Privacy Policy
Privacy Policy
Wheelz Casino NZ
This Privacy Policy explains how Wheelz Casino NZ (operated by Rootz Limited) collects, uses, stores, and protects your personal information in accordance with applicable data protection laws.
🏛️ Operator: Rootz Limited
🇲🇹 MGA Licence: MGA/B2C/370/2017
🇳🇿 Applies to NZ players
This Privacy Policy applies to the website wheelzcasino-nz.com and all related services (“the Platform”) operated by Rootz Limited, a company incorporated and registered in Malta (registration number: C72981) with registered address at Tagliaferro Business Centre, High Street, Sliema SLM 1549, Malta.
Rootz Limited holds a gaming licence issued by the Malta Gaming Authority (MGA Licence: MGA/B2C/370/2017) and operates Wheelz Casino in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR) and applicable New Zealand privacy law.
Rootz Limited is the Data Controller for all personal data processed in connection with Wheelz Casino NZ. For data-related enquiries, contact: [email protected]
By registering an account, making a deposit, or using any feature of Wheelz Casino NZ, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your data as described herein.
We collect personal data in three ways: data you provide directly, data collected automatically, and data received from third parties.
- Full legal name, date of birth, and gender
- Email address, phone number, and residential address
- Username and account password (stored in encrypted form)
- Payment information (card details processed by PCI-compliant payment processors — we do not store full card numbers)
- Government-issued identity documents submitted for KYC verification (passport, driver’s licence, national ID)
- Proof of address documents (utility bills, bank statements)
- Source of funds documentation (where required by anti-money laundering regulations)
- Communications you send to our support team via live chat, email, or phone
- Responsible gambling preferences and limit settings
- IP address and approximate geographic location
- Device type, operating system, and browser information
- Session data including login timestamps and session duration
- Game activity: games played, bets placed, wins, losses, and bonus use
- Transaction history: deposits, withdrawals, and transfer records
- Cookies and similar tracking technologies (see Section 7)
- Referral source and marketing attribution data
- Identity verification data from KYC/AML service providers
- Payment verification data from payment processors and financial institutions
- Fraud prevention and risk-scoring data from third-party providers
- Social login data if you register using Google or Facebook (name and email only)
- Marketing attribution data from affiliate and tracking partners
We use your personal data for the following purposes:
Creating and managing your player account; processing deposits and withdrawals; providing access to games and casino features; sending transactional communications (deposit confirmations, withdrawal notifications, account alerts).
Verifying your identity (KYC); complying with anti-money laundering (AML) obligations; fulfilling MGA licence requirements; maintaining records required by law; responding to regulatory enquiries and law enforcement requests.
Detecting and preventing fraud, money laundering, and account abuse; monitoring for suspicious activity; enforcing our Terms and Conditions; protecting the security and integrity of the Platform.
Monitoring play behaviour to identify potential problem gambling patterns; enforcing player-set limits; applying self-exclusion and cool-off restrictions; providing responsible gambling tools and resources.
Sending promotional emails, bonus offers, and newsletters where you have consented; personalising bonus offers based on your gaming behaviour; conducting market research and analytics to improve our services. You can opt out of marketing at any time.
Responding to your queries and complaints; maintaining records of support interactions for quality assurance; improving our support processes based on feedback.
Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:
Processing necessary to provide our services and fulfil our contractual obligations to you — account management, payment processing, game access.
Processing required to comply with applicable laws — KYC/AML verification, MGA licensing requirements, tax reporting obligations, and law enforcement requests.
Processing in furtherance of our legitimate business interests — fraud prevention, platform security, responsible gambling monitoring, analytics, and service improvement — where these interests are not overridden by your rights.
Processing based on your explicit consent — primarily for direct marketing communications and personalised offers. You may withdraw consent at any time by unsubscribing or adjusting your marketing preferences in your account settings.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal and regulatory requirements.
After the applicable retention period, your data is securely deleted or anonymised. Certain data may be retained for longer periods where required by law or for legitimate dispute resolution purposes.
We implement comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction.
- SSL/TLS Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS technology.
- Data Encryption at Rest: Sensitive personal data, including identity documents and payment information, is encrypted when stored.
- PCI DSS Compliance: Our payment processing systems comply with the Payment Card Industry Data Security Standard.
- Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. All access is logged and audited.
- Security Monitoring: We continuously monitor our systems for threats, suspicious activity, and unauthorised access attempts.
- Regular Security Audits: We conduct regular security assessments and penetration testing to identify and address vulnerabilities.
- Data Breach Response: We maintain a data breach response plan and will notify affected individuals and relevant authorities within 72 hours of discovering a significant breach, in accordance with GDPR requirements.
While we implement industry-leading security measures, no method of internet transmission is 100% secure. You should always use a strong, unique password for your Wheelz account and enable two-factor authentication where available.
Under GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Request a copy of all personal data we hold about you, free of charge.
Request correction of inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where there is no longer a lawful basis for retention.
Request that we limit the processing of your data in certain circumstances.
Receive your data in a structured, machine-readable format to transfer to another service.
Object to processing based on legitimate interests, or to direct marketing at any time.
Request human review of automated decisions that significantly affect you.
Some rights are subject to limitations. For example, we may be unable to delete data we are legally required to retain for AML/KYC purposes. We will always explain our reasoning clearly in our response to any data rights request. You have the right to lodge a complaint with the Malta Information and Data Protection Commissioner (idpc.org.mt) or the New Zealand Privacy Commissioner (privacy.org.nz).
Wheelz Casino NZ is strictly prohibited to individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age.
All players are required to verify their identity and age as part of the KYC process before making withdrawals. If we become aware that we have inadvertently collected personal data from a minor, we will immediately close the account, refund any deposits, and delete all associated personal data.
If you believe a minor has registered an account, please contact us immediately at [email protected].
As a Malta-based operator serving New Zealand players, your personal data may be transferred from New Zealand to Malta (EU) and to other countries where our service providers operate.
Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Transfers to countries with an EU adequacy decision
- Binding Corporate Rules where applicable
- Explicit consent where no other mechanism applies
New Zealand has been recognised as providing adequate data protection under EU standards. For transfers from the EU to New Zealand, we rely on the EU-New Zealand adequacy determination.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:
- Update the “Last Updated” date at the top of this Policy
- Send a notification email to all registered account holders
- Display a prominent notice on the Platform for at least 30 days
Your continued use of the Platform after notification of changes constitutes your acceptance of the updated Policy. If you do not agree with the changes, you should close your account and contact us to request deletion of your data.
For any questions, concerns, or to exercise your data rights, please contact our Data Protection Officer:
Available 24/7 via the Platform
Rootz Limited, Tagliaferro Business Centre, High Street, Sliema SLM 1549, Malta
New Zealand players may also contact the Office of the Privacy Commissioner of New Zealand if they believe their privacy rights have been breached. Visit privacy.org.nz or call 0800 803 909.
This Privacy Policy was last updated on 7 May 2025. If you have any questions about how we handle your personal data, please contact us at [email protected].
