Our Privacy Policy, Your Data
This page sets out exactly what personal data we at Grosvenor Casino collect when you play with us at grosvenoronline.uk, why we hold it, how long we keep it and what rights you hold over it. We operate under the UK GDPR and the Data Protection Act, and our licence with the Malta Gaming Authority (MGA/B2C/394/2019) adds further record-keeping duties that we explain below.
The Data We Collect
We collect personal data only where there is a clear reason to do so, and we keep each category separate in our systems so that it can be managed, corrected or deleted without touching unrelated records.
- Identity data: your name, date of birth, email address, phone number and residential address, provided when you register your account.
- Verification documents: passport, driving licence or utility bill copies submitted for identity and address checks before your first withdrawal.
- Transaction data: deposits and withdrawals, payment method details, amounts and timestamps, processed in GBP.
- Device and connection data: IP address, device identifiers, browser type and approximate location derived from your IP.
- Gameplay behaviour: games played, stakes, wins, losses, session duration and betting patterns.
- Marketing preferences: which channels you opted into, when you consented and how you withdrew that consent.
How We Use Your Data
We process your data to open and run your account, verify you are who you say you are, process deposits and withdrawals in GBP, and meet the reporting duties attached to our MGA licence. Fraud prevention runs continuously: transaction data and gameplay behaviour feed automated checks that flag unusual patterns for our risk team to review.
Responsible-gambling monitoring is another core use. Session length, deposit frequency and loss patterns let us identify players who may need support, and we act on those signals with limits checks or direct contact where appropriate. Where you have consented, we also use your email and phone number for promotional messages, and we stop the moment you withdraw consent.
Why the Law Lets Us
Contract: processing your identity and transaction data is necessary to create your account, honour wagers and pay out winnings. Without it we cannot offer you the service at all.
Legal obligation: our gambling licence, anti-money-laundering rules and tax reporting require us to verify your identity, monitor transactions and retain records for statutory periods. You cannot opt out of these, and neither can we.
Legitimate interest: fraud detection, security logging and aggregated service improvement rest on our legitimate interest in running a safe platform. This interest is balanced against your rights, and it never covers direct marketing.
Consent: marketing emails, SMS and personalised offers run only on your explicit consent. Consent is given at registration or later, recorded with a timestamp, and can be withdrawn at any time through your account settings or a link in every message we send.
How Long We Keep It
Retention periods follow the strictest applicable rule, which is usually the gambling regulation rather than the general data-protection default. Nothing is kept past the point where the last applicable deadline expires, and automated deletion jobs clear expired marketing data.
| Data category | Retention period |
|---|---|
| Identity and verification documents | 5 years after account closure, longer if an investigation is open |
| Transaction records | 6 years, as required for financial and AML reporting |
| Gameplay and betting history | 5 years after your last session |
| Device, IP and security logs | 12 months |
| Marketing preferences and consent records | Until you withdraw consent, plus 6 months to evidence the withdrawal |
| Account correspondence | 2 years after closure |
Who Else Sees It
Where a processor sits outside the UK or EEA, we rely on adequacy decisions or standard contractual clauses and carry out transfer risk assessments before any data moves.
- Payment processors handling your Visa Debit, Mastercard, Trustly, PayPal, Skrill, Neteller and bank transactions.
- Identity and address verification providers running our KYC checks.
- Anti-fraud and AML screening services.
- The Malta Gaming Authority and UK regulators, when reports or audits require it.
- Analytics providers measuring site performance on an aggregated basis, with IP anonymisation applied.
Your Rights Over Us
To exercise any right, email our data protection team at the address below with your account details. Withdrawing consent stops marketing immediately, but it does not erase records we must keep under gambling law.
- Access: a copy of the personal data we hold about you, plus how we use it.
- Rectification: correction of inaccurate records, including verification details.
- Erasure: deletion where no legal retention duty applies.
- Portability: your account and gameplay data in a machine-readable format.
- Objection: an objection to processing based on legitimate interest.
- Complaint: you may complain to the Information Commissioner's Office (ico.org.uk) at any time.
Cookies and Tracking
We use strictly necessary cookies to keep you logged in and your session secure, plus optional analytics and marketing cookies that load only after you accept them in the consent banner. Session cookies expire when you close your browser; persistent cookies are capped at 12 months. Full details, including the categories and how to change your choices, sit on our dedicated Cookies Policy page, which we keep separate so you can manage cookie preferences without reading the whole privacy document.
How We Protect You
All traffic between your device and our platform travels over TLS encryption, and stored verification documents sit encrypted at rest in access-controlled storage. Staff access follows least-privilege rules: our support agents see only what your query needs, and full records are restricted to compliance personnel under logged, auditable permissions.
If a personal data breach occurs, we notify the Information Commissioner's Office within 72 hours where the law requires it, and we tell you directly without undue delay if the breach poses a high risk to your rights. Our incident process covers containment, assessment, notification and a post-incident review, and its findings feed back into our controls.
Frequently asked questions
Do you keep my ID documents forever?
No. Verification documents are deleted 5 years after your account closes, unless an open investigation or a regulator instruction requires us to hold them longer.
Can I stop marketing emails but keep playing?
Yes. Withdraw consent through your account settings or any email link; marketing stops immediately while your account and gameplay continue unchanged.
How do I ask for a copy of my data?
Email our data protection team with your account details and we send a full copy, plus the purposes and retention periods for each category, within one month.
Who do I complain to if I am unhappy?
You can complain to the Information Commissioner's Office at ico.org.uk, and we ask you to contact us first so we can try to resolve it directly.