Privacy Policy

1. Who We Are

Onyx Gaming Ltd operates the online casino platform available at https://onyx-casino-uk.com/ (the “Platform”). We are registered and based at The Coach House, Headgate, Colchester, United Kingdom, and we operate under casino licence number 64666.

For the purposes of UK data protection legislation, Onyx Gaming Ltd is the data controller in respect of any personal information you provide when using our Platform, contacting our support team, or otherwise engaging with our services.

This Privacy Policy explains how we collect, use, store, and share your personal data, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have questions about anything in this document or want to exercise any of your rights, please contact us at [email protected] or by post to the address above.

2. Personal Data We Collect

2.1 Information You Give Us Directly

When you create an account, deposit funds, request a withdrawal, contact our support team, or interact with any feature of the Platform, you may provide us with personal data including:

• Full name and date of birth
• Postal address and country of residence
• Email address and telephone number
• Payment details, including card numbers (last four digits only), e-wallet identifiers, and cryptocurrency wallet addresses
• Government-issued identity documents submitted for age or identity verification (such as a passport, driving licence, or utility bill)
• Source of funds documentation where required for compliance purposes
• Communications you send to our customer support team via email or live chat

2.2 Information We Collect Automatically

When you use the Platform, certain technical data is collected automatically through cookies, server logs, and similar technologies, including:

• IP address and approximate geolocation derived from it
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and clickstream data
• Session identifiers and login timestamps
• Game activity logs, including wagers placed, game outcomes, and session duration

2.3 Information From Third Parties

We may receive personal data about you from third parties in the following circumstances:

• Identity verification and fraud prevention agencies, such as those used for Know Your Customer (KYC) checks
• Payment processors and banking partners processing your transactions
• Credit reference agencies where permitted by law
• Our responsible gambling partners and self-exclusion registers, including GamStop, to verify whether a voluntary self-exclusion is in place

3. Legal Basis for Processing Your Data

Under UK GDPR, we must have a valid legal basis for each type of processing we carry out. The grounds we rely on are as follows:

• Contract performance: Processing necessary to set up and manage your account, process deposits and withdrawals, and provide you with the gaming services you have signed up for.
• Legal obligation: Processing required to comply with our obligations under UK gambling law, anti-money laundering legislation, age verification requirements, and financial reporting rules.
• Legitimate interests: Processing carried out to detect fraud, improve the security of the Platform, conduct analytics, prevent misuse of accounts, and protect our business from unlawful activity, where those interests are not overridden by your rights.
• Consent: Where we send you direct marketing communications by email or SMS, and where we place non-essential cookies on your device. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Vital interests: In exceptional circumstances where processing is necessary to protect someone’s life.

4. How We Use Your Data

4.1 Operating the Platform

We use your personal data to create and maintain your account, process financial transactions, provide customer support, verify your identity and age, and deliver the gaming services available through the Platform.

4.2 Regulatory and Legal Compliance

Online gambling in the United Kingdom is subject to strict regulatory requirements. We process personal data as required to:

• Verify that all registered players are at least 18 years of age before allowing access to real-money gaming
• Conduct anti-money laundering checks and assess source of funds where thresholds are met
• Maintain records required by our operating licence, including transaction histories and player account data
• Respond to requests from the Gambling Commission, law enforcement agencies, financial regulators, or courts
• Apply any self-exclusion or cooling-off period you have requested, including through national self-exclusion schemes such as GamStop

4.3 Responsible Gambling

We are committed to promoting safe gambling practices and take our duty of care to players seriously. Your data is used to:

• Monitor patterns of play that may indicate problem gambling behaviour
• Apply deposit limits, session limits, or account restrictions that you have set or that we consider necessary
• Contact you with responsible gambling information or direct you towards support services where appropriate
• Conduct affordability assessments in line with guidance from the Gambling Commission

4.4 Fraud Prevention and Security

We use automated and manual processes to detect unusual account activity, prevent unauthorised access, investigate suspected fraud, and protect the integrity of our games and payment systems.

4.5 Marketing

Where you have given your consent, we may send you promotional communications about bonuses, new games, and other Platform features by email or SMS. You can opt out at any time by clicking the unsubscribe link in any marketing email, texting STOP in response to an SMS, or by updating your preferences in your account settings.

We do not sell your personal data to third parties for their own marketing purposes.

4.6 Platform Improvement and Analytics

We use aggregated and anonymised data, along with cookies and session analytics, to understand how players use the Platform, identify technical issues, test new features, and improve the overall user experience.

5. Cookies and Similar Technologies

We use cookies, web beacons, and similar technologies on the Platform. These fall into four categories:

• Strictly necessary cookies: Required for the Platform to function, including session management and security tokens. These cannot be turned off.
• Functional cookies: Used to remember your preferences, such as language settings and display options.
• Analytics cookies: Used to collect anonymised data about how you navigate the Platform, which helps us understand usage patterns and improve performance.
• Marketing cookies: Used to serve relevant promotional content and to measure the effectiveness of our campaigns.

You can control non-essential cookies via the cookie preference centre accessible on the Platform. For further details on how we use cookies, please read our Cookie Policy at https://onyx-casino-uk.com/cookie-policy/

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share it only in the circumstances described below, and only to the extent necessary for the stated purpose.

• Identity verification providers: We share identity documents and related personal data with regulated KYC and anti-money laundering service providers to verify your age and identity as required by law.
• Payment processors: Your financial data is shared with payment service providers, including those handling Visa, Mastercard, Apple Pay, Google Pay, and cryptocurrency transactions, to process deposits and withdrawals securely.
• Responsible gambling organisations: We share data with self-exclusion registers and support services, including GamStop, Gambling Therapy, and BeGambleAware, to fulfil our safer gambling obligations.
• Fraud and security services: We use third-party fraud detection tools and cybersecurity providers who process data on our behalf under strict contractual controls.
• Regulatory and legal authorities: We disclose data to the UK Gambling Commission, Her Majesty’s Revenue and Customs, law enforcement, or any court where required by applicable law or legal process.
• IT and hosting providers: Providers who host and maintain our infrastructure process data on our behalf as data processors, bound by data processing agreements that comply with UK GDPR requirements.

All third parties who process your data on our behalf are required to maintain appropriate security measures and to use your data only for the purposes we specify.

7. International Data Transfers

Some of our third-party service providers operate outside the United Kingdom. Where we transfer personal data to countries that do not provide a level of data protection equivalent to that in the UK, we put in place appropriate safeguards, which may include:

• Standard contractual clauses approved or recognised for use under UK data protection law
• An adequacy decision made by the UK Secretary of State or the Information Commissioner’s Office in relation to the destination country
• Binding corporate rules or another recognised transfer mechanism

You may request details of the specific safeguards applied to any international transfer by contacting us at [email protected].

8. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law or regulation.

• Account and transaction records are retained for a minimum of five years from the date of the last transaction, in line with anti-money laundering legislation.
• Identity verification documents are retained for five years following the closure of your account or the last transaction, whichever is later.
• Responsible gambling records, including details of any self-exclusion, deposit limits, or interventions, are retained for a minimum of five years.
• Customer support communications are retained for three years from the date of the conversation.
• Marketing preferences and consent records are kept for as long as you hold an account with us and for a reasonable period after account closure, to demonstrate compliance.
• Server logs and technical data are retained for a period of up to 12 months, except where longer retention is required for security investigations.

At the end of the applicable retention period, data is securely deleted or anonymised.

9. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights in relation to the personal data we hold about you:

• Right of access: You may request a copy of the personal data we hold about you (commonly known as a Subject Access Request). We will respond within one calendar month.
• Right to rectification: If any data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it.
• Right to erasure: You may ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. Note that we may be required to retain certain data by law, which would limit this right.
• Right to restriction: You may ask us to restrict processing of your data in certain circumstances, such as whilst an accuracy dispute is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on our legitimate interests, including profiling. You also have the right to object to the processing of your data for direct marketing purposes at any time.
• Rights related to automated decision-making: We do not make solely automated decisions that produce significant legal effects on you. Where automated tools are used in responsible gambling assessments or fraud detection, human review is applied before any consequential action is taken.

To exercise any of these rights, please send your request to [email protected] or write to Onyx Gaming Ltd, The Coach House, Headgate, Colchester, United Kingdom. We will respond within one calendar month. For complex or multiple requests, we may extend this period by a further two months and will inform you if this is the case.

We will not charge a fee for handling a rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative charge may apply.

10. How We Protect Your Data

We implement a range of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. These include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and our servers
• Encryption of sensitive stored data, including payment details and identity documents
• Strict internal access controls, so that only authorised staff can access personal data, and only to the extent necessary for their role
• Regular penetration testing and security audits of our systems
• Staff training on data protection obligations and information security practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will notify you directly where required.

11. Age Verification and Under-18s

Our Platform is strictly for adults aged 18 and over. We carry out age verification checks before any player is permitted to access real-money gaming, in compliance with our licence conditions and the requirements of the Gambling Commission.

We do not knowingly collect or process the personal data of anyone under the age of 18. If we become aware that we hold data relating to an individual who was under 18 at the time of registration, we will take immediate steps to close the account and securely delete the relevant data.

If you have reason to believe that a minor has registered on the Platform, please contact us immediately at [email protected].

12. Third-Party Websites

The Platform may contain links to third-party websites, including responsible gambling resources such as BeGambleAware at https://www.begambleaware.org/ and Gambling Therapy at https://www.gamblingtherapy.org/. These sites operate under their own privacy policies, and we have no responsibility or control over how they collect or use your data. We recommend that you review the privacy policy of any external website you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. When we make changes, we will publish the revised version on this page. Where changes are material, we will notify you by email or by displaying a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the Platform following any update constitutes your acknowledgement of the revised policy. If you do not agree with the updated terms, you should close your account and stop using the Platform.

14. How to Complain

If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the supervisory authority for data protection in the United Kingdom.

You can contact the ICO online at https://ico.org.uk/make-a-complaint/, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, and we encourage you to contact us in the first instance at [email protected].

15. Contact Us

For all privacy-related enquiries, requests to exercise your rights, or general questions about how we use your personal data, please use any of the following contact methods:

• Email: [email protected]
• Telephone: +447458159505
• Post: Onyx Gaming Ltd, The Coach House, Headgate, Colchester, United Kingdom

We aim to respond to all enquiries within five business days and to any formal rights request within the statutory period of one calendar month.