Wolf Winner Privacy Policy for Australian Players

1. What Is Collected

Personal information is gathered in four ways: what you type into forms, what your device sends automatically, what payment and verification partners return, and what your gameplay generates.

Identity information. Full name, date of birth, gender where provided, and the username chosen at registration.

Contact information. Email address, mobile number, and the residential address supplied during verification.

Verification records. Copies of government-issued photo identification such as a passport or driving licence, proof of address, and where a payment method requires confirmation, a partially redacted image of the card or a screenshot of the wallet. These are collected to satisfy anti-money-laundering and age-verification obligations.

Financial information. Deposit and withdrawal history, amounts, timestamps, the payment methods linked to the account, and the tokenised reference returned by the payment provider. Full card numbers are not stored by the casino; they are held by the payment processor.

Technical information. IP address, approximate location derived from it, device type, operating system, browser and version, screen resolution, language setting, and session identifiers.

Usage information. Games opened, stake sizes, session start and end times, bonus participation, limits set, and pages viewed on the site.

Communications. Live chat transcripts, support tickets and their attachments, and the record of which marketing messages were sent and opened.

Responsible gambling records. Limits, time-outs, self-exclusions and any related contact, which are held separately and cannot be erased on request while an exclusion is active.

2. Why Each Category Is Held

The last row is the only one that depends on your permission. Everything above it exists because the account cannot function or cannot lawfully exist without it. Refusing marketing has no effect on your ability to play, deposit or withdraw, and no promotion is ever conditioned on accepting it.

3. Who Receives Your Information

Personal information is not sold, rented, or handed to data brokers. It is disclosed only where a specific function requires it:

• Payment providers and acquiring banks, to move money in and out and to investigate a disputed transaction.
• Identity verification and anti-fraud services, which check documents against official records and return a pass, fail or referral.
• Game studios, which receive a session identifier and gameplay data so a round can run and be settled correctly. They do not receive your name, address or payment details.
• Hosting, security and analytics providers, under contract, for the infrastructure the site runs on.
• Professional advisers, such as auditors and lawyers, where a specific matter requires it.
• Law enforcement, regulators and courts, where disclosure is required by law or by a valid order, and where refusing would itself be unlawful.

Each recipient receives the minimum needed for its function. Contracts with service providers restrict use of the data to the purpose it was supplied for.

4. Data That Leaves Australia

Some of the providers described above operate outside Australia, so information about Australian players may be stored or processed overseas, including in the European Economic Area, the United Kingdom and Asia-Pacific data centres.

Australian Privacy Principle 8 governs this. Before any cross-border disclosure, reasonable steps are taken to ensure the recipient handles the information in a way consistent with the APPs, through contractual obligations covering security, purpose limitation, breach notification and deletion at the end of the relationship. Where a provider is located in a jurisdiction with an equivalent data protection regime, that regime applies in addition.

5. Your Rights and How to Use Them

Under the Privacy Act 1988 and the APPs you can do each of the following. Every request is made the same way: open live chat inside your Wolf Winner account and state which of these you want, and ask the agent to log it as a formal privacy request so it is routed to the team that handles them.

Access. Ask for a copy of the personal information held about you. Expect to verify your identity first, since handing account data to whoever asks would be the larger privacy failure. A response is provided within a reasonable period, and in most cases within 30 days.

Correction. Ask for inaccurate, out-of-date or incomplete information to be fixed. Name, address and contact details are corrected on request; a change to a verified identity detail requires a supporting document.

Deletion. Ask for information to be erased. Section 7 explains what that actually achieves while legal retention obligations are running.

Marketing withdrawal. Turn off promotional email and messaging in your account settings, or ask support to do it. This takes effect immediately and does not require a reason.

Objection to particular processing. Ask that a specific use stops. Where the processing rests on legitimate interest rather than a legal obligation, the use stops unless there is a compelling reason it cannot, and you are told which applies.

Complaint. Section 9 sets out the route.

There is no charge for any of these, and making a request has no effect on your account standing.

6. How Long Information Is Kept

Retention is not open-ended, but it is not immediate either.

• Verification documents and transaction records are kept for a minimum of seven years after the account relationship ends. Seven years is the standard record-keeping period under anti-money-laundering rules, and it is not shortened at a player's request.
• Account and gameplay history is retained while the account is open and for the same seven-year period afterwards, since it forms part of the transaction record.
• Support transcripts are kept for the period needed to handle any follow-up or dispute, then deleted.
• Marketing data is deleted when consent is withdrawn, apart from a minimal suppression record proving that you asked not to be contacted.
• Responsible gambling records are kept for the duration of a limit or exclusion and afterwards, so that a self-exclusion cannot be defeated by opening a new account.
• Technical logs are held on a short cycle, typically months rather than years, unless a security investigation requires otherwise.

7. What Deletion Actually Means

Saying that data is erased on request would be simpler than the truth, so here is the truth. Where information is held under a legal retention obligation, it cannot be deleted while that obligation runs. What happens instead is that the information is closed off: removed from active systems, restricted to the small number of people who need it for compliance purposes, excluded from all marketing and analysis, and destroyed at the end of the retention period.

Everything not covered by a retention obligation, including marketing preferences, optional profile details and analytics identifiers, is deleted when you ask for it to be.

8. Cookies and Tracking

The site uses strictly necessary cookies to hold your session, functionality cookies to remember preferences, analytics cookies to measure performance, and advertising cookies where you have consented to them. Non-essential categories are consent-based and can be turned off at any time without losing access to games or your balance. The cookie policy covers the categories, their lifespans and browser-level controls in detail.

9. Complaints and Escalation

Raise a privacy concern first through live chat in your account, asking for it to be recorded as a privacy complaint. You should receive an acknowledgement promptly and a substantive response within 30 days.

If the response does not resolve the matter, an Australian player can escalate to the Office of the Australian Information Commissioner at oaic.gov.au, which handles privacy complaints and can investigate. The OAIC normally expects you to have raised the issue directly first. Referring a complaint to the OAIC is free, and it is an independent body rather than one connected to Wolf Winner in any way.

10. Security

Traffic between your device and the site is encrypted in transit. Passwords are stored as hashes and are not readable by staff, which is why support can trigger a reset but cannot tell you what your password is. Verification documents are stored in restricted systems with access limited by role and logged. Payment card details are handled by the payment provider rather than stored on the casino's own systems.

Your side of the arrangement matters as much as any of that: use a password unique to this account, avoid signing in on shared or public devices, sign out rather than closing the tab, and treat unsolicited messages asking you to confirm account details through a link as suspect until you have checked the domain in the address bar.

11. Under-18s

Accounts are restricted to adults aged 18 or over. Personal information is not knowingly collected from anyone under that age. Where an account is found to belong to a minor, it is closed immediately, winnings are voided, deposits are returned through the original method, and the information collected is deleted except for the minimum record required to prevent the account being reopened.

If you believe a minor has registered using your device or your details, raise it through live chat straight away.

12. Contact and Updates to This Policy

Privacy questions, access requests, corrections and complaints all go through live chat inside your account, where they are logged and routed to the team responsible. Asking the agent to record the matter as a privacy request is the step that guarantees it is handled through that process rather than as a general enquiry.

This policy is revised when practices, providers or obligations change. The current version is always the one published here, and material changes are notified in the account so that a returning player sees them at the next sign-in rather than discovering them later.