Plain English Summary
What this policy means for you in plain English:
✓We collect only the data needed to operate your account, process payments, and comply with anti-money-laundering laws.
✓We never sell your personal data to advertisers or third parties for marketing purposes.
✓You can request a copy of your data, correct errors, or ask for deletion at any time by contacting us.
✓You can opt out of marketing emails at any time — every email we send includes an unsubscribe link.
✓Your financial data is encrypted with 256-bit SSL and never stored in plain text. Payment card details are processed by certified PCI DSS providers.
✓We comply with the New Zealand Privacy Act 2020 and international AML/CFT regulations applicable to licensed gaming operators.
01
Who We Are & How to Contact Us
Zodiac Casino is operated by Bayton Limited, a company incorporated in Malta (Company Registration C-41492) and licensed by the Malta Gaming Authority under licence number MGA/B2C/145/2007. Bayton Limited acts as the data controller responsible for your personal information.
The services are provided to New Zealand residents through the website zodiac-casinonz.com. By registering an account and using our services, you acknowledge that you have read, understood, and agreed to this Privacy Policy.
Data Controller Contact Details
Company: Bayton Limited
Registered address: Portomaso Business Tower, Level 12, St. Julian’s PTM01, Malta
Response time: Within 30 days of receipt (as required by the NZ Privacy Act 2020)
02
What Personal Data We Collect
We collect personal data in three ways: information you provide directly, information collected automatically when you use our services, and information we receive from third parties.
📋
Information You Provide to Us
▾
When you register, verify your account, or contact support, you provide us with:
→Identity data: Full legal name, date of birth, gender, nationality
→Contact data: Email address, phone number, residential address (including postcode)
→Identity documents: Copies of government-issued photo ID (e.g. NZ driver’s licence or passport), proof of address, source-of-funds documentation for KYC/AML compliance
→Financial data: Payment method details (card type, partial number — not full PAN), bank account information for withdrawals, transaction history
→Account data: Username, password (stored as a hashed value — never in plain text), security questions, deposit limits, responsible gambling settings
→Communications: Messages sent to customer support (chat transcripts, emails), survey responses, bonus claim history
🖥️
Information Collected Automatically
▾
When you visit our website or use our mobile app, we automatically collect:
→Device & technical data: IP address, browser type and version, operating system, device type (mobile/desktop/tablet), screen resolution, device identifiers
→Usage data: Pages visited, time spent on each page, features used, games played, bet amounts and outcomes, session duration and timing
→Location data: General geographic location derived from your IP address (city/country level — we do not collect precise GPS location data)
→Cookie & tracking data: Session cookies, preference cookies, analytics identifiers. See Section 9 (Cookie Policy) for full details.
🔄
Information from Third Parties
▾
We may receive information about you from trusted third-party sources, including:
→Identity verification providers: Third-party KYC services that verify your identity documents and cross-reference against sanctions lists, PEP (Politically Exposed Persons) databases, and fraud registers
→Payment processors: Confirmation of payment transactions, fraud risk scores from payment providers
→Analytics partners: Aggregated usage data to improve site performance (no personal identifiers shared)
→Affiliate partners: Information about how you arrived at our site (referral source), used solely for affiliate tracking purposes
03
How We Use Your Personal Data
We use your personal data only for the purposes described below. We do not use your data for automated decision-making that produces significant legal effects without human review.
| Purpose | Data Used | Legal Basis |
|---|
| Account registration & management | Identity, contact, account data | Contract |
| Processing deposits & withdrawals | Financial, identity data | Contract |
| Identity verification (KYC) | Identity documents, financial data | Legal obligation |
| AML/CFT compliance & fraud prevention | All data categories | Legal obligation |
| Responsible gambling monitoring | Usage, financial, account data | Legal obligation |
| Customer support | Identity, contact, communications | Contract |
| Marketing communications | Contact data, usage preferences | Consent |
| Site analytics & improvement | Device, usage data (anonymised) | Legitimate interest |
| Regulatory reporting & audit | All relevant data categories | Legal obligation |
04
Legal Basis for Processing
We process your personal data only where we have a valid legal basis. Under the New Zealand Privacy Act 2020 and applicable data protection standards, the legal bases we rely on are:
Contract
Processing is necessary to perform our contract with you — i.e. to provide the gaming services, manage your account, process deposits and withdrawals, and deliver bonuses.
Legal Obligation
Processing is required to comply with applicable laws, including the Malta Gaming Authority licence conditions, Anti-Money Laundering (AML) regulations, Counter-Financing of Terrorism (CFT) obligations, tax reporting requirements, and responsible gambling duties.
Consent
Where we rely on consent (primarily for marketing communications), you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Legitimate Interest
For analytics, fraud detection, security monitoring, and improving our services — provided these interests are not overridden by your fundamental privacy rights. We conduct legitimate interest assessments (LIAs) for all such processing.
05
Sharing Your Personal Data
✓We do not sell your personal data. We do not share your personal data with third parties for their independent marketing purposes. We share data only as described below, and only to the extent necessary for the stated purpose.
🏛️ Regulatory & Legal Authorities
We may share your data with gaming regulators (Malta Gaming Authority), law enforcement agencies, financial intelligence units, and tax authorities where required by applicable law or court order. This includes mandatory reporting under AML/CFT regulations.
🔍 Identity Verification Providers
Your identity documents and personal details are shared with licensed KYC/AML service providers (e.g. Jumio, Onfido, or similar) solely for the purpose of verifying your identity and checking regulatory databases. These providers process your data as data processors under our instructions and are contractually bound to appropriate data protection standards.
💳 Payment Processors
Payment transaction data is shared with PCI DSS-certified payment processors (e.g. PayPal, Visa/Mastercard networks, Skrill, bank transfer providers) to execute deposits and withdrawals. These providers receive only the data necessary to complete the transaction.
📊 Service Providers & Technology Partners
We use third-party providers for hosting, customer support software, email delivery, analytics, and fraud detection. These providers access your data only to provide services on our behalf and are bound by data processing agreements. They include cloud infrastructure providers, live chat platforms, and email delivery services.
🎮 Game Software Providers
When you play a game (e.g. from Microgaming or Play’n GO), your session data (game actions, bet amounts, outcomes) is shared with the game provider to enable gameplay. Game providers do not receive your personal identity information beyond what is necessary for game operation and regulatory reporting.
🏢 Group Companies
Your data may be shared within the Bayton Limited group of companies for internal administration, shared technology systems, and group-level compliance and risk management. All group companies are bound by the same data protection standards as this policy.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with our legal and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|
| Account & identity data | 5 years after account closure | AML/gaming regulatory requirement |
| Transaction records | 7 years after transaction | Tax & financial reporting law |
| KYC / identity documents | 5 years after account closure | AML/CFT regulatory requirement |
| Game history & bet records | 5 years after each session | Gaming licence obligation |
| Customer support communications | 2 years from last contact | Service quality & dispute resolution |
| Marketing preferences | Until consent withdrawn | Consent-based processing |
| Website analytics (anonymised) | 26 months | Analytics provider standard retention |
After the applicable retention period, your data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Where legal proceedings or disputes are pending, we may retain relevant data until their conclusion.
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
🔒
256-bit SSL Encryption
All data transmitted between your browser and our servers is encrypted using industry-standard TLS 1.2 or higher. This includes all login, registration, and payment pages.
🗄️
Encrypted Data Storage
Sensitive data fields (passwords, payment details, identity document scans) are stored encrypted at rest using AES-256 encryption. Passwords are hashed using bcrypt and never stored in recoverable form.
🛡️
Access Controls
Access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and annual privacy training. Access logs are maintained and reviewed regularly.
💳
PCI DSS Compliance
All payment card data is handled by PCI DSS Level 1 certified payment processors. We do not store full payment card numbers on our systems — this is handled entirely by the certified processor.
🔍
Security Monitoring
We conduct regular security audits, vulnerability assessments, and penetration testing. Suspicious activity on accounts is monitored in real time by automated fraud detection systems.
📣
Breach Notification
In the unlikely event of a personal data breach that poses a risk to your rights, we will notify affected individuals and relevant authorities as required by applicable law — within 72 hours where mandated.
Your responsibility: You are responsible for maintaining the confidentiality of your account password and for all activity that occurs under your account. We recommend using a strong, unique password and enabling two-factor authentication (2FA) where available. Never share your login credentials with anyone.
Under the New Zealand Privacy Act 2020 and our data protection commitments, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within 20 working days.
📂
Right of Access (Information Privacy Principle 6)
▾
You have the right to request a copy of all personal data we hold about you, together with information about how it is used and who it has been shared with. This is sometimes called a Subject Access Request (SAR). We will provide this information free of charge in a structured, commonly used, machine-readable format where technically feasible.
✏️
Right to Correction (Information Privacy Principle 7)
▾
If you believe that any personal data we hold about you is inaccurate, incomplete, out of date, or misleading, you have the right to request that we correct it. You can update many of your details directly in your account settings. For corrections to identity or financial data, please contact our support team.
🗑️
Right to Deletion (Right to be Forgotten)
▾
You may request that we delete your personal data. We will honour this request where there is no overriding legal reason to retain the data. Please note: due to AML, gaming licence, and tax obligations, we are legally required to retain certain data (transaction records, KYC documents) for up to 7 years after account closure. These records cannot be deleted until the mandatory retention period expires.
⛔
Right to Object to Processing
▾
You have the right to object to processing of your personal data where we rely on legitimate interests as our legal basis, and where you believe your privacy rights override those interests. You also have an absolute right to object to processing for direct marketing purposes — simply unsubscribe from any marketing email or contact us at any time.
📦
Right to Data Portability
▾
Where technically feasible and where we process your data by automated means based on consent or contract, you may request to receive your personal data in a structured, commonly used, machine-readable format (e.g. CSV or JSON), and to have it transferred directly to another data controller if you choose.
🏛️
Right to Complain to the Privacy Commissioner
▾
If you are dissatisfied with how we have handled your personal data or responded to a privacy request, you have the right to lodge a complaint with the
New Zealand Office of the Privacy Commissioner:
Website: privacy.org.nz
Phone: 0800 803 909
Post: Office of the Privacy Commissioner, PO Box 10094, The Terrace, Wellington 6143
We encourage you to contact us first so we can attempt to resolve your concern directly.
We use cookies and similar tracking technologies on our website. A cookie is a small text file placed on your device when you visit our site.
| Cookie Type | Purpose | Duration | Can Opt Out? |
|---|
| Strictly Necessary | Session management, login state, security, shopping cart | Session / up to 24h | No — required for site function |
| Functional | Language preference, display settings, responsible gambling settings | Up to 1 year | Partial — site may not function correctly |
| Analytics | Usage statistics, page performance, error tracking (via Google Analytics or similar) | Up to 26 months | Yes — via cookie banner |
| Marketing / Affiliate | Tracking referral source, affiliate commission attribution | Up to 30 days | Yes — via cookie banner |
You can manage cookie preferences through your browser settings or through our cookie consent banner displayed on your first visit. Deleting cookies does not delete your account or personal data. Please note that disabling certain cookies may affect the functionality of our website.
10
Marketing Communications
We send marketing communications (promotional emails, SMS, push notifications) only to players who have opted in to receive them during registration or subsequently in their account settings.
✓Opt-out at any time. Every marketing email contains a one-click unsubscribe link in the footer. You can also manage your marketing preferences at any time in My Account → Communication Preferences. Opting out does not affect service-related communications (e.g. deposit confirmations, security alerts, account notifications).
✓No third-party marketing. We do not share your contact details with third parties for their own marketing purposes. All marketing communications you receive from Zodiac Casino are sent by us directly — you will never receive unsolicited marketing from a third party as a result of registering with us.
⚠️Self-excluded players. If you have activated self-exclusion, all marketing communications are automatically suppressed from the moment of exclusion. We will not send bonus offers, promotional emails, or any gambling-related marketing to self-excluded accounts.
11
Third-Party Links & International Transfers
Our website may contain links to third-party websites (e.g. game providers, payment processors, responsible gambling organisations). This Privacy Policy does not apply to those external sites. We recommend reviewing the privacy policy of any third-party site before providing personal data.
International data transfers: As a Malta-based company serving New Zealand players, your personal data may be transferred to and processed in countries outside New Zealand — including Malta, the European Economic Area, and other jurisdictions where our service providers operate. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses (SCCs) or equivalent mechanisms recognised under the Privacy Act 2020.
🔞 Strictly 18+ Only
Our services are intended exclusively for adults aged 18 years and over. We do not knowingly collect or process personal data from children under the age of 18. If we become aware that we have collected personal data from a person under 18 without verified parental or guardian consent, we will take immediate steps to delete that information and close the account. If you believe a child under 18 has registered with us, please contact us immediately at [email protected].
13
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory requirements. When we make material changes, we will:
→Update the “Last updated” date at the top of this page
→Send an email notification to your registered email address describing the key changes
→Display a notice on our website homepage for at least 30 days following a material change
→Where required by law, seek your renewed consent for any new processing activities
Your continued use of our services after the effective date of an updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this page periodically. Previous versions of this Privacy Policy are available on request.
14
Contact Us About Privacy
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us using any of the following methods. We are committed to responding to all privacy enquiries within 20 working days.
📧
Privacy Email
For all privacy requests, Subject Access Requests, correction requests, and data deletion enquiries.
[email protected]
💬
Live Support Chat
For general privacy questions or to be directed to the correct team, contact our 24/7 live support chat.
Open Live Chat
📮
Postal Address
Bayton Limited
Attn: Data Protection Officer
Portomaso Business Tower
Level 12, St. Julian’s PTM01
Malta
🏛️
NZ Privacy Commissioner
If we fail to resolve your complaint, contact the Office of the Privacy Commissioner (NZ).
