Privacy Act 2020
Every right listed on this page has an instruction attached to it, because a right you cannot work out how to use is not much of a right.
Privacy Policy: What Casino Kingdom Collects, Why, and What You Can Make Us Do About It
Three commitments, before the detail
Your information is never sold, and it never reaches an advertising network. Marketing consent is optional and refusing it changes nothing about your ability to deposit, play or withdraw. And every right listed further down this page has an instruction attached to it, because a right you cannot work out how to use is not much of a right.
Everything below sits under the Privacy Act 2020 and its Information Privacy Principles. Where the Act sets a higher standard than another jurisdiction the operation touches, the Act's standard is the one applied to a New Zealand player's data. The operator is Rock Swift Group Limited, holding licence 00884 from the Kahnawake Gaming Commission, whose conditions impose record-keeping duties reflected throughout this policy.
What gets collected, and when
Grouping by moment is more useful than grouping by category, because it shows you what is being asked for and why at the point you are being asked.
When you register. Full name, date of birth, email address, contact details, residential address, chosen username, a hashed password, account currency and communication preferences.
When you use the cashier. Deposit and withdrawal history, the identifier of each payment method, partial card numbers, and wallet addresses where crypto is used. Full card numbers are captured by the payment provider on its own systems and never reach ours. What is kept is enough to recognise a method and reconcile a transaction, not enough to charge anything.
When verification is triggered. A photographic identity document, proof of address, and where a threshold is met, evidence of source of funds, along with the results of the screening checks run against them.
While you play. Games opened, stake and session history, bonus participation, and any limits or exclusions you have set.
Automatically, on every visit. IP address, device and browser type, operating system, time zone and session identifiers.
The reason behind each collection
| Purpose | Data used | Basis |
|---|---|---|
| Running the account | Identity, contact, account, financial | Contractual. Without it there is no account to operate |
| Anti-money laundering, age and licensing duties | Verification, transactions, screening results | Legal obligation. Not dependent on your consent and not refusable |
| Fraud prevention and platform integrity | Technical, behavioural | Legitimate interest in detecting duplicate accounts, bonus abuse and account takeover |
| Enforcing safer gambling controls | Limits, exclusions, play patterns | Legal and operational. A limit cannot be enforced without the record of it |
| Marketing | Contact details | Consent, given by opt-in and withdrawable at any time |
Only the last row is optional. That distinction is deliberate and worth holding on to: marketing consent can be withdrawn this afternoon with no consequence, while verification data cannot be withdrawn at all while the account exists.
Who else sees it
Disclosure happens in a defined set of circumstances and nowhere outside them.
- Payment providers and banks receive only what a specific transaction requires.
- Verification and screening agencies receive documents and identifiers to confirm identity and run the checks the law requires.
- Game suppliers, meaning Games Global and Evolution, receive a pseudonymous player identifier and gameplay data so games and live tables function and remain auditable. Identity documents are not shared with them.
- The Kahnawake Gaming Commission receives records on request, including in a dispute you have raised yourself.
- Law enforcement, courts and regulators receive data where a lawful basis compels it.
- Technical providers covering hosting, email delivery, analytics and fraud tooling process data under written contract, on instruction, for no purpose of their own.
No category above involves payment for your data, and none of it involves advertising profiles.
Data leaving New Zealand
It does leave. The operating company is registered in the British Virgin Islands, the licensing authority sits in Canada, and technical providers run infrastructure across several jurisdictions.
Information Privacy Principle 12 governs this. Personal information may only be sent to a foreign party subject to comparable safeguards, either under that country's law or by binding contractual terms. Overseas processors handling casino kingdom nz player data are bound in writing on confidentiality, security standards, breach notification and onward transfer.
Your rights, and the exact way to use each one
| Right | How to exercise it | What to expect |
|---|---|---|
| Access what is held | Email the privacy address below from your registered address | A response within 20 working days, as the Act requires |
| Correct an inaccuracy | Same route, stating what is wrong and what it should say | Corrected, or a statement of correction attached if we disagree |
| Withdraw marketing consent | Account preferences panel, or the unsubscribe link in any promotional message | Takes effect immediately |
| Request deletion | Email the privacy address, from the registered address | Granted for anything not held under a retention obligation. See the section below |
| Complain | To us first, then the Office of the Privacy Commissioner at privacy.org.nz | Independent review if our answer does not satisfy you |
Identity is confirmed before any information is released, which is a protection for you rather than an obstacle. If a 20 working day response needs extending, you will be told before the original period expires, not after.
How long things are kept
Verification, anti-money laundering and transaction records are held for a minimum of five years after the account closes, because licence conditions and AML law require it. Account and gameplay history is retained for the life of the account and then falls inside that same window. Support correspondence is kept for up to two years after a matter closes, longer if it forms part of a dispute. Technical logs roll over on a short cycle. Records of marketing consent, and of its withdrawal, are kept as long as needed to prove which was given.
Self-exclusion records are the exception to everything above: they are held indefinitely, because an exclusion that cannot be checked cannot be enforced. Where an investigation or dispute is open, the relevant records are preserved until it concludes even if a retention period would otherwise have run out.
What deletion actually does
It is worth being exact, because "delete my data" and what the law permits are not the same thing.
A deletion request stops marketing immediately, removes optional profile details, and locks restricted records so they serve only the legal purpose that requires them, meaning no profiling, no reactivation prompts, no marketing. When the retention period expires, what remains is destroyed.
What it cannot do is erase verification and transaction records inside the five year AML window, or remove a self-exclusion record while that exclusion is meant to hold. No request overrides either, and any casino claiming otherwise is describing something it is not permitted to do.
Cookies and tracking
Three kinds are in use. Essential cookies hold your session, keep casino kingdom login working and protect against cross-site request forgery; blocking them breaks sign-in. Performance cookies count page loads and errors in aggregate so faults can be located. Marketing cookies measure which campaigns bring players here and are set only where you have accepted them in the consent banner.
Consent can be changed at any time through the cookie settings link, and your browser can block or clear cookies independently. Where a browser sends a Do Not Track or Global Privacy Control signal, non-essential tracking is not applied.
Security measures
Traffic between your device and our servers is encrypted in transit with TLS, which is what the padlock in the address bar indicates. Passwords are stored as salted hashes, so nobody working here can retrieve what you typed. Two-factor authentication is available and worth switching on, particularly if the same email address is used across other gambling or payment services. Passkey sign-in, where your device unlock replaces the password entirely, removes the phishing risk altogether. Access to verification documents is limited to staff whose role requires it and every access is logged.
Your side of it matters as much. Use a password that appears on no other site, secure the email account that can reset it, and treat any request for a password or a screenshot of your cashier as fraudulent regardless of who it appears to come from. Verification documents are uploaded inside your account and never sent to an individual through chat or social media.
People under 18
Accounts are for adults. Information about under-18s is not knowingly collected or held. Where an account is found to belong to a minor it is closed, play is voided, deposits are returned to the funding source, and the personal data is destroyed apart from the minimum record needed to document the closure and prevent re-registration. Reports of underage access are treated as urgent and can be sent to the address below.
Changes, and how to reach a person
Amendments are published on this page, and anything material is notified by email or account message before it takes effect.
For any request, question or complaint about your data, write to the Data Protection Officer at [email protected] from the email address registered on your account. Requests arriving from another address will be answered with a verification step first.
If our answer does not resolve it, the Office of the Privacy Commissioner reviews complaints independently of casino kingdom new zealand and of every other operator, at privacy.org.nz.