Privacy Policy

1. Who we are

Kitsune Casino ("we", "us", "our") is the operator of kitsune-casino.uk. We are the data controller for the personal information described in this policy, which means we decide why and how it is processed. Where we work with third parties such as payment processors or game studios, those parties act as data processors under our instructions, or as independent controllers for their own compliance obligations.

We operate under a UK-facing gambling licence and are therefore subject to both the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Because we are regulated by the Gambling Commission, some of the data we hold is retained under obligations that sit outside data protection law — for example, anti-money-laundering records, which must be kept for a minimum statutory period regardless of any erasure request.

Questions about this policy, or about how your data is handled, should be directed to our Data Protection Officer using the contact details at the bottom of this page.

2. What data we collect

Kitsune collects personal data in five broad categories. Some of it you give us directly when you register or make a deposit. Some is generated automatically as you play. None of it is collected speculatively — each category exists because a specific legal or operational requirement needs it.

There is one specific category Kitsune does not collect unless you provide it voluntarily and it is relevant to a specific case: special category data. This includes information about health, ethnicity, religious beliefs and similar. If you disclose something like a gambling-harm concern to our support team, that will be recorded — because it is necessary to protect you — but it is held under strict access controls and used only for that purpose.

3. Why we collect it

UK GDPR requires that personal data is collected for specific, explicit and legitimate purposes. Kitsune does not collect data "just in case." Every category above is tied to one or more of the following purposes:

To provide the service you have requested

Creating your account, processing deposits and withdrawals, loading games, tracking your balance and paying out your winnings. This is the core function of the casino and is the reason most of the data exists.

To comply with UK gambling regulation

The Gambling Commission requires all licensed operators to verify the identity of every player, confirm their age, screen against sanctions lists, monitor for money laundering, and keep detailed records for audit. This is not optional, and it is not within our discretion to skip.

To protect you and other players

Responsible gambling is a licensing condition. That means monitoring play patterns for signs of harm, enforcing deposit limits you have set, honouring self-exclusion, and intervening when the data suggests a player is at risk. Fraud and account-takeover prevention also falls here.

To operate the loyalty programme

Fox Points, tier assessment and the perks of the Nine-Tails ladder are all calculated from your gameplay data. If you choose to participate in the programme, this processing is what makes the rewards work.

To communicate with you

Transactional messages (deposit confirmations, withdrawal updates, security alerts) are sent as part of the service. Marketing communications about promotions and new games are sent only if you have opted in, and every message includes an unsubscribe link.

To improve the platform

Aggregated, anonymised analytics tell us which games are being played, where the site is slow, and which features players actually use. This data is not tied back to individual accounts when it informs design decisions.

4. Our legal bases for processing

Under UK GDPR, every instance of processing must have a lawful basis. Kitsune relies on four of the six available bases, each matched to the specific purpose it supports.

5. Who we share your data with

Kitsune does not sell your personal data. We do not rent it, trade it or use it as a bargaining chip with advertisers or data brokers. It is shared only with the third parties whose services are actually required to run a licensed UK casino — and only to the extent each one needs.

Payment processors

Banks, card networks and e-wallet providers process your deposits and withdrawals. They receive the information needed to complete the transaction and to satisfy their own anti-fraud and anti-money-laundering obligations. Their privacy policies apply to data they hold directly.

Identity verification services

Age and identity checks are performed by specialist providers who compare the details you have given us against public records and credit reference data. They act as processors under our instruction and do not retain your data for their own marketing purposes.

Game studios and live dealer providers

When you launch a game, the studio behind it needs to know a session is valid and that a bet has been placed. They receive a temporary session identifier, not your personal details, unless a specific game requires more — for example, a live dealer table that displays your chosen nickname.

Regulators and law enforcement

The Gambling Commission, HMRC, the National Crime Agency and similar bodies may require access to records for audit, investigation or compliance purposes. Where legally compelled, we must provide them. Where not compelled, we assess each request individually and share only what is proportionate.

Professional advisers and auditors

Our legal, accounting and audit partners may access data when carrying out their engagements. They are bound by professional confidentiality obligations and act under strict data processing agreements.

Successor entities

If Kitsune Casino is ever sold or merged into another business, player data would transfer as part of that transaction. In such a case, you would be notified in advance and any new owner would be bound by the terms of this policy until you were given the opportunity to review revised terms.

6. How long we keep your data

Retention periods are set by a combination of UK GDPR (which requires that data is kept no longer than necessary) and specific gambling and financial regulations (which require certain records to be kept for minimum periods regardless). Where these conflict, the statutory minimum wins.

• 5 years Anti-money-laundering and transaction records Required by the Money Laundering Regulations. Retained from the end of the customer relationship, regardless of any erasure request.
• 6 years Account and gameplay records Retained for the standard limitation period for contractual claims. After this, records are deleted or fully anonymised.
• Indefinite Self-exclusion records Retained for the duration of the exclusion and for a minimum period after, so that we can honour it. This overrides erasure requests — it is a player-protection measure.
• 7 years Tax and financial accounting records Required by HMRC for corporate tax purposes.
• 13 months Analytics data The maximum recommended under ICO guidance. Aggregated and anonymised before this point wherever possible.
• 90 days Marketing attribution data Retained only as long as it is needed to measure campaign performance, then purged.
• 30 days Support ticket history Retained for quality assurance and dispute resolution. Longer if the ticket relates to a financial transaction.

7. How we protect your data

Security at Kitsune operates on four levels: transport, storage, access and monitoring. No single measure is sufficient on its own, so they are layered.

Transport. Every connection to Kitsune is encrypted with TLS using current best-practice cipher suites. There is no unencrypted path to any part of the platform, including the mobile apps.

Storage. Personal data is held on segregated servers with strict logical separation between production, backup and analytics environments. Payment card details are tokenised — the full card number never reaches our systems, and the token can only be used for the purpose it was created for.

Access. Employee access to personal data is role-based and limited to the minimum necessary for each role. Every access event is logged. Staff with access to sensitive data undergo regular training and are bound by confidentiality agreements.

Monitoring. Automated systems continuously screen for unusual login patterns, mass data access, and potential breach indicators. Two-factor authentication is available on all accounts and strongly recommended for anyone holding a balance.

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected players without undue delay, as required by UK GDPR.

8. Your rights under UK GDPR

As a UK resident, you have eight rights over the personal data Kitsune holds about you. All are free to exercise, and we aim to respond to any request within 30 days. In some cases — where a legal obligation overrides the right, as with anti-money-laundering records — we will explain why a request cannot be fully granted.

To exercise any of these rights, contact our Data Protection Officer using the details at the bottom of this page. We may ask you to verify your identity before processing a request — this is to prevent someone else from accessing or deleting your data.

9. Cookies and similar technologies

Kitsune uses cookies, local storage and similar technologies to keep you logged in, remember your preferences, measure site performance and — with your consent — support marketing activity. The full list of cookies we use, what each one does and how long it lasts is documented in our Cookie Policy.

Cookie consent is managed separately from this policy, through the consent banner and the "Cookie Settings" link in the site footer. You can change your choices at any time, and no essential part of the service depends on accepting optional cookies.

10. International data transfers

Some of the service providers Kitsune works with are based outside the UK. Where personal data is transferred outside the UK — for example, to a game studio's servers in the EU, or to a cloud infrastructure provider in the United States — we ensure the transfer is protected by one of the mechanisms approved under UK GDPR.

In practice, this means the receiving organisation either operates in a country covered by a UK adequacy decision, or has entered into the International Data Transfer Agreement (IDTA) with us, or has implemented the UK Addendum to the EU Standard Contractual Clauses. In every case, additional technical and organisational safeguards are applied, including encryption in transit and at rest.

If you would like details of the specific transfer mechanism applied to any particular provider, our DPO can supply them on request.

11. Changes to this policy

This policy is reviewed at least annually and updated whenever our data practices change, a new provider is added, or the regulatory framework shifts. The "Last updated" date at the top of this page always reflects the most recent revision.

Material changes — anything that alters what data is collected, how it is used, or who it is shared with — will be notified to you in advance by email or through a prominent notice on the site. Minor changes, such as a supplier name change or a retention period tweak, are reflected silently in the text.

We keep an archive of previous versions of this policy. If you would like a copy of an earlier version, contact us using the details below.

12. Contact us

Questions about this policy, requests to exercise your rights, or concerns about how your data has been handled should be directed to the appropriate address below. We aim to respond to all data protection queries within 30 days.