When you register, verify your account, make deposits or withdrawals, or contact our support team, you provide us with:

• Identity data: full legal name, date of birth, gender
• Contact data: email address, phone number, postal address
• Account credentials: username, password (stored as a secure hash — never in plain text)
• Identity verification (KYC): copies of government-issued photo ID (NZ passport, driver’s licence), proof of address (utility bills, bank statements)
• Financial data: payment method details (card numbers are tokenised and never stored in full), bank account information for withdrawals, transaction history
• Communications: records of your correspondence with our customer support team, including live chat transcripts and emails
• Responsible gambling: self-imposed limits, cooling-off preferences, self-exclusion records, and responses to any responsible gambling assessments

When you use Casino Classic NZ, our systems automatically collect technical and behavioural data including:

• Device & technical data: IP address, browser type and version, operating system, device identifiers, screen resolution
• Usage data: pages visited, time spent on each page, links clicked, login timestamps, session duration
• Gaming data: games played, bets placed, wins and losses, game session duration, bonus usage, wagering progress
• Location data: approximate geographic location derived from your IP address (used for regulatory compliance and fraud prevention — we do not collect precise GPS location)
• Cookies and tracking data: session cookies, analytics cookies, preference cookies — see Section 8 for full details

To fulfil our legal obligations and provide our services safely, we may receive personal data from:

• Identity verification providers: third-party KYC and AML (Anti-Money Laundering) services used to verify your identity and comply with regulatory requirements
• Payment processors: confirmation of transactions from your bank, card issuer, or eWallet provider (Skrill, Neteller, etc.)
• Fraud prevention services: risk scores and fraud signals from third-party fraud detection services
• Responsible gambling databases: self-exclusion registers and problem gambling databases maintained by gaming regulators (for compliance with MGA responsible gambling requirements)
• Affiliate partners: if you arrived at Casino Classic NZ through an affiliate link, we may receive anonymised referral data from the affiliate network

You have the right to request a copy of the personal data we hold about you (a “Subject Access Request”). We will provide this within 30 days of receiving your verified request. The information will be provided in a structured, commonly used format. We may ask you to verify your identity before fulfilling this request.

You have the right to have inaccurate personal data corrected. You can update most of your account information directly through your Casino Classic dashboard. For data that cannot be self-edited (such as verified KYC information), contact our support team with evidence of the correct information.

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (for consent-based processing). Note that this right is not absolute — we are legally required to retain certain data (financial records, KYC documents, self-exclusion records) for regulatory compliance periods regardless of a deletion request. We will inform you of what can and cannot be deleted and why.

Where we process your data based on your consent or a contract, and that processing is automated, you have the right to receive your personal data in a structured, machine-readable format (such as CSV or JSON) for transfer to another service provider. Contact us to make a portability request.

You may object to the processing of your personal data where we rely on legitimate interests as our lawful basis. You have an absolute right to object to direct marketing at any time — unsubscribe from any email or update your preferences in account settings. For other legitimate-interest processing, we will assess whether our interests override your rights and respond accordingly.

In certain circumstances (for example, while we investigate the accuracy of data you have contested), you may request that we restrict processing of your personal data to storage only. We will not process restricted data for any other purpose until the restriction is lifted.

Where we rely on your consent to process data (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, unsubscribe from any Casino Classic email, update your preferences in your account settings, or contact our support team.

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint. In New Zealand, the supervisory authority is the Office of the Privacy Commissioner (privacycommissioner.govt.nz — 0800 803 909). For GDPR-related matters, the lead supervisory authority is the Information and Data Protection Commissioner of Malta (IDPC). We encourage you to contact us directly first — we take privacy complaints seriously and aim to resolve them promptly.