Privacy Policy

Last updated: April 2026

This Privacy Policy explains how CardVibez Club Social Casino (“we”, “us”, “our”) collects, uses, stores, and protects personal information when you use our website, apps, and related services (collectively, the “Services”). We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) as supplemented by the Data Protection Act 2018, and—where applicable—the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

By using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

We may collect the following categories of information, depending on how you interact with the Services:

1.1 Information you provide directly

Account and profile data: username, display name, email address, password or authentication credentials (stored in hashed form where applicable), date of birth or age confirmation, country or region, and preferences you set in your account.
Communications: messages you send to us (for example through support forms or email), including content and metadata needed to respond.
Payment-related information: if you purchase virtual currency or items, we or our payment processors may process transaction identifiers, billing country, and limited payment details as required to complete the transaction. We do not store full payment card numbers on our servers when a third-party processor tokenises card data.
Responsible gaming and verification: information you provide in connection with age checks, self-exclusion requests, or limits, where permitted by law.

1.2 Information collected automatically

Device and technical data: IP address, browser type and version, operating system, device identifiers, language settings, and approximate location derived from IP (e.g. country or region).
Usage data: pages viewed, features used, game sessions, timestamps, referral URLs, crash logs, and similar diagnostics to operate and improve the Services.
Cookies and similar technologies: as described in the “Cookies and Tracking” section below.

1.3 Information from third parties

We may receive information from authentication providers (if you sign in with a third-party account), analytics or advertising partners, payment processors, and fraud-prevention services, in accordance with their terms and this Policy.

2. How We Use Your Information

We use personal information for purposes including:

Providing, operating, and maintaining the Services, including virtual gameplay and social features.
Creating and managing your account, authenticating users, and enforcing our Terms of Service.
Processing purchases of virtual items and complying with tax, accounting, or legal obligations related to transactions.
Communicating with you about service updates, security alerts, and support requests.
Personalising content and experiences where you have consented or where we rely on legitimate interests.
Measuring usage, performing analytics, troubleshooting, and improving performance and security.
Detecting, preventing, and investigating fraud, abuse, and illegal activity.
Complying with legal obligations and responding to lawful requests from public authorities.
Where permitted, sending marketing communications (you may opt out as described below).

Our Services are for entertainment only. Virtual currency and items have no real-world monetary value and cannot be redeemed for cash.

3. Legal Basis for Processing (UK GDPR)

Where UK GDPR applies, we process personal data on one or more of the following legal bases:

Consent (Article 6(1)(a)): where you have given clear consent, for example for non-essential cookies, certain marketing communications, or optional features.
Performance of a contract (Article 6(1)(b)): processing necessary to provide the Services you request, including account management and fulfilment of virtual purchases.
Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate interests or those of a third party, such as securing our systems, analytics to improve the Services, and preventing fraud—balanced against your rights and freedoms.
Legal obligation (Article 6(1)(c)): where we must process data to comply with applicable law.
Vital interests (Article 6(1)(d)): rarely, where necessary to protect someone’s life.

Where we process special categories of personal data (if any), we will identify the applicable condition under Article 9 UK GDPR (for example explicit consent where required).

4. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. Factors we consider include the nature of the data, the potential risk of harm from unauthorised use or disclosure, whether we can achieve those purposes through other means, and applicable legal requirements.

Examples (non-exhaustive): account data is kept while your account is active and for a reasonable period afterwards to resolve disputes and enforce our terms; transaction records may be retained for a longer period where the law requires; marketing preferences and cookie logs are retained according to consent records and legal limits; logs may be retained for security monitoring on a rolling basis.

When retention is no longer necessary, we will delete or anonymise personal information in line with our internal policies.

5. Your Rights

5.1 Rights under UK GDPR (Articles 15–22)

If UK GDPR applies to our processing of your personal data, you may have the following rights, subject to conditions and exemptions in applicable law:

Article 15 — Right of access: request confirmation of whether we process your personal data and obtain a copy, together with certain details about the processing.
Article 16 — Right to rectification: request correction of inaccurate personal data and completion of incomplete data.
Article 17 — Right to erasure (“right to be forgotten”): request deletion of personal data where grounds apply (for example where processing is no longer necessary or you withdraw consent).
Article 18 — Right to restriction of processing: request that we limit processing in certain circumstances.
Article 19 — Notification obligation: where we rectify, erase, or restrict processing, we will inform recipients where required unless impossible or disproportionate.
Article 20 — Right to data portability: receive personal data you provided in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible, where processing is based on consent or contract and carried out by automated means.
Article 21 — Right to object: object to processing based on legitimate interests or for direct marketing (including profiling related to marketing). Where you object to marketing, we will stop that processing.
Article 22 — Automated individual decision-making, including profiling: you have rights not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects, subject to exceptions.

You also have the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You may lodge a complaint with a supervisory authority. In the UK, the Information Commissioner’s Office (ICO) can be contacted at ico.org.uk.

5.2 California residents (CCPA / CPRA)

If you are a California resident, you may have rights including:

Right to know / access: request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third-party disclosures, subject to verification and applicable exceptions.
Right to delete: request deletion of personal information we collected, subject to exceptions.
Right to correct: request correction of inaccurate personal information.
Right to opt out of “sale” or “sharing”: California law defines “sale” and “sharing” broadly (including certain advertising cookies). We do not sell personal information for monetary consideration in the conventional sense; where our use of cookies or similar technologies constitutes a “sale” or “sharing” under CCPA/CPRA, you may opt out via our cookie controls and browser signals such as the Global Privacy Control where we honour them.
Right to limit use of sensitive personal information: where applicable, to limit use to purposes permitted by law.
Non-discrimination: we will not discriminate against you for exercising CCPA/CPRA rights.

Authorized agents may submit requests on your behalf where permitted by law and with proper verification.

To exercise any of these rights, contact us using the details in “Contact Information” below. We may need to verify your identity before fulfilling requests.

6. Cookies and Tracking

We use cookies, pixels, local storage, and similar technologies to recognise your browser or device, remember preferences, analyse traffic, measure campaign effectiveness, and improve the Services.

Essential cookies are necessary for core functionality (for example security and session management). Non-essential cookies (such as analytics or marketing) are used only where allowed by law—typically after you provide consent where consent is required.

You can control cookies through your browser settings and, where available, our cookie banner. Blocking some cookies may affect how the Services work.

7. Third-Party Services

We may use third-party service providers for hosting, analytics, customer support, payment processing, advertising measurement, email delivery, and security. These providers process personal information on our instructions or as independent controllers as described in their policies, and only to the extent needed to perform their services.

Our Services may contain links to third-party websites or features. We are not responsible for the privacy practices of those third parties; please read their policies before providing information.

8. International Data Transfers

We may process and store personal information in the United Kingdom, the European Economic Area, the United States, and other countries where we or our providers operate. When we transfer personal data from the UK or EEA to countries not subject to an adequacy decision, we use appropriate safeguards where required by law, such as the UK International Data Transfer Agreement / Addendum, Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms.

You may contact us to request more information about transfers and safeguards.

9. Children’s Privacy (18+ Only)

The Services are not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have collected information from someone under 18, please contact us immediately and we will take steps to delete such information in accordance with applicable law.

10. Data Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures may include encryption in transit, access controls, staff training, and vendor assessments. No method of transmission over the Internet or electronic storage is completely secure; we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Where changes are material, we will provide additional notice as required by law (for example by email or a prominent notice on the Services). Your continued use of the Services after the effective date of changes constitutes acceptance of the updated Policy, where permitted by law.

12. Contact Information

For questions about this Privacy Policy, to exercise your privacy rights, or to contact our data protection representative (where applicable), please reach out to:

CardVibez Club Social Casino
[Business Address]
Email: [email protected]

We will respond to verified requests within the timeframes required by applicable law.