Privacy Policy for Wonderluck Casino Players
Who Controls the Data You Give Us
The controller of all personal data collected through this site is Nova Forge Ltd, the operator of Wonderluck Casino, at Hamchako, Mutsamudu, Autonomous Island of Anjouan, Union of Comoros.
Nova Forge Ltd decides what is collected, why it is processed and how long it is kept, and it holds gaming licence ALSI-152406028-FI2 issued by the Gaming Board of Anjouan. Where a payment provider or a game studio processes your data for its own purposes rather than on our instruction, that company acts as a controller in its own right for that activity, and its own policy governs what it does. Correspondence about anything in this document reaches us at [email protected].
What Happens When You Ask for a Copy of Your Data
A written request to [email protected] starts a 30 day clock, and we confirm receipt within 48 hours so you know the request has been logged rather than lost.
You may ask for access to the personal data held on your account, and we supply it as a machine readable export covering registration details, transaction history and support correspondence. You may ask us to correct details that are wrong, and where the correction touches a verified identity field we will ask for a replacement document before the change is applied. You may ask for deletion, restriction of processing or an objection to a particular purpose, and you may ask us to port your data to another provider. Requests that would put us in breach of anti money laundering record keeping are refused in writing with the reason stated, and the rest of the request is still processed. We do not charge for the first request in any twelve month period.
Why We Process Each Category
Each category of data is tied to one purpose, and we do not repurpose data collected for verification into marketing or profiling.
| Category | Purpose | Legal basis |
|---|---|---|
| Registration details | Creating and securing the account | Performance of contract |
| Payment records | Processing deposits and withdrawals | Performance of contract |
| Identity documents | Age and identity checks, anti money laundering | Legal obligation of the licensee |
| Wagering and session logs | Game integrity, bonus tracking, dispute evidence | Legitimate interest |
| Responsible gambling settings | Enforcing limits and self exclusion | Legal obligation of the licensee |
| Marketing preferences | Sending promotional email | Consent, withdrawable at any time |
Consent is the basis only for marketing, and withdrawing it stops promotional email without affecting your ability to play. The other bases operate independently of consent, which means an objection to processing under legitimate interest is weighed against our record keeping duties rather than granted automatically.
What We Record, Where It Goes and How to Escalate
Registration captures your name, date of birth, residential address, email address and account currency. The cashier records the payment instrument used, the amount, the timestamp and the provider reference for every deposit and withdrawal, including the destination wallet address for cryptocurrency payouts. Verification adds a copy of your Australian driver’s licence, passport or Medicare card, plus a utility bill or bank statement as proof of address. Technical collection covers the IP address of each session, device type, browser and operating system version, timestamps of login and logout, and the pages requested, all of which sit in server logs alongside cookie identifiers described further down this page.
Our platform servers, backup storage and support ticketing are located outside Australia, and identity documents are reviewed by verification staff working in the same jurisdictions. Transfers of that kind are made under contractual terms requiring the recipient to apply the security and retention rules set out here, and no personal data is sold, rented or transferred to a party that is not processing it for one of the purposes in the table above.
If you consider that any of this processing is unlawful, raise it first with us at [email protected] so the matter is recorded and answered within 30 days. Where the answer does not resolve it, the complaint can be escalated to the Gaming Board of Anjouan as the authority supervising licence ALSI-152406028-FI2, and separately to the data protection authority in your own country of residence, which retains jurisdiction over you as a data subject regardless of where our servers sit.
Who Receives Your Data and How Long We Keep It
Disclosure is limited to the companies that have to see a given field in order to complete the transaction or check in front of them.
Payment data goes to the provider handling that specific transaction, which means Visa, Mastercard, Skrill, Neteller, MiFinity, eZeeWallet, Jeton, ecoPayz, Neosurf, Flexepin or your bank for a transfer, and to the blockchain network for a Bitcoin, Ethereum, Litecoin, Tether, Ripple, Dogecoin, Cardano, Solana or USDC payout. Identity documents go to our verification partners for the duration of the check. Game studios including Pragmatic Play, Evolution, NetEnt, Play’n GO, Ezugi, Playtech, Yggdrasil, Hacksaw Gaming, Spribe, Betgames.TV and Live88 receive a pseudonymous session token and the stake data for each round, never your name or your documents.
Account and transaction records are retained for five years after the account closes, which is the period the licensee is required to keep them for anti money laundering purposes. Verification documents are held for the same five years and then deleted. Server and session logs are purged after 12 months. A self exclusion record is kept permanently, because deleting it would let a closed account be reopened and defeat the exclusion, and marketing preferences are erased as soon as consent is withdrawn.
What Happens When You Decline Cookies
Refusing the non essential categories in the consent banner leaves the site fully playable, because only the strictly necessary cookies are needed to hold a session open.
Strictly necessary cookies store your login session, your language and currency selection and the state of the consent banner itself, and they cannot be switched off without breaking sign in. Analytics cookies count visits and record which lobby categories are opened, in aggregate and without identifying you individually. Marketing cookies record which promotion brought you to the site so that affiliate commission is attributed correctly. Analytics and marketing are both off until you accept them, and the choice is reversible at any time from the cookie notice at the foot of every page or by clearing site data in your browser, which resets the banner on your next visit.
Requests concerning personal data, including access, correction, deletion, restriction, objection, portability and withdrawal of marketing consent, are handled at [email protected]. Send the request from the email address registered on the account, because we cannot discuss account data with an unverified sender and will otherwise have to establish ownership before we begin.