Privacy Policy | Spinroo Casino Australia

01 What we collect

Registration details, verification documents, transaction records and technical data from your device.

We only ask for information we actually need to run a licensed casino account. That falls into four groups.

Details you give us

Name, date of birth, residential address, email address and phone number, taken at sign-up.
Identity and address documents supplied during verification — passport or driver licence, plus a recent utility bill or bank statement.
Payment instrument details, such as the card or wallet you fund the account with. Full card numbers are handled by our payment providers, not stored in full on our systems.
Anything you write to us: live chat transcripts, emails, complaint forms.

Details generated by your play

Deposits, withdrawals, bets, wins, bonus claims and loyalty point movements across all 4,368 games.
Which VIP tier you sit in and how you got there.
Any limits, time-outs or self-exclusions you have set.

Details collected automatically

IP address, approximate location derived from it, device type, operating system and browser.
Session timestamps, pages viewed and referring links.
Cookie identifiers — described in full in our Cookies Policy.

02 Why we collect it

To open and run your account, to satisfy licence conditions, to stop fraud, and to improve the site.

Every piece of data above is tied to at least one of the following purposes. If a purpose ends, so does our reason for holding the data.

Purpose	What it covers	Why we are allowed to
Running your account	Registration, deposits from $5, withdrawals up to $10,000, bonus and loyalty tracking	Performance of our contract with you
Age and identity checks	Confirming you are 18 or over and that you are who you say you are	Legal obligation under our licence
Anti-money-laundering	Monitoring transaction patterns, source-of-funds questions on large deposits	Legal obligation
Safer gambling	Spotting risky play patterns, honouring limits and self-exclusions	Legal obligation and our duty of care
Fraud and bonus abuse	Detecting duplicate accounts, chargebacks and collusion	Our legitimate interest in a fair casino
Service messages	Withdrawal confirmations, security alerts, policy changes	Performance of our contract
Marketing	Offers, free spin drops, tournament reminders	Your consent, withdrawable at any time
Site improvement	Aggregated analytics on which pages and games get used	Our legitimate interest, with consent for analytics cookies

03 Verification and source of funds

Verification is mandatory before your first withdrawal, and sometimes again later.

Our Malta Gaming Authority licence requires us to know who holds every account. We will ask for documents at registration, before your first cashout, or when a deposit pattern triggers a review.

Documents are reviewed by our compliance team and stored encrypted. They are not used for marketing and are never sold. If a document is rejected we will tell you why and what to send instead.

Withdrawals and verification

Cashouts run on a 24 to 48 hour clock, but that clock starts once verification is complete. Getting documents in early is the single best way to keep the $30 minimum withdrawal moving quickly.

04 Who else sees your data

Payment processors, verification providers, game studios, our regulator, and nobody else.

We do not sell personal data. We share it only where the account cannot function without it, or where the law requires it.

Payment providers — card acquirers, e-wallet operators and crypto processors handling your deposits and withdrawals.
Identity verification services — specialists who check documents against official records.
Game studios — the 88 providers behind the lobby receive the minimum needed to run a session and settle a bet.
The Malta Gaming Authority and other lawful authorities, on request or where we are obliged to report.
Self-exclusion registers, where you have asked to be added.
Technical suppliers — hosting, email delivery and support-desk software, all bound by written data agreements.

Where a supplier sits outside the European Economic Area, transfers are covered by standard contractual clauses or an adequacy decision.

05 Cookies and tracking

Essential cookies keep you signed in; everything else waits for your consent.

We use cookies to hold your session, remember display preferences, measure traffic and, with permission, tailor promotions. The full breakdown — category by category, with lifespans — sits in our Cookies Policy.

You can withdraw cookie consent at any time from the banner or from your browser settings. Essential cookies cannot be switched off, because without them the site cannot keep you logged in.

06 How long we keep things

Account and transaction records are kept for at least five years after closure; marketing consent dies with your account.

Data	Kept for
Account and identity records	Five years from account closure, as anti-money-laundering rules require
Transaction and gameplay history	Five years from the transaction
Verification documents	Five years from account closure, then securely destroyed
Support conversations	Two years from the last message
Marketing preferences	Until you withdraw consent or the account closes
Self-exclusion records	Retained permanently, so an exclusion cannot be accidentally undone
Analytics cookie data	Up to 24 months

07 Your rights, and how to use them

Access, correction, deletion, restriction, portability and objection — free of charge, answered within 30 days.

Write to [email protected] from the address on your account, or raise it in live chat and ask for it to go to the data team. We answer within 30 days.

Access — a copy of everything we hold about you.
Correction — fix anything inaccurate, such as a misspelled name or an old address.
Deletion — removal of data we no longer have a legal reason to keep. Records we must retain for anti-money-laundering purposes are the exception.
Restriction — pause our use of your data while a dispute is resolved.
Portability — your data in a machine-readable file.
Objection — stop processing based on legitimate interests, and stop marketing outright.
Withdraw consent — at any time, without affecting anything done before you withdrew it.

One thing deletion will not undo

If you have self-excluded, we keep that record even after an account is deleted. Removing it would let the exclusion be bypassed, which defeats the point of asking for it.

08 How we protect it

Encryption in transit and at rest, segregated player funds, and access limited to staff who need it.

All traffic between your device and our servers runs over TLS.
Verification documents and identity records are encrypted at rest.
Access is role-based: support agents see what they need to answer you, and nothing more.
Player balances are held separately from operating funds, as our licence requires.
Payment card details are handled inside our providers’ PCI-compliant environments.

No system is perfect. If a breach ever affects your rights, we will notify you and the regulator within the timeframes the law sets.

09 Age limits

Strictly 18+. Accounts opened by minors are closed and stakes returned.

We do not knowingly collect data from anyone under 18. Age is checked at registration and again during verification. If we find that an account holder is underage, the account is closed immediately, deposits are returned and any winnings are void.

If you share a device, consider filtering software such as Net Nanny or Qustodio, and never save your password in a shared browser. More on this in Responsible Gaming.

10 Changes and contact

Material changes are announced by email and on-site before they take effect.

We review this policy at least annually and whenever we change how data is handled. Minor wording fixes appear here with an updated review date. Anything that materially affects your rights is emailed to you and flagged on the site before it starts.

Questions, requests or complaints: [email protected], or 24/7 live chat. If you are not satisfied with our answer, you may complain to the Malta Gaming Authority or to your local data protection authority.