Privacy and Personal Information

Who is accountable for your information

The organisation deciding why and how personal information is used is the data controller. A completed notice must identify that legal entity, provide its address and privacy contact, and identify any representative or data protection officer where applicable; the VeryWell Casino brand name alone does not supply these details.

Conflicting licence descriptions cannot establish which company controls player records or which legal obligations apply. Before providing identity documents, check that the recipient is the verified operating entity and that its privacy notice explains the intended use.

Information involved and reasons for processing

Depending on the services actually provided, relevant information may include names, contact details, dates of birth, verification documents, payment references, gambling transactions and correspondence. Technical records may include IP addresses, device characteristics and security events; these categories must be checked against the operator's real collection practices.

Each processing purpose needs an applicable lawful basis. Where UK data protection law applies, account administration may rely on contractual necessity, legally required checks on a legal obligation, and proportionate security activity on legitimate interests following the necessary assessment.

Consent must be obtained where required for marketing or optional tracking. A completed notice must explain cookie purposes, third-party technologies and how consent can be withdrawn; accepting account terms does not by itself authorise every use of personal information.

Recipients, overseas access and retention

Potential recipients include payment providers, identity-checking services, hosting suppliers, professional advisers and authorities acting under a lawful request. The final policy must specify the relevant recipient categories, their roles and the purposes of disclosure rather than treating all sharing as routine.

If information is transferred or made accessible to a separate organisation outside the UK, applicable transfer requirements must be assessed. The notice should describe the destinations, the protection relied upon and how further details can be obtained, consistent with the ICO's international-transfer guidance.

Retention should follow documented periods or clear criteria for each record category, including any applicable statutory requirement. Closing an account does not necessarily require immediate deletion of every transaction, but unspecified future business use is not a sufficient explanation for indefinite storage.

Requests, objections and complaints

Where applicable law provides these rights, individuals may request access or correction, seek erasure or restriction, object to certain processing and obtain eligible information in a portable form. These rights have conditions and exceptions; withdrawing consent does not invalidate processing that was lawful before withdrawal.

Send requests through a privacy channel confirmed as belonging to the controller. Proportionate identity checks may be necessary, but the operator should avoid collecting additional sensitive documents when a less intrusive method will suffice.

If a concern remains unresolved, the appropriate supervisory authority may consider a complaint. UK users can consult the Information Commissioner's Office for guidance on personal-information rights and complaint routes; its jurisdiction depends on the circumstances.