Lüks Casino processes personal data at several points along the player journey, from registration to payment to support. This page sets out what is collected, why, for how long and with whom it is shared. Opening an account means accepting the practices described here, and this policy should be read together with the Terms and Conditions.
Sources and categories of data
Three sources feed the data on file: what you type in at registration, what the system logs while you play, and what a payment provider returns during a transaction. No personal data is bought from third parties for advertising purposes.
- Phone number and email — kept for as long as the account stays open, used to open the account, confirm logins and reach you.
- Name and date of birth — kept for as long as the law requires, used to verify the 18 age limit and account ownership.
- Payment details — kept for as long as the law requires, used to carry out deposits and withdrawals.
- Betting and game history — kept for as long as the law requires, used for settlement, bonus wagering and complaint reviews.
- IP address and device data — kept for a limited period after the record is made, used for security and detecting multiple accounts or fraud.
- Support correspondence — kept for a limited period after a file is closed, used to follow and resolve an open complaint.
- Cookie records — kept for the lifetime of the cookie, used to keep the session open and remember language and preferences.
Legal grounds for processing
- Contract performance: opening the account, accepting a bet, completing a payment.
- Legal obligation: age verification, identity checks and statutory record keeping.
- Legitimate interest: preventing fraud, bot activity and duplicate accounts.
- Explicit consent: sending bonus announcements and campaign notifications.
Consent to notifications can be withdrawn at any point without closing the account — only the marketing messages stop.
How cookies are used
Cookies are small files stored by the browser. Essential cookies keep the session open and the site working; without them login is not possible. Preference cookies remember language and display settings, while measurement cookies show, in aggregate, which sections get used without identifying an individual player.
Cookies can be deleted or blocked through browser settings, though blocking the essential ones prevents logging in.
Recipients of the data
- Payment providers, limited to what completing a transaction requires.
- Game studios, to verify a round's outcome and the associated bet record.
- Identity verification services, to confirm age and account ownership.
- Competent authorities, when the law requires it and only to the extent requested.
Data is never sold for advertising and lists are never rented to third parties; every service provider handles data strictly on instruction and on the operator's behalf.
How the data is protected
Traffic between the site and the browser is encrypted, and passwords are stored in a form that cannot be reversed — not even by the support team. Access follows job function: payment records are visible only to the payments team, and a complaint file only to whoever is handling it.
Part of account security depends on the player: avoid reusing the password elsewhere, never share a confirmation code, and never leave a session open on an unfamiliar device.
Player rights over their data
- Requesting a copy of the data held about you.
- Requesting correction of details that are wrong or incomplete.
- Requesting deletion of data that fall outside the legal retention duty.
- Objecting to marketing messages and withdrawing consent.
Any of these requests can be sent through support. Closing an account does not erase everything instantly — payment and betting records stay on file until the legal period runs out. A self-exclusion record is kept until its term ends so the exclusion itself keeps working, as explained on the Responsible Gaming page, and any disagreement about data handling follows the Player Complaint Policy.
Changes to this policy
This policy can change, and the version published here is always the current, applicable one from the moment it goes live. A change that widens the data collected or who it is shared with is announced to the contact address on file for the account.