Privacy Policy: What Galactic Wins Collects, Why It Is Held, and the Rights You Have Under the Privacy Act 2020

Opening a casino account means handing over more personal information than most websites ask for: identity documents, payment details and a record of how you play. This page sets out what is collected, the reason behind each category, who else sees it, how long it stays and what you can do about any of it. It is written to be used, not skimmed past.

New Zealand's Privacy Act 2020 and its thirteen information privacy principles are the framework we work to for players in this country. Where the operator's Maltese obligations require something stricter, the stricter rule applies.

Who holds your data

The operator is Green Feather Online Limited, company number C 80735, registered at Elite Business Centre, Trejqa ta' Box Box, Msida MSD 1840, Malta, holder of licence MGA/B2C/445/2017 issued by the Malta Gaming Authority. That company is the agency responsible for your personal information under the Privacy Act, and it is the entity a request or complaint should be addressed to.

What is collected

Identity, verification, financial and gameplay data are not optional. An account cannot legally exist without them. Marketing data is the one genuinely optional category, and declining it changes nothing about your ability to play.

Why each category is held

• To run your account (contractual necessity). Registration details, balances, transactions and gameplay records exist because there is no account without them.
• To meet legal obligations. Verification documents, source of funds checks and transaction monitoring are anti-money-laundering and licensing requirements, not preferences. Regulators can require these records to be produced.
• For legitimate interests. Fraud detection, bonus abuse checks, security monitoring, dispute resolution and improving how the platform works. These are balanced against your interests, and you can object to processing on this basis.
• With your consent. Marketing emails, promotional messages and non-essential cookies. Consent can be withdrawn at any time without affecting anything else.

The distinction matters in practice: unsubscribing from marketing does not remove KYC records, and no legal obligation requires you to accept promotional email.

Who your information is shared with

Personal information is not sold, rented or traded. It is disclosed only where a specific function requires it:

• Payment providers and banks, to move deposits and withdrawals and to investigate failed transactions.
• Identity verification agencies, to confirm documents are genuine and to run required sanctions and politically exposed person screening.
• Game providers, which receive the technical data needed to run a session and record its outcome, not your identity documents.
• Technology suppliers hosting the platform, sending transactional email or providing live chat, all bound by contract to process data only on instruction.
• Regulators and law enforcement, including the Malta Gaming Authority and, where a lawful request is made, New Zealand authorities.
• Group companies under the same licensee, where an account, self-exclusion or fraud record needs to be recognised across brands.

When data leaves New Zealand

It does. The operator is based in Malta and its systems and suppliers sit largely in the European Economic Area, so your information is stored and processed offshore. Information privacy principle 12 of the Privacy Act 2020 permits that where the receiving jurisdiction offers comparable safeguards or contractual protections are in place. Malta is subject to European data protection law, which meets that test, and suppliers outside it are engaged under standard contractual clauses.

Your rights, and how to use them

Under the Privacy Act 2020 you can:

• Ask what is held about you (principle 6). Send a request from your registered email address. A response is due within 20 working days, and the usual output is a structured export of your account, transaction and communication records.
• Correct anything wrong (principle 7). Name and contact details can often be edited in account settings; anything tied to verification is corrected by support with a document showing the correct detail. If a correction is refused, you can require that your request be recorded alongside the data.
• Ask for deletion. Marketing data, contact preferences and optional profile details can be removed on request. Records covered by anti-money-laundering law cannot, until the retention period expires. Anyone promising instant total erasure of a gambling account is describing something no licensed operator can lawfully do.
• Withdraw marketing consent. Use the unsubscribe link, change the setting in your account, or ask support. Transactional messages about your balance, withdrawals or account security continue, because they are part of the service rather than marketing.
• Object to profiling. You can ask that your data stop being used to tailor promotional offers, without closing the account.
• Complain. Raise it with the operator first. If the response does not satisfy you, the Office of the Privacy Commissioner at privacy.org.nz takes complaints from New Zealand residents free of charge.

How long records are kept

Account, transaction and verification records are retained for a minimum of five years after your account closes, the standard anti-money-laundering retention period the licensee is bound by. Some records, particularly those tied to an investigation, a dispute or a self-exclusion, are held longer where the law or the regulator requires it.

Self-exclusion records are deliberately kept after closure. Deleting them would defeat the exclusion by letting a new account open freely. Marketing preferences are held until you withdraw consent, then a minimal suppression record remains so that you are not contacted again by mistake. Live chat transcripts and complaint files are kept while they remain relevant to an open matter.

Cookies and tracking

Three kinds of cookie run on the site. Essential cookies keep you logged in, hold your session and protect against fraud; the site does not work without them. Performance and analytics cookies show how pages are used in aggregate so slow or broken journeys can be found. Marketing cookies measure campaign response and can support advertising.

Only the first category is set without asking. The rest depend on your choice in the cookie banner, which can be reopened and changed at any time. Browser settings offer a second layer of control, including blocking third-party cookies or clearing them on exit. Declining analytics and marketing cookies does not restrict access to any part of the site.

How your data is protected

Traffic between your device and the platform is encrypted in transit, and stored credentials are hashed rather than kept in readable form. Access to verification documents is restricted to staff whose role requires it, and that access is logged. Payment card details are handled inside the payment provider's environment rather than being stored in full by the casino.

Your side of this matters too. Use a password unique to this account, turn on two-factor authentication if it is offered, do not stay logged in on shared devices, and treat any message asking for your password or a document by email as suspicious. Support will never ask for your password.

People under 18

Accounts are restricted to adults aged 18 and over, and age is checked as part of verification. Personal information about children is not knowingly collected. If an account is found to belong to someone under 18, it is closed, wagers are voided and the data is handled as the law requires rather than kept for commercial use. A parent or guardian who believes a minor has registered should contact support immediately so the account can be locked.

Contacting the privacy team

Privacy requests, access requests, corrections and complaints go to the operator's data protection contact, reachable through live chat inside the Galactic Wins account or by writing to the registered address above marked for the attention of the Data Protection Officer. Send requests from your registered email address so identity can be confirmed without extra document checks, and state clearly what you want: access, correction, deletion or objection. Acknowledgement is normally same-day, with a substantive answer inside the 20 working days the Privacy Act allows.

If you believe this policy has not been followed, the Office of the Privacy Commissioner at privacy.org.nz can review the matter independently.