Data, Purpose and Retention in One View
This document is a working structure dated 29 October 2026 and is not final. It is replaced by the operator’s own policy once the brand agreement is signed, or by a lawyer’s adaptation. The schedule below summarises the processing grounds, operational rationales, and baseline retention intervals governing user records across the platform.
| Data category | Why we collect it | Lawful basis | How long we keep it |
|---|---|---|---|
| Registration data | Establishing account credentials, verifying basic identity, and executing platform access agreements | Performance of contract | Retained for the active duration of the account plus the period stated in the schedule to this policy |
| Verification documents | Validating legal age, confirming physical residence, and satisfying anti-money-laundering requirements | Compliance with legal obligation | Retained for the term prescribed by anti-money-laundering legislation, running from the date of account termination |
| Payment data | Facilitating incoming deposits, processing payout remittances, and checking payment instrument consistency | Performance of contract and compliance with legal obligation | Retained throughout commercial usage and after closure under financial auditing standards |
| Gameplay activity | Settling wagering records, executing game session calculations, and monitoring account integrity | Performance of contract and legitimate interest | Preserved within system audit logs for the period stated in the schedule to this policy |
| Technical data | Maintaining server security, diagnosing network errors, and preventing unauthorised account takeover | Legitimate interest | Archived in security log repositories for the period stated in the schedule to this policy |
| Marketing preferences | Distributing service notifications, promotional updates, and managing player communication parameters | Consent | Retained continuously until explicit consent withdrawal is submitted via account preference controls |
1.1. Data Controller Identification. The administrative entity responsible for determining the objectives, protocols, and technical resources applied to personal records collected across this platform operates in the capacity of Data Controller. The definitive administrative register and institutional corporate identity of the Data Controller are set out in the schedule to this policy. All interim personal data handling operates under strict operational segregation to secure player profiles from external misuse.
1.2. Scope and Application. The provisions set forth in this instrument apply across all registration portals, deposit facilities, gaming lobbies, and administrative interfaces made available under the operational domain. Any user establishing credentials, uploading documentary evidence, executing balance adjustments, or generating technical access trails falls fully within the purview of this document.
1.3. Procedural Obligations. The Data Controller exercises continuous accountability for the processing of sensitive player entries. Processing is conducted exclusively via systems incorporating data isolation, strict access tiering, and operational monitoring. Technical records are logged to protect financial assets and maintain system resilience against malicious intervention.
1.4. Inquiries and Submissions. Any participant seeking operational clarification concerning data handling practices, systemic logging, or document retention schedules must submit a formal communication directly to [email protected]. Inquiries are queued chronologically and addressed under established administrative review standards.
Categories of Data Held
2.1. Registration Profile Elements. Upon initial completion of the sign-up form, the platform records identity data required to create and administer the player account. These elements encompass the individual’s full legal name, declared date of birth, personal physical address, active email contact address, assigned player identification handle, and primary mobile contact telephone number. These elements establish account individuality and prevent duplicate account creation across the database.
2.2. Documentary Verification Files. In compliance with identity confirmation rules, the platform collects digital copies of authentication materials prior to authorising withdrawal transactions. These files consist of high-resolution photographic captures of a government-issued photo identity document, accompanied by documentary proof of address dated within the preceding three months, such as an official utility invoice or authenticated financial institution statement. Where elevated transaction volume warrants further validation, additional documentary verification files concerning source of wealth or economic origin may be formally requested.
2.3. Transaction and Ledger Data. All movements of funds directed through the cashier create permanent financial records. The platform captures transaction reference sequences, chosen processing methods, partial masking credentials of payment instruments, incoming and outgoing fund magnitudes stated in the currency shown in the cashier, transaction timestamps, and reconciliation markers received from integrated payment networks.
2.4. Wagering and Gameplay History. Interaction with software titles and streamed table environments generates persistent system metrics. The logged elements comprise software session identifiers, game titles accessed, exact stake allocations per round, round outcomes, progressive jackpot balance interactions, tournament placements, and bonus wagering progression figures.
2.5. Technical Footprint and Device Telemetry. When an interface connection is made, server infrastructure automatically documents access parameters. These records include the client network address, operating system specifications, browser classification and version, terminal display dimensions, network routing characteristics, error logs, and session activity timestamps. This telemetry is logged to detect suspicious access patterns.
2.6. Direct Communications and Contact Logs. All operational dialogues conducted between account holders and customer assistance services are permanently archived. This comprises text transcripts generated via real-time customer messaging channels, formal notices submitted to [email protected] or [email protected], and documentation uploaded to resolve administrative discrepancies.
2.7. Consent and Marketing Preferences. The platform records explicit selections registered by players regarding promotional correspondence, direct system updates, and third-party commercial content distribution. Recorded metrics document the exact timestamp of consent submission, consent version identifiers, and subsequent revocation notices registered via internal account settings.
The Basis We Rely On for Each Category
3.1. Performance of Contractual Obligations. The processing of core identity records, registration data, transaction figures, and game session entries is carried out to execute the foundational terms binding the operator and the player. Without the collection and real-time processing of these specific data categories, the platform cannot establish user access, calculate wagering outcomes, maintain balance accuracy in the currency shown in the cashier, or execute user-requested deposit and withdrawal settlements.
3.2. Compliance with Statutory Obligations. Selected informational processing operates to fulfil binding requirements established by anti-money-laundering legislation and related financial prevention mandates. Under these standards, the platform is legally obliged to execute customer verification, validate the physical identity of participants, corroborate ownership of external payment instruments, screen for fraudulent behaviours, and report suspicious financial throughput. Compliance-driven processing occurs independently of individual preference.
3.3. Legitimate Interests of the Operator. Processing activities involving technical access telemetry, server logs, fraud mitigation algorithms, and communications logs rely upon the legitimate interest of the operator to preserve infrastructure integrity. These processing workflows permit proactive defence against malicious intrusions, automated bots, identity substitution, bonus abuse, duplicate account networks, and unauthorised access attempts directed against player funds.
3.4. Explicit Consent Parameters. The delivery of direct marketing promotions, tailored product announcements, and non-essential system communications relies exclusively upon unambiguous, freely given affirmative consent. Users hold full operational discretion to decline these communications during initial account creation or to retract authorisation at any subsequent interval via personal profile preferences, without compromising access to core betting facilities.
3.5. Separation of Processing Grounds. Where a single transactional record serves multiple distinct grounds, the Data Controller segments internal access privileges accordingly. Transactional ledger entries required for financial statutory compliance are locked against general marketing queries and held strictly within access-restricted operational environments.
Categories of Recipient
4.1. Financial Settlement Processors. Personal identity markers, transaction sums, and masked payment details are transmitted to authorised payment handling partners, acquiring platforms, and banking service suppliers. These external partners receive exclusively the minimum data scope necessary to authenticate deposits, route payouts in the currency shown in the cashier, and detect fraudulent banking attempts.
4.2. Identity and Age Verification Contractors. To validate documentary submissions without undue administrative delay, digital records comprising government-issued photo identity documents and proof of address files may be processed via specialised external identity verification providers. These processors operate under contract to analyse image authenticity, cross-reference structural document features, and return structured verification decisions. The specific providers engaged are named in the schedule to this policy.
4.3. Gaming Content Providers. When a participant initiates software wagering or enters a live dealer table, technical identifiers and encrypted session tokens are exchanged with the studio responsible for that game. Studios receive transaction references to credit software outcomes and progressive contributions, without acquiring direct access to raw identity files or contact records.
4.4. Technical Hosting and Infrastructure Partners. System operations rely upon secure computational facilities, distributed data storage providers, and managed network security vendors. Infrastructure partners handle encrypted server images and database storage units strictly under operational agreements prohibiting unencrypted parsing or unauthorised secondary usage.
4.5. Statutory and Administrative Authorities. Personal records, gameplay histories, and transactional ledgers may be presented to competent public authorities, statutory investigative services, or legal bodies pursuant to lawful requests, official summons, or binding anti-money-laundering mandates. The disclosure of files under these conditions is confined to the minimum documentation demanded by law.
4.6. Professional Advisors and Corporate Auditors. Under circumstances involving institutional financial audits, formal legal disputes, or operational compliance reviews, designated legal representatives, independent chartered accountants, and forensic specialists may inspect processing systems under obligations of professional confidentiality.
Transfers to Other Territories
5.1. Cross-Border Processing Workflows. Due to the international distribution of technical server clusters, payment settlement gateways, and technical customer service teams, personal data collected by the platform may be routed or preserved within territories outside the participant’s place of residence. All cross-border infrastructure operates under baseline organisational parameters designed to prevent data exposure during routing.
5.2. Contractual Safeguards and Equivalent Protections. Where system data moves across territorial boundaries, the Data Controller implements operational safeguards equivalent to international standards of data governance. These instruments incorporate standardised model clauses, institutional data-processing agreements, strict encryption protocols during data transit, and independent verification of the recipient’s computational security controls.
5.3. Vendor Assessment Standards. External entities situated in cross-border regions must complete institutional cybersecurity appraisals prior to receiving data processing authorisation. These audits evaluate access-control architectures, physical data centre protections, disaster recovery capabilities, and staff data-handling protocols to verify equivalent protections.
5.4. Specific Transfer Instruments. The schedule to this policy details the specific geographic storage allocations, localised processing hubs, and the safeguard relied upon for each cross-border route. Users seeking further specifics regarding operational data storage regions may submit inquiries directly to [email protected].