Reef Crown Privacy Policy

Last updated: 15.10.2026

This Privacy Policy explains how Reef Crown, accessible at ReefCrown, handles personal information about Australian players. We act in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By registering, depositing or playing with us, you acknowledge that you have read this policy.

Who We Are and How to Contact Our Data Protection Officer

Reef Crown, the operator of the ReefCrown website and associated services, is responsible for deciding how your personal information is collected, used and protected. Under Australian law we are an APP entity, and in this policy we describe that role as the data controller. We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the conditions of the licence and regulatory framework that apply to our gambling services.

We have appointed a Data Protection Officer (DPO), who also serves as our Privacy Officer. The DPO monitors compliance, advises our teams and manages privacy requests. You can contact the DPO at [email protected] or by post at Data Protection Officer, Reef Crown, [registered business address]. We aim to acknowledge every enquiry within five business days.

Personal Information We Collect

We collect only the personal information reasonably necessary to operate your account and meet our legal duties. This includes:

Identity data: full name, date of birth, gender, nationality and copies of identity documents.
Contact data: residential address, email address and mobile number.
Financial and payment data: payment card or e-wallet details, bank account information, deposits, withdrawals and source-of-funds documents.
Gameplay and transaction data: games played, stakes, wins, bonuses, account activity and responsible gambling settings such as deposit limits.
Device, IP and geolocation data: IP address, browser type, device identifiers, operating system and your approximate or precise location.
Marketing preferences: your communication choices, promotional interests and consent records.

We also keep records of your communications with our support team. Most information comes directly from you, and some comes from verification providers, payment partners and publicly available sources.

Why We Use Your Information and Our Legal Basis

The APPs do not use the same lawful-basis labels as European law, but we apply equivalent standards and identify the basis for each purpose below.

Account creation, payments and gameplay: necessary to perform our contract with you.
Identity, age and location checks, AML reporting and responding to authorities: required or authorised by law.
Fraud prevention, security, platform improvement and analytics: our legitimate interests, balanced against your privacy rights.
Responsible gambling monitoring and intervention: legal obligation and our legitimate interest in player protection.
Marketing communications, non-essential cookies and certain location features: your consent, which you may withdraw at any time.

Where we rely on consent, we will ask for it clearly and keep a record of it. We will not use your information for a materially different purpose unless you would reasonably expect it, you consent, or the law requires it.

KYC and Anti-Money Laundering Processing

As a gambling operator, we are subject to anti-money laundering and counter-terrorism financing obligations, including those administered by AUSTRAC where applicable, together with our licensing conditions. To meet them, we verify your identity, age, source of funds and location, including through geolocation, before and during your use of our services. In practice, we may:

check identity documents and confirm that you are at least 18 years old;
request proof of address, bank statements or evidence of source of funds and wealth;
screen you against sanctions, politically exposed person and fraud databases;
confirm that you are accessing our services from a permitted location;
monitor transactions and report suspicious activity to the relevant authorities.

This processing is mandatory. If you do not provide the information we request, we may restrict, suspend or close your account. We may also be legally prohibited from telling you about certain reports.

Cookies, Data Storage and Security

ReefCrown uses cookies, pixels and similar technologies to keep you signed in, remember preferences, secure sessions, measure performance and, with your consent, personalise content and advertising. You can manage non-essential cookies through our cookie banner or your browser settings. Further detail is set out in our Cookie Policy.

We protect personal information with encryption in transit and at rest, firewalls, intrusion monitoring and regular security testing. Access is limited on a need-to-know basis through role-based permissions, multi-factor authentication and audit logging, and our staff receive privacy training. Payment card data is handled in line with PCI DSS standards. No system is entirely secure. If an eligible data breach occurs, we will assess it promptly and notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

Sharing Your Information and International Transfers

We share personal information only where necessary and under appropriate contracts. Recipients include:

payment providers, banks and e-wallet services that process deposits and withdrawals;
KYC and verification vendors that perform identity, fraud and sanctions checks;
regulators, law enforcement and other authorities where the law requires it;
game providers and technology suppliers needed to deliver games and platform services;
affiliates and marketing partners, in limited non-identifying form or where you have consented;
professional advisers, auditors and IT service providers bound by confidentiality.

We do not sell your personal information. Some recipients are located outside Australia, including in the European Economic Area and other jurisdictions. As required by APP 8, before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs. We do this through contractual clauses, security assessments and, where appropriate, your consent.

How Long We Keep Your Information

We keep personal information only for as long as needed for the purposes in this policy or as the law requires. Account and profile data is generally retained while your account remains open, and for a limited period afterwards to resolve disputes and enforce our terms. AML, identity verification and financial transaction records are typically retained for a legally mandated period, generally at least seven years after our relationship ends, even if you ask us to close your account. Marketing data is kept until you withdraw consent or remain inactive for a prolonged period. Cookie data expires according to its stated lifespan. Once information is no longer required, we securely destroy or de-identify it in line with APP 11. Where different rules apply to specific records, we apply the longer period required by law.

Your Privacy Rights, Marketing Choices and Complaints

Subject to applicable law, you may:

access the personal information we hold about you;
ask us to correct information that is inaccurate, out of date or incomplete;
request deletion or de-identification where we no longer need the data;
request a copy of your data in a commonly used, machine-readable format;
object to certain uses, including direct marketing;
withdraw consent at any time.

To make a request, email [email protected]. We will verify your identity and respond to access requests (DSARs) within 30 days, explaining any refusal in writing. Access is generally free of charge. Some rights are limited where we must retain records by law. You can opt out of marketing using the unsubscribe link in any message, your account settings or by contacting us, and we comply with the Spam Act 2001 (Cth).

If you are unhappy with our response, you may complain to the OAIC at oaic.gov.au. We may amend this policy from time to time, and changes take effect once published on this page.