Privacy Policy

1. Who is responsible for your data

The data controller for freeplaycasinoclub.com is Coralwave Interactive Ltd, registered in Cyprus under number HE 452118, registered office 42 Amathountos Avenue, Office 5B, 4532 Limassol, Cyprus. For any privacy matter, write to [email protected]. We handle personal data in line with the EU General Data Protection Regulation and the data protection law of Cyprus.

2. What we collect

If you register: your email address, the display name you choose, a scrypt hash of your password (never the password itself), your virtual coin balance, the timestamp of your registration and of your last daily bonus claim, and a log of coin credits on your account.

If you only browse or play as a guest: we store nothing about you server-side beyond ordinary web-server access logs, which record the requested address, the time, your IP address, and the browser user-agent string your device sends.

In your browser: a session cookie once you log in, and a single local-storage flag remembering that you passed the age check. Details are in our Cookie Policy.

What we never collect: payment card, bank or wallet details — the site has no payment facility at all. We do not ask for your real name, date of birth, postal address, phone number or identity documents, and we do not build advertising or behavioural profiles.

3. Why we use it, and on what legal basis

• To run your account — email, display name, password hash and coin balance. Legal basis: performance of the contract set out in our Terms of Use.
• To keep you logged in — the signed session cookie. Legal basis: strictly necessary for a service you requested.
• To enforce the 18+ restriction and prevent abuse — the age flag, access logs and bonus timestamps. Legal basis: our legitimate interest in operating a lawful, age-restricted site free of automated abuse.
• To answer your email — whatever you put in your message. Legal basis: legitimate interest in responding to correspondence.
• To keep the site secure and diagnose faults — server logs. Legal basis: legitimate interest in the security and integrity of our service.

We do not use your data for marketing, we send no promotional email, and we do not sell, rent or trade personal data to anyone, ever.

4. Who else sees anything

Account data lives in a database on our own server and is not shared with third-party analytics, advertising or profiling services — we run none.

The games in our lobby are embedded from their manufacturers’ own demonstration servers. When a game loads, your browser connects directly to that supplier, which will see your IP address and browser information as a technical necessity of delivering the game, and may set its own cookies within its own frame. That processing is outside our control and governed by the supplier’s privacy notice. We pass no account data, email address or coin balance to any game supplier.

We may disclose data where we are legally obliged to do so, or where it is necessary to protect our rights or the safety of others. Our infrastructure provider processes data on our behalf as a hosting processor under contract.

5. Where data is stored and for how long

Data is stored on servers within the European Economic Area. We keep account data for as long as your account exists. When you ask us to delete your account we remove your record and its coin history within 30 days. Web-server access logs rotate and are discarded within 30 days. Email correspondence is kept for up to 12 months so we have context if you write again.

6. Your rights

You have the right to:

• ask what we hold about you, and receive a copy;
• have inaccurate details corrected;
• have your account and data deleted;
• ask us to restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable form;
• complain to the data protection authority in Cyprus or in your own country of residence.

Email [email protected] from your registered address and we will act within 30 days. There is no charge, and we will not ask you to justify a deletion request.

7. Security

Traffic to the site is encrypted in transit. Passwords are stored only as salted scrypt hashes, so nobody — including us — can read them. Session cookies are HTTP-only, restricted to this site and cryptographically signed, so they cannot be forged or read by scripts. Access to the server is limited to the people who maintain it. No system is perfectly secure, so please use a password you do not reuse elsewhere.

8. Children

The site is for adults aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact [email protected] and we will delete the account and its data promptly.

9. Changes to this policy

If this policy changes we will update the date at the top of the page. Material changes affecting registered members will also be announced on the site.