Privacy Policy

This Privacy Policy explains how Spirit Casino, operated via the website spirit-au.com and related domains, collects, uses, discloses and protects your personal information. It applies to players, registered account holders, and all visitors who access or use our websites, mobile versions, and related online services.

By creating an account with Spirit Casino, placing bets, using our games, or browsing spirit-au.com, you acknowledge that you have read and understood this Privacy Policy.

Effective date: 1 January 2026

Who We Are

Spirit Casino, including the AU-facing project known as Spirit Casino, is operated online through spirit-au.com by:

• Operator: Complete Technologies N.V.
• Legal form: Public limited liability company (N.V.)
• Registration number: 154512
• Registered address: Zuikertuintjeweg Z/N (Zuikertuin Tower), Curaçao
• Licensing: Sublicensee under Curaçao Antillephone N.V. license 8048/JAZ2014-044 (online gambling).

For certain payment services, we may act together with or via our payment processing subsidiary:

• Payment processor: Bovive Ltd
• Jurisdiction: Cyprus
• Registration number: HE424520

Data protection contact (DPO / privacy team)

• Email: [email protected]
• Postal address for privacy matters: Data Protection Officer, Complete Technologies N.V., Zuikertuintjeweg Z/N (Zuikertuin Tower), Curaçao
• Preferred contact method: Email. We may ask you to verify your identity before we act on your request.

What Personal Data We Collect

We collect and process different categories of data, depending on how you use spirit-au.com and related services.

Identification and contact data

• Full name, date of birth, gender.
• Residential address, country of residence, postcode.
• Email address, telephone number, preferred language.
• Identity verification data (e.g. copies of ID, passport, driving licence, proof of address, selfies or live verification captures) where required for KYC/AML checks.

Account and gameplay data

• Username, account ID and internal profile information.
• Login history, device associations, account status and limits.
• Betting and gaming history, game preferences, wins and losses.
• Bonus usage, loyalty program participation and rewards.

Financial and transaction data

• Selected currency (e.g. AUD, NZD, CAD, cryptocurrencies where applicable).
• Deposit and withdrawal records, including amounts, timestamps, payment methods, and transaction references.
• Limited payment instrument details (e.g. masked card numbers) as provided by payment processors.
• Bank account identifiers or PayID details where used, and cryptocurrency wallet identifiers.

Technical and usage data

• IP address, approximate location inferred from IP, device type, operating system, browser type and version, screen resolution, language settings.
• Log data such as access times, pages viewed, clicks, in-game actions, session duration, and referral URLs.
• Security logs (login attempts, device fingerprinting, suspected fraud patterns).

Behavioral and marketing data

• Interaction with our emails, SMS and push notifications (opens, clicks, unsubscribes).
• Responses to surveys, feedback forms and customer support communications.
• Participation in promotions and tournaments, bonus opt-ins and opt-outs.

Cookies and similar technologies

• Cookies, web beacons, pixels, local storage objects, SDKs and similar technologies placed on your browser or device.
• Information about your interactions with spirit-au.com, including navigation patterns, time spent, and preference settings.

We generally do not seek to collect special categories of data (such as health data). However, if you voluntarily provide information about problem gambling or self-exclusion for responsible gambling support, we will treat it with heightened confidentiality and use it only for that purpose.

Legal Basis for Processing

Because Spirit Casino serves players from multiple countries, including Australia, and is operated from Curaçao, we apply a combination of legal bases derived from international standards such as the EU General Data Protection Regulation (GDPR) and comparable privacy regimes. Depending on the context, we rely on one or more of the following grounds:

• Performance of a contract: We process your data to create and manage your account, enable deposits and withdrawals, verify your eligibility to play, provide games, process bets and payouts, manage bonuses, resolve technical issues and deliver customer support. Without this processing, we cannot provide the spirit-au.com services you request.
• Compliance with legal obligations: As a licensed online gambling operator under Curaçao law and subject to AML/CFT regulations and other applicable laws, we must carry out identity checks, monitor transactions, keep certain records, report unusual or suspicious activities, and honour responsible gambling commitments. These obligations may be imposed by Curaçao regulations and, where applicable, other national laws.
• Legitimate interests: We process data to secure our platform, prevent fraud and abuse, detect account misuse, ensure game integrity, conduct internal analytics, improve our services, defend our legal rights, and manage business operations. When we rely on legitimate interests, we balance our interests against your rights and reasonable expectations.
• Consent: We rely on your consent where required by law, for example:
  • Sending certain types of marketing communications by email, SMS or push notification.
  • Storing or accessing non-essential cookies and similar tracking technologies on your device for analytics and advertising.
  • Processing sensitive information you voluntarily provide (such as problem gambling information) for responsible gambling support.
  You can withdraw your consent at any time, as described below, without affecting the lawfulness of processing before withdrawal.

Purpose of Processing

We use your personal data only for specified, explicit and legitimate purposes, including:

• Providing and operating the casino services: Creating and managing your Spirit Casino account on spirit-au.com, delivering games, processing deposits, bets and withdrawals, administering bonuses and loyalty programs, and providing customer support.
• Compliance and risk management: Performing KYC/AML checks, age and identity verification, transaction monitoring, sanctions screening where required, responsible gambling measures, record-keeping, audits, and responding to lawful requests from authorities.
• Service improvement and analytics: Analysing gameplay, traffic patterns and platform performance to understand how Spirit Casino is used, troubleshoot issues, and develop new features and offerings appropriate for our AU-facing players and other markets.
• Marketing and personalisation: Sending promotional messages (where permitted), tailoring content, bonuses and recommendations to your profile and behaviour, running surveys and loyalty programs, and measuring campaign effectiveness.
• Fraud prevention and security: Detecting and preventing fraud, money laundering, bonus abuse, account takeovers, collusion and other prohibited conduct; enforcing our Terms and Conditions; protecting our rights, property and the safety of users.
• Corporate purposes: Business planning, internal reporting, mergers, acquisitions or reorganisation, subject to appropriate confidentiality safeguards.

Disclosure & Sharing

We do not sell your personal data. However, we may share it with carefully selected third parties where necessary for the purposes described above, under appropriate contractual and security safeguards.

Service providers and business partners

• Payment processors and banks: Including, where applicable, Bovive Ltd in Cyprus and other third-party payment service providers, card schemes, banks, PayID providers and cryptocurrency payment gateways that process deposits and withdrawals.
• Game providers and platform vendors: Companies that supply casino games, live dealer solutions, RNG technology, and back-office systems.
• Verification and AML/KYC providers: Identity verification services, sanctions and PEP screening providers, fraud-prevention tools, and address verification services.
• IT and security providers: Hosting providers, cloud infrastructure, content delivery networks, email and SMS platforms, analytics services, and security monitoring tools.
• Marketing and affiliate partners: Affiliate networks, advertising partners and campaign management tools, only where consistent with your marketing preferences and applicable law.

Regulators and authorities

• Licensing and supervisory authorities in Curaçao and other jurisdictions where we are required to report or cooperate.
• Financial intelligence units and other competent authorities for AML/CFT reporting and investigations, where legally required.
• Court orders, law enforcement requests or legal proceedings where disclosure is required by law or necessary to assert or defend legal rights.

Corporate transactions and other disclosures

• Professional advisers (lawyers, auditors, consultants) under confidentiality obligations.
• Potential acquirers, investors or other counterparties in the context of a merger, acquisition, sale of assets or restructuring, subject to appropriate safeguards.
• Aggregated or anonymised data that does not identify you personally, for statistical or research purposes.

Where third parties act as our processors, they may only process your data on our instructions and must implement appropriate security measures. Where they act as independent controllers (for example, certain payment providers), their own privacy policies will also apply.

International Transfers

As an online casino operated from Curaçao and serving players in Australia and other countries, we may transfer your personal data internationally. This includes:

• From your country of residence to Curaçao (CW): Where Complete Technologies N.V. is registered and operates spirit-au.com and related infrastructure.
• To Cyprus (CY): Where Bovive Ltd and certain payment or support services may be located.
• To the European Economic Area (EEA), the United Kingdom and other jurisdictions: Where hosting, customer support, analytics, game providers or other vendors are based.
• To other countries (including potentially the United States): Where cloud hosting, communications or security providers operate data centres.

Because privacy laws differ between countries, we take steps to ensure that your personal data receives an adequate level of protection consistent with this Privacy Policy and applicable law, including, where relevant:

• Using standard contractual clauses or equivalent data transfer agreements approved by competent authorities.
• Applying technical safeguards such as encryption, pseudonymisation and access controls.
• Limiting access to personal data to personnel and service providers who need it for the specified purposes.
• Conducting due diligence on key suppliers and, where appropriate, assessing their security and privacy practices.

By using spirit-au.com and providing your personal data, you acknowledge that your data may be processed in countries outside your own, which may have different data protection standards. In all cases, we will handle your data in accordance with this Privacy Policy.

Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, to meet legal, regulatory, accounting and reporting requirements, and to resolve disputes. Retention periods may vary depending on the type of data and applicable law, but we generally apply the following guidelines:

• Player account and identification data: Typically retained for the duration of your account and, after account closure, for a period of up to 5 years, or longer if required by AML/CFT or other legal obligations in Curaçao or other relevant jurisdictions.
• Transaction and financial records: Retained for 5 - 10 years after the relevant transaction or account closure, to comply with anti-money-laundering laws, tax and accounting rules, and for evidential purposes.
• Gameplay and betting history: Retained while your account is active and for a period after closure (typically up to 5 years) for regulatory reporting, dispute resolution and responsible gambling analysis.
• Marketing data and preferences: Retained until you withdraw your consent, object to processing, or your account has been inactive for a period (for example, 3 years), after which it may be anonymised or deleted, unless we need it for legal purposes.
• Technical logs and security data: Retained for shorter periods (typically 12 - 24 months) unless needed longer for security investigations, fraud prevention or legal claims.
• Responsible gambling information: Self-exclusion records and related notes may be kept for the duration of the exclusion and for a further period where necessary to honour the exclusion and comply with responsible gambling obligations.

When data is no longer required, we will either securely delete it or irreversibly anonymise it so that it can no longer be associated with you. In some cases, technological limitations (for example, backup archives) may delay full deletion, but we will ensure that such data is securely stored and isolated from further active use.

Your Rights

We recognise and support data subject rights inspired by international standards such as the EU GDPR and, where relevant, Mexican privacy law (including the Federal Law on Protection of Personal Data Held by Private Parties and its regulations). Your exact rights depend on your country of residence, but, as a general principle, we offer the following rights to our players and visitors, to the extent permitted by applicable law:

• Right of access: You can request confirmation whether we process your personal data and obtain a copy of your data together with information about how we use it.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data. In many cases, you can update core account details directly in your profile on spirit-au.com.
• Right to erasure ("right to be forgotten" / cancelación): You can request deletion of your personal data in certain circumstances, for example where it is no longer needed for the original purpose or you have withdrawn consent. We may need to retain some data where required by law (for example, AML/transaction records).
• Right to restriction of processing: You can ask us to restrict the processing of your data in specific situations, for example while we verify its accuracy or assess an objection.
• Right to object (oposición): You can object to certain processing based on legitimate interests, and you can always object to direct marketing (including profiling for marketing).
• Right to data portability: Where technically feasible and required by law, you may request a machine-readable copy of certain personal data that you have provided to us, so that you can reuse it or transfer it to another provider.
• Right to withdraw consent: Where processing is based on your consent (for example, certain marketing or cookies), you can withdraw that consent at any time. This will not affect processing carried out before withdrawal.
• Rights relating to automated decision-making: If we use automated decisions that produce legal or similarly significant effects (for example, automated blocks for AML or risk purposes), you may have the right to request human review and to express your point of view, subject to legal constraints (e.g. AML secrecy).

How to exercise your rights

1. Submit a request: Contact us at [email protected] from the email address linked to your account, clearly stating:
   • Your full name and username.
   • The right(s) you wish to exercise (e.g. access, rectification, erasure, ARCO rights).
   • Any relevant details that help us locate your data.
2. Verification: We may ask you to provide additional information to verify your identity and ensure that we do not disclose data to the wrong person.
3. Response time: We aim to respond within 30 days of receiving a complete request. If your request is complex or we receive multiple requests, we may extend this by a further period permitted by law, informing you of the delay and reasons.
4. Fees: We will handle your request free of charge, unless it is manifestly unfounded or excessive (for example, repeated requests). In such cases, we may charge a reasonable fee or refuse the request, as allowed by law.

Please note that legal obligations (for example, AML/CTF rules in Curaçao or other applicable jurisdictions) may require us to retain certain data even if you request deletion or object to processing.

Cookies & Tracking Technologies

Spirit Casino uses cookies and similar technologies on spirit-au.com to operate the site, enhance your experience, and analyse and improve our services.

Types of cookies we use

• Strictly necessary (functional) cookies: Essential for the website to function, enabling core features such as account login, session management, security and transaction processing. These cookies cannot be disabled through our systems, although you can configure your browser to block them (which may cause parts of the site to malfunction).
• Performance and analytics cookies: Help us understand how visitors use our site (for example, which pages are visited, how long users stay, and any errors encountered). We use this information to improve the performance, design and usability of spirit-au.com.
• Preference cookies: Remember your language and region settings, display options, and other choices, so that the site is tailored to your preferences on return visits.
• Advertising and affiliate cookies: Used to measure the effectiveness of our marketing campaigns, track referrals from affiliate partners, and, where permitted, deliver or optimise advertising. These may be set by us or by third-party partners.
• Session vs. persistent cookies: Session cookies are deleted when you close your browser. Persistent cookies remain on your device for a set period or until you delete them.

Managing cookies

• You can manage or disable cookies via your browser settings. Most browsers allow you to refuse all or some cookies and to delete cookies already set. The method varies by browser and device; consult your browser's help section for instructions.
• Where required by law, we will present a cookie banner or preference centre when you first visit spirit-au.com, allowing you to accept or reject non-essential cookies. You can change your choices at any time via the cookie settings link (where available) on our site.
• If you block or delete cookies, some features of Spirit Casino on spirit-au.com may not function properly, and your user experience may be degraded.

Data Security

We take the security of your personal data seriously and implement technical and organisational measures designed to protect it against unauthorised access, loss, misuse, alteration or disclosure.

• Encryption in transit: Communication between your browser and spirit-au.com is protected using TLS (Transport Layer Security) 1.2 or higher, helping to safeguard data transmitted over the internet.
• Encryption at rest: Where appropriate, we encrypt or pseudonymise sensitive data stored on our systems and in backups, reducing the risk of exposure in the event of unauthorised access.
• Access controls: Personal data is accessible only to authorised personnel and service providers that need access for legitimate business purposes, subject to confidentiality obligations and role-based access rights.
• Authentication and account security: We encourage strong passwords and may deploy additional security mechanisms such as multi-factor authentication (MFA) where available. We monitor for unusual login behaviour and may block or challenge suspicious access attempts.
• Network and infrastructure security: Firewalls, intrusion detection/prevention systems, anti-malware tools, and regular patching are used to protect our infrastructure and services.
• Monitoring and testing: We perform regular internal security checks, vulnerability assessments and, where appropriate, engage external specialists to test the robustness of our systems.
• Policies and training: Staff with access to personal data receive training on data protection and confidentiality obligations. Internal policies govern data handling, retention and incident response.
• Incident response: We maintain procedures to detect, investigate and respond to suspected data breaches. Where required by law, we will notify affected individuals and relevant authorities without undue delay.

We aim to align our information security practices with recognised industry standards and frameworks (such as ISO 27001 or SOC 2) to the extent appropriate for our operations, even if we are not formally certified as of 2026. No system can be completely secure, but we strive to continuously improve our security posture.

Complaints & Contacts

If you have questions, concerns or complaints about how we handle your personal data on spirit-au.com, please contact us first so that we can try to resolve the issue directly.

How to contact us

• Privacy email (primary contact): [email protected]
• General support: Via the support channels indicated on spirit-au.com (such as live chat or helpdesk, where available).
• Postal address: Data Protection Officer, Complete Technologies N.V., Zuikertuintjeweg Z/N (Zuikertuin Tower), Curaçao.

Internal complaint procedure

1. Step 1 - Contact support or DPO: Explain your concern in as much detail as possible and identify yourself and your account.
2. Step 2 - Investigation: We will investigate your complaint, which may involve reviewing system logs, consulting relevant teams, and requesting additional information from you if necessary.
3. Step 3 - Response: We aim to respond to privacy complaints within 30 days of receipt. If we cannot respond within this period, we will inform you of the delay and provide an updated timeframe.
4. Step 4 - Further steps: If you are not satisfied with our response, you may have the right to escalate the matter to a relevant supervisory authority, as outlined below.

Supervisory authorities and escalation

Your options to escalate a complaint may depend on your country of residence. Without limiting any local rights, the following may be relevant:

• Australia: If you are in Australia and believe your privacy has been interfered with, you can contact the Office of the Australian Information Commissioner (OAIC):
  • Website: https://www.oaic.gov.au
• Mexico: If you are in Mexico, you may submit a complaint to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI), in accordance with Mexican data protection law.
• European Union / EEA: If you are in the EU/EEA and believe we process your data in a way that violates data protection law, you may lodge a complaint with your local data protection authority. A list of authorities is available on the website of the European Data Protection Board.
• Other jurisdictions: You may have the right to complain to your local data protection regulator or similar authority, in addition to any gaming regulator that may be relevant for gambling-related issues.

Nothing in this section limits any rights you may have under applicable law to bring a claim before a court of competent jurisdiction.

Updates

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices.

• Notification of changes: For material changes, we will take reasonable steps to notify you in advance, for example by:
  • Sending an email to the address associated with your Spirit Casino account.
  • Displaying a prominent notice or banner on spirit-au.com.
  • Providing an in-account notification when you next log in.
• Advance notice: Where feasible and required, we will provide at least 30 days' notice before material changes take effect. Minor updates (for example, clarifications or corrections) may take effect immediately without prior notice.
• Your options: If you do not agree with the updated Privacy Policy, you may close your account and stop using spirit-au.com. Continued use of our services after the effective date of an updated policy will signify your acceptance of the changes.
• Version control and changelog: We maintain records of previous versions of this Privacy Policy. Material changes in recent updates include clarifications on international transfers, expanded explanations of user rights (including Mexican ARCO-aligned rights), and additional details on data retention and security practices.

Last updated: February 2026