Our Privacy Policy Explained
This policy sets out what personal data we collect at Spinsamurai Casino, why we collect it, who we share it with and the rights you hold over it. We launched in 2020 under licence 8048/JAZ2019-049 from the Government of Curaçao, and we handle your data in line with that licence and with Australian privacy principles.
Data We Collect From You
We collect only what we need to run your account, meet our licence obligations and keep the site safe. Here is the full picture by category.
- Identity data: your name, date of birth, residential address, email address and phone number, provided when you register.
- Verification documents: a government-issued photo ID, proof of address (utility bill or bank statement dated within the last 3 months) and proof of payment method before your first withdrawal.
- Transaction data: deposits, withdrawals, bet history, bonus usage and the payment instruments you use, including crypto wallet addresses.
- Technical data: IP address, device type, operating system, browser version, language setting and approximate location derived from your IP.
- Gameplay behaviour: games you play, session duration, wagering patterns and win/loss history, which feeds our responsible-gambling monitoring.
- Marketing preferences: whether you opted in to email, SMS or push promotions, and which offers you interact with.
How We Use Your Data
Each use maps to a purpose we can point to in this policy. We do not profile you beyond fraud detection and responsible-gambling monitoring.
- Creating and maintaining your player account, including password resets and login security.
- Verifying your identity, age and payment method as part of our KYC process, which runs within 24 to 48 hours.
- Processing deposits and withdrawals through your chosen methods, including crypto transfers on the relevant blockchains.
- Preventing fraud, bonus abuse, chargeback schemes and multi-accounting by cross-checking gameplay and transaction signals.
- Monitoring for signs of problem gambling so we can act on our responsible-gambling tools, including deposit limits and session reminders.
- Sending you marketing messages when you have consented, and honouring your preferences when you have not.
- Meeting legal and regulatory obligations under our Curaçao licence, including anti-money-laundering reporting and tax or court orders where applicable.
Why the Law Lets Us
Performance of contract
To open your account, verify you and pay out winnings, we must process your identity and transaction data. This processing is necessary to perform the contract between you and us, and it stops when your account closes, subject to the retention periods below.
Legal obligation
Our licence requires us to verify your identity, keep transaction records for at least 5 years and report suspicious activity to the regulator. We cannot offer you the service without this processing, and no consent would remove it.
Legitimate interest
Fraud prevention, security monitoring and aggregated statistics on how the site performs rest on our legitimate interest in running a safe business. We weigh that interest against your expectations and keep the data scoped to the minimum the purpose needs.
Consent
Marketing emails, SMS and push notifications, and non-essential cookies, run on your consent only. You gave it through an affirmative action such as ticking a box, and you can withdraw it at any time through your account settings or a link in every message we send.
How Long We Keep It
We hold each category for the shortest period that satisfies our legal duties and your account needs. Where the law is silent, we delete once the purpose expires.
| Data category | Retention period |
|---|---|
| Identity data | For the life of your account, then 5 years after closure |
| Verification documents | 5 years after your last transaction, per AML rules |
| Transaction and wagering records | Minimum 5 years under our licence conditions |
| Technical and device data | Up to 12 months for security analysis |
| Marketing preferences | Until you withdraw consent or ask us to delete them |
| Closed-account data | 5 years, then deletion or anonymisation |
Who We Share Data With
We never sell your data. We share it only with processors and authorities that need it for a defined job, under written agreements that bind them to equivalent protection standards.
- Payment processors handling your deposits and withdrawals, including card acquirers, e-wallet providers and crypto payment gateways.
- KYC and AML verification providers that check your ID documents and screen transactions against sanctions lists.
- Our regulator, the Government of Curaçao, and law enforcement or courts when we are legally compelled to disclose.
- Analytics and hosting providers that help us keep the site stable, working with aggregated or pseudonymised data where possible.
- Game providers whose titles you play, receiving only your account ID and gameplay signals needed to run the session.
Your Rights Over Your Data
Whatever the legal basis, you can act on your data directly through our support team, available 24/7 via live chat or [email protected]. We respond within 30 days and verify your identity before making changes, which protects you from impersonation.
- Access: get a copy of the personal data we hold about you.
- Rectification: correct anything inaccurate or incomplete.
- Erasure: ask us to delete data we no longer need, subject to the 5-year regulatory minimum.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest, such as profiling for fraud checks.
- Withdrawal of consent: switch off marketing at any time without affecting your account.
- Complaint: raise a concern with us first, then with the Office of the Australian Information Commissioner (OAIC) if you remain unsatisfied.
Cookies and Site Security
Cookies in short
On security, all traffic to spinsamurai-aud.com runs over TLS encryption, identity documents sit in access-controlled storage separate from gameplay databases, and staff reach personal data only on a need-to-know basis with logged access. We test our defences regularly, keep backups encrypted, and if a breach affects your data we will notify you and the relevant authority without undue delay.
Contact Our Data Team
Questions about this policy, a data request or a privacy complaint go to our data protection officer at [email protected]. Written requests reach us at our support address, [email protected], or through 24/7 live chat, and we route them to the DPO the same working day. We review this policy whenever our processing changes and publish the updated version here.
Frequently Asked Questions
How do I request a copy of my data?
Email [email protected] or message our 24/7 live chat with the subject line 'data access request'. We verify your identity and send your records within 30 days.
Can I delete my account and my data?
You can close your account at any time through self-exclusion or by contacting support. Identity and transaction records are then kept for the 5-year minimum our Curaçao licence requires, after which we delete or anonymise them.
How do I stop marketing messages?
Withdraw consent in your account settings, use the unsubscribe link in any email, or ask live chat to remove you. We stop marketing messages immediately while keeping your account untouched.
Do you share my ID documents with anyone?
Only with the KYC verification providers that check them and, where compelled, with our regulator or law enforcement. Documents stay in access-controlled encrypted storage for the retention period, then we destroy them.
Is my gameplay data used for anything else?
Gameplay signals feed fraud detection and responsible-gambling monitoring, both based on our legitimate interest. We do not sell them or use them for unrelated profiling.