I have written a fair number of privacy policies over the years, and most of them are drafted purely to satisfy a legal checklist rather than to actually help the person reading them understand what happens to their information. That is not the approach taken here. This page sets out, in plain terms, what personal data Candyland Casino collects from UK players, why it is needed, how it is protected, and what rights you hold over it under current UK data protection law. Any figures or thresholds mentioned throughout are given in British pounds, matching the currency used across the UK platform in 2026.
What personal data actually gets collected
Registration is the starting point for most of the data collection that happens on this platform, and it helps to know exactly what gets asked for and why. Identity details such as your full name, date of birth, and residential address are gathered primarily to confirm you meet the legal age requirement and to satisfy UK identity verification obligations. Contact information, including your email address and phone number, allows the platform to send account updates, security notifications, and, only where you have opted in, promotional messages. Financial information tied to your chosen payment method is also recorded, though card numbers themselves are typically tokenised or encrypted rather than stored as plain, readable digits sitting in a database somewhere.
| Data category | Examples | Main purpose |
|---|---|---|
| Identity data | Full name, date of birth, ID documents | Age and identity verification |
| Contact data | Email address, phone number, home address | Account communication |
| Financial data | Payment method, transaction records | Deposits, withdrawals, fraud checks |
| Technical data | IP address, browser type, device information | Platform security and functionality |
| Behavioural data | Game history, session duration, wagering patterns | Responsible gambling monitoring |
The reasoning behind each category of data
None of the information listed above gets collected simply because it is convenient to have, each category serves a specific operational or legal function tied to running a properly licensed gambling platform. Identity and age verification exist because UK gambling regulation requires operators to confirm every player is genuinely who they say they are and old enough to gamble legally. Financial data supports the mechanics of deposits and withdrawals, but it also plays a direct role in anti-money-laundering checks that every UK-facing operator is legally required to carry out. Behavioural data, covering things like how long you play and how often, feeds into the responsible gambling systems described on other parts of the site, helping flag patterns that might suggest a player would benefit from setting a limit or taking a break.
The legal grounds relied upon for processing:
- Consent, given when you opt into marketing emails or optional cookies
- Contractual necessity, required simply to deliver the account services you signed up for
- Legal obligation, tied directly to UK gambling and anti-money-laundering rules
- Legitimate interest, covering areas like fraud prevention and platform security
How your data gets kept secure day to day
Security is not a single switch that gets flipped once, it is a layered system that works continuously in the background. Encrypted connections, typically using SSL or TLS standards, protect data as it moves between your device and the platform’s servers, making interception by third parties considerably harder. Internal access to stored personal information is restricted, meaning only staff with a genuine operational reason, such as compliance officers or customer support agents handling a specific query, can actually view sensitive records. Regular security testing, including audits and penetration testing, helps identify weaknesses before they can be exploited, which has become fairly standard practice among UK-regulated operators. Two-factor authentication is also available as an optional extra layer of account protection, and honestly, it is worth switching on rather than skipping.
Who else might see your information
Sharing data sounds worse than it usually is in practice, since most sharing here is narrow, purpose-specific, and tightly regulated rather than open-ended. Payment processors receive only what is needed to complete a specific deposit or withdrawal, nothing more. Regulatory bodies, including the UK Gambling Commission, may receive relevant data where required for compliance reviews or investigations into suspicious activity. Identity verification providers are sometimes used to confirm documents quickly and accurately, which speeds up account approval considerably compared to manual review alone. Marketing partners only ever receive data where explicit consent has been given, and that consent can be withdrawn at any point through your account settings without affecting your ability to use the platform.
Third parties commonly involved in data handling:
- Payment processors handling deposits and withdrawals
- Identity verification providers confirming documents and age
- UK regulatory authorities, including the Gambling Commission
- Fraud prevention and anti-money-laundering service providers
- Marketing platforms, strictly limited to where consent has been given
Your rights under UK data protection rules
UK data protection law, shaped by the UK GDPR alongside the Data Protection Act, gives players genuine, enforceable rights over their own personal information, not just symbolic ones. You can request a copy of the data held about you, commonly called a subject access request, and the platform is legally required to respond within a defined timeframe. You can also ask for inaccurate data to be corrected, request deletion where legally permissible, and object to specific types of processing such as direct marketing. Where consent underpins a particular type of processing, such as promotional emails, you can withdraw that consent at any time without affecting the legality of anything processed before the withdrawal took place.
A summary of your available rights:
- Right to access the personal data held about you
- Right to correct inaccurate or outdated information
- Right to request deletion, subject to legal exceptions
- Right to object to certain types of processing
- Right to withdraw consent at any point
How long information actually stays on file
Data retention is not indefinite, though gambling regulation does require certain records to be kept for specific minimum periods regardless of player preference. Financial and transaction records are typically retained for several years following account closure, satisfying anti-money-laundering and audit obligations set by UK regulators. Identity verification documents are similarly kept for a defined period, mainly so the platform can demonstrate compliance if ever questioned by a regulatory body. Marketing-related data, by contrast, tends to be deleted far sooner, particularly once consent is withdrawn or an account becomes inactive over an extended stretch of time. Closing your account entirely usually results in most non-regulatory data being deleted or anonymised within a reasonable period, though certain records remain as required by law.
Cookies and how they connect to your data
Cookies work alongside the broader data collection described above, helping the platform remember preferences and understand general usage patterns across the site. Essential cookies are necessary for basic functions like staying logged in, while optional analytics and marketing cookies can be adjusted or switched off entirely through your cookie preference settings. None of this cookie-related data gets treated any differently from other personal information in terms of the security and access controls applied to it. A more detailed breakdown of specific cookie types sits on a separate page dedicated entirely to that topic.
Getting in touch about your personal data
If you have a question about how your data gets used, or want to exercise any of the rights outlined above, reaching out through the platform’s dedicated data protection contact is the recommended starting point. Requests like this are typically handled separately from general customer support, reviewed instead by staff specifically trained in data protection matters. If a response feels inadequate or a concern goes unresolved, UK players retain the right to escalate the issue to the Information Commissioner’s Office, the independent body overseeing data protection compliance across the UK. Trying direct contact first tends to resolve most issues faster than jumping straight to a formal complaint, based on how these things usually play out in practice.
