1.1 The data controller responsible for your personal data is Veganova Ltd, a company registered in the Union of Comoros, licensed by the Anjouan Gaming Commission, with its registered office at 15856, PO BOX 1212 Hamchako, Mutsamudu, Autonomous Island of Anjouan, Union of Comoros.

1.2 For privacy-related enquiries, please contact our Customer Support team via live chat or email at [insert privacy contact email]. We aim to respond to all data-related requests within 30 calendar days.

2.1 Information you provide directly. We collect personal information when you register, play, make deposits or withdrawals, contact support, or submit verification documents. This may include: full name, username, and date of birth; email address, phone number, and residential or billing address; government-issued identification documents and proof of address; payment details including card information, cryptocurrency wallet addresses, and e-wallet identifiers; transaction history and account preferences; communications and correspondence with our support team; source of funds and source of wealth documentation where requested; and any other data you voluntarily provide to us.

2.2 Automatically collected data. When you use our platform, we automatically collect certain technical and behavioural data, including: IP address and approximate geolocation; browser type, version, and operating system; device type and unique device identifiers; date, time, and duration of access; pages and features visited and gameplay session data; language and display settings; error reports and performance diagnostics; and referral source and marketing attribution data.

2.3 Data from third parties. We may receive data about you from third parties in connection with our services, including: identity verification and KYC providers; payment processors; AML screening providers; game providers; affiliate partners where applicable; and fraud prevention networks.

3.1 We use your personal information for the following purposes: to create and manage your account and provide access to our services; to verify your identity, age, and eligibility in line with our KYC obligations; to process deposits, withdrawals, and all financial transactions; to detect, prevent, and investigate fraud, money laundering, and prohibited activities; to comply with our legal and regulatory obligations under Anjouan gaming law and applicable AML/CFT regulations; to monitor gameplay and account activity for integrity, responsible gambling, and security purposes; to send you transactional communications including account updates, deposit receipts, and verification requests; to send you marketing communications where you have consented to receive them; to conduct analytics and improve platform performance using aggregated data via Google Analytics; to make automated decisions in fraud detection, risk scoring, and responsible gambling monitoring; and to resolve disputes and enforce our Terms & Conditions.

5.1 Subject to applicable law, you have the following rights over your personal data: the right of access: you may request a copy of the personal data we hold about you; the right to rectification: you may ask us to correct inaccurate or incomplete data; the right to erasure: you may request deletion of your data where it is no longer necessary for the purpose for which it was collected; the right to restriction: you may ask us to pause processing of your data in certain circumstances; the right to object: you may object to processing based on legitimate interests, including direct marketing; the right to data portability: you may request a copy of data you provided to us in a structured, machine-readable format; and rights related to automated decision-making, as described in Section 8.

5.2 To exercise any of these rights, contact our support team via live chat or email. We may require proof of identity to protect your account. We will respond within 30 days. In some cases, legal or regulatory obligations may prevent us from fulfilling a request in full; we will explain this where it applies.

6.1 We do not sell your personal data to third parties. We may share it with the following categories of recipients, strictly as necessary: KYC and identity verification providers; payment processors and financial institutions; game providers for game integrity verification and dispute resolution; AML and sanctions screening services; fraud prevention and risk intelligence networks; regulatory and law enforcement bodies where required by law or court order; professional advisers including lawyers and auditors, under confidentiality obligations; and third-party technology and hosting providers who process data on our behalf under data processing agreements.

6.2 Where we share data with organisations involved in responsible gambling research or addiction prevention, we do so only in anonymised or aggregated form that cannot be used to identify you.

7.1 Some of our service providers and technology partners operate outside the Union of Comoros. Where your data is transferred internationally, we take steps to ensure it is protected to an adequate standard, including through data processing agreements incorporating standard contractual clauses, transfers to countries recognised as providing adequate data protection, and binding corporate rules where applicable.

7.2 If you would like more information about the specific safeguards applied to any international transfer, please contact our support team.

8.1 We use automated processing in the following contexts: fraud detection: automated systems score account and transaction activity for fraud risk signals, and high-risk scores may trigger manual review, account restriction, or payment holds; AML and sanctions screening: automated tools screen your identity and transactions against sanctions lists, politically exposed person databases, and adverse media sources; and responsible gambling monitoring: automated systems flag unusual patterns of play or deposit behaviour that may indicate problem gambling, prompting internal review and possible outreach from our team.

8.2 Where an automated decision produces a significant effect on you, such as an account restriction or payment hold, you have the right to request human review of that decision. Please contact our support team to do so.

9.1 We retain your personal data for as long as is necessary to fulfil the purposes described in this policy, including: for the duration of your active account and for a minimum of five (5) years following account closure, in accordance with AML/CFT regulations and our gaming licence obligations; for the period required by applicable tax, financial, or gambling law in the relevant jurisdiction; and for as long as necessary to resolve disputes, enforce our terms, or respond to legal proceedings.

9.2 After the applicable retention period, we securely delete or anonymise your data. Anonymised data may be retained indefinitely for statistical and analytical purposes.

10.1 We take the security of your personal data seriously. Our safeguards include: all data in transit is encrypted using TLS 1.2 or higher with 256-bit encryption; data at rest is stored on secured, access-controlled servers; internal access to personal data is restricted on a need-to-know basis; our systems are monitored continuously for unauthorised access attempts; and we conduct regular security reviews and penetration testing.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulatory authority without undue delay, in accordance with our legal obligations.

11.1 With your consent, we may send you promotional emails, SMS messages, push notifications, or phone calls about our offers, games, and promotions. You can withdraw this consent at any time by using the unsubscribe link in any marketing email, adjusting your communication preferences in your account settings, or contacting our support team directly.

11.2 Withdrawing marketing consent does not affect our ability to send you essential transactional communications about your account.

12.1 Our services are not directed at or intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If we discover that personal data has been collected from a minor, we will delete it promptly and close the associated account. If you believe a minor has registered on our platform, please contact us immediately.

13.1 Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal data.

14.1 We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on the platform or by email to your registered address. The updated policy will be published with a revised effective date. Continued use of the platform following the effective date constitutes acceptance of the revised policy.