What we collect

• Identification and contact details: name, date of birth, address, email, telephone number.
• Account information: username, settings, limits, self-exclusion status.
• Verification records: age and identity checks, copies of documents where required by law.
• Transaction and payment details: payment method tokens, deposits, withdrawals, bets, winnings, losses.
• Technical and usage data: device details, IP address, log files, cookies, session data.
• Gameplay and betting history.
• Communications and preferences: support interactions, emails, marketing choices.
• Responsible gambling information: affordability assessments and interaction notes where required by regulation.

Why we collect

• To provide and maintain services and user accounts.
• To process payments and payouts securely.
• To meet legal duties under UK gambling, anti-money laundering, and tax rules.
• To prevent fraud and protect security and integrity.
• To improve the website and user experience through analytics and testing.
• To send service messages and marketing where permitted.

Protection measures

• Encryption in transit, strict access controls, role-based permissions, logging and monitoring.
• Segregated environments and regular security testing.
• Staff training and confidentiality obligations.
• Vendor due diligence and written data processing terms.
• Incident response and breach notification procedures.

Retention

• Personal data is kept only as long as needed for the purposes above.
• Records required for anti-money laundering and regulatory purposes are retained for up to 7 years after account closure, then securely deleted or anonymised.

Your rights (UK GDPR)

• Access, rectification, erasure, restriction, portability, and objection.
• Right to withdraw consent where processing relies on consent.
• Right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects.
• Right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Compliance

• Nine Casino acts as data controller and complies with UK GDPR, the Data Protection Act 2018, the Gambling Commission’s requirements, and the Privacy and Electronic Communications Regulations (PECR).

Lawful bases

• Performance of a contract: to operate accounts and provide services.
• Legal obligation: KYC, AML, age verification, and regulatory reporting.
• Legitimate interests: security, fraud prevention, and service improvement, balanced against user rights.
• Consent: non-essential cookies, direct marketing, certain analytics.

How data is used

• Create and administer accounts; verify identity and age.
• Process deposits, bets, payouts, and related transaction information.
• Monitor fairness and integrity; detect fraud, abuse, and problem gambling indicators.
• Provide support and service communications.
• Improve online services using aggregated analytics and testing.
• Personalise website content and settings.
• Conduct marketing by email, SMS, or push where consent exists or soft opt-in applies, with opt-out available at any time.
• Meet audits, disputes, and regulatory checks.

Transparency

• Processing is lawful, fair, and transparent. Notices are updated when collection or use changes in a meaningful way.

Access and portability

• Users can request a copy of personal data through account privacy tools or by contacting support. A response is provided within one month, extended by up to two months for complex requests.

Correction

• Most account details can be updated in settings. Users may request rectification if records are inaccurate or incomplete.

Deletion

• Users can request erasure. Information that must be retained to comply with law or to establish or defend legal claims will be kept for the required period, then removed or anonymised.

Verification

• Proof of identity may be requested to protect the security of accounts and data.

Security checks and payments

• By using Nine Casino, the user consents to necessary security checks and to the processing of payment information by authorised payment providers and anti-fraud services.

• Services are available only to persons aged 18 or over.
• The operator cannot confirm a user’s age without suitable documents or electronic verification checks.
• Accounts suspected to belong to a minor will be suspended. Personal data relating to a confirmed minor will be deleted on verification, unless retention is required for legal reasons.
• Parents or guardians may contact support to request deletion of a minor’s information. Steps will be taken to verify the requester before actioning the request.

• Personal data may be transferred to and processed in countries outside the United Kingdom where payment processors, verification providers, fraud prevention services, cloud hosting, or support partners operate.
• Appropriate safeguards are used, including UK adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, and technical and organisational measures.
• Use of the website signifies consent to these transfers where consent is required by law.
• All partners are bound by confidentiality and data protection obligations in their contracts and are assessed for compliance before onboarding.

• This legal disclaimer forms part of the policy and may limit, qualify, or clarify how certain rules apply in practice.
• The disclaimer takes effect when the user accepts this policy through signature, electronic acceptance, or accession during registration or continued use.
• Nothing in this policy limits rights granted by applicable data protection law or excludes liability where such exclusion would be unlawful.

• Cookies are small text files stored on a device by websites and apps.
• Non-essential cookies are used for statistics, behaviour analysis, personalisation, and site improvement. Retention for these cookies is up to 1 year.
• Categories include: strictly necessary, performance and analytics, functional, and targeting.
• Controls are available through the cookie banner and browser settings. Under PECR, non-essential cookies are set only after consent, which can be withdrawn at any time.

• Using Nine Casino signifies full acceptance of this policy. The current version published on the website prevails over earlier versions.
• Material changes will be reflected in this policy and, where appropriate, notified through the user account.

• Personal data may be shared with third parties where required by law, to resolve disputes, to prevent fraud, to process payments, to verify identity, or to fulfil agreements with users.
• A list or category description of such third parties is provided on the website. Where specific parties are not named, users will be informed of the purpose and scope before sharing when required by law.
• Providing personal information for these purposes constitutes consent where consent is the lawful basis. In other cases, sharing occurs under contract, legal obligation, or legitimate interests.
• Some partners act as independent controllers and apply their own privacy policies. Users should review those policies on the partners’ websites.

• The website may contain links to third-party websites or services that are not controlled by us.
• Those websites operate their own privacy policies and practices. Responsibility does not extend to their handling of information.
• Users should exercise caution when visiting external websites and when sharing personal data.