Privacy policy

Who we are

MATE29 Casino operates mate29casino.com and is the data controller for the personal information described in this policy. Our Data Protection Officer can be reached at [email protected], and general support at [email protected]. This policy applies to the website, the games, the cashier and every support channel we operate.

What we collect

We group the information we hold into five categories. Everything we collect falls into one of them.

• Identity data. Full name, date of birth, and the government photo identification and proof-of-address documents you supply during verification.
• Contact data. Email address, mobile number and residential address.
• Financial data. Payment method type, the masked account or card identifier, deposit and withdrawal amounts, timestamps and, where required by law, source-of-funds evidence. We never store full card numbers or CVV values — cards are tokenised by our payment processors.
• Gameplay data. Every bet, result, balance movement, bonus credited, wagering progress, session length and the limits or exclusions you have set.
• Technical data. IP address, approximate location derived from it, device type, operating system, browser, device fingerprint, login timestamps and pages viewed.

We do not knowingly collect information about anyone under 18. If we discover an account has been opened by a minor, we close it, return deposits to their source and delete the personal information other than the minimum record we are legally obliged to keep about the closure itself.

Why we collect it, and our lawful basis

Australian privacy law requires collection to be reasonably necessary for our functions, and the GDPR requires a specific lawful basis for each purpose. Here is both, laid out together.

Where we rely on consent — marketing and non-essential analytics — you can withdraw it at any time without affecting anything else about your account. Withdrawing marketing consent does not stop service messages such as withdrawal confirmations or security alerts, which we must send.

Cookies and tracking

Cookies are small files stored by your browser. We use four kinds, and only the first is set without asking you.

• Strictly necessary. Keeping you logged in, remembering your session, protecting against cross-site request forgery, and enforcing self-exclusion. These cannot be disabled because the site does not function without them.
• Preference. Remembering your language, currency display and whether you have dismissed a notice.
• Analytics. Aggregated, de-identified statistics on which pages and games are used, so we can improve them. Set only with your consent.
• Marketing and attribution. Identifying which affiliate or campaign referred you, so partners are paid correctly. Set only with your consent.

You can clear or block cookies through your browser settings at any time. Blocking strictly necessary cookies will prevent you from logging in. We honour Global Privacy Control signals where your browser sends one, and we do not use cross-site tracking pixels for behavioural advertising to players who have self-excluded or set a cool-off.

Third-party processors

We share personal information with a small set of suppliers who process it on our instructions and only for the purposes we specify. Each is bound by a written data processing agreement and none of them may use your information for their own purposes.

• Payment processors — to settle PayID, Osko, POLi, bank transfer, card and cryptocurrency transactions.
• Identity verification providers — to check documents against issuing databases and sanctions lists.
• iovation and ThreatMetrix — device intelligence and fraud scoring on logins and cashouts.
• Game providers — a pseudonymous player identifier and bet data, needed to run and settle rounds. They do not receive your name, address or documents.
• Cloud hosting and backup providers — infrastructure the platform runs on.
• Email and SMS delivery services — for verification codes, service notices and, where you have consented, marketing.
• Testing laboratories and auditors — GLI, iTech Labs and BMM Testlabs receive game and system data for certification, in de-identified form wherever possible.

We also disclose information where we are legally required to: to our licensing authority, to law enforcement or a regulator acting under proper authority, to a court under subpoena, or to a financial intelligence unit under anti-money-laundering law. We do not sell personal information, and we do not share it with data brokers.

International transfers

Some of our processors operate outside Australia, including in the European Union, the United Kingdom, Singapore and the United States. Where personal information is transferred overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, as required by APP 8, and we rely on Standard Contractual Clauses or an adequacy decision where the GDPR applies.

Verification documents are stored on infrastructure located in Australia. You can ask our Data Protection Officer for the current list of processing locations for any category of data.

How long we keep it

Retention is driven mostly by regulation rather than preference. Anti-money-laundering law requires us to keep identity and transaction records for a set period after an account closes, and we cannot delete those early even at your request.

Your rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, and under the GDPR if you are in the European Economic Area or the United Kingdom, you have the following rights. Exercise any of them by emailing [email protected] from your registered address.

• Access. A copy of the personal information we hold about you, provided free of charge within 30 days.
• Correction. Having inaccurate or out-of-date information fixed. Most fields you can edit yourself in Account settings.
• Erasure. Deletion of information we no longer have a lawful reason to keep. We will tell you specifically what we must retain and why.
• Restriction. Pausing processing while a dispute about accuracy or lawfulness is resolved.
• Portability. Receiving the data you gave us in a structured, machine-readable format, or having it sent to another provider.
• Objection. Objecting to processing based on legitimate interests, including profiling for marketing.
• Withdrawing consent. Turning off marketing at any time, through the unsubscribe link, Account settings or a message to support.
• Complaint. Complaining to a regulator — the Office of the Australian Information Commissioner at oaic.gov.au, or your local supervisory authority in the EEA or UK.

We do not make decisions producing legal or similarly significant effects on you by automated means alone. Automated systems flag potential fraud and potential gambling harm, but a person reviews the flag before an account is restricted, and you can ask for that review to be explained.

Security measures

All traffic runs over 256-bit TLS. Verification documents are encrypted at rest and accessible only to the small compliance team that needs them, with every access logged and reviewed. Passwords are stored as salted hashes and are never visible to our staff — which is why we can never tell you your password, only reset it.

Card data is tokenised by our payment processors and never touches our infrastructure. Access to production systems requires multi-factor authentication and is granted on a least-privilege basis. We run penetration testing annually and after any material platform change, and maintain offsite encrypted backups.

If a data breach occurs that is likely to result in serious harm, we will notify affected players and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and any relevant supervisory authority within 72 hours where the GDPR applies. Notification will tell you what happened, what information was involved and what to do about it.

Marketing

We only send marketing email and SMS to players who have opted in, and every message carries a one-click unsubscribe. Unsubscribing takes effect immediately and does not affect service messages. Players who have set a cool-off or self-exclusion are removed from all marketing lists automatically and are never re-added, regardless of any prior consent.

Changes to this policy

We update this policy when our practices, suppliers or legal obligations change. Material changes are notified to your registered email address and published here at least 14 days before they take effect. The "last updated" date at the top of this page always reflects the current version, and previous versions are available on request from our Data Protection Officer.

Contact the Data Protection Officer

For any privacy question, access request, correction or complaint, write to our Data Protection Officer at [email protected]. We acknowledge privacy requests within 5 business days and respond substantively within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner, or to your local supervisory authority if you are in the EEA or UK.