Privacy Policy

Information we hold about you

Registration details include your full name, date of birth, residential address, email address, contact number and preferred currency. These fields are mandatory: our licensing conditions do not permit anonymous accounts.

Verification records comprise identity documents, proof of address and, where a payment method requires it, evidence of ownership of that method. Documents are stored in encrypted form and are accessible only to verification staff.

Transactional records cover deposits, withdrawals, wagers placed, game outcomes, bonus credits and any adjustments made to your balance. Financial regulators require these to be retained in an unaltered state.

Technical information gathered automatically includes IP address, approximate location derived from it, device model, operating system, browser fingerprint characteristics and timestamps of each session.

Lawful grounds for processing

Contractual necessity covers everything required to operate your account: crediting deposits, settling wagers, processing withdrawals and answering support enquiries. Without this processing there is no service to provide.

Legal obligation covers anti-money-laundering monitoring, source-of-funds enquiries, age verification and record retention mandated by the Malta Gaming Authority, the Alderney Gambling Control Commission, the Kahnawake Gaming Commission and the Alcohol and Gaming Commission of Ontario.

Legitimate interests cover fraud detection, collusion analysis, bonus-abuse investigation, network security and the improvement of our games and interfaces. We assess these interests against your rights before relying on this ground and record the outcome.

Consent is used only for direct marketing and for optional analytics or advertising cookies. Consent given can be withdrawn at any time without affecting the lawfulness of processing carried out beforehand.

Disclosure to third parties

Payment institutions, card schemes and open-banking providers receive the minimum information needed to authorise and reconcile a transaction. Game studios that supply content to Royal Vegas Casino receive a pseudonymous session identifier and never your name or contact details.

Identity verification bureaux, sanctions-screening services and credit-reference agencies are engaged to satisfy regulatory checks. Their searches are recorded on our side and, in some cases, on their own systems.

Regulators, tax authorities, law enforcement and courts receive information when a valid legal instrument compels disclosure. We do not volunteer player data outside these channels.

We do not sell personal information, and we do not share it with data brokers or with unaffiliated advertisers for their own independent purposes.

Cross-border transfers and safeguards

Our infrastructure and service providers are located in the European Economic Area, the United Kingdom, Canada and Malta. Because members reside in New Zealand and elsewhere, personal information necessarily crosses borders.

Transfers outside the EEA are protected by European Commission adequacy decisions where one exists, and by Standard Contractual Clauses supplemented with technical measures where it does not. For members in New Zealand, we handle information in a manner intended to be consistent with Information Privacy Principle 12 of the Privacy Act 2020.

Data at rest is encrypted with AES-256 and traffic in transit uses TLS 1.3. Access to production databases is limited by role, logged in full and reviewed quarterly.

Retention periods and your rights

Account and transaction records are kept for a minimum of five years after the closure of an account, in line with anti-money-laundering requirements. Verification documents follow the same schedule. Marketing preferences and suppression lists are kept indefinitely so that an opt-out is not accidentally reversed.

You may request a copy of the information we hold, ask for inaccurate details to be corrected, object to processing based on legitimate interests, or request erasure of anything not subject to a retention obligation. Requests are answered within 30 days and may be extended once where the request is complex.

Self-excluded members cannot have their records erased during the exclusion term, since deletion would defeat the purpose of the exclusion itself.

Complaints about our handling of personal information can be raised with our Data Protection Officer first. If the response is unsatisfactory, members in New Zealand may approach the Office of the Privacy Commissioner, and members in the European Union may approach their national supervisory authority.