Privacy Policy | Whitelotus Casino
This Privacy Policy explains what personal information we collect when you play at Whitelotus Casino, why we collect it, who we share it with, and the rights you hold over it. We have operated under an Anjouan licence (ALSI-102404011-FI3) since 2016, and we handle your data to the standards that licence and the Australian Privacy Principles require.
What Data We Collect
Categories of information
We collect only the information we need to run your account, verify who you are, process your payments and meet our legal obligations. When you register, we ask for your full name, date of birth, residential address, email address and phone number. Before your first withdrawal we require KYC documents: a photo ID, proof of address and verification of your payment method.
- Identity data: name, date of birth, address, email, phone number
- Verification documents: passport or driver's licence scan, utility bill, card or e-wallet confirmation
- Transaction data: deposits, withdrawals, bonuses claimed, wagering records
- Technical data: IP address, device type, operating system, browser, timestamps
- Gameplay behaviour: games played, session length, bet sizes, win/loss history
- Marketing preferences: whether you opted in to bonus emails, SMS or tournament notifications
How We Use Your Data
We use your identity data to create and maintain your player account, and your verification documents to complete KYC checks before we release a withdrawal. Transaction records let us process deposits and payouts, apply the 40x wagering conditions on your welcome bonus, and reconcile your weekly withdrawal limit of A$8,000.
- Account creation, login and account management
- KYC and anti-money-laundering verification
- Payment processing across PayID, cards, e-wallets and crypto
- Fraud prevention and detection of multi-accounting
- Responsible-gambling monitoring, including deposit and loss limits you set
- Marketing and bonus offers, only where you have consented
- Compliance with Anjouan licensing conditions and Australian law
Why the Law Allows It
Our legal bases
Contract. We process your data to deliver the service you signed up for. Without your name, email and payment details we cannot open an account, run games or pay out winnings.
Obligation, interest, consent
Legal obligation. Gambling regulation requires us to verify your identity, keep transaction records for at least five years and report suspicious activity, so we cannot delete this data on request while those duties stand. Legitimate interest. We use device and gameplay data to detect fraud, prevent bonus abuse and keep the platform secure. Consent. Marketing messages, promotional emails and personalised offers go only to players who opted in, and you can withdraw that consent at any time from your account settings or via [email protected].
How Long We Keep It
We hold each category of data only as long as the purpose requires. Gambling regulations oblige us to retain identity verification and transaction records for a minimum of five years after account closure, and we delete them once that period expires.
- KYC documents and transaction data: 5 years minimum after account closure
- Account and gameplay records: lifetime of the account plus 5 years
- Marketing preferences: until you withdraw consent or ask us to delete them
- Support correspondence: up to 2 years after your last contact
- Analytics data in aggregated, de-identified form: up to 26 months
Who We Share It With
We never sell your personal data. We share it only with service providers who need it to perform a specific function for us, under written agreements that restrict how they may use it.
- Payment processors handling PayID, Visa, Mastercard, Skrill, MiFinity and crypto transactions
- KYC and AML verification providers checking your documents against official records
- The Anjouan licensing authority and, where legally required, Australian regulators or law enforcement
- Game and platform providers delivering the 250 titles in our casino library
- Analytics providers measuring site performance in aggregated, de-identified form
- Email delivery services, but only for communications you consented to
Your Rights Over Your Data
You control your personal information. Email [email protected] or message our 24/7 live chat and we will act on your request within 30 days. Where a legal obligation prevents full deletion, we will tell you exactly what we must keep and why.
- Access: get a copy of the personal data we hold about you
- Rectification: correct inaccurate details such as your address or phone number
- Erasure: delete your data where no legal retention duty applies
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Withdraw consent: stop marketing at any time, effective immediately
- Complain: raise a complaint with the Office of the Australian Information Commissioner (OAIC), or with the supervisory authority of your EU member state if you reside in the EU
Cookies and Tracking
We use cookies to keep you logged in, remember your currency preference and measure how the site performs. Analytics cookies collect aggregated statistics only; they never identify you by name. Our full cookie inventory, including how to block or delete cookies in your browser, is set out on the dedicated Cookies Policy page of whitelotus-aud.com.
How We Protect Your Data
All traffic between your device and our servers travels over TLS encryption, and stored KYC documents sit in encrypted storage with strict access controls. Only staff who need your data to do their job, such as payments and compliance officers, can reach it, and every access is logged.
- TLS 1.2 or higher encryption for all data in transit
- Encryption at rest for identity documents and financial records
- Role-based access controls with audit logging
- Segregated storage of payment credentials
- Documented incident response with breach notification to affected players and regulators within the statutory timeframes
Frequently Asked Questions
Can I delete my KYC documents after verification?
No. Gambling regulations require us to retain identity verification and transaction records for at least 5 years after your account closes. After that period we delete them automatically.
Do you share my data with game providers?
Game providers receive only the minimum data needed to run a session, such as an anonymous player ID. They never see your payment details or KYC documents.
How do I stop marketing emails?
Open your account settings and switch off communications, click the unsubscribe link in any email, or contact our 24/7 live chat. Consent withdrawal takes effect immediately.
Who do I complain to about my privacy?
Contact us first at [email protected] and we will respond within 30 days. If you are unsatisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).