Last updated: April 2026. Applies to all registered customers and visitors of the Monopoly platform operating under UKGC supervision since 2010.

Monopoly Privacy Policy - GDPR, UKGC Data Protection and Player Rights

Monopoly Privacy Policy Overview

Monopoly safeguards every £10 deposit, every £20 withdrawal and every personal record under the supervision of the UK Gambling Commission (UKGC), the UK Information Commissioner's Office (ICO) and the EU/UK GDPR. The platform has been licensed since 2010 and is operated by Gamesys Operations Limited, a Bally's Corporation subsidiary, which acts as the data controller. Registration requires 18+ identity confirmation, full Know Your Customer (KYC) documentation and consent to responsible gambling monitoring before the welcome offer of 30 free spins can be released. Customers from NZ$10 equivalent micro-deposits to high-stakes accounts receive identical legal protection under the UK Data Protection Act 2018 (DPA 2018).

This Monopoly privacy policy explains the legal basis for every processing activity, the lifecycle of each personal record, the encryption applied during transit, the 7-year retention rule mandated by UKGC and HMRC, and the rights every player can exercise under GDPR Articles 15 to 22. Monopoly refuses to sell personal data, refuses to transfer information outside EU/UK data centres without adequacy safeguards, and refuses to onboard any user under 18 years of age. Monopoly integrates the privacy framework with responsible gambling tools - deposit limits, reality checks and self-exclusion - so that data processing always supports player welfare rather than commercial pressure.

Data We Collect from NZ and UK Players

Monopoly collects only the categories of personal data necessary to operate a UKGC-licensed gambling account, to honour £10 minimum deposits, to release £20 withdrawals and to enforce 18+ verification. Each data category is logged inside ISO 27001-aligned systems housed in EU/UK data centres, encrypted at rest with AES-256 and in transit with SSL 256-bit protocols. The collection pipeline activates the moment a NZ or UK player begins registration on the Monopoly website and continues throughout the customer lifecycle.

Categories of Personal Data Processed by Monopoly

Data Category	Examples	Source	Mandatory Under UKGC?
Identity	Full name, date of birth, government ID, residential address	Registration form, KYC upload	Yes - 18+ and AML
Financial	Card number (tokenised), e-wallet ID, deposit and withdrawal log from £10 upward	Payment processor	Yes - HMRC and AML
Behavioural	Game play, session length, stake size, bonus claim history	Platform telemetry	Yes - responsible gambling
Technical	IP address, device fingerprint, browser, cookie identifiers	Web servers, SDKs	Yes - fraud prevention
Communications	Live chat transcripts, support emails, telephone recordings	Support channels	Yes - dispute resolution

Why Monopoly Verifies New Zealand Customers Identically

• The platform sets the uKGC parity at Every NZ-facing account receives the same UK-grade verification.
• AML obligation: Source-of-funds checks for cumulative deposits beyond £2,000.
• Age assurance: Mandatory 18+ proof before any 30 free spins release.
• The platform sets the fraud control at Device profiling cross-referenced with risk databases.
• The platform sets the responsible gambling at Behavioural triggers feed UKGC-required interventions.
• Currency conversion: NZ$10 micro-deposits processed at the daily FX rate before £ ledger entry.

Monopoly segregates KYC documentation from gameplay telemetry to comply with the GDPR principle of data minimisation, and every uploaded passport, driving licence or proof of address is stored in an encrypted bucket with restricted access. The Monopoly fraud team retains the right to request additional verification at any time during the customer lifecycle - particularly when behavioural anomalies suggest potential account takeover, third-party funding or violation of the UKGC 18+ threshold. All such requests are documented inside the legitimate interest register published by Gamesys Operations Limited.

How We Use Your Personal Data

Monopoly uses the personal data of UKGC-licensed players to deliver the gambling contract, to release each £10 bonus deposit, to authorise every £20 withdrawal request and to remain compliant with the UKGC, HMRC, ICO and the National Crime Agency. No processing activity occurs outside the lawful basis declared in this Monopoly privacy policy, and no marketing message leaves the platform without recorded consent.

Core Processing Purposes Explained

1. Account creation and KYC: Verifying age 18+, identity and residency before activation.
2. Financial transactions: Settling deposits from £10 and withdrawals from £20 through tier-1 payment processors.
3. The platform sets the responsible gambling monitoring at Enforcing UKGC's GAMSTOP, deposit caps, time alerts and self-exclusion.
4. Marketing with consent: Delivering tailored offers - including the 30 free spins welcome - only to opted-in customers.
5. The platform sets the fraud prevention at Comparing IP, device and behavioural fingerprints against industry blacklists.
6. The platform sets the legal compliance at Reporting suspicious activity to the UKGC and the National Crime Agency.

• Service contract delivery - GDPR Article 6(1)(b).
• Legal obligation - GDPR Article 6(1)(c) covering UKGC, AML and HMRC duties.
• Legitimate interest - GDPR Article 6(1)(f) for fraud and platform integrity.
• Consent - GDPR Article 6(1)(a) for marketing and optional cookies.
• Vital interest - GDPR Article 6(1)(d) for safeguarding vulnerable customers.

Legal Basis Under GDPR and UK DPA 2018

Monopoly documents a lawful basis before any record - from a £10 deposit ticket to a £20 withdrawal log - is created on the UKGC-regulated platform. The legal architecture combines the EU GDPR, the UK GDPR and the UK Data Protection Act 2018 (DPA 2018), with secondary references to the Gambling Act 2005, the Money Laundering Regulations 2017 and HMRC tax legislation. Every Monopoly employee with data access is bound by confidentiality clauses and audited annually.

Mapping Lawful Bases to Monopoly Activities

Activity	Lawful Basis	Statute / Regulator	Retention
Identity verification (18+, KYC)	Legal obligation	UKGC, AML 2017	7 years after closure
Deposit log (£10+)	Contract performance	UK GDPR 6(1)(b)	7 years
Withdrawal log (£20+)	Contract performance	UK GDPR 6(1)(b)	7 years
Responsible gambling alerts	Legal obligation	UKGC LCCP	Indefinite under UKGC LCCP 3.4
Marketing emails (30 free spins)	Consent	PECR 2003	Until consent withdrawn
Cookie analytics	Consent	PECR 2003, ICO guidance	Maximum 13 months

Sharing Data with UKGC and Third Parties

Monopoly shares data only when the UKGC, HMRC, payment processors or accredited service providers require disclosure to maintain the gambling licence, secure each £10 deposit and authorise each £20 payout. Every third-party relationship is governed by a written Data Processing Agreement compliant with GDPR Article 28 and the UK DPA 2018. Monopoly never sells personal data, never trades behavioural profiles and never grants advertising networks unrestricted access to player records.

Recipients of Monopoly Personal Data

• The platform sets the uK Gambling Commission at Suspicious activity reports, audit data, problem-gambling cases - statutory under UKGC LCCP.
• HMRC and tax authorities: Transaction logs related to taxable winnings retained for 7 years.
• Payment processors: Visa, Mastercard, PayPal and Worldpay process card data tokenised inside SSL 256-bit tunnels.
• The platform sets the kYC vendors at Onfido, Jumio and GBG verify ID documents under ISO 27001 controls.
• The platform sets the marketing partners at Email service providers act only on opted-in consent records.
• The platform sets the law enforcement at National Crime Agency, Action Fraud and police forces under court order or AML disclosure.
• The platform sets the auditors at eCOGRA, GLI and KPMG inspect Monopoly controls annually.

1. The Monopoly legal team reviews every disclosure request.
2. The data minimisation principle limits transfer to the strictly necessary fields.
3. The transfer is logged, encrypted and reported in the annual UKGC compliance pack.

Cookies and Tracking Technologies

Monopoly deploys cookies to maintain authenticated sessions for £10+ deposits, to detect fraud on every £20 withdrawal and to remember responsible gambling preferences such as deposit limits, reality checks and self-exclusion windows. The cookie banner aligns with PECR 2003, ICO guidance and the EDPB cookie directives, and the consent record is timestamped, auditable and synchronised with the player's UKGC-regulated account.

Cookie Categories on Monopoly

• Essential cookies: Session token, anti-CSRF, load balancer routing, payment authentication for deposits from £10.
• The platform sets the performance cookies at Aggregated traffic analytics, A/B testing, slot performance dashboards.
• Marketing cookies: Conversion attribution for the 30 free spins welcome and remarketing audiences - consent only.
• The platform sets the preference cookies at Language, currency (GBP / NZ$10 conversion), accessibility and UI theme.
• The platform sets the responsible gambling cookies at Storing reality-check intervals and self-exclusion countdowns.

1. Open the Monopoly cookie preference centre at any time.
2. Toggle marketing or performance categories independently.
3. Save the preference - the timestamp is bound to the account ID.
4. Disabling essential cookies suspends play and any pending £20 withdrawal until reactivated.

Data Security and SSL Encryption

Monopoly enforces SSL 256-bit encryption on every byte transmitted between the player and the UKGC-licensed servers, whether the customer deposits £10, requests a £20 withdrawal or simply browses the games library. The security framework follows ISO 27001, PCI DSS Level 1, eCOGRA testing and the UKGC's technical standards for online casinos.

Layered Security Controls

Layer	Control	Standard
Transport	SSL 256-bit TLS 1.3 with HSTS	NIST SP 800-52
Storage	AES-256 at-rest encryption, hardware security modules	FIPS 140-2
Access	Multi-factor authentication and least privilege	ISO 27001 A.9
Detection	SIEM, behavioural analytics, 24/7 SOC	NCSC CAF
Testing	eCOGRA RNG audit, penetration tests twice yearly	UKGC RTS
Recovery	EU/UK redundant data centres, RPO 15 minutes	ISO 22301

• The platform sets the tokenisation at Card PAN never stored - tokens map to processor vaults.
• Segmentation: KYC documents segregated from gameplay databases.
• Backups: Encrypted snapshots replicated across two EU/UK regions.
• Incident response: ICO notification within 72 hours of any breach.

Your Rights Under GDPR

Monopoly guarantees every UKGC-registered player the full GDPR rights catalogue, allowing access, correction or erasure of any record - from a £10 deposit memo to a £20 withdrawal trail - subject to legal retention duties. Requests are handled by the Data Protection Officer within 30 days at no charge, in line with UK GDPR Article 12 and DPA 2018 Section 45.

Player Rights and How to Exercise Them

• Right of access: Receive a copy of every personal record Monopoly holds.
• Right of rectification: Correct inaccurate identity, contact or financial data.
• Right of erasure: Delete data unless retained for UKGC, AML or HMRC duty (7 years).
• Right of portability: Receive structured CSV/JSON exports of contractual data.
• Right to object: Stop direct marketing or legitimate interest processing immediately.
• Right to restrict: Pause processing while a dispute is investigated.
• Right against automated decisions: Request human review for any algorithmic restriction.
• Right to complain: Lodge a complaint with the ICO at ico.org.uk.

1. Email the Monopoly Data Protection Officer with the request type.
2. Confirm identity through the existing KYC channel - no new documents required.
3. Receive acknowledgement within 72 hours and the formal response inside 30 days.
4. Escalate to the ICO if Monopoly Casino fails to resolve the matter.

Data Retention and Storage Periods

Monopoly Casino retains personal data only for the period required by the UKGC, HMRC and the UK DPA 2018 - typically 7 years after account closure for financial logs, £10 deposit history and £20 withdrawal evidence. Marketing consents are retained until withdrawn, while responsible gambling exclusions are kept indefinitely under UKGC LCCP 3.4 to protect vulnerable customers.

Retention Matrix

Record Type	Retention	Trigger to Delete	Authority
Identity / KYC	7 years	End of UKGC retention window	UKGC LCCP
Deposits / withdrawals	7 years	End of HMRC archive	HMRC, AML 2017
Behavioural and gameplay	5 years	End of UKGC compliance review	UKGC RTS
Marketing preferences	Until withdrawn	Consent revocation	PECR 2003
Self-exclusion record	Indefinite	Never deleted	UKGC LCCP 3.4
Cookie analytics	13 months	Cookie expiry	ICO guidance

International Transfers and Cross-Border Compliance

Monopoly Casino primarily stores data inside EU/UK data centres certified under GDPR adequacy, while every £10 deposit and every £20 withdrawal is processed through UKGC-approved acquirers. When transfers leave the UK or EEA - for example to a New Zealand customer's local payment partner - Monopoly Casino relies on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses and supplementary technical measures.

Cross-Border Safeguards

• UK IDTA / SCCs: Signed before any transfer to a third country.
• Transfer Risk Assessment: Documented per ICO guidance.
• Encryption in transit: SSL 256-bit end-to-end with certificate pinning.
• Vendor due diligence: ISO 27001, SOC 2 Type II evidence required.
• Sub-processor register: Public list of all sub-processors with locations.
• NZ specific: Privacy Act 2020 alignment for any New Zealand resident, with NZ$10 minimum deposit accounts treated identically to UK accounts.

1. Identify the destination country and check for an adequacy decision.
2. Apply the UK IDTA when the country lacks adequacy.
3. Conduct the Transfer Risk Assessment and add supplementary measures.
4. Monitor the destination's legal climate continuously.

Frequently Asked Questions About Monopoly Casino Privacy

Monopoly Casino addresses the most common privacy enquiries received from UKGC-licensed customers, including £10 minimum deposit holders, NZ$10 micro-stake players and high-volume £20+ withdrawers. Each answer references the relevant clause of GDPR, the DPA 2018 or the UKGC LCCP so that the legal basis stays transparent. Responsible gambling, 18+ verification and consent control are reaffirmed throughout.

Does Monopoly Casino sell my personal data to advertisers?

No. Monopoly Casino never sells data and never shares it for unrelated advertising. Marketing partners receive only opted-in consent records and operate strictly under GDPR Article 28 contracts. Every advertising audience is built from hashed identifiers, never from raw email addresses, and every campaign is logged inside the UKGC compliance archive for the statutory 7 years.

How quickly does Monopoly Casino respond to a GDPR access request?

Monopoly Casino acknowledges every Subject Access Request within 72 hours and delivers the full export inside 30 days, including £10 deposit history, £20 withdrawal logs and behavioural data. The export is delivered through an encrypted portal with two-factor authentication, and the Monopoly Casino Data Protection Officer is available for follow-up clarification.

Where are my data stored when I deposit NZ$10 from New Zealand?

The funds clear through UKGC-authorised processors and the personal record is stored inside EU/UK data centres protected by SSL 256-bit encryption. NZ$10 deposits are converted to GBP at the daily FX rate before the ledger entry, and the record retention period mirrors the standard UK retention of 7 years for AML and HMRC purposes.

How does the privacy policy support responsible gambling?

Monopoly Casino feeds behavioural data into UKGC-mandated responsible gambling tools - deposit caps, reality checks, GAMSTOP integration and self-exclusion - so that 18+ customers benefit from real-time interventions without compromising data minimisation. The processing is recorded as a legal obligation under UK GDPR Article 6(1)(c) and is therefore exempt from the right of erasure during an active intervention.

Can I withdraw consent for marketing once I have claimed the 30 free spins?

Yes. Players can revoke consent through the Monopoly Casino account preferences page or by clicking the unsubscribe link in any marketing email. The 30 free spins welcome is contractual and remains valid even after consent is withdrawn, while no further marketing email is sent. Operational notices - statements, KYC reminders, responsible gambling alerts - continue under the legitimate interest basis.

What happens to my data if Monopoly Casino changes ownership?

Any corporate restructure within the Bally's group keeps the data inside the same UKGC-licensed framework. Players are notified at least 30 days in advance and may exercise the right to object before the transfer concludes. The acquiring entity inherits the existing GDPR retention schedule, the 7-year AML archive and the responsible gambling exclusion register without reset.

How does Monopoly Casino secure my payment card from £10 deposits onward?

Card numbers never reach the Monopoly Casino servers in plain form. Payments are tokenised at the PCI DSS Level 1 acquirer, transmitted through SSL 256-bit tunnels and stored as opaque tokens inside the UKGC-supervised vault. Every £10 deposit and every £20 withdrawal is matched to a unique token reference auditable by the UKGC and HMRC.

Monopoly Casino reviews this privacy policy every 12 months and after any material change to UKGC, ICO or GDPR guidance. Version April 2026 supersedes all previous Monopoly Casino privacy notices. Players who require additional explanations may contact [email protected] or write to the Data Protection Officer at the registered Gamesys Operations Limited address. Monopoly Casino remains committed to 18+ only operations, responsible gambling first principles and uncompromising data protection for every £10 deposit, every £20 withdrawal and every NZ$10 equivalent stake placed on the platform.