Privacy Policy

This Privacy Policy explains how Westward Way Tech N.V. ("K8 Casino", "we", "us", "our") collects, uses, discloses and protects personal data in connection with the k8casinor.com website, including the K8 Casino version of our service for users in the United Kingdom. It applies to players, visitors, and any other individuals whose personal data we process through k8casinor.com. Please read it carefully so that you understand how and why your data is used, as well as the choices available to you. This Privacy Policy is effective and applies from 1 January 2026.

Who We Are

The online casino services offered under the brand "K8 Casino" on k8casinor.com are operated by Westward Way Tech N.V., a company incorporated under the laws of Curaçao.

Legal entity and registration: Westward Way Tech N.V., registration number 158203, registered in Curaçao as a Naamloze Vennootschap (N.V.).
Registered address: Westward Way Tech N.V., Abraham de Veerstraat 9, Curaçao.
Gambling licence: The services are provided under Curaçao licence 365/JAZ with sub-licence GLH-OCCHKTW0708032021, issued by Gaming Services Provider N.V. The relevant licensing authority can be contacted at [email protected] for gambling-related regulatory disputes.
United Kingdom presence: Westward Way Tech N.V. does not have a physical office in the United Kingdom and is not licensed by the UK Gambling Commission. Access to k8casinor.com from the UK is provided on a cross-border basis under Curaçao law. National self-exclusion schemes such as GamStop do not apply; only our internal self-exclusion tools are available.

For the purposes of UK data protection law (including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018), Westward Way Tech N.V. acts as the "data controller" for personal data processed through k8casinor.com in relation to UK users.

Data Protection Contact

Data Protection Officer / privacy contact: Data Protection Officer, Westward Way Tech N.V.
Email: [email protected] (preferred channel for privacy and data-protection matters).
Postal: Data Protection Officer, Westward Way Tech N.V., Abraham de Veerstraat 9, Curaçao (please mark the envelope "Data Protection").

If you contact us about privacy or your data protection rights, we will handle your request in line with this Privacy Policy and applicable law.

What Personal Data We Collect

We collect and process different categories of personal data when you use k8casinor.com and the K8 Casino version of our services. The specific data collected depends on how you interact with us and the features you use.

Identification and Contact Data

Account and profile data: Full name, date of birth, username, password or other login credentials, preferred language, country of residence, and account settings.
Contact details: Email address, telephone number (where provided), instant messaging handles (if used for support), and correspondence history.
KYC/verification data: Copies of identity documents (passport, driving licence, national ID), proof of address (utility bill, bank statement), source of funds/source of wealth information, and any other documentation requested to satisfy KYC/AML requirements.

Financial and Transaction Data

Payment information: Limited payment card details (tokenised by payment processors), e-wallet identifiers, bank details where necessary for payouts, and crypto wallet addresses used for deposits and withdrawals.
Transaction history: Records of deposits, wagers, wins, losses, bonuses, withdrawals, refunds, chargebacks, and account balances.

Technical and Usage Data

Technical identifiers: IP address, device identifiers, browser type and version, operating system, time zone, language settings, and other technical information relating to devices used to access k8casinor.com.
Usage and log data: Login and logout times, session duration, pages and features accessed, clicks, scrolls, error logs, and diagnostic information.
Location-related data: Approximate location inferred from IP address or similar network information, which can be used for security, compliance, and localisation.

Behavioural and Profiling Data

Gameplay data: Games played, stakes placed, betting patterns, bet history, frequency and duration of sessions, game preferences, and bonus usage.
Risk and responsible gambling data: Self-exclusion and cooling-off settings, internal risk scores, indicators of potentially harmful play, and communications about responsible gambling.
Marketing and communication preferences: Subscription status for email, SMS or push marketing, and records of consent, withdrawal of consent, and opt-out choices.

Cookies and Similar Technologies

Cookie data: Unique identifiers stored in cookies and similar technologies (such as pixels, tags or local storage) to remember your preferences, keep you logged in, secure your account, and measure site performance.
Third-party tracking data: Information collected by analytics and advertising partners through cookies or similar technologies on our site, subject to your choices and applicable consent requirements.

Where required by law (for example in relation to non-essential cookies or certain marketing activities), we will only collect and use the relevant data once you have given your consent through our cookie banner or account settings.

Legal Basis for Processing

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, and, where applicable, the EU GDPR and other local laws. Our processing is based on one or more of the following legal grounds:

Performance of a Contract

Account creation and management: We process your identification, contact, financial and technical data to register your account, authenticate you, and provide access to k8casinor.com.
Provision of gambling services: We use your data to accept deposits, place bets, settle wagers, credit winnings, process withdrawals, and provide customer support.
Implementation of self-exclusion and limits: Where you use our internal responsible gambling tools, we process data necessary to apply those settings to your account.

Compliance with Legal Obligations

KYC/AML and fraud prevention laws: We are required under anti-money laundering and counter-terrorist financing laws, and other regulatory requirements, to verify your identity, assess risk, monitor transactions, and retain specific records for minimum periods.
Accounting and reporting obligations: We process and store transaction data to comply with tax, accounting, and statutory reporting obligations in Curaçao and other relevant jurisdictions.
Law enforcement and regulatory requests: We may process and disclose your data when required by courts, regulators (including Gaming Services Provider N.V.), or other competent authorities.

Legitimate Interests

Service optimisation and security: We analyse how k8casinor.com is used to maintain, improve and secure our systems, prevent abuse, detect bots or unauthorised access, and ensure network integrity.
Risk management and responsible gambling: We use behavioural and technical data (such as play patterns and device information) to identify potential fraud, bonus abuse, and gambling-related harm, and to take proportionate action.
Analytics and internal statistics: We use pseudonymised or aggregated data to understand product performance, user trends and to plan business development.
Defending legal claims: We may retain and use relevant data to establish, exercise, or defend legal claims or complaints.

When we rely on legitimate interests, we balance our interests against your rights and expectations, taking into account the nature of the data, the context of collection, and the impact of processing.

Consent

Marketing communications: Where required by law, we send electronic marketing (for example promotional emails or SMS) only with your consent. You can withdraw consent or opt out at any time.
Non-essential cookies and similar technologies: Analytics, advertising and certain functionality cookies are used only after you have given consent via our cookie banner or settings.
Special categories of data: In the rare cases where we may need to process health-related or other special category data (for example in connection with responsible gambling interventions), we will do so with your explicit consent or another applicable legal basis.

Purpose of Processing

We use personal data for the following purposes, each linked to one or more of the legal bases described above:

Providing and operating the casino services: To register and maintain your account, enable deposits, bets and withdrawals, manage game sessions, settle wagers, pay winnings, and provide customer support.
Compliance, verification and risk management: To perform KYC/AML checks, confirm your identity and age, monitor transactions for suspicious activity, prevent fraud and bonus abuse, and comply with regulatory and licensing obligations in Curaçao and other jurisdictions.
Responsible gambling: To offer and manage internal self-exclusion tools, deposit and loss limits, and other safeguards, and to monitor behavioural indicators of potential gambling-related harm.
Service improvement and personalization: To analyse usage data and gameplay patterns, troubleshoot technical issues, improve site performance, develop new features, and tailor content or offers to your interests (within the limits of applicable law).
Marketing and promotions: To send you promotional communications, loyalty offers and bonuses, to run campaigns, and to measure their effectiveness, subject to your consent and preferences.
Analytics and reporting: To produce aggregated statistics and business reports about our user base, game performance and financial metrics, in a way that does not identify you directly in public outputs.
Legal and regulatory purposes: To respond to complaints and disputes, cooperate with regulators and authorities, enforce our terms and conditions, protect our rights and those of other users, and manage potential or actual legal claims.

Disclosure & Sharing

We do not sell your personal data. We share personal data only with carefully selected third parties where necessary for the purposes described in this Privacy Policy, and always subject to appropriate safeguards and contractual protections.

Service Providers and Business Partners

Payment and banking partners: Payment processors, banks, e-wallet providers and crypto-payment gateways that process deposits and withdrawals. These partners receive only the information needed to perform the relevant transactions and comply with their own legal obligations.
Game and platform providers: Software providers that supply games and related technologies may receive identifiers and gameplay data needed to run games, resolve technical issues, and ensure fair operation.
KYC/AML and risk service providers: Identity verification companies, sanctions and PEP screening tools, fraud-detection services, and similar providers may receive identification, contact, and transaction data to help us meet our legal and risk-management obligations.
IT, hosting, and security providers: Cloud hosting services, content delivery networks, security monitoring and backup providers that process technical and limited personal data to support our infrastructure.
Analytics and advertising networks: Where permitted by law and subject to your choices, we may share pseudonymised identifiers and usage data with analytics or advertising partners to measure performance and, in some cases, display relevant offers.

Affiliates and Related Parties

Group entities and affiliates: Where Westward Way Tech N.V. has related companies or contractual affiliates that assist with customer support, marketing, compliance, or risk management, your data may be shared with them for compatible purposes.

Regulators, Authorities and Dispute Resolution Bodies

Gaming regulators: Gaming Services Provider N.V. and related regulatory bodies in Curaçao may receive your data when necessary to assess our compliance with licence 365/JAZ (sub-licence GLH-OCCHKTW0708032021) or to handle gambling-related complaints. Contact details for Gaming Services Provider N.V. include [email protected] for dispute submissions.
Data protection and other public authorities: We may share data with data protection authorities (for example the UK Information Commissioner's Office), law enforcement agencies, courts, and other governmental bodies where required by law or where necessary to protect our rights or the rights of others.
Dispute resolution or legal advisors: External lawyers, auditors, consultants, and alternative dispute resolution bodies may receive data where necessary to investigate and resolve complaints or legal claims.

Corporate Transactions

Business transfers: If we are involved in a merger, reorganisation, sale of assets, or similar corporate transaction, your personal data may be transferred to the relevant third parties as part of that transaction, subject to continued protection consistent with this Privacy Policy.

Whenever we share personal data with third parties, we require them (through contractual terms and/or law) to keep the data secure, to use it only for the specified purposes, and to process it in accordance with applicable data protection laws.

International Transfers

As a Curaçao-based operator serving users in multiple countries, including the United Kingdom, we may transfer your personal data to countries outside of the UK and the European Economic Area ("EEA"). These countries may have different data protection laws that are not considered to provide the same level of protection as UK or EU law.

Transfers to Curaçao: Most of our core systems, support teams and operational processes are based in or accessible from Curaçao, where Westward Way Tech N.V. is registered. Your data will routinely be stored and processed in Curaçao.
Transfers to other countries: Some of our service providers (for example payment processors, game providers, cloud hosts, analytics or support services) may be located in or process data from locations such as the EEA, Switzerland, the United States, and other jurisdictions.

Where we transfer personal data to countries that have not been recognised as providing an adequate level of data protection by the UK government or the European Commission, we implement appropriate safeguards, which may include:

Standard contractual clauses: Using UK or EU-approved standard contractual clauses in our agreements with non-UK/EEA recipients to ensure that your data enjoys equivalent protection.
Technical and organisational measures: Applying encryption, access controls, minimisation, and other security measures to limit access and reduce risk in cross-border transfers.
Due diligence and oversight: Assessing the legal environment and security posture of third parties that receive your data and taking reasonable steps to ensure compliance with our standards.

By using k8casinor.com, including the K8 Casino version of the site, you understand that your personal data will be processed in Curaçao and other countries as described above, subject to these safeguards and your data protection rights.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements. Retention periods are determined by reference to UK and Curaçao legal requirements, industry standards, and our own operational needs.

Account and profile data: Stored for the life of your account and normally for up to 5 years after account closure, to comply with anti-money laundering and gaming regulations, and to handle potential disputes or investigations.
KYC/AML and verification records: Identification documents, proof of address and related verification data are generally retained for at least 5 years from the end of the business relationship or the date of the last transaction, whichever is later, in line with AML regulations.
Transaction and gameplay records: Deposits, withdrawals, betting history and game logs are typically retained for 5 - 7 years after the transaction or account closure, to meet legal, tax and regulatory requirements and for evidence in case of claims.
Marketing and communication data: Records of consents, opt-outs and marketing interactions are kept for as long as you remain subscribed and for up to 3 years after you last interact with our marketing, unless you request earlier deletion where legally permissible.
Customer support and complaint records: Communications with support and dispute files are generally stored for up to 6 years from closure of the matter, to document our handling of issues and defend legal claims.
Technical logs and security data: Server logs, access logs and security-related records are usually kept for 12 - 24 months, unless longer retention is needed for security investigations or legal reasons.
Cookies and online identifiers: Cookie lifetimes vary depending on type and purpose. Session cookies are deleted when you close your browser; most persistent cookies last from a few days to up to 2 years, as described in our cookie settings interface.

When personal data is no longer required and no longer subject to a legal obligation to retain it, we will securely delete, anonymise or aggregate it so that it can no longer be linked to you. If you request deletion of your data, we will also consider our legal obligations and legitimate interests as explained in the "Your Rights" section below.

Your Rights

If you are in the United Kingdom or the EEA, you have rights under the UK GDPR or EU GDPR in relation to your personal data. If you are in Mexico, similar rights may apply under the Federal Law on Protection of Personal Data Held by Private Parties and its regulations. We endeavour to respect these rights in a consistent and transparent way, subject to any legal limitations.

Data Protection Rights

Right of access: You can ask whether we process your personal data and receive a copy of your data, together with information about how we use it.
Right to rectification: You can request correction of inaccurate or incomplete personal data. In many cases you can update certain details directly in your account settings.
Right to erasure ("right to be forgotten" / cancellation): You can request deletion of your personal data where there is no longer a lawful reason for us to keep it. We may need to retain certain data to comply with AML, gambling or other legal obligations, or to defend legal claims.
Right to restriction of processing: You can ask us to restrict the processing of your data (for example while we verify its accuracy or assess an objection).
Right to object: You can object to processing based on our legitimate interests, including profiling related to such interests. You also have an absolute right to object to direct marketing at any time.
Right to data portability: In certain circumstances, you can request that we provide your personal data in a structured, commonly used and machine-readable format, or that we transmit it to another controller where technically feasible.
Rights relating to consent: Where we rely on your consent (for example for marketing or cookies), you can withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
ARCO rights (Mexico): Where Mexican data protection law applies, you may exercise rights of Access, Rectification, Cancellation and Opposition over your personal data, which broadly correspond to the rights described above.

How to Exercise Your Rights

Contact point: To exercise any of these rights, please contact our Data Protection Officer at [email protected] and clearly state that your request concerns "Data Protection Rights".
Information we may request: We may ask you for additional information to verify your identity before acting on your request, especially where sensitive data or high-risk actions (such as account closure) are involved.
Timeframe: We aim to respond within one month (30 days) of receiving a valid request. If your request is complex or we receive numerous requests, we may extend this period by up to two further months; if we do so, we will inform you and explain the reasons for the delay.
Fees: We will normally handle your request free of charge. If a request is manifestly unfounded or excessive (for example repetitive), we may charge a reasonable fee or refuse to act, as permitted by law.
Limitations: Your rights are not absolute. We may refuse or limit a request where an exemption applies, such as where processing is necessary for compliance with legal obligations (for example AML record-keeping) or for the establishment, exercise or defence of legal claims. In such cases we will explain our reasoning, unless we are prevented from doing so by law.

Cookies & Tracking Technologies

We use cookies and similar technologies on k8casinor.com to make our services work, improve performance, personalise content, and support marketing activities. Some cookies are essential for the site to function, while others are optional and used only with your consent where required by law.

Types of Cookies We Use

Strictly necessary (session) cookies: These cookies are essential to provide core site functions, such as logging in, maintaining your session, processing bets and ensuring basic security. They are usually session-based and expire when you close your browser.
Functional and preference cookies: These may be session or persistent cookies that remember your choices (such as language, region, or display settings) and help customise your experience.
Analytics and performance cookies: These persistent or third-party cookies collect information about how visitors use the site (for example which pages are visited most often) to help us understand performance and improve services. Data is typically aggregated, but may include identifiers.
Advertising and targeting cookies: These cookies may be placed by us or our advertising partners to build a profile of your interests and show relevant offers, both on k8casinor.com and on other websites, depending on your choices.

Managing Cookies

Cookie banner and settings: When you first visit k8casinor.com, you will see a cookie banner that allows you to accept or reject non-essential cookies. You can modify your cookie choices at any time via our cookie settings panel (where available) or your account preferences.
Browser controls: Most browsers allow you to block or delete cookies via their settings. Blocking all cookies may affect site functionality, and you may not be able to use certain features or remain logged in.
Third-party opt-outs: For some analytics or advertising cookies, you may also manage preferences directly with the third-party providers, subject to the options they offer.

For more detailed information about the specific cookies and similar technologies used on k8casinor.com, including their lifetimes and purposes, please refer to our cookie settings interface or any dedicated cookie information pages we make available.

Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage. No system can be guaranteed as completely secure, but we work to reduce risks to a level appropriate to the nature of the data and the activities involved.

Technical Measures

Encryption in transit and at rest: Data transmitted between your browser and k8casinor.com is protected using TLS 1.2 or higher (commonly referred to as "HTTPS"). Where practical, we also encrypt sensitive data at rest within our systems.
Access controls and authentication: Access to personal data is restricted to authorised personnel and service providers who need it for their duties. We use role-based access controls, strong authentication mechanisms, and, where appropriate, multi-factor authentication for internal systems.
Network and application security: We employ firewalls, intrusion detection and prevention systems, and other security technologies to protect our network and applications from unauthorised access and attacks.
Backups and resilience: We maintain backup and recovery procedures to help ensure availability and integrity of data in case of technical failure or other incidents.

Organisational Measures

Policies and training: We maintain internal policies and procedures covering information security, data protection, acceptable use and incident response, and we provide training and awareness for relevant staff.
Vendor due diligence: We assess the security posture of key third-party service providers and include contractual obligations for data protection and security where they process personal data on our behalf.
Security reviews and audits: We periodically review our security measures, carry out internal or external assessments, and implement improvements as needed. Our controls are designed to align with internationally recognised security standards such as ISO 27001 and SOC 2, although we may not hold formal certification.
Incident response: We have procedures in place to identify, assess and respond to data security incidents. Where required by law, we will notify the relevant data protection authority (for example the UK Information Commissioner's Office) and affected individuals without undue delay.

We also encourage you to help protect your data by using a strong, unique password for your k8casinor.com account, keeping your login details confidential, enabling security features where available, and promptly contacting us if you suspect unauthorised use of your account.

Complaints & Contacts

We are committed to handling your personal data fairly and transparently. If you have questions or concerns about this Privacy Policy or how we process your data, please contact us first so that we can try to resolve the issue informally.

How to Contact Us

General support: For general account or service issues, please contact our customer support team via the support channels indicated on k8casinor.com (for example in-site chat or help centre).
Privacy-specific contact: For questions, requests, or complaints related to data protection, please email our Data Protection Officer at [email protected].
Postal: Data Protection Officer, Westward Way Tech N.V., Abraham de Veerstraat 9, Curaçao.

Complaint Procedure

Step 1 - Contact us: Send your query or complaint to our Data Protection Officer, providing as much detail as possible (including relevant dates, account identifiers, and copies of previous correspondence if applicable).
Step 2 - Our review: We will acknowledge receipt of your complaint and investigate it, involving relevant internal teams as needed. We aim to provide an initial substantive response within 30 days.
Step 3 - Further clarification: If we need more information from you to address your complaint properly, we will let you know and pause the response timeframe until we receive the requested details.
Step 4 - Outcome and follow-up: We will inform you of the outcome of our investigation and any steps we have taken or propose to take to address your concerns.

Escalation to Supervisory and Regulatory Authorities

UK data protection authority: If you are in the UK and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). Contact details (as at 2026) include: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom; website: www.ico.org.uk; telephone: +44 (0)303 123 1113.
EEA supervisory authorities: If you are located in the EEA, you may lodge a complaint with your local data protection authority. Contact details are available via the European Data Protection Board website at edpb.europa.eu.
Mexican data protection authority: If Mexican data protection law applies to you and you wish to escalate a matter, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). Website: home.inai.org.mx.
Gaming regulator (gambling disputes): For disputes specifically related to gambling operations under our Curaçao licence (for example game fairness or payout disputes), you may contact Gaming Services Provider N.V. at [email protected]. Please note that this channel is primarily for gambling regulatory issues, not data protection; it is known to provide limited remedies for players.

You can use these avenues in addition to, or instead of, contacting us directly. We nonetheless encourage you to approach us first, as we may be able to resolve your concerns more quickly.

Updates

We may update this Privacy Policy from time to time to reflect changes in our processing activities, our services, applicable laws, or regulatory guidance. When we make material changes, we will take appropriate steps to notify you and give you an opportunity to review the updated policy.

Notification methods: We may inform you of important updates via email, in-account notifications, prominent banners or notices on k8casinor.com, or any combination of these methods.
Advance notice for significant changes: Where feasible and required by law, we will provide at least 30 days' notice before material changes take effect, particularly where they could affect your rights or how we use your data.
Continued use of the service: If you continue to use k8casinor.com, including the K8 Casino version of the site, after changes take effect, you will be deemed to have acknowledged the updated Privacy Policy, subject to any rights you may have under applicable law.
Your options: If you do not agree with changes to this Privacy Policy, you should stop using our services and may request account closure and, where applicable, exercise your data protection rights as described in the "Your Rights" section.

Last updated: January 2026. Any future material revisions will be indicated by updating this date and, where appropriate, by including a summary of key changes or a changelog accessible from this page.