Light Casino privacy notice
What personal data the company behind Light Casino collects, why it needs it, who else receives it, how long it is kept, and how to use your rights over it.
Cookies have a page of their own, the cookie policy. The rules of your account are in the terms.
1. Who is responsible for your data
- 1.1
The controller of your personal data, the company that decides how and why it is used, is Lucenthra Gaming Limited (company number C 121846), Level 2, Lucenthra House, Abate Rigord Street, Ta' Xbiex XBX 1120, Malta.
- 1.2
Questions and requests about your personal data go to our data protection officer, privacy@light-casino.biz.
- 1.3
This notice covers light-casino.biz, your account, the cashier, conversations with support and the messages we send you. Sites we link to, such as regulators and helplines, have notices of their own.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, date of birth, home address, email address, phone number | You, when you register |
| Verification | Identity document, proof of address, proof that a payment method is yours and, where the law requires it, evidence of where your money came from | You, and our identity-verification provider when it checks them |
| Account and play | Balance, deposits, withdrawals, bets, wins, game sessions and the limits you set | Created as you use the service |
| Payments | Type of payment method, the parts of a card or account number we are allowed to see, transaction references | You and your payment provider |
| Device and usage | IP address, device and browser type, sign-in times, pages visited | Your browser; see the cookie policy |
| Conversations | Messages to support by email and live chat, and complaint records. We have no phone line, so no calls are recorded. | You |
| Responsible gaming | Limits, time-outs, self-exclusion, and signs of harm in your play | You, and our monitoring of play |
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Opening and running your account, taking deposits, paying withdrawals, settling bets | Performing our contract with you |
| Checking your age and identity, preventing money laundering and fraud, meeting the conditions of our licence, reporting to the Malta Gaming Authority (MGA) and other authorities | Legal obligation |
| Applying limits, time-outs and self-exclusion; spotting signs of harm and acting on them | Legal obligation: the player protection conditions of our licence |
| Keeping accounts and games secure; detecting cheating and abuse of offers | Legitimate interests: protecting players and the service |
| Answering support requests and complaints | Performing our contract with you |
| Sending marketing | Your consent, which you can withdraw at any time |
4. Identity and money-laundering checks
- 4.1
Our licence and anti-money-laundering law require us to verify who you are and, in some cases, where your money comes from. We use an identity-verification provider, which acts only on our instructions, to check documents and to screen names against the sanctions lists of the European Union and the United Nations, and against lists of politically exposed persons.
- 4.2
If you ask us to delete verification records while the law still requires us to keep them, we keep them until that period ends and tell you so. Section 10 gives the periods.
5. Responsible gaming data
- 5.1
We record the limits, time-outs and self-exclusions you set. A self-exclusion stays on file for the whole exclusion and 5 years after it ends, so it still applies if you try to open a new account.
- 5.2
We look for signs of harm in how you play, such as deposits that rise quickly, several deposits in one session, long sessions late at night, chasing losses and repeated attempts to raise a limit. We may then contact you or restrict the account, as section 10 of the terms describes.
- 5.3
We treat information that reveals a gambling problem or another health matter, such as something you tell us about your health, as health data. We use it only to protect you and keep it with your responsible gaming record. The condition we rely on is substantial public interest, on the basis of the player protection law that applies to our licence (GDPR Article 9(2)(g)).
6. Marketing
- 6.1
We send marketing only if you have agreed to receive it, and only through the channels you chose.
- 6.2
You can withdraw that agreement at any time in Account › Settings, or with the unsubscribe link in any marketing message.
- 6.3
We send no marketing to an account on a time-out or self-exclusion.
7. Who receives your data
| Recipient | Why |
|---|---|
| Payment providers and banks | To move money into and out of your account |
| Identity-verification and fraud-prevention services | For the checks in section 4 |
| Game studios | To run the game sessions you open |
| Hosting, IT and customer-support providers | To run the site and answer you, on our instructions |
| The Malta Gaming Authority (MGA), tax authorities, police and courts | When the law requires us to share it |
| Professional advisers, such as auditors and lawyers | To audit our accounts and advise us |
- 7.1
The companies we use in each group: for payments, Visa, Mastercard, Apple Pay, Google Pay, Trustly, Skrill, Neteller and Paysafecard; for games, Big Time Gaming, ELK Studios, Evolution, Games Global, Hacksaw Gaming, NetEnt, Nolimit City, Play’n GO, Pragmatic Play, Push Gaming, Red Tiger and Relax Gaming. Our banks, and our identity-verification, fraud-prevention, hosting, IT and customer-support providers, are named in a list we send you on request through the contact in clause 1.2.
- 7.2
Service providers act only on our instructions, under contracts that require them to protect your data.
8. International transfers
- 8.1
Some recipients in section 7 are based in the United Kingdom and the United States.
- 8.2
Transfers to the United Kingdom rely on the European Commission’s adequacy decision for it. Transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission. You can ask for a copy of those clauses through the contact in clause 1.2.
9. Automated decisions
- 9.1
We use automated checks for confirming your age and identity at registration, screening names against sanctions lists, spotting payments that may be fraud, and flagging play that shows signs of harm. A member of our staff reviews a flagged case before we close an account, refuse a withdrawal or restrict play.
- 9.2
You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects on you or affects you in a similarly significant way. That right does not apply where the decision is necessary for our contract with you, is authorised by law, or is based on your explicit consent (GDPR Article 22). Where it rests on the contract or on your consent, you can ask for a person to review the decision, give your point of view and contest it, through the contact in clause 1.2.
10. How long we keep it
| Record | Kept for |
|---|---|
| Account and transaction records | 5 years after your account is closed |
| Verification documents | 5 years after your account is closed |
| Self-exclusion records | The whole exclusion and 5 years after it ends; a permanent exclusion, for as long as the account record exists |
| Support messages and complaints | 3 years after the conversation or complaint is closed |
| Marketing consent records | As long as your consent lasts, and 3 years after you withdraw it |
When a period ends, we delete the data or make it anonymous.
11. Your rights
Send a request to our data protection officer at privacy@light-casino.biz. We reply within one month. For complex or numerous requests that period can be extended by two further months, and if it is, we tell you why within the first month. We may ask you to confirm who you are first, so that nobody else can obtain your data.
- To be informed
- What we collect, why, and who receives it. This notice is how we meet it.
- Access
- A copy of the personal data we hold about you.
- Rectification
- Correction of data that is incorrect, inaccurate or incomplete.
- Erasure
- Deletion when the data is no longer needed or processing it is unlawful. Records the law requires us to keep stay until that period ends.
- Restriction
- A limit on how we process your data, in specific cases.
- Portability
- The data you gave us, in a structured, machine-readable format, to keep or to send to another company. It applies where we process that data by automated means on the basis of your consent or our contract with you (Article 20).
- Objection
- To marketing, at any time and without giving a reason. To processing based on our legitimate interests, on grounds relating to your particular situation; we must then stop unless we show compelling legitimate grounds that override your interests, or need the data for legal claims (Article 21).
- Automated decisions
- Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, with the exceptions in section 9 (Article 22).
12. Complaints to a data protection authority
- 12.1
If you are unhappy with how we have handled your data, tell us at privacy@light-casino.biz and we will look into it.
- 12.2
You can also complain to your national data protection authority. The authority that supervises us is the Information and Data Protection Commissioner (IDPC) in Malta. The European Data Protection Board lists every national authority in the EU and EEA.
13. Children
- 13.1
Light Casino is for adults only. If we learn that an account belongs to someone under 18, we close it, as section 4.6 of the terms describes. We then keep only what we need to return the deposits and to stop a new account being opened, and delete the rest.
14. Security
- 14.1
We protect personal data with TLS encryption on every page, encryption of stored identity documents, and access limited to the staff who need it for their work, with every access logged. You can turn on two-step verification for your account, and card payments are handled by our payment providers, so we never store your full card number.
- 14.2
The security page explains how to protect your own account, and how to recognise messages that pretend to come from us.
15. Changes to this notice
- 15.1
We date every version at the top of this page. If a change affects how we use data you have already given us, we tell you at least 30 days before it takes effect, by email to your registered address and with a message the next time you sign in.
Sources
The rights in sections 9 and 11 and the complaint route in section 12 follow these sources, checked on 13 September 2026.
- Information for individuals — data protection European Commission. The rights to be informed, of access, rectification, erasure, restriction, portability and objection; rights on automated decisions; complaints to a national authority.
- Regulation (EU) 2016/679, the General Data Protection Regulation EUR-Lex. Article 20 (portability: data provided on the basis of consent or contract, processed by automated means), Article 21 (objection: to processing based on legitimate interests or a public task, and to direct marketing at any time) and Article 22 (decisions based solely on automated processing, its exceptions and the right to human intervention).
- Our members European Data Protection Board. The national data protection authorities of the EU and EEA.
Written by Light Casino · Last reviewed