Privacy Policy: What Galactic Wins Collects, Why, and What You Can Do About It
This document is written to be used, not skimmed past. It sets out which information is collected from a Galactic Wins player in New Zealand, why, who else sees it, how long it stays on file, and the steps to take if you want a copy, a correction, or an end to marketing contact. New Zealand's Privacy Act 2020 and its information privacy principles are the framework applied throughout.
The short version: personal data here exists to run your account, to satisfy anti-money-laundering law and to keep the platform secure. It is not a product, and it is not sold to anyone.
What is collected
| Category | Specific data |
|---|---|
| Identity | Full legal name, date of birth, gender where supplied, nationality or country of residence |
| Contact | Email address, mobile number, residential address |
| Account | Username, hashed password, account currency, preferences, limits you have set |
| Verification (KYC) | Photo ID such as a passport or driver licence, proof of address, occasionally a selfie or proof of source of funds |
| Financial | Payment method details, deposit and withdrawal records, transaction history, partial card numbers |
| Technical | IP address, device type, operating system, browser, time zone, connection data |
| Usage | Games opened, session times and lengths, pages viewed, clicks within the site |
| Communications | Live chat transcripts, emails to support, notes from complaint handling |
Sensitive categories are not sought. Where a responsible gambling conversation touches on health matters, that information stays with the staff handling the case.
Why each category is collected
Collection is tied to a specific purpose, and different purposes carry different obligations for you and for us.
- To run your account (contractual necessity). Identity, contact, account and financial data. Without these there is no account: deposits cannot be attributed, withdrawals cannot be paid, and support cannot confirm who is asking.
- To meet legal obligations. Verification documents, transaction records and source-of-funds evidence exist because anti-money-laundering and licensing rules require them. This is the one category you cannot decline and still play, and it is why a withdrawal can pause until documents are approved.
- For legitimate interests. Technical and usage data supports fraud detection, bonus-abuse checks, bug fixing and improvements to the site. Data here is used in aggregate wherever a general answer will do.
- With your consent. Marketing email, promotional messages and non-essential cookies. Consent is asked for separately, it is not a condition of holding an account, and withdrawing it changes nothing else about your access.
Read that as two groups: the legal and contractual items are mandatory, marketing is entirely optional.
Who the data is shared with
Personal information is never sold, rented or traded, and it is not passed to advertisers as a mailing list. Disclosure happens in four defined situations:
- Payment providers and banks receive what they need to move money, and nothing more.
- Identity verification agencies check submitted documents against their records. They receive the document and the result goes back; they do not receive your gameplay history.
- Game suppliers receive an anonymised session identifier so that a round can be reconstructed if a game result is queried. They do not receive your name or contact details.
- Regulators, auditors and law enforcement receive information when a licence condition, a court order or an anti-money-laundering obligation requires it. This category is not optional for either side.
Service providers acting on our behalf, such as hosting and email delivery, are bound by contract to use the data only for the task given to them.
Cross-border transfers
Galactic Wins is operated by Green Feather Online Limited, a Maltese company, so data relating to your account is processed in Malta and elsewhere in the European Economic Area. That is governed by information privacy principle 12 of the Privacy Act 2020, which covers sending personal information overseas. Malta operates under the GDPR, recognised as providing comparable safeguards to New Zealand's own. Where a provider sits outside that area, contractual protections at an equivalent standard are agreed before anything is transferred.
How long it is kept
Retention is not open-ended, but neither is it short, and the reason is legal rather than commercial.
- Account, identity, verification and transaction records: at least five years after the account is closed. Anti-money-laundering law sets that minimum, and it applies whether the account closed by request or by exclusion.
- Responsible gambling records, including self-exclusion: kept for the length of the exclusion and afterwards, so that an exclusion cannot be defeated by opening a fresh account.
- Live chat and support correspondence: commonly two years, longer where a complaint or dispute remains live.
- Marketing consent records: kept while consent stands, plus a record of the withdrawal itself, so that an opt-out is not accidentally reversed.
- Technical logs: typically months rather than years, unless attached to a fraud or security investigation.
Your rights, and how to use them
The Privacy Act 2020 gives you rights that work in practice, not just on paper. Every request below goes to the same address, [email protected], and requests are answered within 20 working days, which is the statutory limit.
| Right | What it means | How to use it |
|---|---|---|
| Access | Obtain confirmation of what is held about you and a copy of it | Email the privacy address from your registered email, stating what you want |
| Correction | Have inaccurate or incomplete information fixed | Email with the correct detail; where a change affects verified identity data, a supporting document is needed |
| Deletion | Have data removed where no legal obligation requires it to be kept | Email a deletion request; see the honest limit below |
| Withdraw marketing consent | Stop promotional email and messages | Use the unsubscribe link, or change the setting in your account, effective immediately |
| Complain | Escalate if the response is unsatisfactory | Office of the Privacy Commissioner, privacy.org.nz |
On deletion, the accurate position is that closing an account and erasing every trace of it are not the same thing. Marketing profiles, preferences and optional details can be deleted on request. Identity, verification and transaction records cannot, until the anti-money-laundering retention period has run, because removing them would breach the law that requires them. Instead the remaining data is locked down, taken out of active use and kept only for that compliance purpose. Anyone promising total immediate erasure of a gambling account is describing something the law does not allow.
Cookies and tracking
Three kinds of cookie are used, and only the first is unavoidable.
- Essential cookies keep you logged in, remember your session and protect against cross-site request forgery. Disabling them breaks the site.
- Performance and analytics cookies show which pages load slowly and where players get stuck. Data here is aggregated.
- Marketing cookies measure which campaign brought a visitor and limit repeat advertising. These are set only with consent.
The consent banner on first visit lets you accept or decline the non-essential categories, and the choice can be changed at any time from the cookie settings link in the footer. Browser controls give you a further layer: any modern browser can block or clear cookies for a specific site.
Keeping the data secure
Traffic between your device and the platform is encrypted in transit with TLS. Passwords are stored hashed rather than in readable form, meaning nobody at Galactic Wins can look yours up. Access to verification documents is restricted to staff whose role requires it, and it is logged. Card details are handled by PCI-compliant payment providers rather than stored in full on the platform.
No system anywhere is immune to attack, so your side matters too. Use a password unique to this site, switch on two-factor authentication if your account settings offer it, avoid logging in over public Wi-Fi, and tell support at once if you see activity you do not recognise.
People under 18
The platform is for adults. Data on under-18s is not knowingly collected, and age is verified against identity documents rather than taken on trust from a tick box. If an account is found to belong to someone under 18, it is closed, deposits are returned, winnings are void, and the data collected is deleted apart from the minimum record needed to stop the account being reopened. Parents and guardians who suspect a minor has registered should email the privacy address; it is treated as urgent.
Contacting us, and changes to this document
Privacy questions, access requests, corrections and complaints go to [email protected], which reaches the person responsible for data protection. General account matters are faster through 24/7 live chat. If a response does not satisfy you, the Office of the Privacy Commissioner at privacy.org.nz investigates complaints independently and free of charge.
This document is reviewed periodically and the version date at the foot of the page shows when it last changed. Material changes to how your information is used are notified by email or in-account notice before they take effect, not applied quietly.