Our Privacy Policy
This policy explains what personal data Casinoways collects when you play at casinowaysonline.co.uk, why we need it, how long we keep it and what rights you have over it. We act as the data controller for all information processed through this site.
What Data We Collect
We collect several categories of personal data, each tied to a specific function of your account. You always know which category a piece of information belongs to because we group it the same way in our records.
- Identity data: your name, date of birth, email address, phone number and residential address, provided when you register.
- Verification documents: a photo ID (passport or driving licence), proof of address and proof of payment method, collected before your first withdrawal as part of KYC.
- Transaction data: deposits, withdrawals, bet history, bonuses claimed and game outcomes linked to your account.
- Technical data: IP address, device identifiers, browser type, operating system and approximate location derived from your IP.
- Gameplay behaviour: sessions, game preferences, wagering patterns and responsible-gambling indicators such as loss streaks.
- Marketing preferences: which channels you agreed to receive communications on (email, SMS) and whether you opted in at all.
How We Use Your Data
We process your data only for defined purposes connected to running your account and meeting our legal duties. If a new purpose arises, we tell you before we start processing for it.
- Creating and managing your player account and authenticating your logins.
- Carrying out KYC checks before withdrawals, which typically take up to 3 business days.
- Processing deposits and withdrawals across Visa Debit, Mastercard, Trustly, e-wallets and crypto.
- Preventing fraud, bonus abuse, underage gambling and multi-accounting.
- Monitoring play for responsible-gambling signs so we can step in with limits or a check-in.
- Sending marketing offers where you have consented, such as our Friday reload and weekly cashback news.
- Meeting legal and regulatory obligations, including AML reporting to the Curaçao authority.
Our Legal Bases
Contract: we process identity, transaction and gameplay data to perform the agreement you enter when you register. Without it we cannot hold funds, settle bets or pay withdrawals.
Legal obligation: KYC and AML checks rest on our licensing duties under licence OGL/2024/842/0350. We must verify your identity and report suspicious activity, and we cannot switch this processing off.
Legitimate interest: fraud prevention, security monitoring and service improvement rely on our legitimate interest in operating a safe casino. We weigh this interest against your rights and keep the processing proportionate.
Consent: marketing emails, SMS offers and non-essential cookies run only on your consent. You can withdraw it at any time without losing access to your account.
How Long We Keep It
Retention depends on the type of data and the reason we hold it. Gambling regulations require us to keep transaction and KYC records for at least 5 years after your last activity; everything else is kept no longer than necessary.
| Data category | Retention period |
|---|---|
| Verification (KYC) documents | 5 years after account closure, or longer if required by the regulator |
| Transaction and wagering records | Minimum 5 years under AML rules |
| Account and identity data | While your account is active, then 5 years archived |
| Marketing preferences | Until you withdraw consent or ask us to delete them |
| Technical logs and device data | Up to 12 months for security analysis |
When a retention period ends, we delete or irreversibly anonymise the data. Crypto transactions on the blockchain itself cannot be altered, but our copy of the linking records is removed on schedule.
Who We Share Data With
We never sell your personal data. We share it only with parties who need it to deliver a service to you or to us, and each one is bound by a data-processing agreement.
- Payment processors handling your Visa, Mastercard, Trustly, Skrill, Neteller, MiFinity and crypto transactions.
- KYC and AML verification providers that check your documents against sanctions and PEP lists.
- The Curaçao licensing authority, when a regulatory request or reporting duty applies.
- Game and platform providers that receive only your player ID and session data, never your full identity.
- Analytics and hosting services that help us keep the site fast and secure.
Your Rights Over Your Data
GDPR gives you direct control over what we hold. Send any request to our data protection contact and we will respond within one month, extendable by two further months for complex cases.
Access and portability: get a copy of your data or have it transferred to another operator in a machine-readable format.
Rectification and erasure: correct anything inaccurate, or ask us to delete data we hold without a legal reason to keep. Note that KYC and transaction records are exempt during the regulatory retention window.
Objection and restriction: object to processing based on legitimate interest, or ask us to pause processing while a dispute is resolved.
Withdraw consent and complain: withdraw marketing consent at any time, and lodge a complaint with your national data protection authority if you believe we mishandled your data.
Cookies and Tracking
We use strictly necessary cookies to keep you logged in and your session secure, plus optional analytics and marketing cookies that load only with your consent. You can change your cookie choices at any time from the cookie banner or your browser settings. Full details, including the list of cookies and their lifespans, are in our separate Cookies Policy.
How We Protect Your Data
All traffic between your device and our servers is encrypted with TLS, and stored verification documents sit in encrypted storage accessible only to trained compliance staff. Access to personal data follows a strict need-to-know model, with role-based permissions and audit logs on every access.
If a personal data breach occurs that risks your rights, we notify the relevant supervisory authority within 72 hours and inform you directly when the risk to you is high. Our support team is available 24/7 at [email protected] and by live chat if you ever suspect unusual activity on your account.
Frequently asked questions
Who is the data controller at Casinoways?
Casinoways N.V., the operator of casinowaysonline.co.uk under Curaçao licence OGL/2024/842/0350, is the data controller for all personal data processed on this site.
Can I delete my KYC documents after verification?
No. Gambling regulations require us to retain verification documents and transaction records for a minimum of 5 years after your account closes, so we cannot erase them earlier.
How do I stop marketing emails?
Use the unsubscribe link in any email, change your preferences in your account settings, or contact [email protected]. Consent withdrawal takes effect immediately.
Do you share my data with game providers?
Only in limited form. Providers receive your player ID and session data to run the games; they never see your full identity, documents or payment details.
How long do you respond to data requests?
Within one month of receiving a verified request, extended by up to two further months if the request is complex. We will tell you if we need an extension.