Privacy Policy

Categories of information we hold

Registration details form the core record: name, date of birth, residential address, email address, telephone number and chosen currency. These fields are mandatory because licensing conditions require an operator to know the identity and age of every account holder.

Verification material is collected separately and usually consists of a government-issued photo identity document, a recent utility bill or bank statement showing your address, and — where a card was used — a partially masked image of that card. We ask you to obscure all but the final four digits before uploading.

Transactional records cover deposits, withdrawals, bonus credits, wagers placed and game outcomes. Technical records cover IP address, approximate location derived from it, device type, operating system, browser build, language preference and the timestamps of each login.

Correspondence is retained as written: live chat transcripts, emails to and from support, and notes added by agents while resolving a query.

Purposes and legal grounds

We process registration and verification data to perform our contract with you and to satisfy obligations placed on us as a licensee of Curaçao eGaming under licence 365/JAZ, including age verification, anti-money-laundering checks and sanctions screening. Refusing to provide this data means an account cannot be opened or funded.

Transactional and technical data are processed in our legitimate interest in running a secure platform: detecting duplicate accounts, identifying bonus abuse, spotting compromised logins and investigating disputed payments. The same records let us reconstruct what happened when a player queries a result.

Behavioural signals are also reviewed for responsible gaming purposes. Sharp increases in deposit frequency, repeated cancellation of withdrawals or play at unusual hours may prompt us to contact you and point you towards the limit tools described in our responsible gaming policy.

Marketing by email or SMS is sent only on the basis of consent given at registration or later in your account settings. Withdrawing that consent stops promotional contact immediately; it does not stop service messages such as password resets or withdrawal confirmations, which we must continue to send.

Cookies, analytics and third-party recipients

Strictly necessary cookies keep you logged in, preserve your basket of game settings and protect forms against automated abuse. They cannot be switched off without breaking the site. Analytics and preference cookies are optional and are governed by the choices you make in the consent banner, which you can revisit at any time.

Data is shared with a limited set of processors who each act on our written instructions: payment providers and their fraud screening systems, the identity verification bureau that checks your documents, the game studios whose titles run inside our lobby, our hosting and email delivery suppliers, and our external auditors.

Disclosure also occurs where it is compelled: to our licensing authority on request, to law enforcement acting under lawful process, and to the Australian Transaction Reports and Analysis Centre or equivalent bodies where reporting duties apply. We do not sell personal information and we do not pass it to advertising brokers.

Some of these recipients are located outside your country of residence. Where personal data leaves Australia or the European Economic Area we rely on standard contractual clauses or an equivalent transfer mechanism, and we require the recipient to apply protections no weaker than those described here.

Security measures and retention periods

Traffic between your device and our servers is encrypted in transit. Verification documents are stored in an access-controlled repository, passwords are held only as salted hashes, and staff access to player records is limited by role and recorded in an audit log.

No system can promise absolute security. You share responsibility for it by using a password unique to Grand Rush Casino, enabling two-factor authentication where offered, and telling us at once if you suspect someone else has reached your account.

Account and transaction records are kept for a minimum of five years after an account closes, because anti-money-laundering rules require that period. Verification documents follow the same clock. Chat transcripts are held for two years, and optional analytics data is aggregated or deleted within twenty-six months.

Where a self-exclusion is in force we keep the minimum information needed to enforce it — essentially your name, date of birth and the exclusion end date — for the duration of the exclusion and afterwards, because deleting it would allow the block to be bypassed.

Your rights and how to use them

You may ask for a copy of the personal information we hold, request correction of anything inaccurate, object to processing based on legitimate interests, ask for a portable export of the data you supplied to us, or request erasure where no retention duty overrides the request. Australian residents hold these rights under the Privacy Act 1988 and the Australian Privacy Principles.

Requests should be sent from the email address registered to the account. We answer within thirty days and will ask a small number of security questions first — an unverified request is how account takeovers begin, so this step is not negotiable.

If our response does not satisfy you, you may complain to the Office of the Australian Information Commissioner or to the data protection authority in your own jurisdiction, and separately to Curaçao eGaming as our licensing body. We would ask you to raise the matter with us first, since most issues turn out to be correctable in a single exchange.