Legal
What personal information is collected, why each category exists, who receives it, how long it is kept, and the rights you can exercise over it.
Privacy Policy
An online casino cannot run on anonymity. Payments have to be traceable, ages have to be checked, and anti-money-laundering rules require records that survive the closing of an account. This policy describes what that means for the information you hand over to ReefSpins, in specific terms rather than reassuring ones: what is collected, why, who else sees it, how long it stays, and what you can require us to do with it.
Australian players are covered by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set out in it. This document is written against that framework.
What is collected
Information reaches us in four ways: you type it in, you send it to us during verification, your payment method reports it back, or your device generates it while you use the site.
Identity information. Full legal name, date of birth, gender where provided, and nationality or country of residence.
Contact information. Email address, mobile or landline number, and residential address.
Account information. Username, password stored in hashed form, account currency, preferences, communication settings and any responsible gambling limits you have configured.
Verification (KYC) documents. A government-issued photo identity document such as a passport or driving licence, proof of address, for example a recent bank statement or utility bill, and where a payment method requires it, evidence that the card or account belongs to you.
Financial information. Deposit and withdrawal history, transaction amounts and times, partial payment identifiers such as the last four digits of a card, and the account or wallet details used to pay you.
Gameplay information. Games opened, stakes placed, session lengths, bonus participation and wagering progress.
Technical information. IP address, approximate location derived from it, device type, operating system, browser, language setting, and identifiers stored by cookies and similar technologies.
Correspondence. Live chat transcripts, emails to support, and notes recorded when a complaint or verification query is handled.
Full card numbers and the security code printed on a card are never stored on our systems. Those go directly to the payment provider.
Why each category is collected
Nothing on the list above is gathered speculatively. Each category maps to a specific reason.
| Purpose | What it covers | Basis |
|---|---|---|
| Running your account | Registration, login, balances, gameplay, payouts, support | Necessary to provide the service you asked for |
| Legal compliance | Age verification, identity checks, anti-money-laundering and counter-terrorism-financing obligations, record keeping, lawful requests from authorities | Required by law |
| Fraud and platform integrity | Detecting duplicate accounts, bonus abuse, payment fraud and unauthorised access | Legitimate interest in protecting players and the platform |
| Service improvement | Aggregated analysis of how the site performs and where players get stuck | Legitimate interest, in de-identified form wherever possible |
| Marketing | Promotional emails and messages about offers | Consent, given separately and withdrawable at any time |
That last row is the one to read twice. Marketing consent is optional and can be withdrawn without affecting anything else. Identity and payment information is not optional: refuse it and the account cannot be verified, funded or paid out, because those obligations are legal rather than commercial.
Who your information is shared with
Personal information is not sold, rented or traded. It is disclosed only where the disclosure is necessary, and only to these categories of recipient:
- Payment providers and financial institutions, to move deposits and withdrawals and to investigate disputed transactions.
- Identity verification services, to confirm documents are genuine and match the person opening the account.
- Game suppliers, which receive the technical information needed to deliver a game session and settle its outcome.
- Technology providers such as hosting, security and analytics services engaged under contract, permitted to process information only on our instructions.
- Regulators, law enforcement and courts, where there is a lawful obligation or a valid legal request.
- Professional advisers, including auditors and lawyers, where they are bound by confidentiality.
Every commercial recipient is engaged under an agreement restricting what they may do with the information and requiring them to protect it.
Information that leaves Australia
Some of the providers above, and the servers holding the platform, are located outside Australia. Handling, verification and support functions may therefore be carried out overseas.
Where information is disclosed to an overseas recipient, APP 8 applies: we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, through contractual commitments covering security, restricted use and breach notification. If you want to know which countries are involved in relation to your own account, ask, and you will be told.
Your rights and how to use them
Under the Privacy Act you have rights that are exercisable in practice, not just on paper.
Access. Request a copy of the personal information held about you. Send the request from your registered email address; requests are acknowledged and answered within a reasonable period, ordinarily 30 days.
Correction. Ask for anything inaccurate or out of date to be fixed. Basic contact details can usually be changed in your account settings; a change to a verified name or date of birth requires a supporting document, because those fields sit behind the identity check.
Deletion. Request erasure of your personal information. Read the retention section below first, because deletion is not absolute where records must legally be kept.
Withdrawal of marketing consent. Unsubscribe from any promotional email, or change your communication preferences in your account. Service messages about your account, payments or verification will still be sent, since they are not marketing.
Complaint. Raise a privacy concern with us first, using the contact details below. If the response does not resolve it, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, which is an independent body and not affiliated with ReefSpins.
How long information is kept
Account and transaction records are retained for as long as the account is open, and for a further period after it closes, in line with anti-money-laundering and financial record-keeping obligations. Those obligations set a floor, and the floor is measured in years rather than months: verification documents and transaction histories are typically kept for a minimum of five years after the closure of an account or the completion of a transaction, and longer where an investigation, dispute or legal proceeding is on foot.
The practical consequence deserves stating plainly. A deletion request removes what can lawfully be removed, such as marketing profiles, preferences and correspondence that is no longer needed. It does not remove records held under a legal retention obligation, and no operator that tells you otherwise is describing reality. Once the retention period expires, the information is deleted or de-identified.
Self-exclusion records are a deliberate exception. They are retained for the length of the exclusion and afterwards, because the record is what makes the exclusion enforceable.
Security measures
Information in transit between your device and the site is encrypted. Stored information is held on access-controlled systems, with credentials hashed rather than kept in readable form, and access limited to staff who need it for a defined task. Verification documents are held separately from general account records and are visible only to the team handling identity checks.
No system is beyond compromise, and your side of it matters. Use a password that exists nowhere else, do not share credentials, and treat any message asking you to confirm account details through a link as suspicious until you have opened the site yourself and checked. Support communicates through live chat and email, and will never ask for your password.
Players under 18
ReefSpins Casino Australia is for adults aged 18 and over. Accounts are not knowingly opened for minors, and information about people under 18 is not knowingly collected.
If an account is found to belong to someone under 18, it is closed, gameplay outcomes are void, and any personal information collected is deleted except where a record must be kept to document the closure. If you believe a minor has registered using your device or your details, contact us immediately.
Cookies
The site uses cookies and comparable technologies for sign-in sessions, security, preferences, analytics and advertising. Categories, lifespans, third-party sources and the steps for switching off non-essential cookies are set out in the Cookie Policy.
Contacting us about your information
Privacy requests, questions about this policy, and complaints go to [email protected], or through live chat on the site. Send requests from your registered email address, since that is what allows us to confirm the request came from you.
No separate Data Protection Officer address is published; the support channel above is the correct route, and privacy requests reaching it are treated as formal requests rather than general enquiries.
Changes to this policy
This policy is revised when the law, our providers or our practices change. The current version is always the one on this page, marked with its effective date, and material changes are notified on your next sign-in. Continued use of your account after a revision means the updated policy applies.