Windmill Casino Privacy Policy

Information on personal data collection, processing, storage and protection procedures.

This Privacy Policy explains how personal information is collected, used, stored, disclosed and protected in connection with the use of the Windmill Casino website, mobile applications and other service channels. By accessing or using these services, you acknowledge that you have read and understood this Privacy Policy.

This document applies to users located in South Africa and in other jurisdictions where the services of Windmill Casino are accessible. Personal information is handled in accordance with applicable data protection legislation, including the Protection of Personal Information Act (POPIA).

1. Information Collected

Personal information provided directly by the user when registering an account, verifying identity or using the services may include:

Full name, date of birth and identification number
Residential address and contact details (email, telephone)
Copies of identity documents and proof of address
Financial information related to deposits and withdrawals
Account credentials and security information

Information may also be collected automatically through use of the services, including IP addresses, device identifiers, browser type, operating system, pages visited, time spent on pages and referring URLs.

2. Purpose of Data Processing

Personal information is processed for the following purposes:

Account registration and identity verification
Compliance with legal and regulatory obligations, including anti-money laundering (AML) and know-your-customer (KYC) requirements
Processing transactions and maintaining financial records
Preventing fraud, unauthorized access and other illegal activities
Communicating with users regarding accounts, services and policy updates
Responding to inquiries and resolving disputes
Maintaining records as required by law

Personal information is not used for purposes beyond those stated in this Privacy Policy without obtaining the user’s explicit consent.

3. Legal Basis for Processing

Personal information is processed on the following legal grounds:

Performance of contract: to provide requested services and fulfill contractual obligations
Legal obligation: to comply with South African gambling regulations, tax laws, AML/KYC requirements and court orders
Legitimate interests: to protect services from fraud, maintain security and improve operational efficiency
Consent: where the user has provided explicit consent for specific processing activities

The user has the right to withdraw consent at any time, subject to legal and contractual limitations.

Personal information is not sold or rented to third parties. Personal information may be shared with:

Service providers and processors assisting with identity verification, payment processing, IT infrastructure and customer support
Regulatory authorities and law enforcement agencies where required by law
Legal and financial advisors in connection with compliance, audits or dispute resolution
Affiliated entities within the same corporate group, where applicable

Third parties with access to personal information are subject to contractual obligations to maintain confidentiality and to use data only for specified purposes.

5. Data Retention

Personal information is retained for as long as the user account remains active and for any additional period required by law. Retention periods vary depending on the type of information and applicable legal obligations, including:

Identity and verification documents: retained for at least the minimum period prescribed by gambling and financial regulations
Transaction records: retained in accordance with tax and accounting requirements
Communication records: retained for the period necessary to resolve disputes or comply with legal requests

After the relevant retention period expires and no legal obligation requires continued storage, personal information is securely deleted or anonymized.

6. Data Security

Technical and organizational measures are implemented to protect personal information against unauthorized access, alteration, disclosure or destruction. These measures include:

Encryption of data in transit and at rest
Access controls and authentication mechanisms
Regular security assessments and vulnerability testing
Employee training on data protection and confidentiality

No system can be guaranteed as fully secure. Users are responsible for maintaining the confidentiality of account credentials and for promptly reporting any suspected unauthorized access.

7. User Rights

Under South African data protection law, users have the following rights:

Access: to request confirmation of whether personal information is being processed and to obtain a copy of such information
Rectification: to request correction of inaccurate or incomplete information
Erasure: to request deletion of personal information, subject to legal and contractual limitations
Restriction: to request limitation of processing in certain circumstances
Objection: to object to processing based on legitimate interests
Data portability: to request transfer of personal information to another controller, where technically feasible

To exercise any of these rights, the user may contact the Information Office using the contact details provided below. A response will be provided within the timeframe prescribed by law, and identity verification may be required before a request is processed.

8. Cookies and Tracking Technologies

Cookies and similar technologies are used to enhance user experience, analyze usage patterns and maintain session security. Cookies may be disabled in browser settings; however, this may limit the functionality of certain services.

9. International Data Transfers

If personal information is transferred outside South Africa, appropriate safeguards are implemented in accordance with POPIA. These safeguards may include contractual clauses and verification that the recipient jurisdiction provides an adequate level of data protection.

10. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in practices, legal requirements or operational needs. The updated version will be published on the website with the effective date indicated. Continued use of the services after an update constitutes acceptance of the revised Privacy Policy.

11. Contact Information

For questions, requests or complaints regarding this Privacy Policy or data processing practices, the Information Office can be contacted at:

Windmill Casino Information Office
Email: [email protected]
Postal address: PO Box 782121, Sandton 2146, South Africa
Physical address: 6 Sandown Valley Crescent, Sandton 2196, South Africa

If a user is not satisfied with the response received, a complaint may be lodged with the South African Information Regulator.

12. Responsible Gaming and Privacy

Responsible gaming measures may involve the processing of personal information, including self-exclusion requests and account limits. Such requests are processed confidentially, and records are retained for the period required to enforce exclusion measures and to prevent circumvention, in line with applicable legal obligations.

This Privacy Policy is effective as of the date of publication and applies to all personal information collected through the services of Windmill Casino.