Privacy Policy: How Casino Kingdom Handles Player Data in New Zealand
What is collected, why it is held, who sees it, how long it stays, and what you can require us to do about it under the Privacy Act 2020 and its Information Privacy Principles.
Scope of this document
This policy explains what happens to information about you once it reaches Casino Kingdom: what is collected, why it is held, who sees it, how long it stays, and what you can require us to do about it. It covers every visitor and every registered account.
The governing framework for New Zealand players is the Privacy Act 2020 and its Information Privacy Principles. Where those principles set a higher standard than another jurisdiction we operate under, the Privacy Act standard applies to your data. The gaming operation is run by Rock Swift Group Limited under licence 00884 from the Kahnawake Gaming Commission, whose conditions impose record-keeping duties reflected below.
Categories of information collected
| Category | Examples |
|---|---|
| Identity | Full name, date of birth, gender where supplied, nationality |
| Contact | Email address, mobile number, residential address |
| Account | Username, hashed password, currency, communication preferences, correspondence with support |
| Financial | Deposit and withdrawal history, payment method identifiers, partial card numbers, wallet or crypto addresses used for transfers |
| Verification | Photo identity documents, proof of address, source of funds evidence where a threshold is triggered, screening results |
| Technical | IP address, device and browser type, operating system, time zone, session identifiers |
| Behavioural | Games opened, stake and session history, bonus participation, limits and exclusions you have set |
Full card numbers are captured by our payment providers on their own systems, never ours. What we retain is enough to recognise a payment method and reconcile a transaction, not enough to charge a card.
Why each type is held
Purpose is what matters legally, so reasons are set out per activity.
- Operating your account. Identity, contact, account and financial data are processed to open the account, credit deposits, settle withdrawals, apply bonuses and answer your support messages. Without this data there is no account to run.
- Legal and licensing obligations. Verification data, transaction records and screening results are processed to meet anti-money laundering and counter-terrorism financing duties, age verification requirements and the reporting conditions attached to the gaming licence. This processing is not optional and does not depend on your consent.
- Fraud prevention and platform integrity. Technical and behavioural data supports detection of duplicate accounts, bonus abuse, payment fraud and account takeover attempts. This is a legitimate operational interest.
- Safer gambling. Limits, exclusions and play patterns are processed so the controls you set are enforced and concerning patterns can be identified.
- Marketing. Contact details are used for promotional email and SMS only where you have opted in.
That last point sits apart from the rest. Marketing consent is optional, withdrawable at any time, and refusing it changes nothing about your ability to deposit, play or withdraw. Verification and AML data is the opposite: mandatory, and an account cannot run without it.
Disclosure to third parties
Your information is not sold, rented or handed to anyone for commercial gain, and it never reaches advertising networks. Disclosure happens in a limited set of circumstances:
- Payment providers and banks receive what they need to process a specific deposit or payout.
- Identity verification and screening agencies receive documents and identifiers to confirm who you are and to run the checks required by law.
- Game suppliers, including Games Global and Evolution, receive a pseudonymous player identifier and gameplay data so that games and live tables function and are auditable. They do not receive your identity documents.
- The Kahnawake Gaming Commission receives records where the regulator requests them, including in a dispute you have raised.
- Law enforcement, courts and regulators receive data where there is a lawful basis to require it.
- Technical service providers (hosting, email delivery, analytics, fraud tooling) process data under contract, on instruction, and for no purpose of their own.
Transfers outside New Zealand
Your data will be processed outside New Zealand. The operating company is based in the British Virgin Islands, the licensing authority sits in Canada, and technical providers operate infrastructure across several jurisdictions. Under Information Privacy Principle 12, personal information is only sent to a foreign party that is subject to comparable safeguards, either under the law of that country or by binding contract. Overseas processors are bound by written terms covering confidentiality, security, breach notification and onward transfer.
Your rights, and how to use them
Under the Privacy Act 2020 you can:
- Access the personal information held about you and how it is used.
- Correct anything inaccurate, or attach a statement of correction if we disagree with the change.
- Withdraw marketing consent, through the account preferences panel or the unsubscribe link in any promotional message.
- Request deletion of information not covered by a retention obligation, with the limits explained below.
- Complain, to us first and then to the Office of the Privacy Commissioner at privacy.org.nz if you are not satisfied.
Send requests to [email protected] from the email address registered on the account, and state what you want done. Access and correction requests are answered within 20 working days, as the Act requires; if an extension is needed, you will be told before that period expires. Identity is confirmed before anything is released.
- Access
- Correct
- Withdraw marketing consent
- Request deletion
- Complain
Retention periods
| Data | Kept for |
|---|---|
| Verification, AML and transaction records | A minimum of five years after the account is closed |
| Account and gameplay history | The life of the account, then within the AML retention window above |
| Self-exclusion records | Indefinitely, because an exclusion cannot be enforced if the record is erased |
| Support correspondence | Up to two years after the matter is closed, longer if it forms part of a dispute |
| Marketing consent and opt-out records | For as long as needed to prove consent was given or withdrawn |
| Technical logs | A short rolling window for security and diagnostics, then overwritten |
Where a dispute or investigation is open, the relevant records are preserved until it concludes, even if a retention period would otherwise have expired.
What deletion actually achieves
A deletion request does not wipe every trace of you on demand. Anti-money laundering law and licence conditions require verification and transaction records to be held for at least five years from account closure, and no request can override that. Self-exclusion records are kept for as long as the exclusion needs to hold, which for a permanent exclusion means permanently.
What deletion does achieve: marketing stops immediately, optional profile details are removed, and restricted records are locked so they serve only the legal purpose requiring them, not marketing, profiling or reactivation prompts. When the retention clock runs out, what remains is destroyed.
Security measures
Traffic between your device and our servers is encrypted in transit. Passwords are stored as salted hashes, so nobody working here can look up what you typed. Two-factor authentication is available and worth enabling, particularly if the same email address is used across other gambling or payment services. Access to verification documents is restricted to staff whose role requires it and is logged.
On your side: use a password that appears nowhere else, keep your email account secured, and never share a screenshot of the cashier or a verification document with anyone claiming to be from support, because we will not ask for one through chat apps or social media.
Full card numbers never reach our systems: payment providers capture them on their own. What is retained is enough to recognise a method and reconcile a transaction.
- Traffic encrypted in transit
- Passwords stored as salted hashes
- Two-factor authentication available
- Document access restricted by role and logged
People under 18
Accounts are for adults only, and information about under-18s is not knowingly collected or held. If an account is found to belong to a minor, it is closed, play is voided, deposits are returned to the funding source, and the personal data is destroyed apart from the minimum record needed to document the closure and block re-registration. Reports of underage access can be sent to the privacy address below and are treated as urgent.
Changes and contact
Amendments to this policy are published on this page, and material changes are notified by email or an account message before they take effect. Continuing to use the site after that point means the current version applies to you.
For any privacy question, request or complaint, write to the Data Protection Officer at [email protected]. Questions about your rights in general, or an unresolved complaint about how Casino Kingdom handled your information, can also be taken to the Office of the Privacy Commissioner at privacy.org.nz.
Access, correction and deletion requests are answered within 20 working days. Marketing consent can be withdrawn at any time without touching your ability to deposit, play or withdraw.