Legal
Privacy Policy for Australian Players
Wild Tokyo Casino is operated by GBL Solutions N.V., incorporated under the laws of Curaçao and licensed by the Curaçao Gaming Control Board. What follows is what the operator collects from Australian players, why, and for how long. One thing belongs up front rather than three sections down: the site is offshore. Australian residents reach it outside the local consumer protections of the Interactive Gambling Act 2001, which makes the handling of personal data more important here, not less.
Who is responsible for your data
GBL Solutions N.V. is the data controller, holds a Curaçao GCB gaming licence, and runs wildtokyo.com. Privacy questions, complaints and requests to exercise the rights below go to [email protected]. Two facts Australian players should have: Wild Tokyo holds no Australian licence, and it is not registered with the Office of the Australian Information Commissioner. Where Privacy Act 1988 principles line up with Curaçao requirements, the operator applies them as internal policy.
What personal information is collected
Registration asks for your full name, date of birth, residential address, email address, mobile number, and a username and password of your choosing.
Gameplay generates a second layer on its own: session times, IP address, device identifiers, browser type, the history of deposits and withdrawals, wager volume, game selections and bonus activity.
KYC adds documents. A copy of government-issued photo identification, proof of address such as a utility bill under three months old, and evidence of the payment method, which means partially masked card images or e-wallet screenshots. Where a video call is needed for risk assessment, the recording of that call is kept.
Why this information is collected
Four lawful bases carry it. Contractual necessity, to run your account and settle wagers. Legal obligation, under the anti-money-laundering rules attached to the Curaçao licence. Legitimate interest, in fraud prevention and platform security. And consent, which covers marketing communications, is given at registration and can be withdrawn from your account settings at any time.
Age verification sits outside all of that. The operator has to confirm you are at least 18 before accepting a wager, and an account found to belong to someone underage loses its deposits and winnings to the regulatory authority.
Who receives your data
Payment processors move money in and out. Identity verification providers run the KYC checks. Game suppliers see technical logs where a dispute needs resolving. The Curaçao Gaming Control Board receives what a lawful request obliges the operator to hand over, and so may Australian authorities including AUSTRAC where a formal legal request is served on the operator or its processors. Third-party providers who measure site performance get aggregate, non-identifying analytics. Personal information is not sold to advertisers.
Where your data is stored and transferred
The servers sit outside Australia. Data may be transferred to and processed in Curaçao, in the European Union, and in the other jurisdictions where the operator's technology providers work, under standard contractual safeguards with each processor. Put plainly: your information leaves Australia, and the Australian Privacy Principles stop covering it the moment it does. If that is a problem, do not open an account.
How long data is retained
KYC documents, transaction records and account activity logs are kept for at least five years after the account closes, which is what AML obligations under the Curaçao licence require. Marketing preferences and communication history last until you withdraw consent, plus a short archival period for audit. A video verification recording is held for two years unless a specific investigation needs longer. Dormant accounts stay under the same rules until the retention period runs out.
Security measures
TLS encryption in transit. Encrypted storage for identification documents. Internal access restricted to need-to-know. Two-factor authentication offered as an optional account control, and players are urged to switch it on. None of that makes a system immune to breach. If an incident touches your account, notice goes to the email on file, with the steps taken and whatever action is recommended on your side.
Your rights
You can ask for access to the personal information held about you, correction of anything inaccurate, deletion where the law allows it, and a copy of your data in portable form. Requests are handled within 30 days when they come from the address registered on your account, sent to [email protected]. Deletion does not override AML retention: transaction and identification records stay for the statutory period even after an account closes. A complaint can also go to the Office of the Australian Information Commissioner, though enforcement against an offshore operator is limited in practice.
Cookies and tracking
Session cookies keep you logged in, functional cookies remember preferences, analytics cookies measure how the site is used. The Cookie Policy has the detail. Refusing the non-essential ones costs you no core account function, only some personalisation and promotional targeting.
Children
The site is for adults of 18 and over. An account identified as a minor's is closed, its deposits and winnings go to the regulator, and the minor's personal data is deleted, except for whatever the closure and any related investigation require the operator to keep.
Changes to this policy
This policy gets updated from time to time, and whatever is published on the site is the version in force. Material changes go out by email to registered players. Carrying on after a change is treated as acceptance.