General provisions and scope

This Privacy Policy sets out how Gamdom casino collects, uses, stores and discloses personal information in connection with the website gamdomplayau.com and related services. It is intended to reflect obligations under the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other applicable regulatory requirements, while aligning with GDPR style principles of lawfulness, fairness, transparency, purpose limitation and data minimisation where relevant. This document applies to processing activities undertaken through account registration, gameplay, payments, customer support and security monitoring. It addresses personal information relating to identified or reasonably identifiable individuals, whether collected directly or generated through service use. Where separate terms govern particular products, this document operates alongside those terms to the extent they relate to personal information handling.

Regulatory framework, roles and definitions

For the purposes of this document, personal information has the meaning given in the Privacy Act 1988 (Cth), and includes information or an opinion about an identified individual or an individual who is reasonably identifiable. Gamdom casino generally acts as the entity determining the purposes and means of processing for core account and operational functions, and may also act as a recipient of information from service providers in an equivalent controller role. Where third party providers process information strictly on instructions, they are treated as service providers subject to contractual confidentiality and security obligations. This section is framed to support compliance with Australian requirements, while acknowledging concepts such as processing, special categories and legitimate interests that arise under GDPR aligned programs. Interpretive terms used in this document are to be read in a manner that promotes accountability, reasonable steps to protect information, and proportionality to risk.

Categories of personal data processed

The information processed may include identification and contact details such as name, date of birth, residential address, email address and telephone number, as well as account credentials and verification outcomes. Transactional and financial data may include deposit and withdrawal records, payment instrument metadata, billing details and fraud screening results, noting that full card numbers are not intended to be stored by the platform where tokenisation is available. Technical data may include device identifiers, IP address, browser type, operating system, time zone settings, and security logs required to maintain service integrity. Behavioural and usage data may include gameplay history, session data, responsible gambling interactions, support communications and preference settings. Where required by law or risk controls, sensitive information such as identity document images may be processed, and any such handling is limited to what is reasonably necessary for verification and compliance.

Methods and sources of collection

Collection occurs through operational steps such as account creation, profile updates, identity checks, deposits, withdrawals and communications with support channels. The Privacy Policy applies to information provided directly, information generated through use of the services, and information obtained from third parties where permitted. Third party sources can include payment processors, identity verification services, fraud prevention databases and analytics providers, subject to lawful collection and reasonable notice requirements. Automated collection may occur via server logs and similar technologies where the platform records events for security, performance and compliance purposes. Where information is collected from third parties, reasonable steps are taken to ensure the information is accurate, up to date, complete and relevant for the stated purposes.

Legal basis for processing and GDPR aligned principles

Processing is undertaken where it is reasonably necessary for the performance of a contract, including operating accounts, processing transactions and providing requested features. Processing is also undertaken to comply with legal obligations, including regulatory, taxation, identity verification and anti fraud duties, as applicable to the service context. Certain processing is undertaken on the basis of legitimate interests, such as maintaining platform security, preventing misuse, defending legal claims, and improving service reliability, balanced against privacy impacts. Where consent is relied upon, such as for certain marketing preferences or non essential cookies, consent is sought through clear mechanisms and may be withdrawn at any time with effect for future processing. These bases are applied in a manner consistent with transparency and proportionality, and are subject to documented assessment where heightened risk is identified.

Purposes of processing under this Privacy Policy

The primary purposes include establishing and administering accounts, enabling gameplay, processing deposits and withdrawals, and providing customer support in a verifiable manner. Compliance purposes include identity verification, age checks, responsible gambling measures, dispute handling, fraud detection and fulfilment of legal and regulatory obligations. Operational purposes include service analytics, troubleshooting, quality assurance, internal reporting and maintaining business continuity, subject to appropriate access controls. Communications may be sent to confirm transactions, provide security notices, respond to requests, and deliver service messages that are necessary for account operation. Any processing for secondary purposes is limited to what is reasonably expected in the circumstances, or otherwise undertaken with consent or as required by law.

Data retention, deletion and de identification

Retention periods are determined by legal requirements, operational necessity and risk based assessments, including the need to resolve disputes and maintain reliable records. Account and transaction records are generally retained for 7 years after the end of the relevant financial year in which the record is created, where required to meet statutory and audit expectations. Identity verification artefacts may be retained for 2 years after verification completion or account closure, unless a longer period is required for legal claims, fraud prevention, or regulatory requests. Security logs may be retained for 180 days to support incident investigation and system integrity, with extensions applied where an active investigation requires preservation. When information is no longer required, it is securely deleted or de identified, and deletion is carried out within 45 days where practicable, subject to legal holds.

Sharing, disclosure and onward processing

Personal information may be disclosed to service providers that support core functions, including payment processing, identity verification, fraud prevention, hosting, analytics and customer support tooling. Disclosures are limited to what is reasonably necessary for the service provider to perform its contracted function, and are subject to confidentiality and information security terms. Information may also be disclosed to professional advisers such as legal, accounting or audit firms where reasonably necessary for compliance and risk management. Where required or authorised by law, disclosures may occur to regulators, law enforcement agencies, courts, or dispute resolution bodies, including in response to lawful requests. The casino Gamdom service may also be subject to corporate transactions, in which case information may be disclosed to prospective purchasers or advisers under confidentiality controls, with continued handling consistent with this document.

International data transfers and cross border safeguards

Cross border disclosures may occur where service providers or infrastructure are located outside Australia, including data centres and verification vendors. Where cross border disclosure occurs, reasonable steps are taken to ensure the overseas recipient does not breach the Australian Privacy Principles, including by contractual obligations, due diligence and security assurances. Transfer risk is assessed by reference to the nature of the information, the destination jurisdiction, and the safeguards in place, including encryption and access restrictions. Where GDPR aligned practices are applied, appropriate contractual protections and transfer impact considerations are used to support adequate protection. The casino Gamdom environment aims to limit cross border movement to what is necessary for service operation and compliance.

Security measures and integrity controls

Security is implemented through a combination of technical and organisational measures designed to protect information against misuse, interference, loss, unauthorised access, modification or disclosure. Controls may include encryption in transit using TLS, encryption at rest where supported, access control based on least privilege, multi factor authentication for administrative access, and monitoring for anomalous activity. Vulnerability management and patching are performed on a risk based cadence, with critical issues targeted for remediation within 14 days where feasible. The platform applies segregation of duties and logging to support accountability, and retains evidence to assist with investigation of suspicious activity. While no system can be guaranteed to be 100% secure, the casino Gamdom operations aim to maintain a security posture proportionate to the sensitivity of the information processed.

Individual rights and complaint handling procedures

Individuals have rights to request access to personal information held about them and to request correction where information is inaccurate, out of date, incomplete, irrelevant or misleading. The Privacy Policy recognises that certain requests may be refused or limited where permitted by law, including where giving access would unreasonably impact the privacy of others or prejudice security, lawful investigations or legal proceedings. Requests are generally acknowledged within 7 days and responded to within 30 days, unless complexity or legal constraints justify an extension. Where consent is the basis of processing, withdrawal of consent is facilitated for future activities, and withdrawal does not affect processing already lawfully undertaken. Complaints are handled through an internal review process, and where a matter is not resolved, escalation to the Office of the Australian Information Commissioner may be available.

Cookies, analytics and tracking technologies

This section describes how online identifiers are used and how choices may be exercised in relation to non essential tracking, and it is to be read with this Privacy Policy. The platform may use cookies or similar technologies to maintain sessions, remember preferences, support security functions and measure site performance. Analytics tools may collect technical and usage information such as pages viewed, timestamps, device attributes and referral sources, and this data is used to improve reliability and detect abnormal activity. Where consent is required for non essential cookies, it is managed through configurable settings and can be changed at a later time, subject to technical limitations. Blocking cookies may affect certain functions, including login persistence and fraud detection controls, and related processing remains subject to reasonable steps to protect privacy.

Contact details, verification of requests and response handling

Requests relating to personal information, including access, correction, deletion where applicable, or enquiries about handling practices, should be directed using the contact pathway published on gamdomplayau.com. The Privacy Policy requires that identity be verified before releasing information, and verification may involve matching account details and requesting additional evidence where risk indicates. Where an authorised representative acts for an individual, reasonable evidence of authority is required before action is taken. Requests are logged for audit and quality purposes, and records of outcomes may be retained for 12 months to demonstrate compliance and manage repeat requests. If a request relates to suspected unauthorised access, the matter is triaged promptly, and incident response processes are initiated in accordance with assessed severity.

Amendments, governance and ongoing compliance under this Privacy Policy

This Privacy Policy is maintained as a controlled compliance document and may be amended to reflect changes in law, regulatory guidance, technology, business operations, or risk assessments. Amendments take effect from the date of publication on gamdomplayau.com/privacy-policy, and prior versions may be retained for governance and audit purposes. Where changes are material, reasonable steps are taken to provide notice through appropriate channels, such as account notifications or website notices, taking into account the nature of the change and the impact on individuals. The casino Gamdom governance approach includes periodic review at least every 12 months, with interim reviews triggered by significant incidents, vendor changes, or new processing activities. Commitment is maintained to the Australian Privacy Principles, to proportionate safeguards, and to transparent handling of personal information, including clear procedures for submitting and responding to data requests. Any questions about the interpretation or application of this document, or requests for access, correction, or complaint escalation, are handled through the contact and verification procedures described above, with responses targeted within the stated timeframes unless lawful exceptions apply.