Privacy Policy

Version: 1.0  |  Last Updated: 10 November 2026

1. Introduction

Welcome to Galleon Casino ("we", "us", "our"), operated via galleoncasino.games (the "Website"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or otherwise interacts with our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you hold over your information.

This document is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms and Conditions and our Responsible Gaming page, which together form the full regulatory framework applicable to your use of Galleon Casino.

If you have any questions about this Policy or how your data is handled, please contact us using the details provided in Section 13 before using the Website.

2. Data We Collect

We collect personal data only to the extent necessary for the purposes described in this Policy. The categories of data we may collect include:

2.1. Identity & Contact Data

• Full legal name, date of birth, and nationality
• Residential address, email address, and telephone number
• Username and account credentials (password stored in hashed form)
• Copies of government-issued identification documents (e.g., passport, driving licence) provided for Know Your Customer (KYC) and age-verification purposes

2.2. Financial Data

• Payment card details (card type, last four digits, expiry — full card numbers are never stored by us)
• Bank account information where relevant to your chosen payment method
• Transaction history, including deposit amounts, withdrawal requests, and bonus activity
• Source-of-funds documentation where required by anti-money-laundering obligations

2.3. Gaming & Behavioural Data

• Betting history, game sessions, wagering patterns, and win/loss records
• Responsible gaming interactions, including deposit limits set, self-exclusion requests, and time-out activations
• Communication records, including live-chat transcripts, support tickets, and email correspondence

2.4. Technical & Usage Data

• IP address, device type, operating system, and browser version
• Cookies, pixel tags, and similar tracking technologies (see Section 6)
• Geolocation data derived from your IP address to verify that you are accessing from a permitted territory
• Pages visited, session duration, referral sources, and navigation paths

2.5. Data From Third Parties

We may receive supplementary identity or fraud-screening data from third-party verification providers, credit reference agencies, and publicly available sanctions lists. Where you connect via a social login or affiliate link, we may also receive limited profile information from those platforms, subject to your settings with that provider.

3. How We Use Your Data

We use your personal data for the following specific purposes:

3.1. Account Registration & Verification

To create and manage your player account, verify your identity and age (minimum age: 18 years), and ensure compliance with applicable anti-money-laundering and counter-terrorism-financing obligations. Without this data, we cannot legally offer gambling services to you.

3.2. Service Delivery

To process deposits and withdrawals in GBP (£), manage your gaming activity, provide customer support, and administer bonuses or promotional offers you have opted into. Transaction data is also used to resolve disputes and investigate suspicious activity.

3.3. Regulatory Compliance

To fulfil obligations imposed by law and regulatory guidance, including age verification, responsible gaming monitoring, anti-fraud measures, and reporting to competent authorities where legally required. Gaming and behavioural data may be used to identify signs of problem gambling and trigger safeguarding interventions as described in our Responsible Gaming policy.

3.4. Marketing Communications

To send you promotional emails, SMS messages, or push notifications about offers and products that may interest you — but only where you have given us your explicit consent. You may withdraw consent at any time by clicking "unsubscribe" in any marketing email, adjusting your account preferences, or contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

3.5. Analytics & Service Improvement

To analyse aggregated usage trends, improve Website functionality, personalise your experience, and conduct internal research. Where possible, analytics data is processed in pseudonymised or aggregated form to minimise privacy impact.

4. Legal Bases for Processing

Under UK GDPR Article 6, we rely on one or more of the following lawful bases depending on the purpose of processing:

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests; please see Section 9 for details. Where processing involves special-category data (such as health-related inferences about gambling behaviour under Art. 9 UK GDPR), we rely on explicit consent or a substantial public interest condition.

5. Data Sharing & Third Parties

We do not sell your personal data to any third party. We may, however, share your information with carefully selected partners and service providers under strict contractual obligations, solely as necessary to deliver our services or meet legal requirements.

5.1. Categories of Recipients

• Payment processors & e-wallet providers — including Visa, Mastercard, Maestro, PayPal, Apple Pay, Google Pay, Skrill, Neteller, Paysafecard, and bank transfer operators — to facilitate deposits and withdrawals in GBP.
• Identity verification & KYC providers — third-party platforms that perform document checks, biometric comparisons, and credit reference or fraud-screening lookups on our behalf.
• Gaming software suppliers — game studios and platform providers who process gaming session data to deliver their products within our environment.
• IT infrastructure & hosting providers — cloud hosting and cybersecurity partners who process data under our instructions and appropriate data processing agreements.
• Analytics & marketing technology partners — strictly where you have consented to such use.
• Regulatory & law enforcement authorities — where we are legally required to disclose information, for example in response to a court order, formal regulatory request, or to assist an investigation into fraud or financial crime.

5.2. Processor Obligations

All third parties acting as data processors on our behalf are required to sign Data Processing Agreements (DPAs) that mandate compliance with UK GDPR, restrict use of your data to our stated purposes, and require appropriate security measures. We carry out periodic due diligence on our third-party processors to ensure ongoing compliance.

6. Cookies & Tracking Technologies

Our Website uses cookies and similar tracking technologies (such as pixel tags and local storage) to operate core functionality, analyse performance, and — where you have consented — deliver relevant advertising. The table below summarises the main types of cookies we deploy:

When you first visit the Website, a consent banner will ask for your choices regarding non-essential cookies. You may update your preferences at any time via the "Cookie Settings" link in the footer. Please note that disabling certain cookies may affect the functionality of the Website. We comply with the Privacy and Electronic Communications Regulations (PECR), which require your prior informed consent before placing non-essential tracking technologies on your device.

7. Data Security

We implement comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction.

7.1. Technical Measures

• TLS/SSL encryption for all data transmitted between your device and our servers
• Encryption at rest for sensitive data fields, including payment credentials and identity documents
• Firewalls, intrusion detection systems, and regular vulnerability scanning
• Multi-factor authentication (MFA) options available for player accounts
• Strict access controls ensuring that staff access personal data only on a need-to-know basis

7.2. Organisational Measures

• Regular staff training on data protection obligations and phishing awareness
• Data protection impact assessments (DPIAs) for high-risk processing activities
• An incident response plan covering detection, containment, and notification procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware, and we will notify you directly where the breach poses a high risk to you, in accordance with UK GDPR Articles 33 and 34. Despite our measures, no transmission over the internet is entirely secure; you are also responsible for keeping your login credentials confidential.

8. Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected or as required by law. Our general retention periods are as follows:

• Account and identity data — retained for the duration of your account plus a minimum of five (5) years after account closure, in line with anti-money-laundering statutory requirements.
• Transaction and financial records — retained for a minimum of five (5) years following the transaction date to meet legal and audit obligations.
• Marketing data — retained until you withdraw consent or for up to two (2) years of inactivity, whichever comes first.
• Technical / log data — typically retained for up to twelve (12) months for security and operational purposes.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be attributed to you. You may request early deletion subject to Section 9 and applicable legal obligations that may require us to retain certain records regardless.

9. Your Rights

Under UK GDPR, you have a comprehensive set of rights in relation to your personal data. We are committed to facilitating these rights promptly and without undue obstacle.

9.1. Right of Access (Subject Access Request)

You have the right to obtain a copy of the personal data we hold about you, information about how it is used, who it is shared with, and how long it will be retained. We will respond to your request within one calendar month of receipt. For complex or numerous requests, we may extend this by a further two months, in which case we will inform you of the extension and the reason.

9.2. Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it. Please log in to your account to update standard profile information, or contact our support team for assistance with documents and sensitive fields.

9.3. Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and there is no other lawful basis), where you have objected to processing under Article 21, or where processing has been unlawful. Please note that we cannot delete data we are legally obliged to retain (e.g., AML records), and we will inform you of any such limitations when responding to your request.

9.4. Right to Restriction of Processing

You have the right to request that we restrict the processing of your data in certain circumstances — for example, where you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to deletion. During a restriction period, we will store your data but not otherwise process it, except with your consent or for legal claims.

9.5. Right to Data Portability

Where processing is based on your consent or on a contract with you, and is carried out by automated means, you may request that we provide your personal data to you (or transmit it to another controller you nominate) in a structured, commonly used, and machine-readable format such as CSV or JSON.

9.6. Right to Object

You have the right to object at any time to processing based on our legitimate interests, including profiling for direct marketing. Where you object to direct marketing, we will cease processing your data for that purpose immediately. For other legitimate-interests-based processing, we will assess whether our compelling grounds override your interests.

9.7. Rights Related to Automated Decision-Making & Profiling

We may use automated tools to screen accounts for fraud, AML risk, and responsible gaming indicators. Where a decision based solely on automated processing produces legal or similarly significant effects for you, you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

9.8. How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to [email protected]. We may ask you to verify your identity before we can action your request. All requests are free of charge; however, we may charge a reasonable administrative fee if requests are manifestly unfounded or excessive.

9.9. Right to Lodge a Complaint

If you are not satisfied with how we have handled your data or responded to a rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We encourage you to contact us first so that we have an opportunity to resolve your concern directly.

10. International Data Transfers

We primarily store and process your data within the United Kingdom. Where it is necessary to transfer personal data to a country outside the UK — for example, to a third-party software supplier or cloud infrastructure provider — we ensure that appropriate safeguards are in place as required by UK GDPR.

These safeguards may include:

• UK Adequacy Regulations — transfers to countries granted adequacy status by the UK Secretary of State, where data protection standards are deemed equivalent to those in the UK.
• UK International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), which create contractual obligations on the recipient to protect data to UK GDPR standards.
• Binding Corporate Rules (BCRs) — where the recipient is part of a multinational group that has had its data governance framework approved by the ICO.

You may request further details about the specific safeguards in place for any particular transfer by contacting us at [email protected].

11. Minors

Our services are strictly intended for individuals who are 18 years of age or older. We do not knowingly collect or process personal data from anyone under the age of 18. We employ age-verification procedures at account registration and may request documentary proof at any stage to confirm that a user meets the minimum age requirement.

If we discover or are notified that personal data has been collected from an individual under the age of 18, we will promptly suspend the relevant account, delete the data to the extent permitted by law, and reverse any transactions associated with that account. If you believe that a minor has registered with or accessed our platform, please notify us immediately at [email protected]. For further information on protecting young people from gambling harm, please review our Responsible Gaming page.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we offer. When we make material changes, we will notify you by posting the revised Policy on this page with an updated "Last Updated" date, and — where the changes significantly affect your rights or how we process your data — we will send you a direct notification via email or an in-account alert.

We encourage you to review this Policy periodically. Your continued use of the Website following publication of changes constitutes your acknowledgement of the updated Policy. If you disagree with any revision, you should stop using the Website and contact us to discuss your options, including account closure. Previous versions of this Policy can be made available on request.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please do not hesitate to contact us through the following channels:

Our data protection team will acknowledge your enquiry within two business days and provide a full response or update within the statutory timescales set out in Section 9. We are committed to resolving data protection concerns fairly and transparently.

Responsible Gambling Resources

Galleon Casino is committed to promoting safer gambling. If you or someone you know is experiencing difficulties related to gambling, the following free, confidential support services are available in Great Britain:

• GamCare — National Gambling Helpline: 0808 8020 133 (free, 24/7) | gamcare.org.uk
• BeGambleAware — information, tools, and treatment access | begambleaware.org
• Gordon Moody — residential treatment and recovery programmes | gordonmoody.org.uk
• Gamblers Anonymous UK — peer support and 12-step groups | gamblersanonymous.org.uk
• Betknowmore UK — peer support, including specialist support for affected others | betknowmoreuk.org
• NHS National Problem Gambling Clinic — specialist clinical treatment | cnwl.nhs.uk

For more information on the responsible gambling tools available on our platform, including deposit limits, session reminders, and self-exclusion options, please visit our Responsible Gaming page.