Surf Casino Privacy Policy
This page explains what personal data we collect when you play at Surf Casino, why we collect it, who sees it and how long we keep it. We run the site under licence 8048/JAZ2023-041 issued by Antillephone in Curaçao, and we apply the same care to your data whether you log in from Australia or anywhere else we operate.
What We Collect From You
When you register, deposit, play or contact our 24/7 live chat, you give us several categories of personal data. We keep each category separate and use it only for the purposes set out in this policy. Here is the full list:
- Identity data: your name, date of birth, email address, phone number and residential address
- Verification documents: passport or driver licence, proof of address and payment method confirmation, required before your first withdrawal
- Transaction data: deposit and withdrawal amounts, payment method used (PayID, card, e-wallet or crypto), currency and timestamps
- Technical data: IP address, device and browser type, operating system and approximate location derived from your IP
- Gameplay data: bets placed, results, session length, game choices and bonus usage across our 3,000+ titles
- Marketing preferences: which bonuses you opt into, whether you used the promo code SURF, and which channels you agree to be contacted on
Data we never ask for
We do not ask for sensitive categories such as health, religious or biometric data. Where you set deposit limits, loss limits or session reminders under our responsible gambling tools, we store the limits themselves, not the reasons behind them. Aggregated and anonymised gameplay statistics carry no link back to your identity.
How We Use Your Data
Every processing activity we run has a specific purpose tied to operating the casino. We do not use your data for anything outside these purposes without asking you first.
- Creating and maintaining your player account, including login and authentication
- Verifying your identity and running anti-money-laundering checks before payouts
- Processing deposits from AUD 30 and withdrawals from AUD 50, up to AUD 8,000 per week
- Detecting and preventing fraud, bonus abuse, multi-accounting and payment disputes
- Monitoring play for responsible gambling signs, enforcing self-exclusion and referring you to Gambling Help Online (1800 858 858) where appropriate
- Sending marketing about our weekly 10% cashback, weekend reload up to AUD 800, tournaments and free spin drops, only where you have consented
- Meeting tax, licensing and regulatory reporting obligations
Automated decisions
Some checks run automatically, such as AML screening and bonus-abuse flags. If an automated process blocks a withdrawal or restricts your account, you can ask our support team for a human review at any time via live chat or email, and we will respond with the reasoning behind the decision.
Legal Bases for Processing
Contract. Processing your identity, transaction and gameplay data is necessary to perform the agreement you enter when you open an account. Without it we cannot hold your balance, run games or pay out winnings.
Legal obligation. Licence conditions under 8048/JAZ2023-041 and anti-money-laundering law compel us to verify your identity, keep transaction records for at least five years and report suspicious activity. You cannot opt out of processing that law requires.
Legitimate interest. We rely on this basis for fraud prevention, security monitoring, dispute resolution and aggregated analytics that keep the platform safe and functional. We weigh this interest against your rights and restrict it to what is strictly needed.
Consent. Marketing emails, SMS and promo notifications depend on your opt-in. You can withdraw consent at any time through your account settings or the unsubscribe link in any message, and we will stop that processing without affecting your account.
How Long We Keep Records
We do not hold your data forever. Each category has a defined retention period, after which we delete or irreversibly anonymise it. Regulatory rules fix the minimum for financial and verification records; everything else we trim as soon as the purpose expires.
| Data category | Retention period |
|---|---|
| Identity and account data | While your account is active, then 5 years after closure |
| Verification (KYC) documents | 5 years after account closure, per AML rules |
| Transaction records | At least 5 years, as required by our licence |
| Gameplay and betting logs | 5 years after account closure |
| Technical and device logs | Up to 12 months |
| Marketing preferences | Until you withdraw consent or close your account |
Who We Share Data With
We never sell your personal data. We share it only with parties who need it to deliver the service, and each one works under a contract that obliges them to protect your data to the same standard we apply ourselves. The categories are:
- Payment processors handling your deposits and withdrawals, including card schemes, e-wallet operators, voucher providers and public blockchain networks for crypto transfers
- KYC and AML screening providers that verify your documents against sanctions and identity databases
- Game studios supplying the titles you play, which receive your username and gameplay outcomes, never your payment details
- Hosting, security and infrastructure providers that keep surfcasino-au.com running
- Analytics services that measure site performance on aggregated, non-identifying data
- Regulators and law enforcement, including Antillephone in Curaçao and competent Australian authorities, where disclosure is legally required
Your Rights at Surf Casino
You control your data, and exercising any of the rights below costs nothing. Send your request to our data protection officer or raise it in live chat; we respond within 30 days and sooner where we can.
- Access: get a copy of the personal data we hold about you
- Rectification: correct data that is inaccurate or incomplete
- Erasure: request deletion where no legal retention duty applies
- Portability: receive your account and gameplay data in a machine-readable format
- Objection: object to processing based on legitimate interest, including profiling
- Withdrawal of consent: stop marketing at any time without losing access to your account
- Complaint: raise a complaint with the Office of the Australian Information Commissioner (OAIC), or with your local supervisory authority if you reside in the EU
Verification of requests
Before acting on a request we confirm you are the account holder, normally through your registered email or a quick identity check. This step exists purely to stop someone else from accessing or deleting your data.
Cookies and Security Measures
Cookies and tracking
We use strictly necessary cookies for login, session and security, plus optional analytics and marketing cookies that activate only with your consent. Full details, including how to switch each category off in your browser, are set out on our dedicated Cookies Policy page.
How we protect your data
All traffic between your device and our servers travels over TLS encryption. Passwords are stored only as salted hashes, and access to player records inside Surf Casino is limited by role, so a support agent sees account details but never full payment credentials. We log every internal access to sensitive data and audit those logs regularly.
If a breach occurs that risks your rights, we notify the relevant supervisory authority within the statutory deadline and inform affected players directly, with clear guidance on what to do next.
Contacting Our Data Officer
Our data protection officer answers every privacy question, request or complaint. Write to [email protected] and include your registered email so we can locate your account quickly. For anything account-related, our support team is also reachable around the clock at [email protected] or via live chat, available 24/7.
We review this policy whenever our processing changes and publish the updated version here with a new effective date. The version you see on this page is the one that applies to your account today.
Frequently Asked Questions
Do you sell my personal data?
No. We share data only with the categories listed above, such as payment processors and KYC providers, under contracts that require them to protect it. No third party buys your data from us.
Can I play without sending ID documents?
You can register and play, but we must verify your identity, address and payment method before your first withdrawal. This is a licensing requirement, not a choice.
How do I stop marketing messages?
Use the unsubscribe link in any message or switch off marketing in your account settings. Processing stops immediately, and we keep no marketing preferences after your consent is withdrawn.
What happens to my data if I self-exclude?
We keep the minimum data needed to enforce the exclusion and block new accounts, and we stop all marketing for the exclusion period. Transaction records follow the standard five-year retention rule.