How Casino Kingdom Handles Your Personal Information in New Zealand

The Privacy Act 2020 gives you a set of powers over information held about you, and this document explains both what those powers are and what they run up against. It applies to every visitor to this site and every registered account.

The gaming operation is run by Rock Swift Group Limited under licence 00884 from the Kahnawake Gaming Commission. Where the Act sets a higher standard than another jurisdiction involved in that arrangement, the Act's standard governs a New Zealand player's data.

What you can require, and how

You can see what is held. Send a request to the address at the foot of this page from the email registered on your account, and you will receive a response within 20 working days, which is the period the Act allows. Identity is verified before anything is released, since the alternative would be handing your file to whoever asks for it.

You can have inaccuracies corrected. Say what is wrong and what it should be. Where we disagree with a proposed correction, the Act permits you to have a statement of correction attached to the record instead, and that statement travels with the file.

You can withdraw marketing consent at any moment. Use the preferences panel inside your account or the unsubscribe link in any promotional message. It takes effect immediately, and it changes nothing about your ability to deposit, play or withdraw. That last point is worth stating plainly, because the two are frequently, and wrongly, treated as connected.

You can ask for deletion, subject to the retention limits set out further down. It is not an unlimited right, and this policy explains exactly where the limits fall rather than leaving you to discover them later.

You can complain. To us first, and then to the Office of the Privacy Commissioner at privacy.org.nz, which reviews complaints independently of casino kingdom nz and of every other operator.

What information exists in the first place

Six categories, and each is collected for a reason set out in the next section.

Identity. Full name, date of birth, nationality, and gender where supplied.

Contact. Email address, mobile number, residential address.

Account. Username, hashed password, chosen currency, communication preferences, and correspondence with support.

Financial. Deposit and withdrawal history, payment method identifiers, partial card numbers, and wallet addresses where crypto is used. Full card numbers sit with the payment provider on its own systems and never reach ours; what is kept identifies a method and reconciles a transaction, and it cannot be used to charge anything.

Verification. Photographic identity documents, proof of address, evidence of source of funds where a threshold is triggered, and the results of screening checks.

Technical and behavioural. IP address, device and browser type, operating system, time zone, session identifiers, games opened, stake and session history, bonus participation, and any limits or exclusions set on the account.

Why each category is held

Running the account requires the identity, contact, account and financial data. Deposits cannot be credited, withdrawals cannot be settled and support cannot answer you without it. This is contractual, not optional.

Legal and licensing duties account for the verification data, transaction records and screening results. Anti-money laundering obligations, age verification and the reporting conditions attached to licence 00884 all require records to exist and to be retained. Consent plays no part here; an account cannot operate without this processing.

Fraud prevention and platform integrity use technical and behavioural signals to detect duplicate accounts, bonus abuse, payment fraud and attempted account takeover. This is a legitimate operational interest, and it is also what protects your own account from someone else.

Safer gambling controls need the record of the limits and exclusions you set, because a limit with no record behind it cannot be enforced.

Marketing uses contact details, and only where you have opted in.

Who your information reaches

It is not sold, not rented, and not passed to advertising networks for any price. Disclosure is limited to these situations:

• Payment providers and banks, receiving what a specific deposit or payout requires.
• Verification and screening agencies, receiving documents and identifiers to run the checks the law demands.
• Game suppliers, being Games Global and Evolution, receiving a pseudonymous identifier and gameplay data so games and live tables function and remain auditable. Your identity documents are not among what they receive.
• The Kahnawake Gaming Commission, on request, including where you have raised a dispute yourself.
• Law enforcement, courts and regulators, where a lawful basis compels disclosure.
• Technical providers covering hosting, email delivery, analytics and fraud tooling, working under written contract, on instruction, for no purpose of their own.

Information leaving the country

It does leave New Zealand. The operating company is registered in the British Virgin Islands, the regulator sits in Canada, and technical infrastructure spans several jurisdictions.

Information Privacy Principle 12 is the rule that governs this. Personal information may only be transferred to a foreign party subject to comparable safeguards, whether through that country's own law or through binding contractual terms. Processors handling data for casino kingdom new zealand players are bound in writing on confidentiality, security, breach notification and any onward transfer.

How long records survive

Record	Retention
Verification, AML and transaction records	Minimum five years from account closure
Account and gameplay history	Life of the account, then inside the AML window above
Self-exclusion records	Indefinitely
Support correspondence	Up to two years after closure, longer if part of a dispute
Marketing consent and opt-out records	As long as needed to evidence what was given or withdrawn
Technical logs	A short rolling window, then overwritten

Self-exclusion is indefinite for a practical reason rather than a bureaucratic one: an exclusion that has been erased cannot be enforced against a new registration attempt.

An open dispute or investigation freezes the clock: records tied to it stay until the matter is finished, whatever the table above would otherwise allow.

What deletion genuinely achieves

Marketing stops immediately. Optional profile details are removed. Restricted records are locked so that they serve only the legal purpose requiring them, meaning no profiling, no reactivation prompts, no promotional use. Once the applicable retention period ends, whatever is left gets destroyed.

What deletion cannot do is clear verification and transaction records inside the five year anti-money laundering window, or lift a self-exclusion record while that exclusion is meant to hold. No request overrides either obligation, and an operator promising instant and total erasure is promising something it is not permitted to deliver.

Cookies

Essential cookies hold your session and protect against cross-site request forgery. Sign-in stops working without them. Performance cookies count page loads and errors in aggregate so faults can be traced. Marketing cookies measure which campaigns bring players here, and they are set only where you have accepted them in the consent banner.

Consent choices can be revisited at any time through the cookie settings link, and your browser can block or clear cookies on its own terms. A Do Not Track or Global Privacy Control signal from your browser switches off everything except the essential cookies.

Keeping the data secure

Everything travelling between your device and our servers is encrypted along the way. Passwords are stored as salted hashes, which means nobody working here can look up what you typed. Two-factor authentication is available, and a passkey removes the password from the equation entirely by tying sign-in to your device unlock. Access to verification documents is confined to staff whose role requires it, and each access is logged.

The part under your control matters just as much. Use a password that appears on no other site, protect the email account capable of resetting it, and treat any request for your password or a screenshot of your cashier as fraudulent no matter how convincing the sender looks. Verification documents are uploaded inside your account and are never sent to an individual through chat or social media.

Under-18s

This is an adult service and information about minors is not knowingly collected. An account found to belong to someone under 18 is closed, play is voided, deposits are returned to the funding source, and personal data is destroyed apart from the minimum record needed to document the closure and block re-registration. Reports of underage access are treated as urgent.

Changes, and reaching the DPO

Amendments appear on this page, and material changes are notified by email or account message before they take effect.

Write to the Data Protection Officer at [email protected] for any access request, correction, deletion request, or complaint about how casino kingdom handled your information. Use the email address registered on your account, or expect a verification step first. If the answer does not resolve matters, the Office of the Privacy Commissioner takes it from there at privacy.org.nz.