How Galactic Wins Handles Your Personal Information Under the Privacy Act 2020

Opening a casino account means handing over more than an email address. Identity documents, a date of birth, a payment method, a home address and a record of everything you have staked all end up in someone else's system. This page sets out what is collected, why each piece is needed, who else sees it, how long it stays, and what you can do about it as a New Zealand resident under the Privacy Act 2020.

It is written to be used rather than skimmed. Where a right exists, we say how to exercise it. Where something cannot be deleted, we say so instead of implying otherwise.

Who Holds Your Data

The account you register with Galactic Wins is operated by Green Feather Online Limited, a company registered in Malta under number C 80735, at Elite Business Centre, Trejqa ta' Box Box, Msida MSD 1840, Malta. It holds Malta Gaming Authority licence MGA/B2C/445/2017.

That means two frameworks apply at once. Because the company offers services to people in New Zealand, the Privacy Act 2020 governs how your information is handled here. Because the company is established in Malta, European data protection law and Maltese gambling regulation apply to it as well. Where the two differ, the stricter obligation is the practical standard.

This page explains that framework in plain English. The operator's own privacy documentation, published at galacticwins.com, is the binding version, and it is worth reading before you upload identity documents.

What Is Collected

Identity data. Full name, date of birth, gender where provided, and the username you choose at registration. Your date of birth is not optional, because age verification is a licensing requirement.

Contact data. Email address, residential address, and contact preferences.

Account data. Account currency, password in hashed form, security questions, communication settings, and the responsible gambling limits you have set.

Financial data. Payment method details, deposit and withdrawal records, transaction timestamps, and the name registered to the payment instrument. Full card numbers are handled by the payment processor rather than stored in full by the casino.

Verification data. Copies of identity documents such as a passport or driver licence, proof of address, and sometimes proof of payment ownership or source of funds. This is the most sensitive category held.

Technical data. IP address, approximate location derived from it, device type, operating system, browser, language settings, and session identifiers.

Usage data. Games opened, stakes placed, session lengths, bonus participation, and site navigation.

Communications data. Live chat transcripts, emails to support, and complaint records.

Why Each Category Is Collected

Nothing above is collected as a general precaution. Each category has a specific basis:

• To run the account (contractual necessity). Identity, contact, account and financial data are required to open the account, process deposits and withdrawals, credit winnings and provide support. Refusing them means the account cannot operate.
• To meet legal obligations. Verification data, transaction records and age checks are collected because anti-money-laundering rules and the conditions of the Malta Gaming Authority licence require them. This is the category you cannot opt out of while holding an account.
• To prevent fraud and protect the platform (legitimate interests). Technical and usage data support fraud detection, multiple-account detection, bonus abuse checks and platform security.
• To improve the service (legitimate interests). Aggregated usage data informs which games are offered and how the site performs.
• To send marketing (consent). Promotional email and similar messaging are sent only if you tick the optional box at registration or opt in later. This is separate from everything above, it is genuinely optional, and withdrawing it does not affect your account in any way.

The distinction matters. Refusing marketing costs you nothing but offers. Refusing verification means the account cannot be maintained.

Who Your Data Is Shared With

Your personal information is not sold, and it is not passed to third parties for their own marketing purposes. It is shared where the service cannot function without it:

• Payment providers and banks, to process deposits and withdrawals.
• Identity verification and anti-fraud providers, who check documents and screen against sanctions and politically exposed person lists.
• Game suppliers, which receive the technical data needed to run a game session, generally under a pseudonymous account identifier rather than your name.
• Technology suppliers, including hosting, email delivery, live chat and analytics providers, under contracts limiting them to processing on the operator's instructions.
• Regulators and law enforcement, where disclosure is legally required. That includes the Malta Gaming Authority, tax and anti-money-laundering authorities, and courts acting under a valid order.
• Professional advisers, such as auditors and lawyers, in the course of their work.

Data That Leaves New Zealand

Your information is processed outside New Zealand, primarily in Malta and the wider European Economic Area, and by suppliers that may operate elsewhere. That is unavoidable when you play with an offshore operator, and you should register knowing it.

Information privacy principle 12 of the Privacy Act 2020 requires that a New Zealand agency sending personal information overseas is satisfied the recipient is subject to comparable safeguards. The European framework that applies in Malta is generally accepted as meeting that test, and transfers to suppliers outside it are expected to be covered by contractual protections such as standard clauses.

Your Rights Under the Privacy Act 2020

• Access. You can ask for confirmation that your information is held and for a copy of it. A response is due within 20 working days.
• Correction. If something is wrong, you can require it to be corrected. If the correction is refused, you can require a statement of the requested correction to be attached to the record.
• Withdrawal of marketing consent. Change the setting in your account or use the unsubscribe link in any promotional email. It applies to future messages, not ones already sent.
• Deletion, within limits. Marketing profiles and optional data can be deleted on request. Records tied to anti-money-laundering and licensing obligations cannot be, until the retention period expires. Deletion in practice means removing what is not legally required and restricting the rest to compliance use only.
• Complaint. If a request is refused or ignored, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, which investigates privacy complaints in New Zealand free of charge.

To exercise any of these, contact support through live chat, which operates around the clock in English, or write to Green Feather Online Limited at the registered Malta address above. Identify yourself with your username and registered email so the request can be matched to your account, and state which right you are exercising. Keep a copy of what you send and when, since a dated record is what turns a request into an enforceable one.

How Long Information Is Kept

• Account, transaction and verification records: at least five years after the account relationship ends. This is an anti-money-laundering requirement on the licensee, not a preference, and it applies even if you close the account the day after opening it.
• Self-exclusion and responsible gambling records: kept for the duration of the exclusion and afterwards, because the record is what makes an exclusion enforceable.
• Live chat and support records: typically retained for a shorter operational period, in line with complaint handling requirements.
• Marketing data: kept until you withdraw consent, then removed from active use.

When a retention period expires, information is deleted or anonymised so it can no longer identify you.

Cookies and Tracking

Three groups of cookies are typical on a casino platform.

Strictly necessary cookies keep you signed in, hold your session, remember your currency and support security checks. Blocking these breaks sign-in, so they cannot be switched off.

Performance and analytics cookies record which pages and games are used and where errors occur, usually in aggregate.

Marketing and affiliate cookies record which advertisement or partner site brought you to the platform and support retargeting.

You control the last two. Use the cookie banner on your first visit, adjust your choice later through the cookie settings, and use your browser settings to clear or block cookies at any time. Bear in mind that clearing cookies will sign you out, which is a common cause of unexpected logouts.

Security Measures

Traffic between your browser and the platform is encrypted in transit, passwords are stored hashed rather than in readable form, and access to verification documents is restricted to staff whose role requires it. Payment card details are handled through processors operating under card industry security standards.

No system is beyond compromise, and any operator claiming otherwise is overselling. The measures above reduce risk rather than eliminate it, which is why your own habits matter: a unique password, two-step verification if it is offered in your account settings, no sign-ins over open public Wi-Fi, and a healthy suspicion of any message asking for your credentials. Support will never ask for your password.

If a breach occurs that is likely to cause serious harm, the Privacy Act 2020 requires notification to the Office of the Privacy Commissioner and to the people affected.

People Under 18

The platform is for adults aged 18 and over. Information about under-18s is not knowingly collected. If an account is found to belong to someone under 18 it is closed, wagers are void, and the data held is dealt with under the legal retention rules that apply to a closed account rather than kept for commercial use.

If you share a device with children, do not save your credentials in the browser, and consider parental control software.

Getting in Touch About Your Data

Privacy requests, questions about this page, or a request to reach the data protection officer can be raised through the 24-hour live chat inside your account, or in writing to Green Feather Online Limited, Elite Business Centre, Trejqa ta' Box Box, Msida MSD 1840, Malta. Include your username, your registered email address, and a clear description of what you want. Written requests under the Privacy Act 2020 carry a 20 working day response deadline.

This page is reviewed periodically and updated when the operator's practices or the law change. The version published on galacticwins.com prevails if the two ever differ.