11Croco Casino Privacy Policy

11Croco collects the personal data needed to operate the casino and to meet the regulatory obligations that come with the gaming licence. The information falls into a few broad categories. Account data covers your name, date of birth, address, email, phone number and login credentials. Payment data covers the methods you use to deposit and withdraw, with full card numbers never stored on operator servers. Gameplay data covers your activity inside the lobby, including the games you play, the stakes you place and the bonuses you claim. Support data covers any correspondence with the support team through chat, email or the contact form.

The data is used to verify your identity, run your account, process deposits and withdrawals, pay out winnings, prevent fraud, meet regulatory reporting requirements and send the marketing communication you have opted in to. The marketing email and push notification lists are opt in only, and you can unsubscribe from either at any time through the account settings or the unsubscribe link in any marketing email. Closing your account removes you from all marketing lists immediately. The legal basis for processing is a mix of contract, legal obligation and legitimate interest, with consent specifically required for marketing communication.

Sharing and protection

Your data is shared only with the parties needed to run the casino. Payment processors handle deposits and withdrawals. Game studios receive the game session data needed to render the game and pay out winnings. The licensing regulator receives the reporting required by the gaming licence. Outside of these categories, your data is not shared with third parties and is never sold. All data is encrypted in transit using current industry standard protocols and is encrypted at rest on operator servers. Access inside the operator team is restricted by role and is logged for audit.

Under most privacy frameworks you have the right to access the data held about you, the right to request correction of incorrect data, the right to request deletion subject to the legal retention requirements of the gaming licence, the right to object to certain processing and the right to lodge a complaint with the relevant data protection authority. Requests should be sent to the support team through the email channel listed on the Contact page, and are processed inside the legally required window. Some data, such as the records required by the gaming licence, must be retained for a fixed period after account closure and cannot be deleted on request during that period.

Cookies, marketing preferences and data sharing with third parties

The site uses cookies for essential functions, performance analytics and marketing measurement. The first time you visit, the cookie banner offers a clear accept, reject or customise choice and the selection is remembered for future visits. Essential cookies cannot be disabled because they are required for the login session, the cashier and the security of the account, but every other category can be switched off without affecting your ability to play. The full breakdown of cookie categories and their purpose sits on the Cookie Policy page, which is referenced from the cookie banner itself.

Personal data is shared with third parties only where strictly necessary to deliver the service. Payment data is shared with the payment processors handling the deposit or withdrawal. Identity verification data is shared with the regulated KYC provider running the document check. Game data is shared with the studios powering the games on the lobby. None of the data is sold to advertisers and no profile is shared outside the service providers required to keep the account running. The full list of data processors is available on request through the channels listed on the Contact page.

Data retention follows the requirements of the gaming licence and the wider legal framework. Account data is retained for the duration of the active account and for a defined period after closure to satisfy regulatory record keeping obligations. Transaction data tied to the cashier is retained for the longer of the two windows specified by gaming regulation and financial services rules. Marketing data is retained only while the consent is active and is deleted on request alongside any account deletion request that falls outside the regulatory retention window.