Your Privacy at Bigwinbox
Data We Collect From You
We collect only the data we need to run your account, verify your identity and meet our legal obligations. When you register at Bigwinbox Casino we ask for your name, date of birth, email address, phone number and residential address. Before your first withdrawal we also request verification documents: a photo ID, proof of address and proof of your payment method.
Beyond that, our systems record transaction data for every deposit and withdrawal, your device and IP information when you log in, and your gameplay behaviour, including bets placed, games played, bonuses used and session history. If you opt in to marketing, we store your communication preferences.
- Identity data: name, date of birth, email, phone, address
- Verification documents: ID, proof of address, payment method proof
- Transaction data: deposits, withdrawals, payment method details
- Technical data: device type, browser, IP address, login times
- Gameplay data: bets, results, bonuses, session duration
- Marketing preferences: opt-ins, channels, consent records
How We Use Your Data
We use your data to create and manage your account, process deposits and withdrawals, and carry out identity verification (KYC) before your first payout. The same records feed our fraud prevention systems, which flag suspicious patterns such as duplicate accounts or unusual payment behaviour.
We also monitor play patterns to support responsible gambling, watching for signs that deposit limits, loss limits or self-exclusion measures should be applied. Where you have given consent, we use your email and phone details to send bonus offers, tournament invitations and news. Finally, we use your data to meet legal obligations, including anti-money-laundering reporting and responses to regulator requests.
Our Legal Bases for Processing
Contract. We process your identity, account and transaction data to perform the agreement you enter when you register with us. Without this data we cannot open or maintain your account, so processing is necessary for the contract.
Legal obligation. Verification, record-keeping and anti-money-laundering checks are required by our MGA licence. We keep and report this data because the law obliges us to, not because we choose to.
Legitimate interest. Fraud prevention, security monitoring and service improvement rely on our legitimate interest in operating a safe casino. We weigh this interest against your rights and keep intrusion to the minimum needed.
Consent. Marketing emails, SMS and personalised offers are sent only where you have opted in. You can withdraw that consent at any time without losing access to your account.
How Long We Keep Records
We do not hold your data forever, and we do not delete it too early either, since gambling regulations require long record-keeping. Each category has its own retention clock, summarised below. When a period ends, we delete or anonymise the data.
| Data category | Retention period |
|---|---|
| Transaction and KYC records | At least 5 years after account closure, as required by regulation |
| Account and identity data | Duration of the account, plus the statutory archive period |
| Verification documents | Up to 5 years after the last transaction |
| Gameplay and log data | Up to 5 years, then anonymised for analytics |
| Marketing consent records | Until you withdraw consent, plus 2 years for proof of consent |
| Support correspondence | Up to 3 years |
Who We Share Data With
We never sell your personal data. We share it only with partners who help us operate the casino, and each one works under a data processing agreement that limits what they may do with your information.
Payment processors handle your card, e-wallet and crypto transactions. KYC and AML providers verify your documents and screen against sanctions lists. Game providers receive your player ID and bet data so their servers can record outcomes. Analytics and marketing platforms measure site performance where you have consented to cookies. Regulators and, where legally required, law enforcement authorities may request records from us.
- Payment processors (cards, e-wallets, crypto gateways)
- KYC/AML verification providers
- Game and platform suppliers
- Analytics and marketing tools (consent-based)
- Regulators and competent authorities
Your Rights Over Your Data
You control your data, and exercising these rights costs you nothing. Email our data protection officer at [email protected] and we will respond within one month, extendable by two further months for complex requests.
You can ask us for a copy of the data we hold (access), correct anything inaccurate (rectification), delete data we no longer need (erasure), or receive your records in a portable format (portability). You may object to processing based on legitimate interest and withdraw marketing consent at any time via account settings or the unsubscribe link. If you believe we have handled your data incorrectly, you may complain to the Malta Data Protection Commissioner or your local supervisory authority.
- Right of access to your data
- Right to rectification of errors
- Right to erasure where retention is not required by law
- Right to data portability
- Right to object to legitimate-interest processing
- Right to withdraw consent at any time
- Right to complain to a data protection authority
Cookies and Tracking
We use cookies to keep you logged in, remember your preferences and, with your consent, measure traffic and personalise offers. Essential cookies run without consent because the site cannot function without them; analytics and marketing cookies are switched on only after you accept them in the cookie banner. You can change your choices at any time. Full details, including a list of cookie categories and how to block them in your browser, are set out on our separate Cookies Policy page.
How We Protect Your Information
All traffic between your device and our servers is encrypted with TLS. Stored verification documents sit in access-controlled storage, and only staff who need them for KYC or support can open them. Every access attempt is logged and reviewed.
We run regular security testing, segment our network, and require multi-factor authentication for internal systems. If a personal data breach occurs that risks your rights, we notify the relevant supervisory authority within 72 hours and inform you directly where the risk is high.
Contact Our Data Protection Officer
Questions about this policy, your rights or how we process your data go straight to our data protection officer at [email protected]. General account questions are best sent to [email protected], where our live chat and email team are available 24/7. This policy was last reviewed in 2026 and may change; we will post any update on this page and notify you by email if the change affects your rights.
Frequently asked questions
Can I play without giving my ID documents?
You can register and play with deposits, but we must verify your identity before the first withdrawal. This is a licence requirement, so we cannot release funds without ID, proof of address and payment method verification.
How do I stop marketing emails?
Use the unsubscribe link in any email, switch off marketing in your account settings, or email [email protected]. We stop sending offers immediately and keep only a record of your withdrawal of consent.
Will you delete my data if I close my account?
Not immediately. Gambling regulations require us to keep transaction and KYC records for at least 5 years after account closure. Marketing data is deleted much sooner, as soon as your consent is withdrawn.
Do you share my data with advertisers?
No. We never sell personal data. Analytics and marketing platforms receive only consented, cookie-based data used to run our own site and offers.