PlayCroco Data Controller Statement

Who Collects Your Data

PlayCroco Casino operates this website and acts as the data controller for all personal information collected through it. The operator is licensed under the laws of Curaçao and processes personal data in accordance with the Landsverordening bescherming persoonsgegevens (National Ordinance on the Protection of Personal Data) and applicable GCB licensing conditions. Players located in Australia interact with a service governed by Curaçao law; however, the operator acknowledges obligations under Australian privacy expectations and applies data handling standards consistent with responsible international practice.

What Information We Collect

PlayCroco Casino collects the information necessary to operate a licensed gambling service. This includes full legal name, date of birth, residential address, email address, phone number, and government-issued identification documents such as a passport or driver’s licence. Payment data — including bank account details, card numbers, and e-wallet identifiers — is collected at the point of deposit and withdrawal. Technical data is collected automatically: IP address, device type, browser version, operating system, session timestamps, and gameplay logs. Where a player contacts support, records of that correspondence are retained.

Why We Collect It

Identity information is collected to verify that a player is who they say they are and meets the minimum age requirement of 18 years. This is a condition of the GCB licence and cannot be waived. Payment data is required to process deposits and withdrawals accurately and to comply with anti-money laundering obligations under the National Ordinance on the Identification of Clients and the Disclosure of Unusual Transactions. Technical data is processed to maintain platform security, detect fraudulent activity, and resolve disputes. Marketing communications are only sent where a player has expressly opted in; that consent can be withdrawn at any time.

KYC and Identity Verification

All players must complete identity verification before withdrawals are processed. The operator applies a risk-based approach: lower-risk accounts may complete verification with a single document, while higher-risk profiles trigger enhanced due diligence. Documents accepted include a current passport, national identity card, or government-issued driver’s licence alongside proof of residential address dated within three months. Source of funds documentation may be requested where deposit volumes or withdrawal patterns indicate elevated risk. Failure to provide requested documents within the specified timeframe will result in account suspension until verification is complete.

Responsible Gambling and Data Use

PlayCroco Casino uses behavioural and transactional data to identify patterns consistent with problem gambling. Where the system detects sustained losses, rapid deposit sequences, or repeated failed withdrawal requests, the account is flagged for review. Players can request self-exclusion, deposit limits, session time limits, or a cooling-off period at any time. Self-exclusion requests are processed within 24 hours and result in the player being blocked from registering a new account using the same identity data for the duration of the exclusion period. Data used for responsible gambling monitoring is retained for the life of the account plus seven years.

Data Sharing

Personal data is shared with third parties only where operationally necessary or legally required. Payment processors receive the minimum data required to execute a transaction. Identity verification providers receive document images and personal details solely for the purpose of verification. Fraud prevention services and AML monitoring platforms receive transactional and behavioural data under contractual data processing agreements. Regulatory authorities and law enforcement agencies may receive data in response to a lawful request. PlayCroco Casino does not sell personal data to marketing companies or unrelated third parties.

Data Retention

Account data is retained for the duration of the account relationship and for a minimum of five years following account closure, in line with AML record-keeping obligations. Where legal proceedings are active or anticipated, data is retained until those proceedings conclude. Inactive accounts — defined as accounts with no login activity for 24 consecutive months — are subject to a data minimisation process: non-essential data is deleted while identity and transaction records are preserved for the legally required period.

Security

PlayCroco Casino applies industry-standard technical measures to protect personal data. All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256. Access to production data is restricted to authorised personnel and logged. The operator conducts regular internal audits of data access logs and responds to suspected breaches within 72 hours of detection. Players are responsible for maintaining the confidentiality of their account credentials.

Your Rights

Players have the right to request access to the personal data held about them, to correct inaccurate data, and to request deletion of data where no legal retention obligation applies. Requests to restrict processing or object to processing for direct marketing purposes are honoured without requiring justification. Requests should be submitted in writing to the contact email listed in the footer. The operator will respond within 30 days. Where a request is refused, the reason will be provided in writing.

Cookies

PlayCroco Casino uses cookies and similar tracking technologies to maintain session state, remember preferences, and collect analytics data. A separate Cookie Policy governs the specific cookies deployed on this site and the choices available to players.

Changes to This Policy

PlayCroco Casino may update this Privacy Policy to reflect changes in applicable law, licensing requirements, or operational practices. The revised policy will be published on this page with an updated effective date. Continued use of the site after the revised policy is published constitutes acceptance of the updated terms.