Log inRegister

Privacy Policy | Papayawins Casino Data Protection

This Privacy Policy explains what personal data we at Papayawins Casino collect when you play with us, why we collect it, who we share it with and the rights you hold over it. We operate under licence MGA/B2C/823/2020 and process your data in line with the UK GDPR and the Data Protection Act 2018.

The Data We Collect

Categories of personal data

We collect only the data needed to run your account, verify your identity and meet our regulatory duties. Here is every category, with concrete examples of what it covers.

  • Identity data: full name, date of birth, email address, telephone number and residential address.
  • Verification documents: photo ID (passport or driving licence), proof of address and payment method evidence, required before your first withdrawal.
  • Transaction data: deposits, withdrawals, bonuses, wagering history and Bitcoin transaction references where applicable.
  • Technical data: IP address, device and browser type, operating system and approximate location.
  • Gameplay behaviour: games played, session times, stakes, wins and losses.
  • Marketing preferences: which communications you consented to receive and on which channels.

How We Use Your Data

Your data powers the account itself: we create it, verify you under KYC rules, process deposits and withdrawals through Visa Debit, Trustly, Skrill, Bitcoin and other supported methods, and keep an auditable record of every transaction. That record protects both of us when a payment or bonus is disputed.

  • Account creation, login and account management.
  • KYC and anti-money-laundering verification before first withdrawal.
  • Payment processing, refund handling and fraud prevention.
  • Responsible-gambling monitoring, including deposit and loss limits you set.
  • Marketing by email or SMS, only where you have consented.
  • Legal and regulatory obligations, including reports to the Malta Gaming Authority.

Contract: we process identity, transaction and gameplay data to perform the agreement you accept when you register. Without it we cannot hold your balance or pay winnings.

Legal obligation: gambling law requires us to verify your age and identity, run AML checks and retain transaction records, so we process verification documents and financial data regardless of other bases.

Legitimate interest: fraud prevention, security monitoring and service improvement rely on our legitimate interest in keeping the platform safe, balanced against your rights through minimisation and anonymised analytics.

Consent: marketing emails, SMS promotions and non-essential cookies run only on your consent, which you may withdraw at any time without affecting your account.

How Long We Keep It

We do not hold data forever. Each category has a defined clock, set either by gambling regulation or by the purpose it serves.

  • Transaction and KYC records: at least 5 years after account closure, as required by AML and licensing rules.
  • Identity and account data: for the life of your account, then up to 5 years where regulation demands it.
  • Gameplay behaviour data: up to 5 years for responsible-gambling and dispute purposes.
  • Marketing preferences and consent logs: until you withdraw consent, then kept briefly as proof of withdrawal.
  • Technical and analytics data: up to 24 months in aggregated or anonymised form.
  • Verification documents: deleted within 30 days after your withdrawal verification is complete, unless regulation requires longer.

Who We Share It With

We never sell your data. Sharing is limited to partners who need it to deliver a service you use, and each one is bound by a data processing agreement.

  • Payment processors handling your Visa Debit, Mastercard, Trustly, Skrill, Neteller and Bitcoin transactions.
  • KYC and AML verification providers checking your documents against sanctions and PEP lists.
  • Regulators and law enforcement, including the Malta Gaming Authority, where a lawful request is made.
  • Analytics and hosting providers acting on our instructions under contract.
  • Game providers receiving only the minimum data needed to load your session.

Your Rights Over Your Data

UK and EU data protection law gives you direct control, and we answer every request within one month. Some rights, such as erasure of transaction records still inside their statutory retention window, are limited by our regulatory duties; we will tell you when and why that applies.

  • Access: get a copy of the personal data we hold about you.
  • Rectification: correct inaccurate or incomplete details.
  • Erasure: request deletion where no legal basis to retain applies.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: stop marketing or consent-based processing at any time.
  • Complain: escalate to the Information Commissioner's Office (ICO) or your local data protection authority.

Cookies and Tracking

We use strictly necessary cookies for login and security, analytics cookies to understand how the site performs and, only with your consent, marketing cookies that personalise offers. You can change your cookie choices at any time from the cookie banner or your browser settings. Full details, including a per-cookie breakdown and how to withdraw consent, sit on our dedicated Cookies Policy page.

Our Security Measures

All traffic between your device and our servers is encrypted with TLS, and payment data is handled exclusively by PCI DSS certified processors. Access to your records inside Papayawins is role-based and logged; only staff who need it for verification, support or fraud checks can see it, and we review those permissions regularly.

If a personal data breach ever occurs, we will notify the relevant supervisory authority within 72 hours and inform you directly where the breach poses a high risk to your rights.

Contact Our Data Protection Officer

Questions, data subject requests or complaints about this policy go to our Data Protection Officer at [email protected]. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension. Since we launched in 2026, our support team has also been available 24/7 via live chat and at [email protected] for anything urgent.

Frequently asked questions

Can I delete all my data from Papayawins Casino?

You can request erasure at any time via [email protected]. We delete marketing data immediately, but transaction and KYC records must be retained for at least 5 years after account closure under gambling regulation, after which they are erased automatically.

Do you share my data with game providers?

Game providers receive only the minimum data needed to load your session, such as an anonymous session token. They never see your payment details or verification documents.

How do I stop marketing emails?

Use the unsubscribe link in any email, edit preferences in your account settings or withdraw consent through the cookie banner. Marketing stops immediately and we log the withdrawal as proof.