Privacy Policy

This Privacy Policy explains how Royal Reels (operating for Australia-focused users via royalreelsbet-au.com) collects, uses, stores, and shares personal information so that visitors and players understand their privacy choices and our legal and security obligations. It applies to website visitors, registered players, and anyone who interacts with our services (including via mirror domains used for technical access). Effective date: 6 November 2026.

Who We Are

OBSERVE: The available operator profile for Royal Reels does not disclose a verified legal entity name, legal address, or company registration/tax identifiers. The brand is described as an offshore gambling operator targeting Australia and operating primarily via royalreelsbet-au.com, with additional mirror domains (e.g., royalreels2.com, royalreels3.com, royalreels4.com) used for technical reach in Australia due to ACMA blocking activity under the Interactive Gambling Act.

EXPAND: Under Australian privacy expectations (including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), where applicable), users should be able to identify who is handling their data and how to contact them. Where operator identity is not clearly provided, the privacy risk increases (including reduced ability to escalate complaints or exercise rights). Therefore, we provide the clearest operational identification we can from the known service context and set out contact pathways; however, this does not replace the requirement for a proper legal entity disclosure.

REFLECT: For transparency, Royal Reels is presented to users as the Royal Reels brand offering services to Australian users via royalreelsbet-au.com. If you require the operator's full legal name, legal address, and registration details, you should request them before providing further personal information or completing verification.

Operator Details (As Currently Available)

Brand/Service Name: Royal Reels (Royal Reels), operating in the AU-focused context via royalreelsbet-au.com.
Legal Entity Name: Not specified in the available data.
Legal Address: Not specified in the available data.
Company Registration / Tax ID: Not specified in the available data.
Claimed Licensing Reference: Curacao master license reference 365/JAZ (historically displayed), currently unverified with broken/non-functional validator links as of January 2025.

Data Protection Contact (DPO / Privacy Team)

OBSERVE: No direct privacy email address, phone number, or contact form is provided in the available profile data. This is a material transparency gap for any privacy policy.

EXPAND: Because users still need a channel to submit privacy requests (access, deletion, complaint) and because timelines apply (e.g., target response within 30 days), we state the minimum required process: submit via the account support channels on royalreelsbet-au.com and clearly label the request as a privacy request.

REFLECT: Until a dedicated DPO contact is published, you may contact the data protection function by using the support/contact mechanisms available inside royalreelsbet-au.com (for example, live chat or any "Contact Us" flow presented in your account) and stating "Privacy Request / Attn: Data Protection". Keep copies of all correspondence.

What Personal Data We Collect

OBSERVE: Royal Reels (via royalreelsbet-au.com) operates an online casino environment and, based on the operational notes, relies heavily on SMS verification and payment processing that may use third-party descriptors (e.g., "DIGITAL SVCS", "TECH SOLS"). This implies collection of identity, contact, usage, device, and payment-related data.

EXPAND: In gambling contexts, additional data categories often arise: KYC/AML verification documents, fraud/anti-collusion signals, responsible gambling interactions, and withdrawal verification artifacts. Even where not explicitly listed in the profile, these are reasonably necessary to operate accounts and prevent misuse.

REFLECT: We group the data we collect into categories so you can understand what may be collected, whether you provide it directly or it is generated through your use of the services.

Data You Provide Directly

Account & identity data: full name, date of birth, username, password (stored in hashed form), nationality/country of residence, and other registration information you submit.
Contact data: email address (if collected/provided), mobile phone number (noting platform reliance on SMS verification), mailing or residential address (if provided for verification), and communication preferences.
Verification (KYC) data: copies of identity documents, selfies/liveness checks (if used), proof of address, payment ownership proof, and related metadata (submission dates, verification outcomes).
Support communications: messages to support, chat transcripts, complaint submissions, and attachments you provide.

Data Collected Automatically (Technical & Usage)

Device & connection data: IP address, approximate location derived from IP, device identifiers, browser type/version, operating system, language, screen resolution, and timezone.
Log and security data: login timestamps, session identifiers, failed login attempts, SMS delivery events (where applicable), and security/audit logs used to detect suspicious activity.
Usage and behavioural data: pages viewed, clicks, referral URLs, navigation patterns, feature usage, and interaction metrics.

Gambling, Transaction, and Payment Data

Gameplay data: betting history, game rounds, wins/losses, bonus usage, wagering progress, and responsible gambling tool interactions (e.g., deposit limit requests, self-exclusion requests).
Payment data: deposit/withdrawal amounts, timestamps, payment method identifiers, bank or payment account references (tokenised where possible), and chargeback/dispute information.
Payment descriptor information: transactions may appear under third-party processor descriptors (e.g., "DIGITAL SVCS", "TECH SOLS"), reflecting the involvement of payment partners rather than a direct "Royal Reels" merchant name.

Cookies and Similar Technologies

OBSERVE: Online casino sites typically use cookies for session management, fraud prevention, analytics, and advertising (where permitted).

EXPAND: Cookies may include first-party and third-party technologies, including pixels and SDKs that create identifiers for device/browser recognition.

REFLECT: We use cookies and similar technologies as described in the "Cookies & Tracking Technologies" section, including to keep you signed in, keep the platform secure, and measure site performance.

Legal Basis for Processing

OBSERVE: In the AU context, privacy compliance is primarily framed through the Australian Privacy Principles (APPs), which focus on fair and transparent handling, purpose limitation, security, access/correction, and cross-border disclosure. In addition, gambling operations impose verification, anti-fraud, and transaction recordkeeping expectations (even where the operator is offshore and licensing is unverified).

EXPAND: While "GDPR legal bases" terminology is not native to Australian law, using a legal-basis model helps explain processing grounds in a structured way for users. We therefore describe processing grounds in a manner aligned to common international privacy frameworks while still committing to APP-style transparency and safeguards.

REFLECT: We process personal information only when we have a recognised justification, and we link each justification to concrete operational needs for Royal Reels on royalreelsbet-au.com.

Consent: where you agree to specific processing (e.g., optional marketing communications, non-essential cookies/advertising technologies where a consent mechanism is offered). You may withdraw consent at any time, but withdrawal does not affect prior lawful processing.
Contract performance: to create and administer your account, provide gameplay, process deposits/withdrawals, apply bonuses, and deliver customer support consistent with the platform's terms.
Legitimate interests: to secure the platform, prevent fraud, detect account takeovers, maintain service reliability (including investigating SMS delivery issues), perform analytics to improve user experience, and protect our legal rights. We balance these interests against your privacy expectations.
Legal and regulatory obligations: to carry out identity verification (KYC), anti-money laundering and counter-terrorism financing controls (AML/CTF-style controls as applied by our payment partners and operational policies), respond to lawful requests, and maintain records needed for dispute handling and financial integrity.

Purpose of Processing

OBSERVE: The service provides gambling gameplay, payment processing, SMS-based access controls, and customer support, and is subject to heightened fraud and identity risks.

EXPAND: This implies multiple purposes beyond "service delivery": integrity monitoring, responsible gambling administration, incident response, and internal governance (including audits and complaint handling).

REFLECT: We use personal information for the following purposes, each tied to running Royal Reels via royalreelsbet-au.com:

Provide and operate services: register accounts, authenticate logins (including SMS verification where used), enable gameplay, process transactions, and manage bonuses and promotions.
Account verification and eligibility: confirm identity, age, and account ownership; verify payment method ownership; and assess jurisdiction eligibility (including blocking prohibited jurisdictions referenced in terms, such as the US, UK, and FR).
Fraud prevention and platform integrity: detect suspicious activity, collusion, multiple-account abuse, chargeback risk, and security threats; maintain logs and investigate incidents.
Customer support and communications: respond to enquiries, manage complaints, and provide service notices (e.g., policy changes, security notices, transactional messages).
Analytics and service improvement: measure performance, troubleshoot technical issues (including access reliability), and improve product features, UX, and stability.
Marketing (where permitted): send marketing communications and show promotions, subject to your preferences and applicable consent requirements; you can opt out at any time.

Disclosure & Sharing

OBSERVE: The service uses third-party payment processing and may involve affiliates, advertising technologies, and service providers. The AU context also involves ACMA enforcement and ISP blocking activity, which can create additional operational disclosure pressures (e.g., to respond to lawful requests).

EXPAND: Sharing must be limited to what is necessary, governed by contracts, and disclosed clearly - especially for high-risk data (KYC documents, payment identifiers). Additionally, if mirror domains are used, data may still flow to the same underlying processors and infrastructure providers.

REFLECT: We disclose personal information only as needed to provide the service, secure it, comply with lawful requirements, and operate business functions, and we require recipients to apply appropriate safeguards.

Who We May Share Data With

Payment partners and financial service providers: to process deposits/withdrawals, manage fraud screening, and handle chargebacks. Bank statement descriptors may appear under third-party processor names (e.g., "DIGITAL SVCS", "TECH SOLS").
Verification and fraud prevention providers: KYC/ID verification services, device-fingerprinting or risk scoring providers, and security vendors (as applicable) to prevent misuse and verify eligibility.
IT and hosting providers: cloud hosting, content delivery networks (CDNs), analytics providers, customer support tooling, and incident monitoring services.
Affiliates and advertising networks: where you have provided consent or where permitted by applicable law and platform settings, for attribution, campaign measurement, and advertising delivery.
Regulators, authorities, and legal recipients: where required to comply with lawful requests, court orders, or to protect rights and safety. In the AU context, this may include engagement relevant to ACMA enforcement processes.
Business transfers: if we undergo a corporate transaction (merger, acquisition, asset sale), your information may be transferred subject to confidentiality and continued protection.

No Sale of Sensitive Documents for Third-Party Marketing

OBSERVE: KYC documents and verification artifacts are highly sensitive in an online gambling setting.

EXPAND: Sharing such information for unrelated marketing is inconsistent with reasonable user expectations and increases identity theft risk.

REFLECT: We do not share identity documents or verification files with third parties for their independent marketing purposes.

International Transfers

OBSERVE: The operator is described as offshore, with an unverified Curacao licensing reference and a service targeting Australia. This strongly indicates cross-border data handling (hosting, payments, support, verification).

EXPAND: Under APP 8 (Cross-border disclosure), when an Australian user's personal information is disclosed overseas, steps should be taken to ensure the recipient handles the information consistently with the APPs, unless an exception applies. Offshore gambling operations can involve multiple jurisdictions, including where payment processors, cloud infrastructure, or verification services are located.

REFLECT: Your personal information may be transferred to, stored in, or accessed from locations outside Australia, depending on where our service providers and operational teams are located.

Likely Transfer Regions

Offshore operational jurisdictions: potentially including Curacao or other grey-market operational regions associated with gaming operations and support functions.
Global infrastructure regions: where cloud hosting, CDNs, and security tooling operate (which may include the United States, the European Economic Area/United Kingdom, or Asia-Pacific regions depending on vendor configuration).

Safeguards Applied

Contractual protections: data processing clauses and confidentiality obligations with service providers, including restrictions on purpose and onward sharing.
Security controls: encryption in transit and access control requirements for recipients where feasible.
Transfer risk assessment: vendor due diligence and periodic review, particularly for providers handling KYC documents or payment risk data.

Note: References such as "Privacy Shield" may not be applicable or current for all transfers; where a vendor offers recognised international transfer mechanisms (e.g., standard contractual clauses or equivalent contractual protections), we seek to apply them where practical.

Data Retention

OBSERVE: Gambling services require retention for security, disputes, financial records, and verification integrity, while the privacy principle of data minimisation requires that data not be kept longer than necessary.

EXPAND: Because the operator's jurisdictional and regulatory posture is unclear (unverified licensing; offshore), we provide a conservative, user-protective retention schedule and deletion triggers. Certain records may need longer retention where required for legal claims, fraud prevention, or payment disputes.

REFLECT: We keep personal information only as long as needed for the purposes described in this Privacy Policy, unless longer retention is required or justified (e.g., legal claims, fraud investigations, payment disputes).

Retention Periods (Guidance)

Account profile data: retained for the life of your account and up to 5 years after account closure (or last activity), unless a longer period is required due to disputes, fraud prevention, or legal obligations.
KYC/verification files: retained for as long as your account is active and typically up to 5 years after closure, unless extended due to ongoing investigations, disputes, or legal requirements.
Transaction and payment records: typically retained for up to 7 years to support financial integrity, audits, chargeback/dispute handling, and recordkeeping expectations.
Gameplay and behavioural logs: retained for operational integrity and dispute resolution, typically up to 2 - 5 years, depending on the risk level and purpose.
Security logs (device, IP, access): generally retained for 6 - 24 months, unless needed longer for incident investigations or legal claims.
Marketing preferences: retained until you unsubscribe/withdraw consent, then placed on a suppression list to ensure we respect your choice.

Deletion and Anonymisation Criteria

User request: where applicable, we will delete or de-identify information upon a valid request, unless we must keep it for legal, security, or dispute reasons.
Purpose completion: when the processing purpose ends (e.g., resolved support ticket), we delete or de-identify within a reasonable period.
Legal hold: we may retain relevant data longer if required to establish, exercise, or defend legal claims or to investigate suspected fraud.

Your Rights

OBSERVE: The service targets Australia, where user rights are primarily framed via the APPs (access and correction) and complaint rights via the OAIC where applicable. The section requirement also asks for "detailed GDPR and Mexican privacy law alignment," including references to Mexican regulations. That request is not jurisdictionally native to AU, but users may still be located elsewhere or request GDPR-style controls, and aligning to stronger global standards can enhance user protection.

EXPAND: We therefore provide: (1) a core AU-aligned rights set (access/correction/complaints), and (2) an extended rights set aligned to GDPR concepts and Mexico's Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (LFPDPPP) and its Regulations (ARCO rights). Where local law does not mandate a specific right, we may still offer it contractually, subject to identity verification and legal retention constraints typical to gambling services.

REFLECT: You can exercise privacy rights by contacting us through the available support channels inside royalreelsbet-au.com and clearly stating your request type. We aim to respond within 30 days (2026 standard), and we do not charge a fee for standard requests unless they are manifestly unfounded, repetitive, or excessive.

Rights We Provide (AU + Global Alignment)

Access: request a copy of the personal information we hold about you, subject to legal exceptions (e.g., where disclosure would unreasonably impact others, compromise security, or conflict with legal obligations).
Correction: request correction of inaccurate, outdated, incomplete, irrelevant, or misleading information.
Deletion / erasure (where applicable): request deletion or de-identification where the information is no longer needed, subject to retention duties (e.g., payment disputes, fraud prevention, KYC recordkeeping).
Restriction of processing (where applicable): request that we limit processing while a complaint is investigated or a correction is being assessed.
Objection (where applicable): object to processing based on legitimate interests in certain circumstances, including profiling for marketing where offered.
Data portability (where applicable): request export of certain data you provided in a structured, commonly used format, where technically feasible.
Withdraw consent: withdraw consent for marketing and non-essential cookies/advertising technologies at any time.

How to Exercise Your Rights (Procedure)

Submit a request: use the support/contact mechanisms available within royalreelsbet-au.com and title your message "Privacy Request". Specify the right you want to exercise (access, correction, deletion, etc.).
Verify identity: to protect your account, we may request information to confirm you are the account holder (this may include SMS verification steps or additional checks). Do not send unnecessary documents.
Clarify scope: if your request is broad, we may ask you to narrow it to specific data types or time periods to respond efficiently.
Response timeframe: we aim to respond within 30 days. If more time is required due to complexity, we will explain why and provide an updated target date.
Cost: standard requests are handled free of charge unless the request is excessive or abusive, in which case we may charge reasonable administrative costs or refuse the request with reasons.

Mexico and GDPR Alignment (Reference-Grade)

Mexico (LFPDPPP / ARCO rights): where applicable, users may request Access, Rectification, Cancellation, and Opposition (ARCO). We will apply ARCO-aligned handling where we can, subject to identity verification and lawful retention in gambling contexts.
GDPR-style controls (where applicable): we apply principles such as transparency, purpose limitation, data minimisation, and security safeguards, and we support withdrawal of marketing consent and certain portability/restriction requests where feasible.

Cookies & Tracking Technologies

OBSERVE: Cookies and similar technologies are used to enable core site functionality, security, and measurement. Third-party technologies may be present for analytics and advertising.

EXPAND: In gambling environments, certain cookies are security-critical (session integrity, fraud detection) and disabling them may prevent login, deposits, withdrawals, or gameplay. Advertising/measurement cookies should be optional where consent mechanisms exist.

REFLECT: We use cookies to operate royalreelsbet-au.com reliably, keep accounts secure, and understand how the service is used.

Types of Cookies

Strictly necessary (functional/session): required for login sessions, account security, and essential site features.
Preferences: remember settings such as language, region, or UI preferences.
Analytics/performance: help measure traffic, feature usage, and site performance to improve reliability and UX.
Advertising/attribution (where enabled): used to measure campaigns, limit ad frequency, and deliver relevant promotions, typically involving third parties and requiring consent where applicable.
Third-party cookies/pixels: set by vendors that provide analytics, fraud prevention, or advertising services.

How to Manage Cookies

Browser controls: you can block or delete cookies using your browser settings. Note that blocking strictly necessary cookies may break login, payments, or account features.
On-site controls: if a cookie preference panel is provided on royalreelsbet-au.com, you can use it to manage non-essential cookies (analytics/advertising) and withdraw consent.
Device-level controls: on mobile devices, you may have OS settings that limit ad tracking or reset advertising identifiers.

Data Security

OBSERVE: The available data indicates HTTPS with TLS (notably TLS 1.3 and Let's Encrypt), and also indicates the platform is not ISO 27001 certified based on the profile. The service handles sensitive KYC and financial data, requiring strong security controls even in the absence of formal certification.

EXPAND: A defensible security posture includes layered controls: encryption, access management, monitoring, secure development practices, vendor controls, incident response, and staff training. Where SOC 2 / ISO 27001 are not held, we should avoid implying certification while still describing the operational measures used.

REFLECT: We implement administrative, technical, and organisational safeguards designed to protect personal information processed through Royal Reels on royalreelsbet-au.com, recognising that no method of transmission or storage is 100% secure.

Core Security Measures

Encryption in transit: HTTPS with TLS 1.2+ (observed TLS 1.3) to protect data between your device and our services.
Encryption at rest: sensitive information is protected using encryption and/or strong cryptographic hashing where appropriate (e.g., password hashing).
Access controls: role-based access, least-privilege principles, and logging of administrative access to sensitive systems.
Account protection: support for multi-factor or step-up authentication mechanisms where implemented (including SMS-based verification where the platform relies on it), and detection of suspicious logins.
Monitoring and audits: security monitoring, vulnerability management, and periodic reviews of systems and vendor security posture.
Staff training: privacy and security awareness training for personnel with access to user information.

Incident Response

Detection and containment: we maintain procedures to detect, triage, and contain suspected security incidents.
Assessment: we assess the scope, impact, and data involved and document remediation steps.
Notification: where notification is required by applicable law or is appropriate to protect users, we will notify affected users and/or relevant authorities within a reasonable timeframe.

Standards and Certifications

OBSERVE: The profile indicates no ISO 27001 certification and no independently audited equivalent is confirmed.

EXPAND: Users should not be led to believe that audited compliance exists when it does not.

REFLECT: While we may align internal controls to recognised security frameworks (e.g., ISO 27001 or SOC 2 principles), we do not represent that royalreelsbet-au.com is ISO 27001 or SOC 2 certified unless and until independently verified.

Complaints & Contacts

OBSERVE: The available data does not provide a dedicated DPO email/phone, contact form, or postal address. This creates a complaint-handling gap, particularly for users seeking escalation. The service operates in an AU-targeted environment with ACMA enforcement notes, and the section requirement asks for escalation paths including Mexican and EU authorities.

EXPAND: We therefore provide (1) an internal complaint process through available site support channels, and (2) external escalation guidance: OAIC for Australia (privacy regulator), INAI for Mexico (data protection authority), and EU supervisory authorities for EU/EEA residents where applicable. Because we do not have a confirmed EU establishment, "lead authority" cannot be identified; users may contact their local authority.

REFLECT: If you have a privacy concern about Royal Reels on royalreelsbet-au.com, follow the steps below so we can investigate and respond promptly.

Internal Complaint Procedure

Submit your complaint: contact support via the channels available within royalreelsbet-au.com and title your message "Privacy Complaint". Include your account identifier, the issue, relevant dates, and what outcome you want.
Identity verification: we may verify you are the account holder before discussing account-specific data.
Acknowledgement: we aim to acknowledge receipt within 7 days (2026 standard) where feasible.
Investigation: we review logs, account records, vendor interactions (e.g., payment/verification providers), and relevant policies.
Response: we aim to provide a substantive response within 30 days. If more time is required, we will explain the reason and provide an updated timeframe.

Contact Channels (As Available)

DPO / Privacy Team Email: Not specified in the available data (submit via on-site support channels on royalreelsbet-au.com).
Phone: Not specified in the available data.
Online form: Not specified in the available data (use any in-account support/contact workflows shown on royalreelsbet-au.com).
Postal address: Not specified in the available data.

External Escalation (Supervisory Authorities)

Australia (OAIC): Office of the Australian Information Commissioner - Website: https://www.oaic.gov.au - Privacy complaints guidance is available on the OAIC site.
Mexico (INAI): Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales - Website: https://www.inai.org.mx.
EU/EEA (local supervisory authority): If you are in the EU/EEA, you may contact your local data protection authority. A directory is available via the European Data Protection Board (EDPB): https://edpb.europa.eu.

Important context for AU users: Royal Reels is described in the available data as an offshore operator and may be subject to ACMA enforcement and ISP blocking related to the Interactive Gambling Act. This does not remove our responsibility to handle personal information transparently; however, it may affect practical outcomes for dispute resolution.

Updates

OBSERVE: Policies evolve due to operational changes (vendors, payment methods, security controls), legal changes, and product updates. The requirement asks for version control with a "Last updated" timestamp, a changelog, and advance notice of significant changes (minimum 30 days), with options to object or close accounts.

EXPAND: For meaningful consent and transparency, users should be notified through multiple channels (email where held, on-site banner, in-account alerts). Where the operator does not hold a verified email for a user, in-account messaging becomes essential.

REFLECT: We will notify you of material changes to this Privacy Policy and give you reasonable time to review them before they take effect, especially where changes affect your rights or how we use/share your information.

Last updated: November 2026.
Advance notice for significant changes: at least 30 days before material changes take effect, where practicable.
Notification methods: email notification (if we have a verified email on file), prominent website banner on royalreelsbet-au.com, and/or an alert in your account dashboard.
Your options: you may object to certain processing (e.g., marketing) via preference controls, and you may request account closure if you do not agree with material changes (subject to necessary retention for legal/security purposes).

Changelog (Material Changes)

November 2026: First publication of this Privacy Policy version for Royal Reels in the royalreelsbet-au.com AU-focused context, including explicit disclosure of mirror-domain access context, unverified Curacao licensing reference history (365/JAZ), payment descriptor transparency (e.g., "DIGITAL SVCS", "TECH SOLS"), and strengthened rights/complaints workflows with a 30-day response target.