Privacy Policy

Who holds your data

Oakfold Casino Entertainment Ltd. is the controller of the personal information described here, and operates oakfold.casino under a licence from the Malta Gaming Authority. Where this policy says "we", it means that company.

What we collect, and why

Category	Examples	Why we hold it
Account details	Name, date of birth, email, phone, address, username	To open and run the account, and to confirm you are over 18
Verification records	Identity document, proof of address, proof of payment method	Required by our licence before a first withdrawal
Financial records	Deposits, withdrawals, method used, currency, balances	To process payments and meet anti-money-laundering duties
Play history	Games opened, stakes, results, session length, bonuses claimed	To settle disputes, credit bonuses and monitor for harm
Technical data	IP address, device and browser type, approximate location, sign-in times	Security, fraud prevention and confirming which country you play from
Support records	Chat transcripts, emails, call notes	To follow a question through and to investigate complaints
Preferences	Marketing choices, limits you have set, self-exclusion status	To respect what you asked for, and keep respecting it

We do not collect information we have no use for, and we do not sell personal information to anyone. Ever, and under any label.

The grounds we rely on

Contract. Running the account you asked us to open — deposits, play, withdrawals, support.
Legal obligation. Age and identity verification, anti-money-laundering checks, transaction records and player-protection reporting, all set by our licence.
Legitimate interests. Keeping accounts secure, detecting fraud and bonus abuse, and improving how the site works.
Consent. Marketing messages and non-essential cookies. You can withdraw consent at any time without affecting anything else.

Verification, and why we ask twice

Before a first withdrawal we confirm who you are: a government photo ID, something showing your address, and evidence that the payment method belongs to you. We may repeat the check if the details on the account change, if a much larger transaction appears, or if a regulator requires it.

Documents are stored encrypted, kept apart from the day-to-day account record and seen only by trained verification staff. We do not use them for marketing, and we do not pass them to advertisers.

Who else sees it

A short list, and each entry has a reason attached:

Payment providers and banks — only what is needed to move a specific deposit or withdrawal.
Game studios — a session identifier so a round can be played and settled. Studios do not receive your identity documents.
Identity and fraud-check services — to confirm a document is genuine and an account is not being used by somebody else.
The Malta Gaming Authority and other lawful authorities — where our licence or the law requires disclosure.
Our own technology suppliers — hosting, email delivery and support tooling, each under a written agreement that forbids using your data for anything else.

Nobody on that list is permitted to use your information for their own purposes, and no one else receives it.

How long we keep it

Account, financial and verification records are retained for at least five years after an account closes, because anti-money-laundering law requires it. Self-exclusion records are kept for the length of the exclusion and afterwards, since forgetting them would defeat the point. Support transcripts are held for two years. Marketing preferences are kept until you change them.

Once no legal reason to keep something remains, it is deleted or irreversibly anonymised.

How it is protected

Traffic between your browser and the site is encrypted with TLS; stored data is encrypted at rest.
Staff access is restricted by role and logged, and those logs are audited.
Payment card details are handled by PCI-compliant providers — full card numbers do not sit on our systems.
Passwords are stored hashed. We cannot read yours, which is why support can reset it but never tell you what it was.

No system is perfect. If a breach affects your information and creates real risk to you, we will tell you and the regulator without delay, and say plainly what happened.

What you can ask for

A copy of the personal information we hold about you.
A correction where something is wrong or out of date.
Deletion, so far as no legal retention duty stands in the way — we will tell you which parts must remain and why.
Restriction or objection, including opting out of marketing at any time.
Portability — your data in a machine-readable format.
To complain to a supervisory authority if our answer does not satisfy you.

Ask through the help centre. We reply within 30 days, usually sooner, and we do not charge for it.

Cookies

Cookies and similar storage are covered separately, including what each category does and how to switch the optional ones off: see our cookies policy.

Where the data sits

Our systems and suppliers are based mainly in the European Economic Area. Where information moves outside it, the transfer is covered by an adequacy decision or by standard contractual clauses, which bind the recipient to the same protections you have here.

Under-18s

This service is for adults. We do not knowingly collect information from anyone under 18, and an account found to belong to a minor is closed, with deposits returned and winnings voided. Guidance for parents is on our responsible gaming page.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects your rights we will also tell you by email or by a notice in your account before it takes effect.