Privacy Policy at BassBet Casino
This policy sets out how we collect, use, store and share your personal data when you play at BassBet Casino. We hold licence MGA/B2C/394/2017 from the Malta Gaming Authority and process data under the GDPR as well as the Australian Privacy Act. If anything here is unclear, contact our data protection officer at any time.
Data We Collect From You
Categories of personal data
We only collect what we need to run your account, meet our regulatory duties and keep the platform safe. The categories below cover everything we hold about you, from the moment you register to the moment your account closes.
- Identity data: your name, date of birth, email address, phone number and residential address.
- Verification documents: copies of your ID or passport, proof of address and payment method verification required under our KYC rules.
- Transaction data: deposits, withdrawals, bets, wins, losses, bonuses claimed and payment details.
- Technical data: your IP address, device type, operating system, browser and approximate location.
- Gameplay behaviour: the games you play, session duration, betting patterns and login history.
- Marketing preferences: whether you have opted in to receive bonus offers, and which channels you prefer.
Why We Process Your Data
Purposes of processing
Every processing activity we carry out serves a specific purpose listed below. We do not sell your data, and we do not use it for anything outside these purposes without asking you first.
- Creating and managing your player account, including authentication and account recovery.
- Verifying your identity and age before your first withdrawal, as our licence requires.
- Processing deposits and withdrawals through the payment methods you choose.
- Preventing fraud, money laundering, bonus abuse and multiple-account activity.
- Monitoring gambling behaviour to support responsible-gaming tools such as deposit limits and self-exclusion.
- Sending you promotions and tournament news, only where you have given consent.
- Meeting legal and regulatory obligations set by the Malta Gaming Authority and anti-money-laundering law.
Our Legal Bases for Processing
Contract
When you register and accept our terms, we enter a contract with you. To perform that contract we must process your identity, contact and transaction data. Without it we cannot open an account, take a deposit or pay out a withdrawal.
Legal obligation
Our licence obliges us to verify your identity, monitor transactions for money laundering and keep records for at least five years. These checks happen whether or not you ask for them, and we cannot switch them off.
Legitimate interest
Fraud prevention and platform security rest on our legitimate interest in protecting you and us. We analyse betting patterns, device data and login behaviour to detect suspicious activity before it harms anyone. This interest never overrides your rights.
Consent
Marketing emails, SMS offers and promotional push notices require your explicit opt-in. You can withdraw that consent at any time from your account settings or by clicking the unsubscribe link, and we will stop sending marketing immediately.
How Long We Keep Data
Retention by category
We hold each category of data only as long as the purpose requires. Gambling regulation is strict on record keeping, so some transaction data must survive even after you close your account. Everything else goes when the purpose ends.
| Data category | Retention period |
|---|---|
| Identity and account data | For the life of your account, then up to five years |
| KYC verification documents | At least five years after account closure, as our licence requires |
| Transaction and betting records | At least five years, per anti-money-laundering law |
| Device, IP and log data | Up to 24 months for security and fraud analysis |
| Marketing consent records | Until you withdraw consent, plus 12 months for proof of consent |
| Closed account data | Deleted after the regulatory retention window expires |
Who Receives Your Data
Categories of recipients
We share your data only with parties who need it to deliver a service you use or to satisfy a legal duty. Every recipient works under a data processing agreement that binds them to the same standards we apply ourselves.
- Payment processors handling your deposits and withdrawals, including card networks, e-wallet operators and crypto gateways.
- KYC and AML verification providers who check your documents against sanctioned and PEP lists.
- The Malta Gaming Authority and other regulators, auditors and law enforcement when the law demands disclosure.
- Analytics and platform hosting services that keep the site running and help us measure performance.
- Email delivery providers, but only for messages you have asked to receive.
Your Rights Over Your Data
How to exercise each right
You control your personal data, and we answer every request within 30 days. Send requests from your registered email to [email protected], and we will verify your identity before acting. Requests cost nothing unless they are clearly excessive.
- Access: get a copy of the personal data we hold about you.
- Rectification: correct anything inaccurate or out of date.
- Erasure: ask us to delete data where no legal obligation forces retention.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest, such as fraud analysis.
- Withdrawal of consent: stop marketing at any time with immediate effect.
- Complaint: raise a complaint with the Office of the Australian Information Commissioner or the Malta Data Protection Registrar.
Cookies and Tracking
What cookies we set
We use cookies to keep you logged in, remember your preferences and understand how the site performs. Essential cookies stay on regardless; analytics and marketing cookies only load after you accept them in the consent banner. Our full cookie inventory, including how to block or delete cookies in your browser, lives on the dedicated Cookies Policy page, and we keep it updated whenever our tooling changes.
How BassBet Protects Your Data
Technical and organisational safeguards
All traffic between your device and our servers travels over TLS encryption, and payment and KYC documents sit in encrypted storage. Access to personal data follows a strict need-to-know model: staff roles define what each person can see, and every access attempt is logged and auditable.
- TLS encryption in transit and AES encryption at rest for sensitive documents.
- Role-based access controls with periodic permission reviews.
- Two-factor authentication on all staff and admin accounts.
- Regular penetration testing and continuous security monitoring.
- A documented incident response plan with regulator and player notification within 72 hours of a confirmed breach.
Frequently Asked Questions
How long do you keep my KYC documents?
Our licence requires us to keep verification documents for at least five years after your account closes. After that window, we delete them securely.
Can I stop marketing emails at any time?
Yes. Change your preferences in account settings or click the unsubscribe link in any email. Marketing stops immediately, and you will keep receiving essential service messages such as withdrawal confirmations.
Do you sell my personal data?
No. We share data only with payment processors, verification providers, regulators and hosting services that need it to deliver or supervise the service, always under data processing agreements.
What happens if there is a data breach?
We follow a documented incident response plan. If a breach risks your rights, we notify the relevant regulator and affected players within 72 hours and tell you what data was involved and what we are doing about it.
Who do I contact about a privacy question?
Write to [email protected] from your registered email address. We respond to every request within 30 days, and you can escalate to the Office of the Australian Information Commissioner at any time.