Privacy Policy

What personal data we collect

We collect personal data when you register, use your account, contact us or browse our site. Some of it you give us directly, and some is generated automatically as you use our games and services. The categories below cover what we hold.

Account and contact details

• Your name, date of birth, residential address, e-mail address and telephone number.
• Your username, password and the security details you use to recover access.
• Your communication preferences, including whether you have opted in to marketing.
• Messages you send us by e-mail or through the live chat on the site, and our replies.

Identity and verification documents

We hold a gaming licence and are required to confirm the age and identity of every account holder before you can play or withdraw.

• Documents you upload to prove your identity, age and address, and where we ask for it, your source of funds.
• The results of the checks carried out on your account, including information returned by our verification and fraud-prevention partners.

Transactions and gameplay

• Deposits, withdrawals, balances, bonuses and the payment method details shown in the cashier.
• The games you play, your stakes and outcomes, and your session history.
• Your safer gambling settings, such as the limits shown in your account, time-outs and self-exclusion.

Device and usage data

• Your IP address, approximate location, device type, operating system and browser.
• Log-in times, pages viewed, cookie identifiers and similar technical records, including security and error logs.

Why we use your data and the legal bases we rely on

Under UK data protection law we must have a legal basis for each use of your personal data. In plain words, that means we use your data either because we need it to provide the account you asked for, because the law requires it, because we have a business reason that does not override your interests, or because you gave us your consent.

Where we rely on our legitimate interests, we have weighed them against your rights and use only the data we need. Where we rely on your consent, you can withdraw it at any time in your account settings or by writing to us, and we will stop sending you marketing. Withdrawing consent does not affect the data we must keep for legal or licensing reasons.

Who we share your data with

We do not sell your personal data. We share it only where it is needed to run your account, to meet a legal duty or to protect our players and our business. The parties we share it with are:

• Payment providers and banks, to process your deposits and withdrawals and to investigate disputed payments.
• Identity-verification, credit-reference and fraud-prevention partners, who confirm the details you give us and flag risk.
• Game and platform suppliers whose products you play through your account.
• Service providers acting on our instructions, such as hosting, messaging and customer support tools, under written contracts that restrict what they may do with your data.
• Regulators, law enforcement, courts and tax authorities, where the law or our licence requires us to disclose information.
• Our professional advisers, and a buyer or successor if all or part of our business is transferred.

Some of these parties may process your data outside the United Kingdom. Where that happens, we use the safeguards recognised by UK data protection law so that your data keeps an equivalent level of protection.

How long we keep your data

We keep your personal data for as long as your account is open, and after it closes for the period that gambling, anti-money-laundering, tax and accounting law requires us to retain records. That period is set by law and by our licence conditions rather than by us.

Records of self-exclusion and of limits you have set are kept for at least the length of the exclusion, so that we can honour it. We also keep a minimal record of marketing opt-outs so that we do not contact you again. When a retention period ends, we delete your data or keep it only in a form that can no longer identify you.

Your rights and how to use them

Under UK GDPR you have the following rights over the data we hold about you:

• Access - ask for a copy of your personal data and an explanation of how we use it.
• Correction - have inaccurate or incomplete details put right.
• Erasure - ask us to delete data we no longer have a reason to keep.
• Restriction and objection - ask us to pause our use of your data, or object to uses based on our legitimate interests.
• Portability - receive the data you gave us in a commonly used electronic format.
• Withdraw consent - stop marketing messages at any time.

To use any of these rights, write to support@casinoxl.co.uk or speak to us on the live chat on the site. We may ask you to confirm your identity first, and we will reply within the time limit set by law. Some rights are limited: we cannot delete records we are required to keep for verification, anti-money-laundering or licensing purposes, and we cannot reverse a self-exclusion before it expires.

If you are unhappy with how we have handled your data, contact us at privacy@casinoxl.co.uk so that your concern can be looked into. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.

Cookies and changes to this policy

We use cookies and similar technologies to keep you logged in, remember your settings, keep the site secure and understand how our pages are used. Cookies that are not strictly necessary are set only with your consent, which you give or refuse in the cookie banner and can change at any time in the cookie settings on the site. Full details of the categories we use and how to manage them are in our Cookie Policy.

We may update this policy when our services, suppliers or legal duties change. The version on this page is always the current one, and we will tell you about significant changes through your account or by e-mail. If anything here is unclear, write to us at support@casinoxl.co.uk and we will explain it.