Purchase Identifiers: Apple-provided transaction identifiers for purchase verification
• Payment Method Type: General type (not specific details) provided by Apple
• Refund Requests: If you requested refunds through Apple

Location Data (Approximate)

• Country/Region: Derived from device settings or IP address to ensure we display appropriate, region-specific casino offers
• Note: We do NOT collect precise location data (GPS coordinates). We only collect approximate location at country/region level for compliance and offer relevance.

App Performance & Diagnostics

• Crash Reports: Automatically generated reports when the app crashes or experiences errors
• Performance Metrics: App loading times, response times, memory usage, frame rates
• Error Logs: Technical logs of errors encountered during app use
• Bug Reports: Information you provide when reporting issues

Casino Deposit Verification - Detailed Explanation

The Reward Points program requires verification of casino deposits to award points. This section explains exactly what data we collect and how we use it.

What is Deposit Verification?

When you click on a casino offer in the Play for Real section and subsequently register and make a deposit at that casino, we need to verify that the deposit occurred to award you Reward Points. This is a critical part of our affiliate relationship with casino partners.

What Deposit Data We Collect

We collect the following information from casino partners or through tracking mechanisms:

Referral Tracking:

• Unique Referral ID: A code that identifies you clicked through our App
• Casino Partner Name: Which casino you registered with
• Registration Date/Time: When you created your casino account
• Referral Link Used: Which specific offer or link you clicked

Deposit Verification Information:

• Deposit Confirmation: Yes/no confirmation that a qualifying deposit was made
• Deposit Date: The date the deposit occurred
• Approximate Deposit Amount: General range (e.g., £10-£50, £50-£100) to confirm it meets minimum requirements
• Deposit Method Type: General category (e.g., card payment, e-wallet) without specific payment details
• First Deposit Indicator: Whether this was your first deposit at this casino
• Deposit Eligibility: Whether the deposit qualifies for Reward Points based on offer terms

What We DO NOT Collect:

• We do NOT receive your full payment card numbers
• We do NOT receive your banking information
• We do NOT receive your casino account password
• We do NOT receive exact deposit amounts in most cases
• We do NOT receive your identity documents submitted to the casino
• We do NOT receive your casino balance or withdrawal information
• We do NOT have access to your gameplay at the casino

How Deposit Verification Works

1. You Click Through: When you click on a casino offer in our App, we generate a unique tracking code
2. Casino Registration: You register at the casino partner website (outside our App)
3. Deposit Made: You make a deposit at the casino
4. Casino Reports Back: The casino partner sends us confirmation data (usually within 30 days)
5. Verification Process: We verify the data meets Reward Points eligibility criteria
6. Points Awarded: If eligible, Reward Points are credited to your account

Why We Collect This Data

We collect deposit verification data for the following purposes:

Data Sources for Deposit Verification

We receive deposit verification data from:

• Casino Partner Systems: Direct API integration or manual reporting from casino operators
• Affiliate Network Platforms: Third-party affiliate tracking systems (e.g., Income Access, NetRefer)
• Tracking Pixels: Web tracking technology on casino partner websites
• Postback URLs: Automated notifications from casino partners to our servers

How Long We Retain Deposit Data

We retain deposit verification data as follows:

Your Rights Regarding Deposit Data

You have the right to:

• Access: Request a copy of all deposit verification data we hold about you
• Correction: Dispute inaccurate deposit records
• Deletion: Request deletion of deposit data (subject to legal retention requirements)
• Object: Object to processing of deposit data for marketing purposes

To exercise these rights, email [email protected]

We share deposit verification data with:

• Fraud Prevention Services: To detect multiple accounts or fraudulent activity
• Tax Authorities: If legally required for tax reporting
• Legal Authorities: If compelled by court order
• Our Accountants: For financial record-keeping

We do NOT sell deposit verification data to third parties.

We collect and store comprehensive data about your Reward Points:

Points Earned:

• Action type (email validation, casino registration, deposit, etc.)
• Points amount
• Date and time earned
• Source (which casino or action triggered the reward)
• Verification status (pending, confirmed, expired)
• Expiration date (12 months from earning date)

Points Redeemed:

• Redemption request date and time
• Amazon eGift Card value requested
• Points spent
• Redemption status (pending, processing, completed, failed)
• Delivery email address
• Delivery confirmation and date

When you redeem Reward Points for Amazon eGift Cards:

What We Collect:

• Your chosen eGift Card denomination (£10, £20, £50, or £100)
• Reward Points balance before and after redemption
• Email address for eGift Card delivery
• Redemption request timestamp
• IP address from which redemption was requested (fraud prevention)

What Happens Next:

1. We verify you have sufficient Reward Points
2. We process the redemption request (usually within 7 business days)
3. We purchase the Amazon eGift Card from Amazon or an authorized reseller
4. We deliver the eGift Card code to your specified email address
5. We store confirmation of delivery

Data Shared with Amazon:

• Email address for eGift Card delivery
• Approximate location (country) for compliance
• We do NOT share your name, phone number, or other personal details with Amazon unless required

Amazon's Privacy Policy: Once the eGift Card is delivered, Amazon's Privacy Policy governs any further use of the card. We are not responsible for Amazon's data practices.

To prevent fraud and abuse of the Reward Points system, we collect additional data:

• Account Age: How long your account has been active
• Redemption Pattern: Frequency and timing of redemptions
• IP Address History: To detect multiple accounts or suspicious activity
• Device Fingerprinting: To identify device-based fraud patterns
• Casino Deposit Verification Status: Confirming deposits are legitimate
• Email/Phone Validation Status: Confirming contact information is real

If we detect suspicious activity:

• Redemptions may be delayed for investigation (up to 30 days)
• We may request additional verification (ID documents, proof of deposit)
• Accounts may be suspended or terminated
• Reward Points may be forfeited

When you play slot games in the Play Slots section:

We Collect:

• Game Session Data: Start time, end time, duration
• Spins Made: Number of spins, bet amounts, outcomes (win/loss)
• Game Coins Wagered: Total Game Coins spent per session
• Game Coins Won: Game Coins won during gameplay
• Game Preferences: Bet levels, auto-spin settings, sound preferences
• Game Performance: Win rates, bonus feature triggers, jackpot hits
• Session Frequency: How often you play, time of day patterns

Why We Collect This:

• Game Improvement: Understand which games are popular and how to improve them
• Level Progression: Calculate your level advancement
• Personalisation: Recommend games you might enjoy
• Fair Play Monitoring: Detect unusual patterns that might indicate bugs or exploitation
• Analytics: Understand player engagement and retention

The levelling system tracks your progress from Level 1 to Level 100:

We Collect:

• Current level
• Game Coins spent toward next level
• Date and time of level-ups
• Rewards claimed from levelling (Game Coins and Reward Points)
• Level-up history

This data is stored permanently as part of your account history and is used to display your achievements and track rewards earned.

We track all Game Coins activity:

Incoming Game Coins:

• Daily Coin claims (500-7,000 based on consecutive days)
• Purchase history (amount purchased, date, price paid)
• Level-up rewards
• Lucky Wheel prizes
• Any promotional bonuses

Outgoing Game Coins:

• Game Coins spent on slot gameplay
• Balance adjustments (refunds, corrections)

Purpose:

• Maintain accurate balance
• Process purchases through Apple
• Award rewards accurately
• Prevent fraud (e.g., manipulation of balances)
• Tax reporting (purchases are taxable transactions)

We track your Daily Coins claiming pattern:

• Consecutive days claimed (Day 1 through Day 7)
• Last claim date and time
• Next eligibility time (24-hour timer)
• Streak breaks and restarts

This ensures you receive the correct daily bonus and prevents abuse of the system.

The Lucky Wheel feature collects specific data:

We Collect:

• Spin History: Date and time of each spin
• Prizes Won: What you won on each spin (Game Coins, Reward Points, extra spin, or no prize)
• Prize Claims: Confirmation that prizes were credited to your account
• Eligibility Tracking: When your next spin becomes available (24-hour timer)
• Random Number Results: The RNG outcome for each spin (for fairness verification)

Why We Collect This:

• Fair Play: Ensure random outcomes are truly random
• Eligibility Enforcement: Prevent multiple spins within 24 hours
• Prize Distribution: Credit correct prizes to your account
• Analytics: Understand engagement with the feature
• Auditing: Verify prize distribution matches intended probabilities

Data Retention: Lucky Wheel data is retained for:

• Active account period for eligibility tracking
• 6 years for prize distribution records (tax compliance)
• Permanent storage of RNG outcomes (fairness auditing)

We use the mobile app data described above for the following purposes:

Push notifications are messages we send directly to your mobile device to alert you about:

Play Slots Related:

• Daily Coins available to claim
• Level-up achievements and rewards
• New slot games available
• Special Game Coins promotions

Play for Real Related:

• New casino offers matching your preferences
• Exclusive app-only deals
• Time-sensitive bonuses expiring soon
• Reward Points milestones reached
• Casino deposit verification status
• Amazon eGift Card delivery confirmations

Lucky Wheel Related:

• Lucky Wheel spin available
• Special prize opportunities

General:

• Important app updates
• Terms and conditions changes
• Account security alerts
• Opt-In Required: We will ask for your permission before sending push notifications when you first use the app
• Easy to Disable: You can disable push notifications at any time through:
  • iOS Settings → Notifications → Bonus & Spins → Toggle off "Allow Notifications"
  • Within the app: Settings → Notifications → Adjust preferences
• Granular Control: You can choose which types of notifications to receive (e.g., offers only, not game updates)
• If you disable notifications, we will no longer send alerts, but we retain your push token for 90 days in case you re-enable notifications
• After 90 days of disabled notifications, we delete your push notification token
• Notification preference data is linked to your account and used to personalise your experience
• We track notification interactions (opened, dismissed) to improve relevance

The App offers Game Coins which can be purchased using real money through Apple's In-App Purchase system.

• Apple Handles Payments: All payment transactions are processed by Apple Inc. through their In-App Purchase system
• We Don't See Payment Details: We do NOT receive, store, or have access to your credit card, debit card, or other payment information
• What We Receive: Apple provides us with:
  • Confirmation that a purchase was completed
  • Transaction identifier (for verification purposes)
  • Purchase amount and date (in euros or local currency)
  • Your Apple ID (in anonymised form)
  • Receipt data (encrypted token for verification)

We use in-app purchase data to:

• Credit your account with the correct amount of Game Coins
• Maintain a record of your transaction history within the app
• Provide customer support if issues arise with purchases
• Analyse purchasing patterns to improve our virtual currency offerings
• Comply with tax and accounting requirements (VAT reporting, financial audits)
• Detect and prevent fraud (e.g., refund abuse, stolen payment methods)

Under UK tax law, we must retain purchase records for 6 years. This includes:

• Date and time of purchase
• Amount paid (in euros or converted to GBP)
• Game Coins quantity purchased
• Transaction ID
• Your user account ID

Refund requests for in-app purchases must be directed to Apple, as they process all payments. We receive notification from Apple if a refund is issued, which allows us to:

• Deduct refunded Game Coins from your balance
• Flag accounts with excessive refunds for fraud review
• Update our financial records

We use analytics services to understand how users interact with our mobile app. This helps us improve functionality, fix issues, and create a better user experience.

Google Analytics for Firebase:

• Tracks app usage, user engagement, and technical performance
• Collects: app opens, screen views, in-app events, device type, OS version, country
• Data is aggregated and used to understand user behaviour patterns
• Privacy Policy: https://policies.google.com/privacy

Apple App Analytics:

• Basic metrics provided by Apple about app downloads and usage
• Collects: app installs, sessions, crashes, opt-in rate
• Data is anonymized by Apple
• Privacy Policy: https://www.apple.com/legal/privacy/

Internal Analytics:

• Our own systems to track feature usage and user preferences
• Collects: which app sections you use, how often, session duration
• Linked to your user ID for personalised experience
• App Usage: Screens viewed and navigation patterns within the app
• Feature Usage: Which sections you use most (Play Slots, Play for Real, Lucky Wheel)
• Gameplay Analytics:
  • Which slot games you play
  • Session length and frequency
  • Bet patterns and preferences
• Offer Interaction:
  • Casino offers you view, click, or bookmark
  • Filters you use
  • Search queries
• Time Spent: Duration in different sections of the app
• Session Frequency: How often you open the app
• Technical Performance: Loading times, errors, crashes
• Aggregated Demographic Data: Country, device type, iOS version
• Conversion Events:
  • Account registration
  • First Game Coins purchase
  • First casino deposit
  • First Reward Points redemption
• Aggregation: Analytics data is aggregated and anonymised where possible
• No Cross-App Tracking: We do NOT use your data to track you across other apps or websites
• No IDFA Collection: We do not collect Apple's Identifier for Advertisers (IDFA)
• Data Minimisation: We only collect analytics necessary for app improvement
• Opt-Out Available: You can limit analytics through iOS Settings → Privacy → Analytics & Improvements
• Real-time analytics: 90 days
• Aggregated reports: 24 months
• Individual event data: 12 months (then anonymised)

We use your app usage data and preferences to display casino offers that may be of interest to you in the Play for Real section. This includes:

• Casino offers matching your preferred game types
• Bonuses in your selected value range
• Promotions from casinos you've previously shown interest in
• Offers that match your gameplay patterns in Play Slots section

This personalisation happens within our App and does not involve sharing your data with casino partners until you click on an offer.

We work with the following advertising partners who may collect data through the app:

Google Ads:

• For performance measurement and optimisation
• Collects: app events, installs attributed to ads, conversion events
• Does NOT collect IDFA
• Privacy Policy: https://policies.google.com/privacy

Facebook Ads (Meta):

• For performance measurement (if you arrived at our app via a Facebook ad)
• Collects: app installs, in-app events
• Does NOT collect IDFA
• Privacy Policy: https://www.facebook.com/privacy/explanation

Microsoft Advertising:

• For performance measurement and optimisation
• Collects: app events, conversion tracking
• Privacy Policy: https://privacy.microsoft.com/
• Aggregated, anonymised usage data
• Information about which offers you viewed or clicked (not linked to your identity)
• General device and app information (device type, OS version, country)
• Conversion events (app install, registration, first purchase) - without personal identifiers
• We do NOT sell your personal data to advertisers
• We do NOT share your email, name, or contact information with casino partners without your consent
• We do NOT use your data to track you across other apps (no cross-app tracking)
• We do NOT collect Apple's IDFA for targeted advertising
• We do NOT share your gameplay data or Reward Points balance with advertisers

When you click on a casino offer in the Play for Real section:

• We share a unique referral code with the casino partner (not your personal data)
• If you register and deposit, the casino confirms this back to us for Reward Points
• We may receive affiliate commission from the casino
• This tracking is necessary for the Reward Points program to function

The Bonus & Spins app is distributed through Apple's App Store and integrates with various iOS features. Apple has its own privacy practices that govern:

• App Store downloads and updates
• In-App Purchase processing
• iCloud backups (if you enable app data backup)
• Apple ID authentication
• iOS system-level features (notifications, permissions)

Please refer to Apple's Privacy Policy at www.apple.com/legal/privacy for information about Apple's data practices.

The app may request the following iOS permissions:

You can review and change permissions at any time through iOS Settings → Bonus & Spins.

iCloud Backup

If you have iCloud Backup enabled on your device:

• Some app data may be backed up to your iCloud account
• This includes: app preferences, saved favourites, but NOT Game Coins or Reward Points balances
• Balances are stored on our servers, not in iCloud
• You can disable app data backup in iOS Settings → [Your Name] → iCloud → Manage Storage → Backups

Data Retention for Mobile App Data

In addition to the retention periods described in the main Privacy Policy, mobile-specific data is retained as follows:

When you delete the app or close your account, we delete or anonymise your mobile app data in accordance with the timelines above, except where retention is required by law (tax, accounting, legal compliance).

All rights described in Section IX of our main Privacy Policy apply to data collected through the mobile app, including:

• Right to Access: Request a copy of all data we hold about your app usage, including Game Coins history, Reward Points records, deposit verification data, and gameplay statistics
• Right to Deletion: Request deletion of your account and associated app data (subject to legal retention requirements for financial records)
• Right to Portability: Receive your data in a machine-readable format (CSV or JSON)
• Right to Object: Object to processing of your data for direct marketing
• Right to Restrict: Request we limit processing of your data
• Right to Withdraw Consent: Withdraw consent for push notifications or data processing based on consent

Within the App:

1. Go to Settings → Privacy
2. Select "Request My Data" to receive a copy of your data
3. Select "Delete My Account" to permanently delete your account
4. Follow the prompts

Via Email: Contact our Data Privacy Manager at [email protected]

When requesting data, please specify:

• Your account email address
• User ID (if known)
• What data you want (e.g., "All Reward Points transactions" or "All deposit verification records")

Account Deletion: To permanently delete your account and all associated app data:

1. Open the app
2. Go to Settings → Account
3. Select "Delete My Account"
4. Confirm deletion

Important Notes:

• Account deletion is permanent and cannot be undone
• All Game Coins will be lost (no refund)
• All Reward Points will be forfeited
• Pending Amazon eGift Card redemptions will be cancelled
• Some data must be retained for 6 years for tax/legal compliance even after account deletion
• You can request a final data export before deletion

The Bonus & Spins mobile app is strictly for users aged 18 and over, in compliance with UK gambling regulations and the app's content (social casino games and real-money gambling referrals).

• We do NOT knowingly collect data from anyone under 18 years of age
• The app is rated 18+ on the Apple App Store
• We employ age verification measures during registration (date of birth required)
• If we discover we have inadvertently collected data from a minor, we will delete it immediately and terminate the account

Parents/Guardians: If you believe your child has downloaded our app and created an account, please contact us immediately at [email protected] and we will:

• Immediately terminate the account
• Delete all associated data
• Forfeit any Game Coins or Reward Points
• Cancel any pending Amazon eGift Card redemptions
• Report the matter to relevant authorities if required

We may also report suspected underage gambling to:

• UK Gambling Commission
• Local authorities
• Casino partners (to prevent underage gambling at those sites)

In addition to the security measures described in Section VII of our main Privacy Policy, we implement mobile-specific security practices:

Data in Transit:

• All data transmitted between the app and our servers uses TLS 1.3 encryption
• API calls are encrypted end-to-end
• Push notifications are encrypted by Apple's APNs system

Data at Rest:

• Sensitive data stored on your device is encrypted using iOS data protection features (AES-256)
• Game Coins and Reward Points balances are stored on our secure servers, not on your device
• Login credentials are never stored on your device in plain text

Secure Authentication:

• Passwords are hashed using bcrypt with salt
• Optional biometric authentication (Face ID/Touch ID) uses iOS Secure Enclave
• Session tokens expire after 30 days of inactivity

Certificate Pinning:

• Prevents man-in-the-middle attacks when communicating with our servers
• App verifies server SSL certificates match expected values

Biometric Authentication:

• Optional Face ID/Touch ID for additional account security
• Biometric data never leaves your device (processed by iOS Secure Enclave)
• Fallback to password if biometric fails

Automatic Logout:

• App logs you out after 30 minutes of inactivity (configurable in settings)
• Sensitive screens require re-authentication

Secure Storage:

• We use iOS Keychain for storing sensitive tokens and credentials
• Keychain data is encrypted and only accessible by our app

Jailbreak Detection:

• The app may detect jailbroken devices
• On jailbroken devices, we may restrict certain features (Game Coins purchases, Reward Points redemption) for security reasons
• This protects against unauthorised modifications that could enable fraud

Fraud Detection:

• Real-time monitoring of suspicious activity patterns
• Multiple account detection using device fingerprinting
• Unusual Reward Points accumulation triggers investigation
• Abnormal gameplay patterns flagged for review
• Keep your iOS version up to date
• Use a strong, unique password for your account
• Enable biometric authentication if available
• Don't share your account credentials with others
• Don't use the app on jailbroken devices
• Enable two-factor authentication on your email account
• Report suspicious activity to [email protected]

If we detect or are notified of a security breach affecting your mobile app data:

1. We will investigate immediately
2. We will notify you within 72 hours if required by law
3. We will notify relevant authorities (ICO, Gambling Commission)
4. We will take steps to prevent future breaches
5. We will provide guidance on protecting your account

In addition to third parties mentioned in our main Privacy Policy, mobile app data may be shared with:

When you click on an offer in the Play for Real section:

• Referral Tracking: Unique code shared to track your registration
• Deposit Verification: Casino confirms deposits back to us for Reward Points
• Data Shared: Referral ID, registration confirmation, deposit confirmation (not full payment details)
• Why: To operate Reward Points program and earn affiliate commission

When you redeem Reward Points:

• Data Shared: Email address for eGift Card delivery, country for compliance
• Why: To deliver Amazon eGift Cards to you
• Amazon's Privacy: Subject to Amazon's privacy policy after delivery

For in-app purchases and app functionality:

• Data Shared: Purchase confirmation, transaction IDs, device information
• Why: To process Game Coins purchases, provide app updates, enable features
• Apple's Privacy: Subject to Apple's privacy policy

For deposit verification and commission tracking:

• Potential Partners: Income Access, NetRefer, or similar affiliate platforms
• Data Shared: Referral codes, deposit confirmations, commission data
• Why: To track casino referrals and receive affiliate payments

As mentioned in the Mobile Analytics section:

• Google Analytics for Firebase
• Apple Analytics
• Data shared is aggregated and anonymised where possible

If fraud is suspected:

• Data Shared: Device IDs, IP addresses, behaviour patterns, account details
• Why: To detect multiple accounts, payment fraud, Reward Points abuse
• Partners: Specialised fraud detection services (e.g., Sift, Forter)

We may share data with:

• UK Gambling Commission: If required for licensing or investigations
• ICO (Information Commissioner's Office): For data protection compliance
• Law Enforcement: If legally compelled by court order
• Tax Authorities (HMRC): For tax reporting and audits

Your mobile app data may be transferred to and processed in countries outside the UK, including:

United States:

• Our subsidiary Olikaone Incorporation is based in the USA
• Some analytics providers (Google, Apple) process data in the USA
• Affiliate networks may be USA-based

European Union:

• Some casino partners are based in Malta, Gibraltar, or other EU jurisdictions
• Some analytics and hosting providers use EU servers

Other Countries:

• Amazon's eGift Card delivery systems may involve international processing
• Apple's global infrastructure processes in-app purchase data internationally

Safeguards: We ensure appropriate safeguards are in place for international transfers:

• Standard Contractual Clauses (SCCs) with service providers
• Adequacy decisions (for countries deemed adequate by UK authorities)
• Binding Corporate Rules for group transfers
• Data Processing Agreements with all processors

Please contact [email protected] if you want further information on the specific mechanisms used when transferring your personal data out of the UK.

As we improve and update the Bonus & Spins mobile app, our data collection practices may change. When we make significant changes to mobile data collection:

1. App Update: We will include details in the "What's New" section of the app update
2. In-App Notification: You may receive a push notification about privacy changes
3. Policy Update: This privacy policy will be updated with a new "last updated" date
4. Consent: Where required by law, we will ask for your renewed consent
5. Email Notification: For material changes, we will email you at your registered address

Recent Changes:

• Addition of Reward Points program and associated data collection
• Implementation of deposit verification system
• Addition of Amazon eGift Card redemption functionality
• Launch of Lucky Wheel feature
• New analytics integrations

We encourage you to review this privacy policy periodically, especially before and after app updates.

If you have questions, concerns, or requests regarding data collection in the Bonus & Spins mobile app:

General Privacy Questions: Email: [email protected]
Subject Line: "Mobile App Privacy Inquiry"

Deposit Verification Questions: Email: [email protected]
Subject Line: "Deposit Verification Inquiry"

Reward Points Data Questions: Email: [email protected]
Subject Line: "Reward Points Data Inquiry"

Data Access/Deletion Requests: Email: [email protected]
Subject Line: "Data Rights Request - Mobile App"

Postal Address:
Olikaone Limited
Data Privacy Manager
Unit 310 Screenworks
22 Highbury Grove
London, N5 2ER
United Kingdom

Response Time: We aim to respond to all mobile app privacy inquiries within 5 business days. Data subject access requests will be processed within 30 days as required by UK GDPR.

• Main Privacy Policy: https://bonusandspins.com/privacy-policy/
• Terms & Conditions (App): https://bonusandspins.com/app-terms-conditions/
• Terms & Conditions (Website): https://bonusandspins.com/terms-condition/
• Responsible Gambling: https://bonusandspins.com/responsible-gambling/
• Cookie Policy: https://bonusandspins.com/cookie-policy/
• Apple Privacy Policy: https://www.apple.com/legal/privacy/
• Amazon Privacy Policy: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201909010
• UK ICO (Data Protection): https://ico.org.uk
• UK Gambling Commission: https://www.gamblingcommission.gov.uk/

Last Updated: 12 November 2025
Applies to: Bonus & Spins iOS Mobile App (all versions)
Company: Olikaone Limited (Company Registration: England & Wales, No. 11466440)

SUMMARY FOR USERS

Quick Overview of Mobile App Data Collection:

What We Collect:

• Your account information (email, name, date of birth, phone if provided)
• Game Coins balance and transaction history
• Gameplay data from Play Slots section (spins, bets, wins, level progression)
• Casino offer interactions from Play for Real section
• Deposit verification data when you register/deposit at casinos via our App
• Reward Points balance and transaction history
• Amazon eGift Card redemption requests and delivery
• Lucky Wheel spin history and prizes
• App usage data (which features you use, how often)
• Push notification permissions and interactions
• In-app purchase history (Game Coins bought)
• Crash reports and performance data (to fix bugs)
• Approximate location (country only - to show relevant offers)

What We DON'T Collect:

• Your full payment card details (Apple handles payments)
• Your casino account passwords
• Precise GPS location
• Your contacts or photos (unless you grant permission)
• Data from other apps you use
• Your identity documents (unless needed for fraud investigation)
• Your exact deposit amounts (only confirmation and approximate range)

Why We Collect This Data:

• To provide all three app features (Play Slots, Play for Real, Lucky Wheel)
• To manage your Game Coins and Reward Points balances accurately
• To verify casino deposits and award Reward Points
• To process Amazon eGift Card redemptions
• To personalise casino offers for you
• To track your level progression and award rewards
• To improve app features and fix bugs
• To prevent fraud and abuse
• To comply with tax and legal requirements

How Your Data is Protected:

• All communications are encrypted (TLS 1.3)
• Sensitive data on device is encrypted
• We don't sell your personal data
• You can delete your account anytime
• You control your notification preferences
• Biometric authentication available for extra security

Your Rights:

• Access all your data anytime
• Request correction of inaccurate data
• Delete your account whenever you want
• Object to marketing communications
• Receive your data in portable format
• Restrict how we process your data

Important for Reward Points Users:

• We verify your casino deposits with casino partners to award Reward Points
• This verification can take up to 30 days
• We receive confirmation of deposits but NOT your full payment details
• Deposit verification data is kept for 6 years for tax compliance
• You can request details of all deposit verification data we hold about you

This mobile app privacy section should be added to your main privacy policy at https://bonusandspins.com/privacy-policy/ as a new dedicated section.

• Device Information: Device model, operating system version (iOS version), unique device identifiers
• App Version: The version of the Bonus & Spins app you have installed
• Mobile Network Information: Mobile carrier name, connection type (WiFi, cellular)
• App Installation Data: Date and time of app installation, installation source (App Store)
• Session Data: App launch times, session duration, feature usage within the app
• Push Notification Tokens: Device-specific tokens required to send you push notifications about new casino offers, promotions, and app updates
• Notification Preferences: Your settings regarding which types of notifications you wish to receive
• Notification Interaction Data: Whether you opened, dismissed, or interacted with push notifications
• Virtual Currency Transactions: Records of coins or credits purchased through Apple's In-App Purchase system
• Purchase History: Dates, amounts, and types of in-app purchases made
• Purchase Identifiers: Apple-provided transaction identifiers for purchase verification
• Country/Region: Derived from device settings or IP address to ensure we display appropriate, region-specific casino offers
• Note: We do NOT collect precise location data (GPS coordinates). We only collect approximate location at country/region level.
• Crash Reports: Automatically generated reports when the app crashes or experiences errors
• Performance Metrics: App loading times, response times, memory usage
• Error Logs: Technical logs of errors encountered during app use

How We Use Mobile App Data

We use the mobile app data described above for the following purposes:

Push Notifications

What Are Push Notifications?

Push notifications are messages we send directly to your mobile device to alert you about:

• New casino offers and free spins promotions
• Exclusive app-only deals
• Time-sensitive bonuses expiring soon
• Important updates to our terms or app features

Your Control Over Notifications

• Opt-In Required: We will ask for your permission before sending push notifications when you first use the app
• Easy to Disable: You can disable push notifications at any time through:
  • iOS Settings → Notifications → Bonus & Spins → Toggle off "Allow Notifications"
  • Within the app: Settings → Notifications → Adjust preferences
• Granular Control: You can choose which types of notifications to receive (e.g., new offers only, not app updates)

What Happens to Your Data

• If you disable notifications, we will no longer send alerts, but we retain your push token for 90 days in case you re-enable notifications
• After 90 days of disabled notifications, we delete your push notification token
• Notification preference data is linked to your account and used to personalise your experience

In-App Purchases

Virtual Currency

The Bonus & Spins app offers virtual currency called "Coins" which can be purchased using real money through Apple's In-App Purchase system. Coins have no real-world monetary value and cannot be exchanged for cash or used for actual gambling.

Payment Processing

• Apple Handles Payments: All payment transactions are processed by Apple Inc. through their In-App Purchase system
• We Don't See Payment Details: We do NOT receive, store, or have access to your credit card, debit card, or other payment information
• What We Receive: Apple provides us with:
  • Confirmation that a purchase was completed
  • Transaction identifier (for verification purposes)
  • Purchase amount and date
  • Your Apple ID (in anonymised form)

Purchase Data Usage

We use in-app purchase data to:

• Credit your account with the correct amount of coins
• Maintain a record of your transaction history within the app
• Provide customer support if issues arise with purchases
• Analyse purchasing patterns to improve our virtual currency offerings
• Comply with tax and accounting requirements

Refunds

Refund requests for in-app purchases must be directed to Apple, as they process all payments. We cannot issue refunds directly. To request a refund:

1. Visit reportaproblem.apple.com
2. Sign in with your Apple ID
3. Find the purchase and request a refund

Mobile Analytics

We use analytics services to understand how users interact with our mobile app. This helps us improve functionality, fix issues, and create a better user experience.

Analytics Providers We Use

• Google Analytics for Firebase: Tracks app usage, user engagement, and technical performance
• Apple App Analytics: Basic metrics provided by Apple about app downloads and usage
• Internal Analytics: Our own systems to track feature usage and user preferences

What Analytics Data Includes

• Screens viewed and navigation patterns within the app
• Features used (e.g., filters applied, offers bookmarked)
• Time spent in different sections of the app
• Session frequency and duration
• Technical performance metrics (loading times, errors)
• Aggregated demographic data (country, device type, iOS version)

How We Protect Your Privacy in Analytics

• No Personal Identification: Analytics data is aggregated and anonymised where possible
• No Cross-App Tracking: We do NOT use your data to track you across other apps or websites
• No IDFA Collection: We do not collect Apple's Identifier for Advertisers (IDFA)
• Opt-Out Available: You can limit analytics through iOS Settings → Privacy → Analytics & Improvements

Advertising and Marketing in the App

How We Show You Relevant Offers

We use your app usage data and preferences to display casino offers that may be of interest to you. This includes:

• Casino offers matching your preferred game types
• Bonuses in your selected value range
• Promotions from casinos you've previously shown interest in

Third-Party Advertising Services

We work with the following advertising partners who may collect data through the app:

• Google Ads: For performance measurement and optimisation
• Facebook Ads: For performance measurement (if you arrived at our app via a Facebook ad)
• Microsoft Advertising: For performance measurement and optimisation

What Data These Partners Receive

• Aggregated, anonymised usage data
• Information about which offers you viewed or clicked (not linked to your identity)
• General device and app information

What We DON'T Do

• We do NOT sell your personal data to advertisers
• We do NOT share your email, name, or contact information with casino partners without your consent
• We do NOT use your data to track you across other apps (no cross-app tracking)
• We do NOT collect Apple's IDFA for targeted advertising

Apple App Store and iOS Integration

Apple's Role

The Bonus & Spins app is distributed through Apple's App Store and integrates with various iOS features. Apple has its own privacy practices that govern:

• App Store downloads and updates
• In-App Purchase processing
• iCloud backups (if you enable app data backup)
• Apple ID authentication

Please refer to Apple's Privacy Policy at www.apple.com/legal/privacy for information about Apple's data practices.

Permissions We Request

The app may request the following iOS permissions:

You can review and change permissions at any time through iOS Settings → Bonus & Spins.

Data Retention for Mobile App Data

In addition to the retention periods described in the main Privacy Policy, mobile-specific data is retained as follows:

When you delete the app or close your account, we delete or anonymize your mobile app data in accordance with the timelines above.

All rights described in Section IX of our main Privacy Policy apply to data collected through the mobile app, including:

• Right to Access: Request a copy of all data we hold about your app usage
• Right to Deletion: Request deletion of your account and associated app data
• Right to Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data for direct marketing
• Right to Restrict: Request we limit processing of your data

Within the App:

1. Go to Settings → Privacy
2. Select "Request My Data" or "Delete My Account"
3. Follow the prompts

Via Email: Contact our Data Privacy Manager at [email protected]

Account Deletion: To permanently delete your account and all associated app data:

1. Open the app
2. Go to Settings → Account
3. Select "Delete My Account"
4. Confirm deletion

Note: Account deletion is permanent and cannot be undone. All coins, preferences, and saved offers will be lost.

The Bonus & Spins mobile app is strictly for users aged 18 and over, in compliance with UK gambling regulations.

• We do NOT knowingly collect data from anyone under 18 years of age
• The app is rated 18+ on the Apple App Store
• We employ age verification measures where possible
• If we discover we have inadvertently collected data from a minor, we will delete it immediately

Parents/Guardians: If you believe your child has downloaded our app and created an account, please contact us immediately at [email protected] and we will delete the account and all associated data.

In addition to the security measures described in Section VII of our main Privacy Policy, we implement mobile-specific security practices:

• Encryption in Transit: All data transmitted between the app and our servers uses TLS 1.2 or higher encryption
• Encryption at Rest: Sensitive data stored on your device is encrypted using iOS data protection features
• Secure Authentication: Login credentials are never stored on your device in plain text
• Certificate Pinning: Prevents man-in-the-middle attacks when communicating with our servers
• Biometric Authentication: Optional Face ID/Touch ID for additional account security
• Automatic Logout: App logs you out after a period of inactivity (configurable in settings)
• Secure Storage: We use iOS Keychain for storing sensitive tokens and credentials
• Jailbreak Detection: The app may limit functionality on jailbroken devices for security reasons
• Keep your iOS version up to date
• Use a strong, unique password for your account
• Enable biometric authentication if available
• Don't share your account credentials with others
• Report suspicious activity to [email protected]

As we improve and update the Bonus & Spins mobile app, our data collection practices may change. When we make significant changes to mobile data collection:

1. App Update: We will include details in the "What's New" section of the app update
2. In-App Notification: You may receive a notification about privacy changes
3. Policy Update: This privacy policy will be updated with a new "last updated" date
4. Consent: Where required by law, we will ask for your renewed consent

We encourage you to review this privacy policy periodically, especially before and after app updates.

If you have questions, concerns, or requests regarding data collection in the Bonus & Spins mobile app:

Email: [email protected]
Subject Line: "Mobile App Privacy Inquiry"

Postal Address:
Olikaone Limited
Data Privacy Manager
Unit 310 Screenworks
22 Highbury Grove
London, N5 2ER
United Kingdom

Response Time: We aim to respond to all mobile app privacy inquiries within 5 business days.

• Main Privacy Policy: https://bonusandspins.com/privacy-policy
• Terms & Conditions: https://bonusandspins.com/terms-condition
• Cookie Policy: https://bonusandspins.com/cookie-policy
• Responsible Gambling: https://bonusandspins.com/responsible-gambling
• Apple Privacy Policy: https://www.apple.com/legal/privacy
• UK ICO (Data Protection): https://ico.org.uk

Last Updated: 12 November 2025
Applies to: Bonus & Spins iOS Mobile App (Version 2.0 and later)
Company: Olikaone Limited (Company Registration: UK)

XI. Glossary

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

THIRD PARTIES

Internal Third Parties

Other companies in the Olikaone Group acting as processors and who are based in the United States and provide IT and system administration services and undertake leadership reporting.

External Third Parties

• Service providers acting as processors based in the United Kingdom who provide IT and system administration services.
• Professional advisers acting as processors including lawyers, bankers, auditors and insurers based in the United Kingdom, in the United States and in the European Union who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors based in the United Kingdom who require reporting of processing activities in certain circumstances.

For more information, please contact [email protected].

Copyright © 2022–2025 BonusAndSpins

Privacy Policy Version: 12 November 2025