Data and privacy

Privacy Policy: What Is Collected, Why It Is Held, and What You Can Ask For

What this site collects, what a PokieSurf account requires, who else sees it, and the requests you are entitled to make.

BenchmarkThe Privacy Act 1988 and the thirteen Australian Privacy Principles.

RequestsAccess, correction, deletion and marketing opt-out go to [email protected].

How This Document Is Meant to Be Used

Privacy notices earn trust by being specific, so this one skips the reassurance and names things: which fields are collected, what each is for, who else sees them, how long they survive and which requests you can make.

Two scopes run through the page. The first is this site, an information resource about PokieSurf Australia, which collects very little. The second is the account data the operator itself asks for when you register on pokiesurf.com, deposit or request a payout, described here so you know what you are agreeing to. The operator's own notice, linked in its footer, is the binding version for the account relationship.

The Framework This Is Measured Against

Australia's Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles set the baseline for how organisations operating here should handle personal information: collect only what is needed, say why, keep it accurate and secure, and let people see and correct what is held. APP 8 adds a specific duty around sending personal information overseas.

Read this page against that standard. PokieSurf is an offshore operator publishing no gambling licence, so treat the APPs as the benchmark you are entitled to expect rather than a compliance claim made on the operator's behalf.

Information Collected When You Browse This Site

Visiting these pages leaves a small technical footprint, most of it automatic and none of it tied to your name:

Device and connection data: IP address, browser type and version, operating system, screen size and preferred language.
Usage data: which pages you opened, in what order, how long you stayed and which link brought you here.
Cookie identifiers: a random string letting analytics separate a returning visitor from a new one. What each category does, and how to switch the optional ones off, is set out on the cookie policy page.

No account is created here, no payment is taken, and nothing above asks for your identity.

Information a PokieSurf Account Requires

Registering and playing is a different level of disclosure. Expect the operator to collect:

Identity data: full name, date of birth and residential address, to confirm you are over 18 and who you say you are.
Contact data: the email address you register with, which doubles as your account identifier and password recovery route.
Financial data: the payment instrument you deposit with, transaction amounts, currency and payout destination. Balances are held in AUD.
Verification data: photographs of an identity document showing both sides in full, plus a selfie-style image taken inside an on-screen frame so face and document can be matched. This is the process the operator's own interface describes.
Gameplay and technical data: bets, session times, bonus history, device and IP address at the time of play, kept for fraud and bonus-abuse checks.

Why Each Category Is Collected

Different data sits on different footings, and the practical consequence is that some can be withdrawn and some cannot.

To run the account. Email, password, currency and transaction records exist because you asked for a service. Remove them and there is no account.
To meet legal obligations. Age checks, identity verification and transaction monitoring exist because anti-money-laundering rules require an operator to know who is moving money. Consent is not the basis here, and refusing verification means no payout.
Legitimate operational interest. Device details, IP records and betting patterns are used to detect duplicate accounts, bonus abuse, chargeback fraud and compromised logins.
Consent, and only consent. Marketing email, promotional messaging and personalised offers rest on your permission alone.

Optional Marketing Against Mandatory Verification

These two must not blur together, so here is the line drawn plainly. Verification is mandatory: you cannot opt out of identity checks and still withdraw, and no honest operator offers a payout route that skips them.

Marketing is optional. Ticking a promotional consent box is not a condition of holding an account, and withdrawing it later affects neither your balance nor your ability to play. Every marketing email should carry an unsubscribe link, and asking support to remove you from campaign lists should be enough on its own. If promotional mail continues after you have opted out, that is a complaint worth making in writing.

Who the Information Is Shared With

Personal information is not a product to be sold on. Sharing should be limited to parties who need the data for a specific job:

Payment providers and card networks, to move money and investigate disputed transactions.
Identity verification and anti-fraud services, which check documents against sanction and age databases.
Game studios, which receive the session data needed to run a game and settle a round, not your identity documents.
Hosting, analytics and support platforms, under contract and only for the function they perform.
Law enforcement, courts and regulators, where there is a legal obligation to disclose.

If you are ever asked to send documents anywhere other than the operator's own support channel, stop and verify it first.

When Data Leaves Australia

Offshore gambling platforms rarely keep their infrastructure here, so assume some processing, storage and support handling happens outside Australia. APP 8 is the relevant principle: an organisation disclosing personal information overseas should take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, and often remains accountable for what that recipient does.

The practical point is that an overseas recipient may sit under a legal system with weaker privacy remedies than ours. PokieSurf does not publish where its servers or processors are located, so that destination cannot be confirmed here, and it is a fair question to put to support before uploading identity documents.

Your Rights and How to Use Them

The Privacy Act gives you rights worth exercising rather than reading about:

Access. Ask for a copy of what is held. Email from your registered address and describe what you want: account details, transaction history, verification files, or all of it.
Correction. If your name, address or date of birth is wrong, send the correct version with a document supporting it. Inaccurate records cause failed payouts more often than anything else.
Deletion. Ask for removal of data no longer needed, within the retention limits below.
Withdrawal of marketing consent. Unsubscribe, or say so in writing, at any time.
Complaint. Raise it with the operator first and keep the correspondence.

If a privacy complaint goes unanswered or the answer is unsatisfactory, the Office of the Australian Information Commissioner, the OAIC, is the body Australians can approach about the handling of personal information. Be realistic about the outcome: the OAIC's reach over an offshore operator with no Australian presence is limited, and it is not a route to recovering money.

How Long Information Is Kept

Deletion is the request most often misunderstood, so here is the honest position. Anything held for anti-money-laundering purposes, including identity documents, verification results and transaction records, cannot simply be erased on request while that obligation is live. Financial-crime rules require records to be retained for years after a relationship ends, and a request to delete them will properly be refused.

PokieSurf does not publish a specific retention period, and no figure is invented here. Ask support for the exact term applying to your records and get the answer in writing. What can usually be actioned immediately is narrower: marketing consent, contact preferences and optional profile details. Treat "delete my data" as meaning "close the account and delete everything not legally required", because that is what it means in practice.

Accounts and People Under 18

The platform is for adults, and data about anyone under 18 is not knowingly collected. An account found to belong to a minor should be suspended immediately, the identity checks run, winnings voided and deposits returned to source. Personal information gathered in that process is deleted once those steps are complete and any record-keeping duty is met.

Parents and guardians sharing a device should assume a saved password is an open door. If you believe a minor has registered using your details or your card, contact support at once and say so explicitly.

Security, and the Part You Control

Traffic between your browser and the platform runs over an encrypted HTTPS connection, verification documents go through the operator's own upload flow rather than ordinary email, and access to account records is restricted internally.

No two-factor authentication option is published for PokieSurf accounts, which puts more weight on the two things you control. Choose a password you have not reused anywhere, least of all on the inbox itself or on internet banking, and protect that inbox: recovery runs through it, so whoever holds the mailbox holds the account. Treat any request for your password as fraudulent, whoever it appears to come from, and end a session properly on a device other people use.

Contacting Us About Your Data

Privacy requests, access and correction requests, marketing opt-outs and questions about anything above go to the operator's support desk: live chat, or [email protected] by email. No separate data protection officer address is published, so that address is the route. Write from the email address on the account, state what you want, and keep a copy.

Changes to This Policy

This page is revised as practices and Australian privacy guidance change. Where a change materially affects what is collected or who it is shared with, the update is posted with a fresh effective date rather than slipped in quietly. The operator's own privacy notice on pokiesurf.com is maintained separately and governs your account.