Your data, our duty

Privacy Policy | How ShelbyWin Protects Your Data

ShelbyWin Casino Privacy Policy explains what we collect, how long we keep it, who sees it and the rights you have over it.

What information does ShelbyWin Casino collect?

Account registration captures your name, date of birth, email address, phone number, residential address and a chosen password. Verification adds a photo ID document and a recent proof of address. Payment activity logs deposits, withdrawals, methods and timestamps. Gameplay logs every wager, win, bonus and session for regulatory and dispute resolution purposes. We also collect technical data through cookies and server logs, including IP address, device type, browser and referring URL. The cookie policy explains the cookies in more detail.

Where you contact support, we keep a copy of the chat transcript or email thread for at least three years. The transcript helps us resolve future queries quickly and forms part of the audit trail required by the licence. Voice calls are not recorded because we do not operate a phone line.

How is the information used at ShelbyWin Casino?

The lawful basis for processing is contract performance for everything related to running your account, legal obligation for anti-money-laundering and tax reporting, and consent for marketing. We use the data to provide the service, prevent fraud, comply with our licence, calculate VIP tier progression, send transactional messages and, with consent, send promotional offers.

Profiling is limited to fraud prevention and product personalisation. We do not run automated decision making with legal effects on customers. Personalised promotional emails are based on which games you tend to play and which days of the week you tend to log in. None of that profiling decides whether you can withdraw, claim a bonus or access a feature. Consent for promotional profiling can be withdrawn at any time inside account settings.

Who does ShelbyWin Casino share data with?

Payment processors see whatever is needed to settle the transaction. Game studios see anonymised gameplay logs for jackpot and tournament settlement. KYC providers see verification documents. Regulators see whatever they request under formal information notices. We do not sell personal data to third parties for marketing.

The full list of data processors is published in the privacy centre inside the account. Each entry lists the processor name, country of operation, data shared and the contract that governs the transfer. Where a transfer leaves the United Kingdom or European Economic Area, the legal mechanism (standard contractual clauses or adequacy decision) is named explicitly so you can see how the transfer is protected.

How long is the data kept?

Account and transaction records are kept for seven years after the account closes, in line with anti-money-laundering law. Marketing data is deleted within thirty days of you withdrawing consent. Verification documents are kept for as long as the licence requires, then securely destroyed. The close account page walks through what happens to data after closure.

What rights do I have over my data?

You can request a copy of every piece of personal data we hold, correct anything that is wrong, withdraw consent for marketing at any time, and request deletion subject to legal retention rules. The privacy team at privacy@shelbywin.vip handles all requests inside one calendar month.

For the longer read on data security measures, breach notification timelines and the supervisory authority you can escalate to, open the deeper briefing.

Security measures in place

All data in transit is encrypted with TLS 1.3 between your browser and our servers. Data at rest in the primary database is encrypted with AES-256. Verification documents are stored in a separate, segregated bucket with access restricted to named compliance staff and every access logged for audit. Database backups are encrypted, retained for 35 days and stored in a different region from the live data to support disaster recovery.

Internal access to player data follows least-privilege principles. Support agents see the data needed to resolve the ticket in front of them. Compliance sees verification documents. Finance sees aggregate payments. No single role has access to every category of data and access requests above standard scope require sign-off from the data protection officer.

Breach notification

If a data breach affecting personal data is detected, the regulator and the affected customers are notified within 72 hours of discovery, as required under the GDPR equivalent in our licensing jurisdiction. The notification explains what data was affected, what we are doing about it and what steps you should take to protect yourself. We have not had a notifiable breach to date.

Customers can report a suspected breach by emailing privacy@shelbywin.vip with the subject "Suspected breach". The privacy team investigates inside 24 hours and updates you with findings. False alarms are common and we do not consider any report unreasonable; we would rather investigate and find nothing than miss a genuine incident.

Right to complain

If you are not satisfied with how we have handled a privacy request, you have the right to complain to the supervisory authority in the licensing jurisdiction. The contact details are listed in the footer of every page and inside the privacy centre. You also retain the right to complain to the supervisory authority in your country of residence if you live in the United Kingdom or European Economic Area.

Cross-border transfers and the legal basis

Some processors operate from outside the United Kingdom and the European Economic Area. Where personal data crosses a border, the transfer is covered by either an adequacy decision from the European Commission or by standard contractual clauses signed between ShelbyWin Casino and the receiving party. The legal basis for each transfer is published in the privacy centre, alongside the country of destination and the categories of data transferred. We do not transfer data to countries that lack a recognised legal basis for the protection of personal data.

Where you would like a copy of the standard contractual clauses for any specific transfer, email privacy@shelbywin.vip and the privacy team will issue a redacted copy within one calendar month. The redactions remove pricing and other commercially sensitive material; the substantive protections are visible in full.

The data protection officer reviews the list of processors and the legal mechanisms behind each transfer at least once a year, and on any material change in the underlying contract. The annual review is summarised inside the privacy centre so customers can see the date of the most recent check and whether anything material has changed. Where a new processor is added the customer base is notified inside the account dashboard at least 30 days before the transfer begins.

Play at ShelbyWin Casino

18+. Please play responsibly. T&Cs apply.