How we handle your data

Blockchain Casino has operated under licence 8048/JAZ2014-067 since 2014, and everything in this policy applies to every account you hold with us at blockchain-aud.com. It sets out what we collect, why we hold it, and the choices open to you.

Data Blockchain Casino collects

We collect only the categories we need to run your account, meet our licensing obligations and keep the site safe. You give most of this to us directly; a smaller part comes from your device and your activity on the site.

• Identity data: full name, date of birth, residential address, email address and phone number.
• Verification documents: passport, driver licence or national ID, proof of address (utility bill or bank statement), and source-of-funds evidence where required.
• Transaction data: deposits, withdrawals, bonus redemptions (including promo code BLOCK150), wallet addresses for crypto transfers and payment method identifiers.
• Technical data: IP address, device type, operating system, browser, language setting and approximate location derived from your IP.
• Gameplay behaviour: games played, session times, wagering history, win/loss records and tournament entries.
• Marketing preferences: which channels you opted into, which messages you opened and how you unsubscribed.

How we use your data

Each use below ties back to a specific purpose, not a catch-all. If we ever want to use your data for something new, we ask first or rely on a lawful basis we set out in the next section.

• Creating and running your account, including login, balance and bonus tracking.
• Verifying your identity before your first withdrawal, as our Curaçao licence requires.
• Processing deposits and withdrawals across AUD and supported currencies.
• Fraud prevention, anti-money-laundering checks and detection of duplicate or prohibited accounts.
• Responsible-gambling monitoring, including deposit limits, loss limits, session reminders and self-exclusion enforcement.
• Sending promotions and newsletters, only where you consented, honouring Gambling Help Online signposts on request.
• Meeting legal, regulatory and audit obligations owed to our licensing authority.

Our legal bases

For visitors from the EU, the GDPR requires a lawful basis for every processing activity, and we apply the same standard for all players regardless of location.

• Contract: creating your account, processing your wagers and paying out winnings are all necessary to perform the agreement you enter with us on registration.
• Legal obligation: KYC verification, record keeping and suspicious-transaction reporting follow directly from our licence conditions and anti-money-laundering law, so we cannot skip them even if you ask.
• Legitimate interest: fraud prevention, security monitoring, aggregate game analytics and service improvement rest on our legitimate interest in running a safe, functional casino. We weigh this against your rights and keep it to the minimum needed.
• Consent: marketing emails, SMS and personalised bonus offers run only on your consent. You can withdraw it at any time through account settings or the unsubscribe link in every message, with no effect on your gameplay.

How long we keep it

We do not hold data indefinitely. Each category has a defined clock, and the gambling regulations we operate under require a minimum of five years for financial and KYC records after an account closes.

The table below shows the retention period for each category. When a period ends, we delete or irreversibly anonymise the data, and backups roll off within 90 days.

Who we share with

We never sell your personal data. Sharing is limited to the processors and authorities we genuinely need to run the service, and every contract we sign binds them to confidentiality and security standards at least equal to ours.

• Payment processors handling your deposits and withdrawals, including card schemes, e-wallet operators and crypto payment gateways.
• KYC and AML verification providers that check your ID documents and screen transactions against sanctions lists.
• Our licensing authority and, where legally compelled, financial regulators, courts or law enforcement.
• Analytics and hosting providers working under our instructions, processing only aggregated or pseudonymised data.
• Game and platform suppliers that receive your account ID to deliver gameplay, never your full identity, unless a payout requires it.

Your rights over data

Australian players can rely on the Australian Privacy Principles, and EU players additionally have the full set of GDPR rights. In both cases we respond within 30 days and never charge a fee unless a request is clearly excessive or repetitive.

• Access: get a copy of the personal data we hold about you.
• Rectification: correct anything inaccurate or incomplete.
• Erasure: request deletion, noting that our five-year regulatory retention can override this for transaction and KYC records.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest, particularly analytics.
• Withdrawal of consent: switch off marketing at any time from account settings or any unsubscribe link.
• Complaint: contact the Office of the Australian Information Commissioner, or your local data protection authority if you are in the EU, if you believe we mishandled your data.

Cookies and tracking

We use session cookies to keep you logged in, preference cookies to remember settings like currency and language, and, with your consent, analytics cookies that tell us which pages and games perform well. You can reject non-essential cookies in the consent banner or your browser settings without losing access to your account.

Our full cookie inventory, including lifespans and the third parties involved, sits on our dedicated Cookies Policy page.

Security we maintain

All traffic between your device and our servers runs over TLS 1.3 encryption, and stored verification documents and financial records sit encrypted at rest with keys held separately. Access to personal data follows least-privilege rules: only staff whose role requires it can view it, and every access is logged and reviewed monthly.

Crypto transactions add an extra layer, since blockchain transfers expose no card or bank details to us at all. We test our defences with quarterly penetration audits and keep a written incident response plan on file.

If a breach occurs that risks your rights, we notify the relevant supervisory authority within 72 hours and tell affected players directly, without undue delay, with clear steps on what to do next.

Frequently Asked Questions

Do you share my data with marketing companies?

No. We run our own campaigns in-house, and external analytics providers only see pseudonymised data under strict contracts. Your details are never sold or rented to anyone.

Can I delete my KYC documents before five years?

Unfortunately no. Our Curaçao licence obliges us to keep identity and transaction records for at least five years after account closure, so an erasure request cannot override this for those categories. Everything else gets deleted on request.

How do I stop marketing messages?

Open account settings and switch off any channel, or click the unsubscribe link in any email we sent. Consent withdrawal takes effect immediately and does not affect your account or bonuses already credited.

Who do I contact about a privacy question?

Email [email protected] and our data protection officer will respond within 30 days. If your complaint is unresolved, you can escalate it to the Office of the Australian Information Commissioner.