RoyalSea Casino Privacy Policy

We collect the minimum data necessary to register your account, verify your identity, process payments, deliver the games and meet our legal obligations. Registration captures your name, date of birth, residential address, email, telephone number, base currency and chosen password. The date of birth and address are mandatory because we have a legal obligation to verify that you are over 18 and to apply anti money laundering rules. Email and phone are mandatory because they are how we deliver service messages and the recovery flow if you lock yourself out of the account.

Identity verification captures a copy of a government issued photo ID and a recent proof of address. These documents are stored encrypted at rest and accessed only by trained compliance staff. We retain identity documents for the period required by our regulator, which is currently five years after closure of the account, and securely delete them at the end of that retention period.

The lawful bases we rely on vary by data category. Contract performance covers account creation, deposits, gameplay and withdrawals because we cannot deliver the service without those data points. Legal obligation covers identity verification, anti money laundering checks, sanctions screening and the retention of transaction records for the regulatory period. Legitimate interest covers fraud prevention, security monitoring and aggregated analytics that improve the platform without identifying individual users. Consent covers all direct marketing, optional cookies and any optional personalisation features. You can withdraw consent at any time without affecting the lawfulness of processing performed before the withdrawal.

We use a small number of third party processors to operate the service. Payment processors handle deposits and withdrawals and receive only the data they need to process a given transaction. Identity verification providers receive the documents and personal data they need to confirm your identity, then return a result to us and delete the underlying material per their own data policy. Hosting providers run the infrastructure on which the platform operates, with data stored in EU and EEA data centres. Customer support tooling stores conversation logs for the period required to resolve disputes. Marketing tools, where you have opted in, send the messages you have agreed to receive and respect the unsubscribe link in every message.

We do not sell personal data to any party. We do not share personal data with advertisers for behavioural retargeting. The only times we disclose personal data outside the processor list are when we are legally required to do so by a court order, when we need to defend a legal claim, or when we are responding to a substantiated request from a regulator with jurisdiction over our operations.

Account data is retained for the duration of the account plus the regulatory retention period that follows closure. For most categories that period is five years, which matches the standard AML retention requirement, but financial records linked to large transactions may be retained for up to seven years where the underlying transaction warrants it. Marketing data is deleted within thirty days of consent withdrawal. Technical logs are rotated and aggregated within ninety days for the most granular fields, with anonymous aggregates retained longer for security analysis.

To delete your account and trigger the deletion of all data we are not legally required to retain, submit an erasure request via the support team. We will close the account, return any remaining balance to your verified payment method, and confirm the deletion in writing. Data we are legally required to retain for AML purposes cannot be deleted until the regulatory retention window expires, but it is locked from all marketing and analytical use the moment the erasure request is processed.