Privacy Policy

Wild Tokyo Casino is operated by GBL Solutions N.V. under licence from the Curaçao Gaming Control Board, and what follows is how personal information about Australian players is handled. One point belongs at the top rather than buried in a later section: the operator sits offshore. Oversight comes from the Curaçao GCB, not from an Australian licence, so the remedies an Australian player would reach for under the Interactive Gambling Act 2001 framework do not apply here in the way they apply to a locally licensed provider.

Who we are and what this policy covers

GBL Solutions N.V., incorporated under the laws of Curaçao, is the controller of your personal information. The policy covers the whole of your contact with wildtokyo.com: browsing, registration, deposits, pokies and live tables, support tickets, tournaments, the loyalty programme. It is written for residents of Australia, with the Privacy Act 1988 and the Australian Privacy Principles in view, while the legal core of the processing sits under Curaçao data protection law.

Those two frameworks are not identical, and pretending otherwise would be no use to you. Curaçao rules come first for us as an offshore operator, and on transparency, access and correction we align with APP standards. Where the frameworks pull in different directions on a specific action, we tell you which one governs it.

What personal information we collect

Nothing is collected that we cannot tie to a stated purpose. Identity information means your full name, date of birth, gender and nationality, plus the copy of a passport, driver licence or other photo ID that KYC requires. Alongside it sits the contact set: email address, mobile number, residential address.

Your account generates a second layer. Username, hashed password, security questions, loyalty level, coin balance and preferences all belong to it. So does the financial record of how money moves, which means the instruments used to deposit and withdraw, card BIN and last four digits, e-wallet identifiers, bank account details, and cryptocurrency wallet addresses where those apply. Every deposit, withdrawal, wager, tournament entry, Shop exchange and bonus is logged as transactional data.

Then there is what the connection itself reveals: IP address, device identifiers, browser type, operating system, session logs and the interaction data captured by cookies and similar technologies. Communications are kept too. Live Chat messages, emails to support, and recordings or transcripts of a video KYC call where a Risk Department review calls for one.

Sensitive information in the APP sense is not collected as a matter of course. Occasionally a responsible gambling conversation produces something health-adjacent, and that gets the higher standard the Privacy Act expects.

How we collect it

Most of it you hand over yourself, at registration, when documents go up, at the cashier, or in a support ticket. Some is generated as you move around the site, through cookies, server logs and payment gateway callbacks. The rest arrives from third parties: identity verification providers checking your documents, payment processors confirming a transaction, game providers reporting session activity, affiliate partners telling us they referred you.

Why we process your personal information

Opening and running your account is the first reason, and delivering the gambling service you asked for is the second. Deposits and withdrawals have to be processed. Identity and age have to be verified, because the Curaçao licence and AML rules require it. Fraud, bonus abuse, collusion and prohibited software all have to be detected. The loyalty programme, tournaments, cashback and the coin economy need administering, and transactional messages about your account need sending. On top of that sit the legal obligations: AML monitoring, tax reporting where it applies, and lawful requests from regulators or law enforcement.

Direct marketing is a separate purpose with a separate basis. It runs on consent alone, and withdrawing that consent costs you nothing in access to core services.

Legal grounds

Four grounds carry the processing. The contract you enter by accepting the Terms of Use. Our legal obligations under Curaçao gaming and AML rules. Our legitimate interests in security and fraud prevention. And your consent, for marketing and for non-essential cookies. Decline that last one and the account still runs; you simply get no marketing.

Sharing your information

Personal information is not sold. It is shared, though, with the categories of recipient the platform cannot run without. Payment processors and banks move deposits and withdrawals. Identity verification vendors handle KYC and sanctions screening. Game providers get the session data needed to serve a game, and that covers Pragmatic Play, Hacksaw Gaming, NetEnt, Play'n GO, Nolimit City, BGaming and the rest of the library. Abuse is spotted with the help of fraud prevention and analytics providers. Infrastructure sits with cloud hosting, CDN and email delivery vendors. Regulators, tax authorities and courts receive what a lawful request obliges us to give them, and professional advisers such as lawyers and auditors get access strictly where they need it.

International transfers

Your data leaves Australia. It goes to Curaçao, to the European Economic Area, to the United Kingdom, and to whichever other jurisdictions our vendors operate from. Curaçao does not appear on the Australian Government's list of countries with substantially similar privacy laws, and you should know that before you decide. What we can offer against it is contractual: written protections obliging each recipient to hold the data to a standard comparable with our own, and an assessment of every vendor before it is onboarded.

How long we keep it

Account and KYC records live for as long as the relationship does, and then for a further stretch to satisfy the AML retention rules under Curaçao regulation, which generally mean at least five years from the end of the business relationship. Transactional and financial records follow that same clock. Marketing preferences last until you withdraw consent or the account closes, whichever lands first. Support conversations are kept for two years, longer only if a dispute or a regulatory matter forces it. A video KYC recording, where one exists at all, is deleted within twelve months of the review closing unless a specific investigation needs it held.

How we protect it

Measures are technical and organisational, and they are scaled to the risk. TLS in transit. Encryption of sensitive fields at rest, hashed passwords, access controls tied to job function, logging of privileged actions. Two-factor authentication is offered on every account. Behind that sit network segmentation and vendor due diligence. None of it makes a system invulnerable, and we are not going to claim otherwise. If a breach touches your data and meets the notifiable data breach threshold under the Privacy Act, you and the OAIC hear about it in line with the scheme.

Your rights

The Privacy Act and the APPs give you the right to ask what we hold about you, and to have it corrected when it is wrong. Marketing consent can be withdrawn whenever you like. Complaints come to us first, and if our answer does not satisfy you, the Office of the Australian Information Commissioner is the next step. Contact details for that are at oaic.gov.au.

Curaçao rules add erasure, restriction and portability to the list. Some of those sit awkwardly against our AML retention duties. Where a legal obligation requires specific records to stay, we will say so and explain why, rather than quietly delete something we are required to hold.

Cookies and similar technologies

The Cookie Policy has the detail. The short version is that essential cookies keep you logged in and support fraud prevention, while analytics and marketing cookies wait for your consent through the banner.

Automated decision-making

Rules-based systems flag transactions for AML review and pick up bonus abuse and collusion. Before any material adverse decision, though, such as a withheld withdrawal or a closed account, a person reviews the flag. You can ask us to explain a flag that affects you, and to look at it again.

Children

The platform is strictly 18+, and we do not knowingly collect information from anyone under 18. An account found to belong to a minor is closed on the spot, its winnings forfeited to the regulator, and its data deleted apart from what AML rules oblige us to retain.

Changes to this policy

Material changes reach registered players by email, and the updated version goes up on the site. Carrying on with the account afterwards counts as acceptance going forward. Whatever processing already happened stays governed by the version in force at the time.

How to contact us

Write to [email protected]. Privacy queries are answered within a reasonable time, which in practice means inside seven days.

wildtokyo.com | [email protected]