Privacy Policy

Categories of information we hold

Registration details include your full name, date of birth, residential address, email address, telephone number and chosen currency. These are mandatory: without them we cannot verify identity or satisfy the conditions of licence OGL/2024/1798/1048.

Verification records comprise the identity and address documents you upload, along with the outcome of any electronic checks run against them. We store the assessment result and a copy of the submitted document, not the raw data held by the checking provider.

Financial records cover deposits, withdrawals, the last four digits of payment instruments and the associated timestamps. Full card numbers are never written to CosmoBet systems — they are captured and tokenised by our payment processors.

Technical records are generated automatically: IP address, device type, browser build, operating system, session duration and the pages viewed. This material underpins fraud detection, geolocation compliance and diagnostics when something breaks.

Grounds for processing

Most account processing rests on contractual necessity — we cannot open an account, settle a wager or pay a withdrawal without handling the data involved.

Identity verification, source-of-funds enquiries, anti-money-laundering screening and transaction reporting rest on legal obligation. Requests of this nature are not optional and cannot be refused while the account remains open.

Security monitoring, bonus-abuse detection and platform analytics rest on legitimate interest, balanced against your reasonable expectations. Marketing by email or SMS rests on consent alone, which you may withdraw at any moment without effect on the rest of your account.

Disclosure and international transfers

Data is shared with payment institutions, identity verification bureaux, game studios supplying content, and infrastructure providers hosting the platform. Each operates under a written processing agreement restricting use to the purpose we specify.

The Curacao Gaming Control Board and other competent authorities may request records in connection with supervision, dispute resolution or criminal enquiries. Where a lawful demand is made, we comply and generally may not notify you of it.

Certain providers are located outside the UK and the European Economic Area. Those transfers are covered by the UK International Data Transfer Addendum, Standard Contractual Clauses or an applicable adequacy decision, and we assess the destination's legal environment before any transfer begins.

CosmoBet does not sell personal data, and we do not disclose player records to advertisers or data brokers for their own purposes.

Retention periods and your rights

Account, transaction and verification records are kept for a minimum of five years after the account closes, as required by anti-money-laundering rules. Self-exclusion records are held indefinitely so that an exclusion cannot be reversed through re-registration. Marketing preferences are erased once consent is withdrawn.

Under the UK GDPR you may request a copy of your data, ask for inaccuracies to be corrected, object to processing based on legitimate interest, request a portable export, or ask for erasure. Erasure applies only to material we are not legally required to keep — accounting and compliance records fall outside it.

Requests are acknowledged within seventy-two hours and answered within one calendar month; complex cases may extend by a further two months with notice. We will ask you to verify identity first, so that no one can obtain your file by impersonation.

If you are dissatisfied with our response, you may complain to the Information Commissioner's Office in the UK or to the supervisory body in your country of residence.