Privacy and Data Protection: The Full Record of What PokieSurf Players Hand Over
A privacy notice is only useful if you can act on it. This one names every category of information collected, gives the reason it is held, sets out the requests you are entitled to make with the wording that gets them actioned, and flags the places where PokieSurf publishes nothing instead of papering over them. The platform is restricted to adults aged 18 and over, and that restriction shapes much of what follows.
Two Different Sets of Data, One Page
Keep two things apart while you read.
This site is an independent information resource about PokieSurf Australia. It takes no registrations, holds no balances and processes no payments. It sees ordinary web traffic and nothing more: an IP address, a browser and device profile, the pages opened, the referring link.
An account is the other set. Registering, depositing and requesting a payout means handing personal, financial and identity data to the operator at pokiesurf.com, and that relationship runs under the operator's own privacy notice, linked from the footer of its site. What appears here describes the exchange accurately so you know its shape before entering it, not as a promise made on the operator's behalf.
The Australian Yardstick
The Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles set the standard for handling personal information in this country: collect only what is genuinely needed, be open about the purpose, keep records accurate and secure, allow access and correction, and take care when information crosses a border.
PokieSurf publishes no gambling licence and makes no public statement about the Privacy Act, the APPs or the Office of the Australian Information Commissioner. So use the framework the way it is offered here, as the benchmark an Australian player is entitled to measure any operator against, rather than as a compliance claim in the operator's name.
Inventory: What Is Collected and On What Footing
| Category | Typical fields | Why it is held | Optional? |
|---|---|---|---|
| Identity | Full name, date of birth, residential address | Confirming you are over 18 and that the account belongs to you | Mandatory |
| Contact | Email address used at registration | Account identifier, password reset, service messages | Mandatory |
| Financial | Card details entered at the cashier, deposit and payout amounts, currency, balances in AUD | Processing transactions and investigating disputed payments | Mandatory |
| Verification | Photographs of an identity document, front and back, plus a face image captured inside an on-screen frame | Anti-money-laundering and age obligations before a payout is released | Mandatory |
| Gameplay | Bets placed, session times, bonus history, loyalty tier progress | Running the account, settling rounds, applying promotion rules | Mandatory |
| Technical | IP address, device type, operating system, browser, login timestamps | Fraud detection, duplicate-account checks, account security | Mandatory |
| Marketing | Contact preferences, campaign responses, offer history | Sending promotional email and personalised offers | Optional, consent only |
The right-hand column is the one to read twice. Everything marked mandatory exists because the account cannot function or the law cannot be satisfied without it. Only the last row rests on your permission.
Consent, Contract and Legal Duty Are Not the Same Thing
Data collected to run the account, meaning your email, password, currency and transaction ledger, exists because you asked for a service. Withdraw it and there is no account left to run.
Data collected for age and identity verification exists because financial-crime rules require an operator to know who is moving money. Consent is not the basis, which is why refusing verification does not produce a private account, it produces an unpaid withdrawal.
Data collected for fraud prevention, including device fingerprints, IP history and betting patterns, is held on the operator's own interest in detecting duplicate accounts, bonus abuse and compromised logins.
Marketing is the only category that turns on a tick box. Consenting is not a condition of holding an account, and withdrawing consent later changes nothing about your balance, your bonuses or your ability to play. Use the unsubscribe link in any promotional email, or write to support and ask to be removed from campaign lists. Promotional mail that continues after an opt-out is worth complaining about in writing.
The Verification Upload Is the Most Sensitive Thing You Send
An identity document plus a photograph of your face is a package worth protecting. PokieSurf's verification screens ask for the entire document, both sides, fully legible, and a face image aligned inside an on-screen oval so the two can be matched.
Send those files only through the operator's own upload flow. Legitimate support desks do not request identity documents over ordinary email, through a messaging app or via an unprompted link. A blurred or cropped upload is the most common reason a payout stalls, so get it right first time rather than resubmitting sensitive material repeatedly.
Who Else Sees Your Information
Personal information is not merchandise, and nothing here is sold to unrelated companies. Disclosure should be limited to parties with a defined job to do:
- payment processors and card networks, to move funds and resolve chargebacks;
- identity verification and anti-fraud providers, which check documents and screen against age and sanctions databases;
- game studios supplying the software, which receive the session data needed to run and settle a round rather than your identity files;
- hosting, analytics and customer-support platforms, under contract and only for the function they perform;
- courts, law enforcement and financial-crime authorities where a legal obligation to disclose applies.
Information That Leaves Australia
Offshore platforms rarely keep their infrastructure onshore, so assume hosting, support handling and fraud screening may happen outside Australia. APP 8 is the relevant principle: an organisation sending personal information overseas should take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles, and generally stays accountable for what that recipient does with it.
PokieSurf does not disclose where its servers, processors or support teams sit, so no destination country can be confirmed here. A recipient in another jurisdiction may sit under privacy law with weaker remedies than ours, which makes this a fair question to put to support before uploading a passport photograph.
Exercising Your Rights, Request by Request
Rights are worth using rather than reading about. Each request below works the same way: write from the email address registered to the account, state clearly what you want, and keep a copy of everything.
- Access. Ask for a copy of the personal information held about you, and specify the parts: account profile, transaction history, verification files, marketing preferences, or all of it.
- Correction. If a name, date of birth or address is recorded wrongly, send the correct version with a document that supports it. Mismatched details cause more failed payouts than any other paperwork error.
- Deletion. Ask for removal of information no longer required, understanding the retention limits in the next section.
- Marketing opt-out. Withdraw promotional consent at any time, by unsubscribe link or in writing.
- Complaint. Raise a privacy concern with the operator first, in writing, and set a date by which you expect a substantive reply.
What "Delete My Data" Actually Achieves
Deletion is the request most often misunderstood, so here is the accurate version. Marketing consents, contact preferences and optional profile details can generally be removed on request. Verification documents, transaction records and the results of anti-money-laundering checks cannot, for as long as a record-keeping obligation applies to them.
Financial-crime rules oblige operators to keep those records for a set period after an account relationship ends. PokieSurf publishes no retention term, and no figure is invented here to fill the space. Ask support for the exact period applying to your records and get the answer in writing. In practice, "delete my account and my data" means closing the account and erasing everything not held under a legal duty.
Escalating a Privacy Complaint
If a privacy complaint to the operator goes unanswered, or the answer does not hold up, the Office of the Australian Information Commissioner at https://www.oaic.gov.au is the body Australians can approach about mishandled personal information. Keep expectations calibrated: the OAIC's practical reach over an offshore operator with no Australian presence is limited, and it is not a route to recovering money from a casino balance.
Cookies, Analytics and Tracking
Cookies are a form of personal information collection, and the cookie policy page carries the detail: every category in use, how long each type survives, and how to switch the optional ones off. The short version is that strictly necessary cookies keep a session and a login alive, analytics cookies report aggregate behaviour, and advertising cookies run only where you consented and can be withdrawn at any time.
Security, and the Half of It That Is Yours
Traffic between your browser and the platform runs over an encrypted HTTPS connection, verification files pass through a dedicated upload flow rather than ordinary email, and internal access to account records should be limited to staff who need it.
No two-factor authentication option is published for PokieSurf accounts, which puts more weight on the parts you control. Use a password unique to this account and never shared with your email inbox or internet banking: recovery runs through that mailbox, so whoever controls it controls the account. Nobody legitimate will ask for your password. On a shared device, log out properly rather than closing the tab.
People Under 18
The platform is for adults, and information about anyone under 18 is not knowingly held. Where an account is found to belong to a minor, it should be suspended at once, play stopped, winnings voided and net deposits returned to the source they came from. Personal information gathered during that process is deleted once the checks are complete and any record-keeping duty has been met.
If you share a device or a card with a teenager, treat a saved password as an open door. Where you believe a minor has registered using your details, tell support immediately and say so in those words.
Privacy Contact
Access requests, corrections, deletions, marketing opt-outs and any question about the above go to the operator's support desk: live chat on the platform, or email to [email protected]. No separate data protection officer address is published, so that email is the route to use. Support operates in English and its hours are not published, which is another reason to put a privacy request in writing rather than relying on catching chat at the right moment.
Revisions to This Page
This page is updated when Australian privacy guidance changes, or when what the operator collects changes. Revisions carry a new effective date rather than arriving silently, and anything materially affecting what is collected or who receives it is called out at the top of the page. The operator's own notice at pokiesurf.com is maintained separately and governs your account.