Closing an online casino account feels like it should be the end of the relationship. You stop logging in, the balance is withdrawn, the welcome bonus is spent, and the page goes quiet. Under UK data protection law, though, closure and deletion are two very different things. If you have played at a UK Gambling Commission-licensed site such as O’Reels, a meaningful portion of your records will outlive your account, and no amount of clicking “delete my data” will change that.
What actually happens when you close a casino account
Account closure is a commercial and regulatory action, not a data protection one. When you ask an operator to close your account, they typically mark it as closed, stop marketing to you, and block further deposits. What they do not do is shred the audit trail behind the account. That trail includes your identity verification documents, deposit and withdrawal history, bonus acceptance records, safer gambling interactions, and any responsible gambling flags attached to your profile.
The reason is structural. A UK-licensed operator is supervised by the Gambling Commission and by the AML regime that sits behind the licence. Money laundering regulations require gambling businesses to keep records of transactions and customer due diligence for at least five years after the relationship ends. That clock does not start when you close the account in a huff after a bad session. It starts when the business relationship is genuinely over, which in practice means five years from the last transaction or the point at which the operator decides the relationship has ended.
So the first thing to understand is that a closed account is still a record. At a site like O’Reels, which holds licence reference 23328 and is operated by Betable Limited, the closure request is handled by the support team while the compliance team retains the underlying data. Two different departments, two different obligations, one customer who assumes the door has shut behind them.
Why a right to be forgotten request gets partially refused
UK GDPR gives you a right to erasure, but it is not absolute. Article 17 lists the exceptions, and two of them matter enormously here: compliance with a legal obligation, and the establishment, exercise or defence of legal claims. AML record-keeping is a legal obligation. A licensing condition that requires an operator to demonstrate how it handled a customer’s deposits is, in effect, a legal claim waiting to happen if the regulator ever investigates.
This is why a casino will typically respond to an erasure request with a partial refusal rather than a flat no. They may delete marketing preferences, clear your contact details from promotional databases, and stop using your data for anything beyond compliance. They will not delete the transaction ledger, the KYC file, or the record of what bonuses you claimed. That is not an operator being difficult. It is the same answer you would get from a bank, and for the same reason.
The five-year retention rule in practice
Five years is the floor, not the ceiling. Where a complaint, a dispute, or a regulatory query is live, records can be held longer. If you have ever raised a chargeback, disputed a bonus, or been the subject of a safer gambling intervention, expect the file to be kept for the full period and possibly beyond it. Operators are also cautious about destroying records that might be needed if a customer returns, because the five-year clock can reset if the relationship resumes.
The practical consequence is that a “right to be forgotten” request made the day after closure is likely to be answered with a retention notice rather than a deletion confirmation. You can still ask, and you should, because it forces the operator to document what they hold and why. Just do not expect the file to disappear.
What you can and cannot get deleted
The split between deletable and retained data is more predictable than most players assume. Anything used purely for marketing or convenience is usually fair game. Anything that evidences a financial transaction or a regulatory obligation is not.
- Usually deleted or suppressed: marketing consent, email and SMS lists, push notification tokens, and browsing analytics tied to your session.
- Usually retained: deposit and withdrawal records, KYC identity documents, bonus and free spin acceptance history, and safer gambling interaction logs.
- Retained but restricted: your name and contact details may be kept in a suppression list so the operator does not accidentally market to you again.
- Retained for the full period: anything connected to a complaint, dispute, chargeback, or regulatory referral.
- Genuinely ambiguous: chat transcripts and email correspondence, which operators often keep as part of the customer record and cite as compliance evidence.
If you have played at O’Reels and taken the welcome bonus of 20 free spins on Big Bass Splash, that bonus acceptance is part of the record. So is the £10 minimum deposit that unlocked it, and every subsequent deposit made via Visa or Mastercard debit, Trustly, Google Pay, MuchBetter, or Pay by Mobile. Payment records are precisely the sort of data AML rules exist to preserve.
How to close an account properly and limit what lingers
The cleanest route is to use the operator’s own closure process rather than simply abandoning the account. A formal closure request creates a dated record and triggers the operator’s own workflow, which usually includes a confirmation email. Keep that email. It is your evidence of the date the relationship ended, which is the date the retention clock effectively starts ticking from.
At O’Reels, customer support runs 24/7 by live chat and email, so a closure request can be made at any hour. Ask for three things in writing: confirmation that the account is closed, confirmation of what data will be retained and for how long, and confirmation that marketing has been switched off. That third point is the one most people forget, and it is the one you can actually enforce.
Separating closure from erasure
Treat closure and erasure as two separate requests, because they are handled by different teams and produce different answers. The closure request goes to support. The erasure request is a formal UK GDPR request and should be sent in writing, referencing your right to erasure and asking for a response within one month. The operator may extend that by two further months if the request is complex, and they must tell you if they do.
A well-drafted request acknowledges the AML retention obligation and asks only for deletion of data that is not subject to it. That framing tends to get a more useful response than a blanket demand, because it shows you understand the constraint and are testing whether the operator is applying it narrowly or using it as a catch-all excuse. Some operators over-retain. Asking them to justify each category is a reasonable way to find out.
Self-exclusion is a related but distinct lever. If you have self-excluded, the operator must keep enough data to enforce that exclusion, and that obligation can outlast a standard closure. A dedicated online casino without a sportsbook, such as O’Reels, will typically hold self-exclusion records for a defined minimum period set by the Commission, and those records sit outside the ordinary deletion process entirely.
What to watch for and what to do next
Be sceptical of any site that promises instant and total deletion of your gambling history. No UK-licensed operator can honestly make that promise, because the licence conditions and AML rules do not permit it. If you encounter APK mirrors or unofficial app downloads claiming to be a casino brand, treat them as a red flag: they are not bound by the same retention rules, and they may be harvesting your data with no regulatory oversight at all. Stick to the licensed domain.
There is also a practical warning about sister sites and shared platforms. Operators running multiple brands on one platform sometimes retain data centrally, which means closing your account at one brand may not remove you from the group’s records. Ask directly whether your data is shared across casino platform sister sites and, if so, which entities hold it. Betable Limited is the operator behind O’Reels, and that is the entity your request should name.
The realistic playbook is short. Close the account formally, in writing, and keep the confirmation. Send a separate erasure request that acknowledges the five-year AML retention and asks for deletion of everything outside it. Ask for marketing suppression in the same breath. Then, a month later, ask for a copy of what they hold under a subject access request, because the response will tell you more about their retention practices than any privacy policy ever will. The data does not vanish when you close the account. Knowing exactly what stays, and why, is the only way to keep the relationship on your terms.