Your Privacy at Tombet Casino

Q: How do I request a copy of my data?

Email dpo@tombet.com with your account ID. We verify your identity and send a structured copy of the personal data we hold within one month.

This Privacy Policy explains what personal data we collect when you play at Tombet Casino, why we collect it, how long we keep it and what rights you hold over it. We operate under licence MGA/B2C/832/2025 issued by the Malta Gaming Authority.

Data We Collect

Categories of personal data

We collect only the data needed to run your account, meet our licence obligations and keep you safe. You give some of it directly when you register; our systems generate the rest automatically.

Identity data: name, date of birth, email address, phone number and residential address
Verification documents: passport, driving licence or utility bill copies submitted during KYC checks
Transaction data: deposits, withdrawals, payment method details and bonus history
Technical data: IP address, device identifiers, browser type and approximate location
Gameplay behaviour: bets placed, games played, session duration, win and loss records
Marketing preferences: which channels you consented to and your opt-in or opt-out choices

How We Use Your Data

We use your data to create and manage your account, verify your identity and age, process deposits and withdrawals, and detect fraud or money laundering. Our systems also monitor gameplay patterns to identify signs of problem gambling and to apply the responsible-gambling tools you set, such as deposit limits and session reminders.

With your consent we send you promotional messages about bonuses like our weekly 10% cashback up to £100 and monthly prize draws. If you withdraw consent, we stop marketing communication but keep the records that regulation requires us to hold.

Our Legal Bases

Contract: we process your data to open your account, honour the terms you accepted and pay out winnings. Without this data we cannot provide the service you signed up for.

Legal obligation: our MGA licence and anti-money-laundering law require us to verify your identity, monitor transactions and retain records for a minimum of five years.

Legitimate interest: we process technical and gameplay data to prevent fraud, secure our platform and improve game performance, always balancing our interest against your rights.

Consent: marketing emails, SMS and personalised offers run only on your explicit opt-in. You may withdraw consent at any time through your account settings or the unsubscribe link.

How Long We Keep Data

We hold each category of data only as long as needed, then delete or anonymise it. Regulatory retention rules override shorter internal periods where they apply.

Transaction and account records: at least 5 years after account closure, as our licence requires
KYC verification documents: 5 years after the business relationship ends
Fraud and AML investigation records: up to 5 years after the case closes
Marketing preferences: until you withdraw consent, then proof of withdrawal for 12 months
Technical logs: up to 12 months for security and debugging

We never sell your personal data. We share it only with partners who need it to deliver the service, each bound by a data-processing agreement and confidentiality terms.

Payment processors handling your Visa Debit, PayPal, Trustly or e-wallet transactions
KYC and AML verification providers that check your documents and screen against sanctions lists
Game and platform providers, limited to the data needed to run your session
Analytics and hosting providers that support site performance and security
The Malta Gaming Authority and other regulators or law-enforcement bodies when legally required

Your Data Rights

You control your personal data. Under GDPR you can exercise the following rights at any time by emailing our Data Protection Officer; we respond within one month.

Access: get a copy of the personal data we hold about you
Rectification: correct inaccurate or incomplete data
Erasure: request deletion where no legal retention duty applies
Portability: receive your data in a structured, machine-readable format
Objection: object to processing based on legitimate interest
Withdraw consent: stop marketing processing at any time
Complain: lodge a complaint with the Information Commissioner's Office (ICO) or the Maltese supervisory authority

Cookies and Tracking

We use essential cookies to keep you logged in and secure your session, plus optional analytics and marketing cookies set only after your consent in the cookie banner. You can change your cookie choices at any time; full details, including how to disable cookies in your browser, are on our dedicated Cookies Policy page.

How We Protect Data

All traffic between your device and Tombet Casino runs over TLS encryption, and payment credentials are tokenised so full card details never sit on our servers. Access to personal data follows a strict need-to-know model with role-based permissions, mandatory multi-factor authentication for staff and regular access reviews.

We test our defences continuously and log every access to sensitive records. If a personal-data breach occurs that risks your rights, we notify the relevant supervisory authority within 72 hours and inform affected players directly where the law requires it.

Contact Our Data Officer

Questions about this policy, a data request or a privacy concern go straight to our Data Protection Officer at [email protected]. Alternatively, write to TomBet Gaming Limited, Data Protection Office, with your account ID and we will respond within one month. We review this policy at least annually and publish any changes on this page.

Frequently Asked Questions

How do I request a copy of my data?

Email [email protected] with your account ID. We verify your identity and send a structured copy of the personal data we hold within one month.

Can I delete my account and all my data?

You can close your account at any time. Transaction and KYC records must be retained for at least 5 years under our MGA licence, but everything not covered by that duty is deleted.

How do I stop marketing emails?

Use the unsubscribe link in any message or change your preferences in account settings. Consent withdrawal takes effect immediately for future communications.