Privacy And Security Policy
Gambling accounts cannot be anonymous. Money has to be traceable, ages have to be proven, and record-keeping duties outlive the account itself. This policy sets out the consequences of that for you: the exact items requested, the reason attached to each, the parties that receive them, the period they survive, and the requests you can make about them.
Australian players are protected by the Privacy Act 1988 (Cth) and by the Australian Privacy Principles (APPs) it contains. Sections are numbered so a specific answer can be found and quoted without reading the rest.
1. What is requested, and when
| Category | Specific items | Point of collection |
|---|---|---|
| Identity | Full legal name, date of birth, country of residence, nationality where relevant | Registration, then again at verification |
| Contact | Email address, phone number, residential address | Registration and account updates |
| Account | Username, hashed password, chosen currency, communication settings, any responsible gambling limits | Registration and ongoing use |
| Verification (KYC) | Government photo ID (passport, driving licence or equivalent), evidence of your residential address, evidence that a payment instrument is yours | Before a first withdrawal, or when a check is triggered |
| Financial | Deposit and withdrawal records, amounts, timestamps, truncated card identifiers, payout account or wallet details | Every transaction |
| Gameplay | Titles opened, stakes, session duration, bonus opt-ins and wagering progress | Automatically during play |
| Technical | IP address and the approximate location it indicates, device model, operating system, browser, language, cookie identifiers | Automatically on every visit |
| Correspondence | Chat transcripts, support emails, notes made while handling a query or complaint | Whenever you get in touch |
Full card numbers and the three-digit security code are never written to ReefSpins systems. Those details pass to the payment provider and stay there.
2. The reason behind each request
Nothing above is gathered speculatively, and the basis differs by category.
Delivering the service you signed up for. Registration, sign-in, balances, gameplay, payouts and support all require the identity, account and financial records listed above. Withhold them and there is no account to run.
Meeting legal duties. Age checks, identity verification, anti-money-laundering and counter-terrorism-financing obligations, transaction record-keeping and responses to lawful requests from authorities. This basis is not negotiable, because it is imposed by law rather than chosen commercially.
Protecting the platform and its players. Technical, gameplay and payment signals are examined to spot duplicate registrations, promotion abuse, stolen payment instruments and unauthorised access attempts.
Improving the product. Aggregated, de-identified analysis showing where pages fail, where deposits stall, and which parts of the site frustrate people.
Marketing. Emails and messages about offers, sent only where you have opted in.
The line between the last of those and the rest is the one worth being clear about. Marketing consent is optional and can be pulled at any moment without touching anything else. Identity, verification and payment data sit in a different class: without them nothing can be verified, no deposit can be accepted and no payout can be released.
3. Who receives your information
It is not sold, rented or traded, and it is disclosed only where a specific function requires it. Recipients fall into six groups:
- payment providers and financial institutions, for processing transactions and investigating disputed ones;
- identity verification services, which confirm documents are authentic and belong to the applicant;
- game studios, which receive the technical details needed to run a session and settle its outcome;
- infrastructure and analytics suppliers working under contract, permitted to process data only as instructed;
- regulators, law enforcement bodies and courts, where a lawful obligation or valid order applies;
- auditors and legal advisers bound by professional confidentiality.
Every commercial recipient signs an agreement restricting how the information may be used and requiring it to be protected.
4. Data that travels outside Australia
Some suppliers, and some of the servers running the platform, are located overseas. Support, verification and hosting functions can therefore involve handling abroad.
APP 8 governs that situation, and it is treated as a real obligation rather than a formality: before information goes to an overseas recipient, reasonable steps are taken to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles, through contract terms covering security standards, limited use and breach notification. If the destinations relevant to your own account matter to you, ask through the route in section 11 and you will be told them.
5. Your rights, and the steps to use them
Every right below can actually be used, not merely cited.
Access. Email a request from your registered address asking for a copy of what is held about you. Expect an acknowledgement, then a substantive answer inside a reasonable window, normally 30 days.
Correction. Contact details can generally be edited in your account settings. Changing a verified name or date of birth needs a supporting document, since those fields are locked to the identity check.
Deletion. Ask, and everything that can lawfully be removed will be. Read section 6 first, because the word does not mean total erasure where retention duties apply.
Withdrawing marketing consent. Use the unsubscribe link in any promotional message, or change the preference in your account. Operational messages about payments, verification and account security continue, as they are not marketing.
Complaining. Raise it through the contact route below first. If the response leaves the matter unresolved, privacy complaints are accepted by the Office of the Australian Information Commissioner, whose site is oaic.gov.au. The OAIC is an independent regulator; it is not affiliated with this operator, and referring a complaint there is your right rather than a favour.
6. How long records are kept
Account and transaction data is held while the account is open and for a defined period after it closes. Anti-money-laundering and financial record-keeping rules set the floor, and that floor is measured in years: verification documents and transaction histories are typically retained for at least five years from account closure or from the completion of the transaction, with longer retention where an investigation, dispute or legal proceeding is running.
Stated bluntly, because vagueness here would be misleading: a deletion request clears what is legally clearable, such as marketing profiles, stored preferences and correspondence no longer needed. It does not wipe records a law requires to be kept, and any operator claiming otherwise is describing something that cannot happen. When a retention period ends, the material is destroyed or de-identified.
Self-exclusion data is retained on purpose, through the term and past its end, since an exclusion with no record behind it could not be enforced at all.
7. Security measures
Traffic moving from your device to the platform is encrypted along the way. Stored data sits on access-controlled systems; passwords are kept as hashes rather than readable text; verification documents are separated from ordinary account records and visible only to the staff performing identity checks. Access is granted by task, not by seniority.
No arrangement is beyond compromise, and your habits carry weight. Pick a password used on no other service, keep it to yourself, and assume that any request to confirm account details via an emailed link is an attack until you have signed in independently and checked. Support communicates by live chat and email, never asks for your password, and no telephone line is published, so a caller claiming to represent ReefSpins Casino Australia is not who they say they are.
8. Cookies and tracking
Cookies, local storage and similar technologies support sign-in sessions, security, saved preferences, analytics and advertising. Categories, durations, third-party sources and the method for switching off non-essential tracking are set out in full in the Cookie Policy on this site.
9. People under 18
ReefSpins casino is for adults, from 18 upwards. No account is knowingly opened in a minor's name, and no data belonging to a minor is knowingly gathered.
Should an underage registration come to light, the account is shut, gameplay results are cancelled, and the personal data collected is erased except for the minimum needed to evidence that closure. Tell us at once, through the route below, if you believe someone underage has signed up on your device or with your details.
10. Changes to this policy
The policy is revised when the law, the supplier chain or internal practice changes. The version published here, with its effective date, is the operative one. Material changes are flagged at your next sign-in, and continued use of the account after a revision means the updated version applies to you.
11. Contacting us about your data
Use [email protected] for privacy requests, questions about this document and privacy complaints; live chat on the site works too. Send email from the address registered to the account, because that is what allows the request to be tied to you without further checks.
This brand publishes no dedicated Data Protection Officer mailbox. The support channel above is the correct destination, and a privacy request arriving there is treated as a formal request rather than a general enquiry.