Privacy Policy

Categories of information collected

At registration we request a name, date of birth, residential address, email address and telephone number. Verification later requires a government-issued photographic document and, in most cases, a proof of address dated within the preceding three months.

Financial records are generated by your activity: deposit and withdrawal instructions, the last four digits and issuer of payment instruments, currency conversions applied, and the balance movements associated with each wager settled.

Technical information is captured automatically. This covers IP address and derived approximate location, device model, operating system version, browser fingerprint attributes, referring URL, and timestamps for each authenticated session. Support conversations, including chat transcripts and recorded telephone calls where applicable, are retained as part of the account record.

Purposes and legal grounds

Contractual necessity covers the operation of your account — accepting stakes, settling outcomes, processing payments and answering queries. Without this information the service cannot be provided at all.

Legal obligation covers anti-money-laundering checks, sanctions screening, age verification and record retention duties imposed by the licensing regime under which VeryWell Casino operates. These processes cannot be opted out of while an account remains open.

Legitimate interest covers fraud detection, collusion and bonus-abuse analysis, platform security monitoring, and the aggregate statistical work that informs which games we license. Where we rely on legitimate interest you may object, and we will assess whether that interest is overridden in your particular case.

Consent governs marketing only. Promotional email, SMS and push notification require an affirmative opt-in and can be withdrawn at any moment from the communication preferences screen or by using the unsubscribe mechanism carried in every message.

Disclosure and international transfer

Information is shared with payment processors, game content suppliers, identity verification bureaux, hosting providers and analytics vendors strictly to the extent each requires to perform its function. Each such party is bound by written terms restricting use to our documented instructions.

Disclosure to regulators, law enforcement, tax authorities or courts occurs where a lawful demand is made or where reporting is mandated. We do not sell personal information to advertisers or data brokers under any circumstances.

Some processing occurs outside the United Kingdom and the European Economic Area, including in jurisdictions that have not received an adequacy determination. Transfers of that kind are governed by standard contractual clauses or an equivalent safeguard, and a summary of the mechanism applied is available on written request.

Retention periods and security measures

Account and transaction records are held for a minimum of five years following account closure, as regulatory record-keeping duties require. Marketing preference records persist for three years to evidence the lawfulness of past contact. Server and security logs are cycled at thirteen months. Self-exclusion records are held indefinitely, since deleting them would defeat their protective purpose.

Transport is encrypted with TLS 1.2 or above. Credentials are stored as salted hashes and never in recoverable form. Administrative access is granted on a least-privilege basis, reviewed quarterly, and logged for audit. Payment card data is handled by PCI DSS compliant processors and is not stored on our own infrastructure.

Exercising your rights

Subject to applicable law you may request a copy of the information held about you, correction of inaccuracies, erasure where no overriding obligation applies, restriction of processing, portability of data you supplied, and objection to processing based on legitimate interest.

Requests should be sent through the account support channel and will normally be answered within one calendar month. Identity confirmation is required before any disclosure, and a complex request may be extended by a further two months with notice explaining the delay.

Erasure will frequently be refused in part. Anti-money-laundering records, self-exclusion entries and dispute documentation must be preserved regardless of a deletion request, and we will explain precisely which categories are retained and on what basis.