Your privacy at Milkywins Casino
This policy explains what personal data we collect when you register and play at Milkywins Casino, why we hold it, how long we keep it, and the rights you can exercise over it. We are the data controller for this site and process your data under the UK GDPR and the Data Protection Act 2018.
Data we collect
We collect personal data from the moment you open an account and throughout your relationship with us. Each category has a specific purpose set out in the next section.
- Identity data: full name, date of birth, email address, telephone number, residential address and national identification details.
- Verification documents: copies of your photo ID, proof of address and payment method evidence required under our KYC procedures.
- Transaction data: deposits, withdrawals, bets placed, winnings, bonuses claimed and payment instrument details.
- Technical data: IP address, device identifiers, browser type, operating system and pages visited on milkywins-casino.org.uk.
- Gameplay behaviour: games played, session times, stake levels and wagering patterns used for responsible-gambling monitoring.
- Marketing preferences: whether you opted in to email or SMS promotions and which channels you selected.
Why we use your data
We process your data for account creation and management, including login, profile settings and account closure. Verification of your identity under KYC and anti-money-laundering rules happens before your first withdrawal and whenever the law requires a re-check.
- Payment processing for deposits and withdrawals through Visa, Mastercard, PayPal, Trustly, Skrill, Neteller and our other supported methods.
- Fraud prevention, including detecting duplicate accounts, chargeback abuse and payment fraud.
- Responsible-gambling monitoring, such as flagging behaviour that suggests harm so we can intervene and apply limits or self-exclusion.
- Marketing communications, only where you have consented or where we rely on a soft opt-in permitted by law.
- Compliance with legal obligations owed to regulators, tax authorities and law enforcement.
Our legal bases
Contract: we process identity, account and transaction data because they are necessary to set up and run your player agreement with us. Without them we cannot open an account or pay out winnings.
Legal obligation: KYC documentation, transaction records and regulatory reporting are processed to comply with gambling and anti-money-laundering law, including retention duties that run for at least five years after your account closes.
Legitimate interest: fraud prevention, network security and aggregate analytics rely on our legitimate interests as an operator, balanced against your expectations and rights. You may object to processing based on this ground.
Consent: marketing emails, SMS and non-essential cookies run only on your consent, which you can withdraw at any time without affecting the lawfulness of earlier processing.
How long we keep data
We keep each category of data only as long as its purpose requires, then delete or anonymise it. Gambling regulation sets a floor for transaction and KYC records that we cannot shorten.
| Data category | Retention period |
|---|---|
| Identity and account data | While your account is open, then up to 5 years for records we must keep |
| Verification documents | 5 years after account closure, in line with AML rules |
| Transaction data | At least 5 years, per regulatory requirement |
| Technical and device data | Up to 12 months, then deleted or anonymised |
| Marketing preferences | Until you withdraw consent or ask us to erase them |
| Complaint records | 6 years from resolution |
Who we share data with
We share your data only with parties who need it to deliver our service, and always under written contracts that impose the same protection standards we apply ourselves.
Your rights over data
Under the UK GDPR you can contact us at any time to exercise the rights below. We respond within one month and may ask for ID to confirm the request.
- Access a copy of the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data, subject to statutory retention periods.
- Port your data in a structured, machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw marketing consent at any time, including via the unsubscribe link in every email.
- Complain to the Information Commissioner's Office at ico.org.uk if you believe we mishandled your data.
Cookies and tracking
We use session cookies to keep you logged in, preference cookies to remember your settings and, with your consent, analytics and marketing cookies to improve the site and personalise offers. Our full cookie inventory, including how to block or delete each category, is set out on our dedicated Cookies Policy page.
How we protect your data
All traffic between your device and our servers is encrypted with TLS. Data at rest is encrypted, access is limited to staff who need it through role-based controls, and we log access for audit. Verification documents are stored in a segregated, access-restricted repository.
If a personal data breach occurs that poses a risk to your rights, we notify the ICO within 72 hours of becoming aware and inform affected players directly where the risk is high. Our support team is reachable 24/7 at [email protected].
Contacting our DPO
Our data protection officer answers privacy questions and handles requests. Email [email protected] or write to the DPO at the registered office of Milkywins Entertainment Ltd. We recommend including your registered email so we can verify ownership quickly.
Frequently Asked Questions
How do I request a copy of my data?
Email [email protected] with the subject line 'Data access request' from your registered address. We reply with a machine-readable copy within one month.
Can I delete everything you hold about me?
We erase marketing preferences and behavioural data on request, but transaction and KYC records must be retained for at least 5 years under gambling and anti-money-laundering law.
Do you sell my data to advertisers?
No. We never sell personal data. Marketing partners act only as processors under contract, and only for campaigns you consented to.
Why do you need my ID before a withdrawal?
Photo ID, proof of address and payment verification are legal KYC requirements. Without them we cannot release funds or comply with anti-money-laundering rules.