Privacy Policy

1. Introduction

Crazy Tower Casino ("we", "us", "our", or "the Platform"), accessible at crazytowercasino.games, is committed to safeguarding the privacy and personal information of every individual who visits, registers with, or otherwise interacts with our online gaming platform ("Users", "you", or "your").

This Privacy Policy ("Policy") is issued in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) set out in Schedule 1 of that Act. It has also been informed by the Privacy and Other Legislation Amendment Act 2024 (Cth), which introduced the most significant reforms to Australian privacy law in recent years, including stronger enforcement powers, a statutory tort for serious privacy invasions, and new obligations around automated decision-making.

By registering an account, making a deposit, placing a wager, or otherwise using any feature of Crazy Tower Casino, you confirm that you have read, understood, and agreed to the practices described in this Policy. If you do not agree with any part of this Policy, please discontinue use of our Platform immediately.

1.1. Scope

This Policy applies to all personal information collected through:

• The Crazy Tower Casino website at crazytowercasino.games and any associated subdomains;
• Any mobile application or progressive web app we make available;
• Email, live chat, telephone, or any other communication you initiate with our support team;
• Third-party integrations, payment processors, and identity verification services that interact with our Platform on your behalf.

1.2. Definitions

For the purposes of this Policy, the following key terms apply:

• Personal Information — information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and whether recorded in a material form or not (as defined in the Privacy Act 1988).
• Sensitive Information — a subset of personal information including health information, financial details, identity documents, and similar categories that attract a higher level of protection under the APPs.
• Processing — any operation performed on personal information, including collection, storage, use, disclosure, correction, and destruction.
• Third Party — any natural or legal person, public authority, or body other than you and Crazy Tower Casino.

2. Data We Collect

We collect personal information only to the extent that it is reasonably necessary for our legitimate business functions, our legal and compliance obligations, and the delivery of a safe and enjoyable gaming experience. The categories of data we collect are outlined below.

2.1. Information You Provide Directly

• Account Registration Data: Full legal name, date of birth, residential address (including suburb, state, postcode), email address, and phone number.
• Identity Verification Documents: Copies of government-issued photo identification (passport, driver's licence), proof of address (utility bill, bank statement), and any additional documents required to satisfy our Know Your Customer (KYC) and Applicable Customer Identification Procedures (ACIP) obligations.
• Financial Information: Payment method details (card numbers are tokenised and not stored on our servers), bank account identifiers, PayID, transaction history, and deposit/withdrawal records.
• Communications Data: Records of all correspondence with our customer support team, including live chat transcripts, email exchanges, and any attachments you submit.
• Responsible Gaming Preferences: Self-imposed deposit limits, session time limits, cooling-off periods, self-exclusion requests, and any information you provide in connection with our Responsible Gaming tools.

2.2. Information Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, screen resolution, device identifiers, and time zone settings.
• Usage & Behavioural Data: Pages visited, features accessed, game session duration, wagering patterns, click paths, and navigation history within the Platform.
• Cookies & Tracking Technologies: Data collected via cookies, pixel tags, web beacons, and local storage (see Section 6 for full details).
• Geolocation Data: General geographic location derived from your IP address or, where you grant explicit permission, precise location from your device's GPS capabilities.
• Log Files: Server logs recording access times, error reports, and system events associated with your account activity.

2.3. Information Received from Third Parties

• Identity Verification Providers: Results of electronic identity checks, document authenticity assessments, and sanctions/PEP (Politically Exposed Person) screening outputs.
• Payment Processors: Transaction status updates, chargeback notifications, and fraud risk indicators.
• Fraud Prevention & AML Services: Risk scores, device fingerprinting results, and anti-money laundering screening data.
• BetStop (National Self-Exclusion Register): Information confirming whether a prospective or existing user is registered on Australia's national self-exclusion register, as required under applicable regulations.

3. How We Use Your Data

We use the personal information we hold about you for specific, lawful purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected, unless we have obtained your additional consent or are required to do so by law.

3.1. Direct Marketing

We may send you promotional communications about our products, services, and offers via email or SMS where you have consented to receiving such communications, or where we are otherwise entitled to do so under applicable law. Each marketing communication will include a clear and functional opt-out mechanism. You may withdraw your consent to marketing at any time by clicking the unsubscribe link in any email, adjusting your preferences in your account settings, or contacting us at privacy@crazytowercasino.games.

4. Legal Bases for Processing

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, we are required to have a legitimate basis for collecting, using, and disclosing your personal information. The legal bases upon which we rely are set out below.

4.1. Contractual Necessity

The majority of our processing activities are necessary for the performance of the contract between you and Crazy Tower Casino, as set out in our Terms and Conditions. This includes creating your account, processing payments, providing access to games, and managing your winnings.

4.2. Legal Obligation

We process certain categories of personal information because we are required to do so by law. This includes compliance with:

• The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) and associated AUSTRAC reporting obligations;
• The Interactive Gambling Act 2001 (Cth) and its 2024/2026 amendments, including ACIP obligations and BetStop register checks;
• Tax and financial record-keeping requirements under applicable Australian legislation;
• Responses to valid court orders, law enforcement requests, and regulatory investigations.

4.3. Legitimate Interests

We may process your personal information where it is necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights. Such legitimate interests include: preventing fraud and cheating, maintaining Platform security, conducting analytics to improve our services, and defending legal claims.

4.4. Consent

Where we rely on consent as a legal basis (particularly for optional marketing communications, certain cookie categories, and the processing of sensitive information beyond what is strictly required), that consent will be:

• Voluntary — freely given without coercion;
• Informed — based on a clear explanation of what you are consenting to;
• Specific — relating to a defined purpose;
• Current — not assumed from past interactions;
• Unambiguous — demonstrated by a clear affirmative act.

You may withdraw consent at any time, and withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information to unaffiliated third parties for their own marketing purposes. We may, however, share your information with carefully selected categories of third parties where necessary for the purposes described in this Policy.

5.1. Categories of Third-Party Recipients

5.2. Data Processing Agreements

All third-party service providers who process personal information on our behalf are required to execute written data processing agreements that impose obligations equivalent to those under the Australian Privacy Principles. We take reasonable steps to ensure that our service providers handle your information in accordance with this Policy and applicable law.

5.3. Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business assets, your personal information may be transferred to the successor entity. We will provide reasonable notice of any such transfer and ensure that the recipient is bound by privacy obligations no less protective than those contained in this Policy.

6. Cookies & Tracking Technologies

Crazy Tower Casino uses cookies and similar tracking technologies to ensure the Platform functions correctly, to improve your user experience, to support security measures, and — with your consent — to deliver personalised content and analyse Platform performance.

6.1. What Are Cookies?

Cookies are small text files stored on your device by your browser when you visit a website. They allow the website to remember information about your visit — such as your preferred language, login status, and session settings — making your next visit easier and the site more useful to you.

6.2. Types of Cookies We Use

6.3. Other Tracking Technologies

In addition to cookies, we may use:

• Web Beacons / Pixel Tags — Small transparent images embedded in emails or web pages to track whether communications have been opened and actions taken.
• Local Storage & Session Storage — Browser-based storage mechanisms used to preserve session state and user preferences without expiry constraints.
• Device Fingerprinting — Technical signals derived from your device configuration (browser, OS, fonts, screen parameters) used exclusively for fraud detection and security purposes.

6.4. Managing Your Cookie Preferences

You may manage non-essential cookie categories through our cookie consent interface, accessible from the cookie banner displayed on your first visit or via the Privacy Preferences link in the website footer. You may also configure your browser to block or delete cookies, but please note that doing so may impair the functionality of certain Platform features, including your ability to log in or maintain session state.

7. Data Security

We implement a comprehensive set of technical, organisational, and administrative security measures designed to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. These measures are reviewed and updated regularly to reflect the current threat landscape.

7.1. Technical Safeguards

• Transport Encryption: All data transmitted between your browser and our servers is protected using TLS 1.2 or higher (HTTPS). Look for the padlock symbol in your browser's address bar.
• Data Encryption at Rest: Sensitive personal information stored on our servers is encrypted using industry-standard AES-256 encryption.
• Payment Card Tokenisation: We do not store raw payment card numbers. Full card details are tokenised by our certified payment processors, who hold applicable PCI-DSS compliance certifications.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Firewalls & Intrusion Detection: Our infrastructure is protected by enterprise-grade firewalls and continuous intrusion detection and prevention systems.

7.2. Organisational Safeguards

• Regular staff training on data protection obligations and security best practices;
• Internal privacy and data governance policies binding all personnel who handle personal information;
• Mandatory background checks for staff with elevated access to sensitive data;
• Routine security audits, penetration testing, and vulnerability assessments conducted by independent third parties.

7.3. Data Breach Response

In the event of a data breach that is likely to result in serious harm to affected individuals, we will act in accordance with our obligations under the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. This includes:

• Conducting a prompt assessment of the breach;
• Notifying the Office of the Australian Information Commissioner (OAIC) as soon as practicable; and
• Notifying affected individuals in a timely manner, providing a description of the breach and recommended protective steps.

8. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. Our retention periods are guided by our legal and regulatory obligations and our legitimate business needs.

Upon the expiry of the applicable retention period, personal information is securely deleted or anonymised in accordance with Australian Privacy Principle 11.2. Where anonymisation is technically feasible, we may retain aggregated, non-identifiable data for analytical purposes for a longer period.

9. Your Rights

Under the Australian Privacy Principles and applicable Australian privacy law, you have a number of rights in respect of the personal information we hold about you. We are committed to honouring these rights promptly and transparently.

9.1. Right of Access (APP 12)

You have the right to request access to the personal information we hold about you. Upon a valid access request, we will provide you with a copy of the relevant information within a reasonable timeframe (generally 30 days), free of charge unless the request is unusually complex or resource-intensive.

9.2. Right to Correction (APP 13)

If you believe that personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct the information within 30 days of your request and will notify any relevant third parties to whom we previously disclosed the incorrect data.

9.3. Right to Opt Out of Direct Marketing (APP 7)

You have the right to opt out of receiving direct marketing communications from us at any time. You may do so by using the unsubscribe mechanism included in each marketing communication, updating your preferences in your account settings, or contacting our support team.

9.4. Right to Complain

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, you have the right to lodge a complaint. Please contact us in the first instance using the details in Section 13. We will investigate your complaint and respond within 30 days.

If you are dissatisfied with our response, or if we fail to respond within a reasonable time, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

9.5. Anonymity & Pseudonymity (APP 2)

Where lawful and practicable, we offer you the option to interact with us anonymously or using a pseudonym. However, given our regulatory obligations to verify identity before allowing access to gaming services (ACIP requirements), we are generally required to collect your real identity before you can open a player account or place any wager.

9.6. How to Exercise Your Rights

To exercise any of the rights described in this section, please submit a written request to our Privacy Officer at privacy@crazytowercasino.games. We may ask you to verify your identity before processing your request in order to protect the security of your account.

10. International Data Transfers

In the course of providing our services, certain personal information may be transferred to, stored in, or processed by servers or service providers located outside of Australia. Such cross-border disclosures may occur when we engage third-party service providers (including cloud hosting, payment processing, KYC verification, and game software providers) that operate from overseas locations.

10.1. Our Obligations Under APP 8

Australian Privacy Principle 8 requires that, before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient will handle the information in a manner consistent with the APPs. We meet this obligation through:

• Entering into written contractual agreements with overseas recipients that impose APP-equivalent obligations;
• Assessing the privacy framework of the recipient's country to determine whether it affords comparable protection to Australian law;
• Conducting due diligence on third-party security practices and data governance before engagement;
• Requiring overseas processors to report any data breaches involving Australian personal information to us without undue delay.

10.2. Accountability

Under section 16C of the Privacy Act 1988, we remain accountable for the handling of your personal information by overseas recipients to whom we have disclosed it, except where you have expressly consented to the transfer after we have informed you that APP 8 protections will not apply, or where an exception under the APPs applies. We do not seek to rely on such exceptions for routine transfers.

11. Minors

We do not knowingly collect personal information from individuals under the age of 18. As part of our mandatory Applicable Customer Identification Procedures (ACIP), all prospective players are required to verify their age and identity before being permitted to register an account, make a deposit, or engage in any real-money gaming activity.

If we become aware, or have reasonable grounds to suspect, that personal information has been submitted by or on behalf of a minor, we will:

• Immediately suspend the relevant account pending investigation;
• Delete the minor's personal information from our active systems as promptly as technically feasible;
• Reverse any transactions associated with the account; and
• Report the incident to the relevant regulatory authority where required by applicable law.

Parents and guardians who believe their child may have registered on our Platform or submitted personal information to us are urged to contact us immediately at support@crazytowercasino.games or privacy@crazytowercasino.games.

For further information about our age verification procedures and tools to prevent underage access, please review our Responsible Gaming Policy.

11.1. Problem Gambling Support Resources (Australia)

If you or someone you know is experiencing difficulties related to gambling, the following free, confidential support services are available to Australians:

12. Changes to This Policy

We reserve the right to update, amend, or replace this Privacy Policy at any time in order to reflect changes in our data processing practices, applicable law, regulatory guidance, or business operations. When we make material changes to this Policy, we will take reasonable steps to bring those changes to your attention.

12.1. Notification of Changes

Material amendments to this Policy will be communicated through one or more of the following methods:

• A prominent notice displayed on the Crazy Tower Casino homepage or login page;
• An email notification to your registered email address; or
• An in-platform notification presented upon your next login.

12.2. Version History

The current version number and effective date are displayed at the top of this document. All previous versions of this Policy are available upon request by contacting our Privacy Officer. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

12.3. Continued Use

Your continued use of the Crazy Tower Casino Platform following the notification of material changes to this Policy will constitute your acceptance of the revised terms. If you do not agree with the amended Policy, you must cease using our services and contact us to request account closure. Our Terms and Conditions contain further information about account closure procedures.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information by Crazy Tower Casino, please do not hesitate to contact us using the details below. We are committed to responding to all enquiries in a timely and transparent manner.

When contacting us regarding a privacy matter, please include:

• Your full name and registered email address;
• A clear description of your request or complaint;
• The specific sections of this Policy you are referencing, if applicable; and
• Any relevant supporting documentation.

We may need to verify your identity before processing any access, correction, or deletion request to ensure the security of your account.

13.1. Escalation to the OAIC

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC), which is the independent federal regulator responsible for enforcing the Privacy Act 1988:

• Website: www.oaic.gov.au
• Phone: 1300 363 992 (within Australia)
• Post: GPO Box 5218, Sydney NSW 2001