Our Privacy Policy, Explained Clearly

This policy sets out what personal data we collect when you play at Casinolab Casino, why we hold it, who sees it and for how long. It applies to every account registered on casinolab.com.

What Data We Collect

To open and run your account we collect identity data: your full name, date of birth, email address, phone number and residential address. Before your first withdrawal we also collect verification documents, namely a government-issued photo ID, a proof of address dated within the last three months, and evidence of the payment method you used.

Beyond identity, our systems log every deposit and withdrawal you make, including amounts, currency, timestamps and payment channel. We record device and connection details such as IP address, device type, operating system and browser fingerprint. We also track gameplay behaviour: bets placed, games opened, session length and outcomes, because this feeds our responsible-gambling and fraud-monitoring tools.

If you opt in to promotions, we store your marketing preferences, including which channels you have agreed to be contacted through and the date you gave that consent.

How We Use Your Data

We process your personal data for seven specific purposes: creating and maintaining your account, verifying your identity under KYC rules, processing deposits and withdrawals, preventing fraud and money laundering, monitoring play for responsible-gambling signals, sending marketing where you have consented, and meeting our legal and regulatory obligations.

We do not use your data for automated decision-making that produces legal effects, and we do not sell or rent it to advertisers. Every processing activity falls under one of the legal bases described below, and we keep a record of which basis applies to which category.

Our Legal Bases

Contract. Creating your player account, paying out winnings and running the loyalty program all require processing that is necessary to perform the agreement between you and us. Without this data we simply cannot offer you the service.

Legal obligation. Anti-money-laundering and KYC rules oblige us to verify your identity and retain transaction records for at least five years. We cannot switch this off, and refusing to provide the data means we cannot let you play.

Legitimate interest. We rely on this basis for fraud detection, security monitoring, aggregate analytics and keeping our site functional. We weigh our interest against your rights and limit processing to what is genuinely necessary.

Consent. Marketing emails, SMS and bonus alerts are sent only where you have actively opted in. You can withdraw consent at any time by changing your preferences or contacting support; withdrawal never affects the lawfulness of earlier messages.

How Long We Keep It

Retention depends on the category of data and the reason we hold it.

• Account and identity data: kept while your account is open, then up to 5 years after closure for regulatory record-keeping.
• Transaction and wagering records: a minimum of 5 years, as required by our Curaçao licence (OGL/2024/1450/0912) and AML rules.
• KYC verification documents: retained for 5 years after your last transaction, then securely destroyed.
• Marketing preferences and consent logs: kept until you withdraw consent, then deleted within 30 days.
• Technical logs and device data: kept for 12 months for security and debugging purposes.

Who We Share Data With

We share personal data only with processors and authorities that need it, and always under a written data-processing agreement.

We never transfer your data for advertising brokers or data markets. Categories of recipients include:

Payment providers handling your PayID, card, e-wallet or crypto transactions receive the data strictly necessary to complete the payment. KYC and AML screening providers verify your documents against sanctions and PEP lists. Hosting and cloud infrastructure suppliers store our systems. Analytics services process aggregated, pseudonymised data. Regulators and law-enforcement bodies receive data when we are legally compelled to disclose it.

Your Rights and Choices

To exercise any right, email our data protection officer at [email protected] or contact 24/7 support at [email protected]. We respond within 30 days and verify your identity before making changes.

• Access: request a copy of the personal data we hold about you.
• Rectification: correct data that is inaccurate or out of date.
• Erasure: ask us to delete data where no legal obligation requires us to keep it.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: opt out of marketing instantly via your account settings or the unsubscribe link.
• Complaint: escalate to the Office of the Australian Information Commissioner (OAIC) or your local data-protection authority if you believe we mishandled your data.

Cookies and Data Security

Cookies

Our site uses session cookies for login, preference cookies for language and currency, and analytics cookies for aggregate usage statistics. Marketing cookies are set only after your consent. You can manage cookie choices at any time; full details, including a per-category breakdown, are on our dedicated Cookies Policy page.

Security measures

All traffic between you and our servers travels over TLS 1.2 or higher encryption. Passwords are hashed with a one-way algorithm and never stored in readable form. Access to player data inside our organisation follows least-privilege rules and requires multi-factor authentication. Payment card details are handled exclusively by PCI-DSS-certified processors and never touch our own servers. If a personal-data breach occurs, we notify the relevant supervisory authority within 72 hours and inform affected players without undue delay where the breach poses a risk to you.

Changes to This Policy

We review this policy regularly and update it when our processing changes or the law moves. The 2026 version displayed on this page always reflects current practice, and the date of the last revision appears at the top. For material changes we notify registered players by email at least 14 days before the new version takes effect. If you keep playing after that date, the updated policy governs your account. Questions about anything on this page go to [email protected] or to live chat, available around the clock.

Frequently asked questions

Do I have to give you my ID documents?

Yes, before your first withdrawal. Our Curaçao licence requires identity verification, so we ask for a government ID, proof of address and payment method confirmation. Checks are usually done within 24 to 72 hours.

Can I stop marketing messages?

Any time. Open your account settings, untick marketing, or click unsubscribe in any email. Consent withdrawal takes effect immediately and costs nothing.

How do I get a copy of my data?

Email [email protected] from your registered address and ask for a data export. We verify your identity and send a structured copy within 30 days.

Do you keep my data after I close my account?

Identity and transaction records stay for a minimum of 5 years after closure because AML law requires it. Everything not covered by that obligation is deleted.

Is my card number stored on your servers?

No. Payments run through PCI-DSS-certified processors, and card details never reach our systems. We see only the last four digits for reference.