General provisions and scope

This Privacy Policy sets out the principles and practices governing the handling of personal information in connection with Gamdom casino and the domain gamdomplayau.com. It applies to information processed through the website, associated services, support channels, and compliance processes linked to account activity. The policy is intended to reflect the requirements of the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and it aligns with generally recognised GDPR principles to the extent they are relevant to cross border processing. The document is to be read as a compliance instrument that describes collection, use, disclosure, storage, and protection measures in a manner consistent with Australian regulatory expectations. Where this policy refers to personal information, it includes information or an opinion about an identified individual, or an individual who is reasonably identifiable. This policy does not constitute contractual terms for gambling services and does not replace any statutory rights that may apply.

Definitions and roles

For the purposes of this Privacy Policy, personal information includes identifiers, contact details, device related data, and any other information that can reasonably be linked to an individual. The operator acts as the controller of personal information for most processing activities and may act as a processor when handling information on behalf of regulated partners, payment providers, or verification services. Processing includes collection, recording, organisation, storage, alteration, retrieval, use, disclosure, and deletion of personal information. A data breach means unauthorised access to, unauthorised disclosure of, or loss of information that is likely to result in serious harm, consistent with the Notifiable Data Breaches scheme. References to account relate to credentials and related activity records used to access services, including security measures used to authenticate access. Where third parties determine purposes and means of processing independently, they remain separately responsible for their own privacy compliance.

Categories of personal information

The information processed may include identity data such as full name, date of birth, nationality, and government issued identification details required for verification and fraud controls. Contact data may include email address, telephone number, and residential address, as well as correspondence records retained to evidence service delivery. Account data may include username, hashed password, security questions, authentication logs, and records of consent preferences where such preferences are obtained. Transaction and financial data may include payment instrument identifiers, tokenised card references, deposit and withdrawal records, chargeback data, and reconciliation metadata, while avoiding storage of full payment card details where industry standards require tokenisation. Technical data may include IP address, device identifiers, browser type, operating system, session timestamps, and log files used to maintain availability and integrity. For casino Gamdom related compliance, some information may include responsible gambling indicators and risk scoring derived from observed behaviour, where permitted by law and subject to safeguards.

Sensitive information and higher risk data

Sensitive information, where processed, may include biometric information used for identity verification if such verification is conducted by a specialised provider and only where legally permissible. Information about self exclusion, suspected problem gambling, or health related inferences may be treated as sensitive or high risk even when not legally classified as such, due to potential impacts. Criminal history information is not sought as a routine category, but adverse media screening and sanctions checks may indirectly involve such material when required for anti money laundering and counter terrorism financing obligations. Where higher risk processing occurs, access controls, minimisation principles, and restricted retention periods apply to reduce exposure. If a regulatory authority or dispute resolution process requires evidence, the minimum necessary dataset is used. Any sensitive information is handled in accordance with the Privacy Act 1988 (Cth) and applicable confidentiality expectations.

Operational collection methods

Personal information is collected through operational processes such as account registration, identity verification, deposit and withdrawal workflows, and customer support interactions. It may also be collected when a person participates in security checks, interacts with responsible gambling tools, or submits documents for compliance review. Information is gathered via web forms, secure uploads, chat transcripts, email communications, and telephone recordings where notice is provided or where lawful. Certain technical information is collected automatically through server logs and security monitoring to ensure stability and to detect misuse. For casino Gamdom payment and fraud controls, data may also be received from payment gateways and fraud prevention services acting under their own regulatory and contractual obligations. Where information is obtained from third parties, it is generally limited to what is necessary to confirm identity, validate payment legitimacy, or prevent prohibited activity.

Information provided by third parties

Third party sources may include identity verification providers, payment providers, banks, chargeback networks, analytics vendors, and service integrity partners that support fraud prevention. Such sources may provide confirmation outcomes, tokenised identifiers, risk flags, and limited reference data rather than full underlying datasets. Where a third party supplies information, the operator assesses whether the source is reputable and whether the information is reasonably necessary for the stated purpose. The operator does not purchase marketing lists for unrelated advertising and does not seek to create profiles that are incompatible with lawful compliance and security purposes. If a dispute arises, information may also be obtained from complaint bodies, ombuds schemes, or courts to the extent required to respond. Any third party collection remains subject to confidentiality and data protection controls implemented through contracts and due diligence.

Legal basis and regulatory framework

Processing is conducted under legal and regulatory frameworks that include the Privacy Act 1988 (Cth), the Australian Privacy Principles, and any applicable obligations arising from consumer protection and financial crime controls. Where GDPR style principles are relevant, the primary legal bases correspond to performance of a contract, compliance with legal obligations, legitimate interests, and consent where consent is required for specific activities. Legal obligations may include identity verification, record keeping, fraud prevention, and responding to lawful requests from authorities. Legitimate interests include maintaining platform security, preventing abuse, enforcing terms, and ensuring responsible service delivery, balanced against individual rights and reasonable expectations. Consent may be used for certain non essential cookies, optional communications, and preference settings, and may be withdrawn at any time subject to lawful limitations. The Privacy Policy is intended to articulate these bases so that processing activities remain traceable, reviewable, and auditable.

Purposes of processing

The purposes of processing include establishing and administering accounts, authenticating access, and providing customer support and technical assistance. Processing is also undertaken to manage deposits and withdrawals, reconcile payments, mitigate chargebacks, and maintain financial records. Security and integrity purposes include detecting unauthorised access, monitoring for fraud and collusion, and responding to incidents in a manner proportionate to risk. Compliance purposes include verifying identity, meeting anti money laundering expectations where applicable, and enforcing restrictions where services are unavailable to certain jurisdictions. For casino Gamdom integrity, behavioural indicators may be reviewed to identify suspicious activity, account compromise, or attempts to circumvent controls, with review processes designed to avoid solely automated decisions that produce legal effects without appropriate safeguards. Data may also be processed to improve service reliability and to conduct internal audits, while applying minimisation and access controls.

Cookies and tracking technologies

This Privacy Policy governs the use of cookies and similar technologies when used to deliver site functionality, security, and measurement. Cookies may be set to maintain session state, preserve security tokens, and support authentication, including time limited identifiers that expire after 24 hours or upon logout depending on the function. Analytics technologies may collect pseudonymous usage information such as page interactions, referral paths, and aggregated performance metrics to detect errors and maintain availability. Where non essential cookies are used, a consent based approach is applied so that individuals can manage preferences without losing core access to necessary functions. Certain tracking may be used to detect bot activity and mitigate attacks, including rate limiting signals and anomaly detection. Technical identifiers are treated as personal information where they can reasonably identify an individual, and they are protected accordingly.

Cookie management and preference signals

Preferences may be stored for 6 months to reduce repeated prompts while remaining consistent with regulatory expectations regarding periodic review. Where browser or device settings provide signals relating to tracking, the operator assesses those signals in light of technical feasibility and legal requirements. Disabling cookies may impair login persistence, payment workflows, or security functions, and some cookies remain strictly necessary to provide core services. Consent records, where maintained, are used to evidence compliance and are retained only as long as needed for accountability purposes. The operator does not use cookies to infer sensitive traits for targeted advertising as a routine practice. Any third party cookies are subject to vendor assessment and contractual protections to reduce unauthorised secondary use.

Data sharing and disclosure

Personal information may be shared with service providers that support hosting, identity verification, payment processing, fraud prevention, customer support tooling, and security monitoring. Disclosures are limited to what is reasonably necessary for the relevant function, and providers are required to apply confidentiality and security obligations. Information may be disclosed to professional advisers such as auditors, lawyers, and accountants where necessary to obtain advice, conduct audits, or manage disputes. Where required by law, information may be disclosed to regulators, law enforcement, courts, or other competent authorities, and such disclosure is assessed for validity and scope. For casino Gamdom operational continuity, corporate transactions such as restructuring may require disclosure to advisers and counterparties subject to confidentiality and due diligence. The operator does not sell personal information for unrelated commercial gain and does not disclose it for third party marketing purposes without a lawful basis.

Disclosures relating to investigations and disputes

Where fraud, chargebacks, or misuse is suspected, information may be shared with payment networks, banks, and fraud databases to the extent permitted by law and necessary to protect legitimate interests. Dispute records may include correspondence, device logs, and transaction evidence, and are processed to establish facts and respond proportionately. If litigation or formal dispute resolution occurs, information may be produced under legal process or in response to procedural obligations. Access to investigation datasets is restricted to authorised personnel, and audit trails are maintained to support accountability. Automated tools may assist in triage, but material decisions are subject to human review where fairness or significant impact considerations arise. The operator applies minimisation so that disclosures are not excessive and remain tied to a specific purpose.

International data transfers

This Privacy Policy addresses overseas disclosures where personal information is stored or accessed by service providers located outside Australia. International transfers may occur where cloud hosting, identity verification, payment services, or security monitoring involve personnel or infrastructure in jurisdictions such as the European Economic Area, the United Kingdom, the United States, or Singapore. Where an overseas recipient is used, reasonable steps are taken to ensure that the recipient does not breach the Australian Privacy Principles, including contractual commitments and vendor risk assessments. Transfer mechanisms may include contractual safeguards reflecting GDPR aligned standards, confidentiality terms, and audit rights where appropriate. The operator assesses the destination jurisdiction, the nature of the information, and the practical enforceability of obligations, with additional controls for higher risk data. Where feasible, access is limited by role, and data is encrypted in transit and at rest to reduce transfer related risks.

Data retention and disposal

Personal information is retained only for as long as necessary to fulfil the purposes described, including compliance, dispute resolution, and security. Account profile data is generally retained while an account remains active and for a period of 7 years after closure to meet legal, audit, and claims management requirements, subject to exceptions where a longer period is required by law. Verification documents may be retained for 5 years after verification completion or account closure, depending on the applicable compliance context and the sensitivity of the documents. Technical logs used for security monitoring are typically retained for 90 days unless an incident requires longer preservation for investigation and evidence. Where a legal hold applies, relevant data may be retained until the matter is resolved and any limitation period has expired. Disposal is performed through secure deletion, de identification, or controlled destruction processes, with periodic review to ensure retention remains proportionate.

Security controls and breach response

Security safeguards are implemented using a risk based approach that considers the sensitivity of information and the likelihood of harm. Controls include encryption in transit using modern protocols, encryption at rest where appropriate, access control based on least privilege, and monitoring for unauthorised access attempts. Authentication controls may include multi factor authentication options, secure password storage using hashing, and session management designed to limit exposure. Administrative measures include staff training, confidentiality obligations, and vendor oversight, with periodic reviews of security posture. A minimum of 95% of security relevant access events are intended to be logged within the central monitoring environment to support detection and accountability, acknowledging that residual risk cannot be eliminated entirely. In the event of a suspected eligible data breach, the response process includes containment, assessment, notification where required, and remediation consistent with the Notifiable Data Breaches scheme.

Incident handling and accountability

Incident response procedures are designed to identify events, preserve evidence, and restore services within controlled parameters. Where notification is required, communications are directed to affected individuals and the Office of the Australian Information Commissioner as applicable, without unreasonable delay once assessment confirms likely serious harm. Post incident reviews are undertaken to identify root causes, update controls, and document corrective actions within 14 days where feasible, subject to complexity. Access to incident data is restricted and is used only for response, audit, and legal compliance purposes. The operator maintains records of relevant decisions and assessments to demonstrate compliance and to support continuous improvement. Where third parties are involved, incident coordination occurs under contractual notification obligations.

Individual rights and requests

Individuals have rights in relation to personal information, including rights of access and correction under the Privacy Act 1988 (Cth), subject to recognised exceptions. This Privacy Policy describes mechanisms for requesting access to personal information held, and for requesting correction where information is inaccurate, out of date, incomplete, irrelevant, or misleading. Where GDPR aligned rights are applicable due to cross border processing, requests may also include deletion, restriction, portability, and objection, assessed in light of legal obligations and legitimate interests. Requests are handled through verified channels to reduce the risk of unauthorised disclosure, and identity verification may be required before releasing information. A response is generally provided within 30 days, though complex requests may require additional time with notice of the reasons. Where access is refused or limited, reasons are provided unless doing so would be unreasonable or unlawful.

Complaints and escalation

Concerns about privacy practices are handled through an internal complaints process intended to resolve issues fairly and promptly. Where a complaint is received, an acknowledgment is generally issued within 7 days, and a substantive response is provided within a reasonable period depending on complexity. If an outcome is unsatisfactory, the matter may be escalated to the Office of the Australian Information Commissioner or other relevant bodies, subject to jurisdictional requirements. Records of complaints are retained for 12 months after closure to support accountability, trend analysis, and audit requirements. Retention of complaint materials is limited to what is necessary and access is restricted to staff with complaint handling responsibilities. The operator endeavours to ensure that complaint handling does not lead to adverse treatment for the complainant.

Contact details and data request procedures

This Privacy Policy provides a structured process for submitting privacy queries, access requests, correction requests, and complaints. Requests should include sufficient detail to identify the relevant account or interaction, the nature of the request, and any supporting information that assists in locating records. Identification checks may be required to confirm authority, particularly where information is sensitive or where account compromise is suspected. Communications should be directed to the nominated privacy contact using the website contact channels, and where available, a dedicated privacy email address may be provided within the support interface. For casino Gamdom related verification matters, requests may be routed to specialist compliance staff to ensure lawful handling of regulated records. Where an agent acts on behalf of an individual, evidence of authority is required and is retained only as long as necessary to validate the request.

Amendments and ongoing compliance commitments

This Privacy Policy is maintained as a living compliance document and may be amended to reflect changes to legal obligations, regulatory guidance, operational practices, and security standards. Amendments may occur where new processing activities are introduced, where vendor arrangements change, or where risk assessments indicate that additional safeguards are required. Where material changes are made, reasonable steps are taken to provide notice through the website or account communications, and the effective date of the updated policy will be indicated within the published version. The operator’s compliance commitment includes periodic review of retention schedules, vendor assurances, and access controls, with governance oversight to ensure continued alignment with the Privacy Act 1988 (Cth) and Australian Privacy Principles. Where GDPR aligned principles are applied for international processing, the operator reviews transfer safeguards and contractual measures to maintain appropriate protection standards. This Privacy Policy also confirms that data subject rights processes, breach response procedures, and audit records are maintained to support accountability, and that any amendment procedure is documented so changes remain traceable and subject to internal approval controls.