How We Handle Your Data
Data We Collect
We collect only the personal data we need to operate your account, verify your identity, process payments and meet our legal obligations. When you register with Casinoways we ask for your name, date of birth, email address, phone number and residential address. Verification under our KYC policy adds a copy of your photo ID, a proof of address and proof of your payment method before your first withdrawal.
Transaction records cover deposits, withdrawals, wagering and game outcomes, held for the regulatory period described below. Technical data includes your IP address, device type, browser and operating system, collected through standard server logs. Behavioural gameplay data, such as session length, stakes and loss patterns, feeds our responsible-gambling monitoring. Marketing preference data records which channels you consented to and which messages you acted on.
Why We Process Data
We process your data for seven defined purposes: creating and maintaining your account, completing KYC verification, processing deposits and withdrawals, preventing fraud and money laundering, monitoring play for signs of gambling harm, sending marketing where you have consented, and complying with gambling and financial regulation.
- Account creation and management of your Casinoways login
- Identity and age verification (KYC) before your first withdrawal
- Payment processing across cards, e-wallets and crypto
- Fraud detection, AML screening and multi-account checks
- Responsible-gambling monitoring against deposit and loss limits
- Marketing by email or SMS, only with your consent
- Legal, tax and regulatory reporting obligations
Our Legal Bases
Contract. To open your account, verify you are of legal age, and pay out winnings, we must process the data you supplied at registration. Without it we cannot provide the service you signed up for.
Legal obligation. Gambling and anti-money-laundering law require us to verify identity, keep transaction records for at least 5 years, report suspicious activity to the relevant authority, and cooperate with regulators.
Legitimate interest. We rely on legitimate interest for fraud prevention, security of our platform, aggregate analytics on game performance, and enforcing our terms and conditions.
Consent. Marketing communications, optional cookies and any data we use beyond the purposes above are processed only with your consent, which you can withdraw at any time.
How Long We Keep It
Retention depends on the type of data and why we hold it. Transaction and KYC records are kept for the regulatory minimum of 5 years after account closure. Account data is retained while your account is open and for a short closure period. Marketing data is deleted immediately when you withdraw consent or unsubscribe. Where you request erasure, we delete data unless a legal obligation requires us to keep it.
Data kept beyond regulatory minimums is either deleted or anonymised so it no longer identifies you.
| Data category | Retention period |
|---|---|
| Identity and account data | While your account is open, plus 24 months after closure |
| KYC verification documents | 5 years after account closure |
| Transaction and wagering records | 5 years after account closure |
| Device and IP logs | 12 months |
| Gameplay behaviour data | 24 months, aggregated thereafter |
| Marketing preferences and history | Until consent is withdrawn |
Who We Share With
We share your data only with processors and authorities that need it, under contract and confidentiality. We do not sell your personal data to anyone.
Payment processors handle your card, e-wallet and crypto transactions. KYC and AML verification providers validate your documents and screen against sanctions lists. Our licensed game providers receive the minimum data needed to record your play and settle wins. Regulators and financial intelligence units receive reports where law requires. Analytics and hosting providers support platform operation under data-processing agreements.
- Payment processors and acquiring banks
- KYC/AML verification and screening providers
- Game and platform providers under strict agreements
- Gambling regulators and law enforcement
- Analytics, hosting and IT support providers
Your Rights Over Data
You control your personal data. Email [email protected] with any request; we respond within one month, extended by two further months for complex cases, and we will tell you if we do.
You can object to processing based on legitimate interest, restrict processing while a dispute is open, and complain to the data protection authority in your country if you believe we mishandled your data.
- Access a copy of the data we hold about you
- Rectify inaccurate data
- Erase data we have no legal duty to keep
- Port your data in a structured, machine-readable format
- Object to or restrict certain processing
- Withdraw consent for marketing at any time
- Complain to your national data protection authority
Cookies and Tracking
We use strictly necessary cookies to keep you logged in and secure the platform, plus optional analytics and marketing cookies that load only after you consent through the cookie banner. You can change your cookie choices at any time from the cookie settings link in our footer. Full details of every cookie, its purpose and its lifetime are set out on our dedicated Cookies Policy page.
Security and Breaches
All traffic between your device and our platform is encrypted with TLS. Stored data is encrypted at rest, access is restricted to staff who need it for support, payments or compliance, and every access is logged. We run regular security reviews of our infrastructure.
If a breach affects your personal data and creates a risk to you, we will notify the relevant supervisory authority without undue delay and inform you directly without unnecessary delay, describing what happened, what data was involved and what we are doing about it.
Frequently Asked Questions
Do you sell my personal data?
No. We never sell your data. We share it only with payment processors, verification providers, regulators and infrastructure suppliers that need it to deliver the service.
How do I stop marketing emails?
Use the unsubscribe link in any email, contact support, or withdraw your consent by emailing [email protected]. Marketing data is deleted once consent is withdrawn.
Can I get my KYC documents deleted?
Not immediately. Gambling and AML rules require us to keep verification documents for 5 years after account closure, after which they are destroyed.