Privacy Policy

This Privacy Policy explains how Tombola Casino processes personal data when a player uses the website, tombola arcade games, mobile access, account registration, sign-in tools, payments, bonuses, promotions, customer support, safer gambling tools and related services. The policy applies to all account holders, visitors and users who interact with Tombola Casino online services.

Tombola Casino is positioned as a UK-facing arcade and casino-style platform with number-draw games, instant-reveal formats, low-stake rounds, free spin-style rewards, cashback offers and community-focused play. Because the service includes account registration, age checks, payment handling, gameplay tracking and responsible gambling tools, the platform must process several categories of personal data for contractual, legal, security and player protection purposes.

1. Overview

This Privacy Policy applies whenever a player visits Tombola Casino, creates an account, uses tombola arcade games, signs in through mobile or desktop, deposits funds, requests withdrawals, claims promotions, uses the welcome bonus, contacts support or activates safer gambling tools. The document explains what data is collected, why it is used, how it is protected, how long it may be retained and what rights the account holder may exercise.

The service processes data to operate account access, deliver games, verify players aged 18+, support GBP payments, check payment ownership, prevent fraud, monitor risk, manage bonuses and provide responsible gambling controls. This includes data directly provided by the player, data created through use of the service and data received from third-party providers such as payment processors, identity verification services, fraud prevention systems and regulatory or compliance sources.

The platform follows a data-minimisation principle. This means only data needed for account operation, payments, legal compliance, safety monitoring, support, marketing preferences or service improvement should be collected. Some data is required before the player can access full account functionality, including withdrawals and certain bonuses.

2. Who Controls Personal Data

For the purposes of this Privacy Policy, Tombola Casino acts as the data controller for personal data processed through its website, account system, tombola arcade games, cashier, support tools and promotional services. The data controller determines why and how personal data is processed.

Where third-party providers process data on behalf of the platform, they act as processors or independent controllers depending on their role. This may include payment companies, KYC providers, fraud detection services, game suppliers, email platforms, analytics tools, hosting providers and safer gambling partners.

Players should check the official website footer and legal pages for the current operator name, company details, licence information and contact channels before registering or depositing. Operator and licence details may change over time and should always be verified on the official service.

3. Personal Data Collected by the Platform

Tombola Casino may collect several types of personal data because gambling services require identity checks, account monitoring, payment records, gameplay logs and responsible gambling controls. The exact data collected depends on whether the user is only browsing, registering, depositing, playing, claiming bonuses or withdrawing funds.

The platform may also process technical data such as cookies, session identifiers, geolocation indicators, login timestamps, failed sign-in attempts and fraud risk scores. These records help protect accounts, detect unusual activity and maintain platform security.

4. Data Provided by the Player

The player may provide personal data during registration, account updates, payment setup, KYC checks, support conversations, complaints or responsible gambling requests. This can include name, date of birth, address, email, mobile number, password, preferred currency, communication preferences and safer gambling settings.

Verification may require documents such as a passport, driving licence, national ID card, bank statement, utility bill or payment confirmation. These documents may be required before withdrawals, after unusual account activity or during enhanced due diligence checks.

The account holder must provide accurate and current information. Incorrect name, date of birth, address or payment ownership details can delay verification, restrict withdrawals or lead to account suspension. The same applies if documents are unclear, expired, edited or inconsistent with the registered account data.

5. Data Created Through Use of the Service

The platform creates and stores data when the player signs in, plays tombola arcade games, enters number-draw rooms, uses instant-reveal games, claims bonuses, deposits funds, requests withdrawals, contacts support or changes account limits. This data forms the operational record of the account.

Gameplay data may include game name, round ID, stake size, win/loss result, ticket entries, prize records, free spins used, bonus progress and session duration. For tombola arcade formats, this may also include room activity, community game participation, promotional entries and time-based session records.

Account data may include login history, password reset activity, device records, IP address, security alerts, transaction history and responsible gambling settings. These records are used to maintain account security, resolve disputes, calculate bonus eligibility and identify potentially harmful gambling patterns.

6. Data Received from Other Sources

The platform may receive information from third parties where necessary for account verification, payment processing, fraud prevention, safer gambling, legal compliance or risk review. These sources may include identity verification providers, payment processors, fraud prevention databases, open-source records, public registers, regulatory bodies and trusted compliance partners.

Payment providers may confirm transaction status, payment ownership, chargebacks, failed deposits, withdrawal settlement and fraud alerts. Identity verification providers may confirm age, address, document authenticity and whether additional checks are required.

The platform may also receive information from safer gambling tools, self-exclusion systems or risk-monitoring partners where applicable. This data helps prevent underage gambling, detect gambling harm and support account restrictions where required.

7. How and Why Personal Data Is Used

Personal data is used to operate the Tombola Casino service, provide account access, deliver tombola arcade games, process payments, manage bonuses, protect the platform, comply with gambling rules and support responsible gaming. Each use must have a lawful basis.

The service may use data to register accounts, verify age, confirm identity, process GBP deposits, review withdrawals, display game history, apply bonus terms, calculate free spins, monitor gameplay, send service messages, respond to support requests and investigate complaints.

The platform may also use data to detect fraud, duplicate accounts, payment abuse, suspicious gameplay, technical errors, money laundering risks and unsafe gambling behaviour. These uses protect both the player and the service.

8. Legal Bases for Processing

The platform processes personal data under several lawful bases depending on the purpose.

Contract processing is needed to provide the service. Legal obligation applies where gambling, AML, payment or data protection rules require checks and records. Legitimate interest applies where the platform protects its business, players and systems. Consent applies where optional marketing or non-essential cookies are used.

The account holder may withdraw consent for marketing or optional cookies without affecting core account services. However, withdrawal of consent does not affect processing already completed before consent was withdrawn.

9. Account Verification, KYC and AML Checks

Tombola Casino may process identity, address, payment and financial data to verify that the player is at least 18 years old and legally eligible to use the service. Verification may be required during registration, before withdrawals, after payment changes, after unusual activity or when regulatory checks are triggered.

KYC checks may include document review, age verification, address confirmation, payment ownership checks and comparison of account information against official or trusted sources. AML checks may include transaction monitoring, source-of-funds review, source-of-wealth requests and analysis of unusual deposit or withdrawal behaviour.

If verification cannot be completed, the platform may restrict deposits, block withdrawals, limit gameplay, suspend promotions or close the account. Where required by law, information may be shared with regulators, law enforcement bodies or fraud prevention agencies.

10. Payments, Transactions and Withdrawal Data

Payment data is processed to accept deposits, process withdrawals, confirm payment ownership, prevent fraud, comply with AML rules and maintain accurate account records. This may include payment method type, transaction amount, date, currency, payment status, withdrawal reference and related security checks.

For Tombola UK accounts, payments are usually handled in GBP. The platform may check whether the payment method belongs to the registered account holder. Third-party payment use may trigger account restrictions or additional verification.

Withdrawal records may be retained for regulatory, accounting and fraud-prevention purposes. If a withdrawal is delayed, the platform may process additional data to confirm identity, review bonus status, check transaction history or assess source-of-funds information.

11. Tombola Arcade Gameplay, Bonus and RTP Data

Tombola arcade data may include number-draw entries, instant-reveal rounds, arcade slot activity, community room participation, stakes, results, session time, RTP category, volatility tags where available and game history. This data is needed to provide games, settle results, support dispute review and maintain responsible gambling records.

Bonus data may include welcome bonus eligibility, free spins, cashback, promo codes, tournament entries, community drops, wagering progress, expiry periods and maximum conversion limits. This data allows the platform to apply promotional terms correctly and detect bonus abuse.

RTP-related data is not used to guarantee results. RTP is a theoretical long-term return percentage. Gameplay records may be used to show account history, support complaints, detect technical errors and review whether promotion rules were followed.

12. Safe Play and Responsible Gambling Data

Responsible gambling data may include deposit limits, loss limits, reality checks, session reminders, time-outs, self-exclusion requests, account closures, safer gambling interactions, support notes and behavioural risk indicators. This data is processed to protect players and comply with gambling-related obligations.

The platform may monitor indicators such as rapid deposit increases, repeated failed payments, long sessions, chasing losses, frequent limit changes, reversed withdrawals or unusual play intensity. These indicators may trigger safer gambling messages, account reviews, affordability checks or restrictions.

Responsible gambling data may be more sensitive than standard account data because it can relate to player welfare. Access to this information should be limited to authorised staff and systems that require it for safer gambling, compliance or support purposes.

13. Marketing, Service Personalisation and Cookies

The platform may process marketing preferences, email consent, account activity and promotional history to send offers where legally permitted. Marketing may include updates about the welcome bonus, tombola arcade promotions, free spins, cashback, tournaments, app updates or community events.

Players should be able to opt out of marketing communications through account settings, unsubscribe links or support contact. Opting out of marketing does not stop essential service messages about account security, payments, verification, terms changes or responsible gambling.

Cookies and similar technologies may be used for login sessions, security, website performance, analytics, personalisation and advertising where applicable. Essential cookies are required for core website functions. Optional analytics or marketing cookies should depend on consent where required.

14. Data Sharing and Third-Party Providers

Tombola Casino may share personal data with trusted third parties where necessary to operate the service, comply with law, process payments, verify identity, prevent fraud, provide games or support safer gambling. Data sharing should be limited to what is necessary for the relevant purpose.

Possible recipients include:

Payment processors, banks, card networks, identity verification providers, fraud prevention services, AML screening tools, game suppliers, hosting companies, analytics providers, email and SMS providers, customer support tools, safer gambling partners, regulators, auditors, legal advisers and law enforcement bodies where required.

The platform may also share data within a corporate group if this is necessary for security, compliance, operations, analytics or customer support. Third-party providers must apply appropriate security and confidentiality measures.

15. International Data Transfers

Some data may be processed outside the player’s country of residence if service providers, hosting systems, payment partners, group companies or support tools operate internationally. International transfers may be required for payment processing, fraud prevention, game delivery, analytics or customer support.

Where personal data is transferred internationally, the platform should use appropriate safeguards. These may include adequacy decisions, standard contractual clauses, data processing agreements, security controls and access restrictions.

The player should check the official Privacy Policy and legal footer for current details about the operator, applicable jurisdiction and international processing arrangements.

16. Data Security

The platform should use technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures may include encryption, access control, password protection, two-factor authentication, firewall systems, transaction monitoring and staff access limits.

Payment data should be handled through secure processors and protected by recognised security standards. Sensitive documents used for KYC or AML should be stored in restricted systems and accessed only by authorised teams.

No online service can guarantee absolute security. The player also has responsibility for account protection, including using a strong password, keeping login details private, avoiding shared devices, logging out after use and not sending documents through unsecured channels.

17. Data Retention

Personal data is retained only for as long as necessary for account operation, legal compliance, regulatory duties, accounting, fraud prevention, AML review, responsible gambling records, dispute handling and legitimate business purposes.

Different data categories may have different retention periods. Account details, KYC documents, payment records, gameplay history, responsible gambling records and complaint files may be retained for several years where gambling, AML, tax or legal rules require this.

When retention is no longer required, data should be deleted, anonymised or securely archived. Some deletion requests may not be fulfilled immediately if the platform has a legal duty to keep gambling, AML, tax, payment or responsible gambling records.

18. Player Data Rights

The account holder may have several rights under applicable data protection law. These rights may include access, correction, erasure, restriction, portability, objection, withdrawal of consent and complaint to a data protection regulator.

Some rights are limited by gambling, AML, fraud prevention, accounting and regulatory obligations. For example, the platform may not delete KYC or payment records immediately if there is a legal obligation to retain them.

19. Automated Decision-Making and Profiling

The platform may use automated tools to support fraud prevention, payment security, risk analysis, bonus abuse detection, safer gambling monitoring and marketing personalisation. These tools may assess login behaviour, transaction patterns, gameplay activity, device data and account changes.

Automated systems may flag accounts for review, but significant account decisions should usually include human assessment where required by law or internal policy. Examples include withdrawal review, enhanced due diligence, safer gambling intervention or account restriction.

The player may have the right to request more information about automated decisions and profiling, especially if such processing significantly affects account access, payments or promotional eligibility.

20. Minors and 18+ Protection

Tombola Casino services are strictly for players aged 18 or over. The platform may process date of birth, identity documents and verification data to prevent underage gambling.

If an account is found to belong to a minor, the platform may close the account, restrict access and handle any remaining balance according to applicable law and account terms. Marketing should not be directed at minors or vulnerable individuals.

Players sharing devices with children should avoid saving passwords, log out after every session and use parental control software where appropriate.

21. Changes to This Privacy Policy

The platform may update this Privacy Policy to reflect legal, technical, operational, security, payment or product changes. Updates may be published on the website with a revised “Last Updated” date.

If a change materially affects how personal data is used, the platform may provide notice through the website, account inbox, email or another appropriate channel. Continued use of the service after updates may indicate acceptance of the revised policy where applicable.

Players should review this Privacy Policy periodically, especially before registration, deposits, withdrawals or use of new promotional features.

22. Contact Information

Players may contact support about privacy questions, data access requests, correction requests, marketing preferences, cookie settings, account records or complaints. Contact options may include live chat, help centre, email or other channels listed on the official website.

Requests involving data rights should include enough information to identify the account holder. The platform may require verification before releasing or changing personal data to prevent unauthorised access.

For urgent account security issues, such as suspected unauthorised login or payment misuse, the player should contact support immediately and change the account password where possible.