Our Privacy Policy

This Privacy Policy sets out how we at Allbritish Casino, operated by L&L Europe Ltd under MGA licence MGA/B2C/211/2011, collect and handle your personal data. We run a British-focused casino, so we treat your privacy with the same seriousness we bring to licensing and fair play. Read on for the exact categories of data we hold, our legal bases, retention periods and how to exercise your rights.

What We Collect

We collect only the data we need to run your account legally and safely. Since we launched in 2013 the categories below have stayed deliberately narrow, and every field we request at registration maps to a specific purpose described in the next section.

• Identity data: your full name, date of birth, email address, telephone number and residential address.
• Verification documents: a photo ID (passport or driving licence), proof of address and proof of payment method, required before your first withdrawal.
• Transaction data: deposits, withdrawals, bonus balances and wagering history across our GBP-only cashier.
• Technical data: device type, operating system, browser, IP address and approximate location derived from that IP.
• Gameplay behaviour: games played, session durations, bet sizes, win/loss records and tournament entries.
• Marketing preferences: which channels you opted into, when you consented and how you have responded to our communications.

How We Use Your Data

Every processing activity we carry out serves one of seven purposes. We do not profile you for third-party advertising, and we do not sell your data.

• Creating and administering your player account, including login and account settings.
• Verifying your identity and age under our KYC obligations before we release a withdrawal.
• Processing deposits and withdrawals through Visa Debit, Mastercard Debit, Trustly, e-wallets and bank transfer.
• Preventing fraud, bonus abuse, collusion and duplicate-account creation.
• Monitoring play against our responsible-gambling tools, such as deposit limits, loss limits and session reminders.
• Sending marketing about promotions like our 10% weekly cashback, only where you have consented.
• Meeting legal and regulatory obligations owed to the Malta Gaming Authority and payment regulators.

Our Legal Bases for Processing

Under GDPR we rely on four legal bases, and we match each data category to the correct one before we touch it.

• Contract: account data, transaction data and gameplay records are processed to perform the agreement between you and us when you register and play.
• Legal obligation: KYC documents, anti-money-laundering records and regulatory reporting are handled because gaming law requires us to.
• Legitimate interest: fraud prevention, security logging and aggregate service improvement rest on our legitimate interest in running a safe casino, balanced against your rights.
• Consent: marketing emails, SMS and any analytics cookies beyond the strictly necessary set run only on your explicit consent, which you may withdraw at any time.

How Long We Keep Records

We delete data as soon as its purpose ends; nothing is stored indefinitely by default. Regulatory rules fix some minimum periods, and we honour those exactly rather than rounding them down.

• KYC verification documents: retained for 5 years after your last transaction, as AML rules require.
• Transaction and wagering data: retained for at least 5 years to satisfy MGA record-keeping obligations.
• Account and identity data: kept while your account is open, then archived for the statutory period before deletion.
• Marketing preferences: kept until you withdraw consent, then erased within 30 days.
• Technical logs: kept for up to 12 months for security and fraud investigation.

Who We Share Data With

We share your data only with processors and authorities who need it to deliver the service or enforce the law, and every processor works under a written data-processing agreement with us.

• Payment processors handling your Visa, Mastercard, Trustly, Paysafecard, Skrill, Neteller, MiFinity and Jeton transactions.
• KYC and AML verification providers that check your ID, address and payment method documents.
• Game and platform providers, such as Pragmatic Play, Evolution and NetEnt, receiving only the technical data needed to run sessions.
• The Malta Gaming Authority and other regulators, auditors or law-enforcement bodies where disclosure is legally required.
• Analytics and hosting providers, bound by contract to process data solely on our instructions.

Your Rights Under GDPR

You control your data, and we answer every request within one month of receiving it. Where a request is complex we may extend this by two further months and we will tell you why.

• Access: get a copy of the personal data we hold about you.
• Rectification: correct anything inaccurate or incomplete.
• Erasure: ask us to delete data where no legal obligation forces us to keep it.
• Portability: receive your account and transaction data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: opt out of marketing at any time, including through account settings or the unsubscribe link.
• Complaint: escalate to the supervisory authority in your country of residence if you believe we mishandled your data.

Cookies and Contacting Our DPO

We use strictly necessary cookies for login, session security and cashier function, plus optional analytics and marketing cookies that load only after you consent through our cookie banner. Full details, including how to change your choices, sit on our dedicated Cookies Policy page, so we keep this section short by design.

• Raise a data-protection question with our Data Protection Officer at [email protected].
• Our support team is also reachable 24/7 via live chat and at [email protected] for anything account-related.
• We will confirm your identity before acting on any rights request, using details already on file.

How We Protect Your Information

All traffic between your device and our servers travels over TLS encryption, and payment and KYC documents are stored encrypted at rest with access restricted to staff who need it for verification or fraud checks. We log every internal access to sensitive records and review those logs regularly.

• TLS encryption in transit and AES encryption at rest for documents.
• Role-based access controls with individual staff credentials and mandatory two-factor authentication internally.
• Regular security testing and penetration reviews of the platform.
• A documented incident-response plan: if a breach affects your personal data, we notify the supervisory authority within 72 hours and inform you without undue delay where the risk to you is high.

Frequently Asked Questions

Do you share my data with advertisers?

No. We do not sell or rent your data, and third-party advertising cookies load only if you consent to them in our cookie banner.

How do I opt out of marketing emails?

Use the unsubscribe link in any email, adjust the marketing settings in your account, or email [email protected]. We stop sending marketing within 30 days of withdrawal.

Why do you need my ID before my first withdrawal?

Gaming law requires us to verify your identity, age and payment method under KYC and anti-money-laundering rules before releasing funds. The documents are retained for 5 years after your last transaction.

Can I get a copy of everything you hold about me?

Yes. Send an access request to [email protected] and we will deliver your data in a machine-readable format within one month.

What happens to my data if I close my account?

Account data is archived for the statutory retention period, marketing preferences are erased within 30 days, and transaction records are kept for at least 5 years as regulators require.