Privacy Policy

Wild Tokyo Casino, operated by GBL Solutions N.V. under licence from the Curaçao Gaming Control Board, handles personal information of Australian players in the manner set out below. Honesty requires stating this upfront: the operator sits offshore under Curaçao GCB oversight, not under an Australian licence, so local remedies through the Interactive Gambling Act 2001 framework do not apply in the same way they would for a locally licensed provider. This is a fact, not marketing.

Who we are and what this policy covers

The controller of your personal information is GBL Solutions N.V., a company incorporated under the laws of Curaçao. This policy explains what we collect when you visit wildtokyo.com, register an account, deposit, play pokies or live tables, contact support, or take part in tournaments and the loyalty programme. It applies to residents of Australia and is written with the Privacy Act 1988 and the Australian Privacy Principles in mind, while the legal core of processing sits with Curaçao data protection law.

Honesty requires naming the tension. As an offshore operator we follow Curaçao rules first, and we align with APP standards on transparency, access and correction. Where the two frameworks differ, we tell you which one governs a specific action.

What personal information we collect

We collect the categories listed here and nothing that we cannot justify against a specific purpose. Identity data covers full name, date of birth, gender, nationality and a copy of your passport, driver licence or other photo ID used during KYC. Contact data covers email address, mobile number and residential address. Account data covers your username, hashed password, security questions, loyalty level, coin balance and preferences. Financial data covers the payment instruments you use to deposit and withdraw, including card BIN and last four digits, e-wallet identifiers, bank account details and, where relevant, wallet addresses for cryptocurrency. Transactional data covers deposits, withdrawals, wagering activity, tournament participation, Shop exchanges and bonus history. Technical data covers IP address, device identifiers, browser type, operating system, session logs and interaction data captured by cookies and similar technologies. Communication data covers messages sent to Live Chat, emails to support, and any recordings or transcripts of video KYC calls if a Risk Department review requires one.

We do not collect sensitive information in the APP sense as a matter of course. If a responsible gambling interaction produces health-adjacent information, we treat it with the higher standard the Privacy Act expects.

How we collect it

Most of the data comes directly from you when you register, upload documents, deposit or contact us. Some is generated automatically as you use the site, through cookies, server logs and payment gateway callbacks. Some reaches us from third parties: identity verification providers running KYC checks against your documents, payment processors confirming a transaction, game providers reporting your session activity, and affiliate partners that referred you to the platform.

Why we process your personal information

We process your data to open and maintain your account, to run the gambling services you asked for, to process deposits and withdrawals, to verify your identity and age as the Curaçao licence and AML rules require, to detect fraud, bonus abuse, collusion and use of prohibited software, to administer the loyalty programme, tournaments, cashback and the coin economy, to send transactional messages about your account, and to comply with legal obligations including AML monitoring, tax reporting where applicable and lawful requests from regulators or law enforcement.

Direct marketing is a separate purpose. It runs on your consent, and you can withdraw that consent at any time without losing access to core services.

Legal grounds

Processing rests on performance of the contract you enter when you accept the Terms of Use, on our legal obligations under Curaçao gaming and AML rules, on our legitimate interests in security and fraud prevention, and on your consent for marketing and non-essential cookies. Where you decline consent, we still run the account. You simply do not receive marketing.

Sharing your information

We do not sell personal information. We share it with categories of recipients that are necessary to run the platform. Payment processors and banks handle deposits and withdrawals. Identity verification vendors run KYC and sanctions screening. Game providers, including Pragmatic Play, Hacksaw Gaming, NetEnt, Play’n GO, Nolimit City, BGaming and others in our library, receive session data needed to serve the game. Fraud prevention and analytics providers help us spot abuse. Cloud hosting, CDN and email delivery vendors handle infrastructure. Regulators, tax authorities and courts receive information when a lawful request requires it. Professional advisers such as lawyers and auditors receive it on a need-to-know basis.

International transfers

Your data may be transferred outside Australia, including to Curaçao, the European Economic Area, the United Kingdom and other jurisdictions where our vendors operate. Curaçao is not on the Australian Government’s list of countries with substantially similar privacy laws, and this is worth knowing. Where transfers happen, we use written contractual protections that require recipients to protect the data at a level comparable to what we apply ourselves, and we assess each vendor before onboarding.

How long we keep it

Account and KYC records are held for the duration of your relationship with the platform and for a further period after closure to meet AML retention rules under Curaçao regulation, which generally require at least five years from the end of the business relationship. Transactional and financial records follow the same rule. Marketing preferences are held until you withdraw consent or the account is closed, whichever comes first. Support communications are held for two years unless a dispute or regulatory matter requires longer retention. Video KYC recordings, where they exist, are deleted no later than twelve months after the review closes unless a specific investigation requires retention.

How we protect it

We apply technical and organisational measures proportionate to the risk. That includes TLS in transit, encryption of sensitive fields at rest, hashed passwords, access controls tied to job function, logging of privileged actions, two-factor authentication offered to every account, network segmentation and vendor due diligence. No system is invulnerable. Honesty requires stating that; we will not claim otherwise. If a breach affects your data in a way that meets the notifiable data breach threshold under the Privacy Act, we will notify you and the OAIC in line with the scheme.

Your rights

Under the Privacy Act and the APPs you can request access to the personal information we hold about you and ask us to correct it if it is inaccurate. You can withdraw marketing consent. You can complain to us about how we handle your information, and if you are not satisfied you can escalate to the Office of the Australian Information Commissioner. Contact for OAIC complaints is available at oaic.gov.au.

Curaçao rules also give you the ability to ask for erasure, restriction or portability. Some rights sit in tension with our AML retention obligations, and where a legal obligation requires us to keep specific records we will explain that clearly rather than delete data we are required to hold.

Cookies and similar technologies

Details are set out in the Cookie Policy. In summary, essential cookies keep you logged in and support fraud prevention, and non-essential cookies for analytics and marketing run only after you give consent through the banner.

Automated decision-making

We use rules-based systems to flag transactions for AML review and to detect bonus abuse and collusion. A human reviews before any material adverse decision such as withholding a withdrawal or closing an account. You can ask us to explain a flag that affects you and to reconsider it.

Children

The platform is strictly 18+. We do not knowingly collect information from anyone under 18. If we discover an account held by a minor, we close it immediately, forfeit any winnings to the regulator, and delete data other than what AML rules require us to keep.

Changes to this policy

If we make material changes we will notify registered players by email and post the updated version on the site. Continued use of the account after the change constitutes acceptance for the future. Past processing remains governed by the version that was in force at the time.

How to contact us

Email us at [email protected]. We answer privacy queries within a reasonable time and normally inside seven days.

wildtokyo.com | [email protected]