Last updated: January 2026
1. Who We Are
This privacy policy describes how Whitebox B.V., the operator of V.Vegas ("we"), processes the personal data of players and visitors. We act as data controller for the information described below. You can reach our data team at [email protected].
2. Data We Collect
- Account data: Name, date of birth, email, phone, address, currency, password (hashed).
- Verification data: Identity documents, proof of address, proof of payment, source-of-funds documents.
- Transaction data: Deposits, withdrawals, bets, balances, bonus history.
- Technical data: IP address, device, browser, operating system, referrer URL, session timestamps.
- Marketing data: Communication preferences, promotion responses, segmentation tags.
- Support data: Chat logs, emails, call recordings (where applicable).
3. Why We Process Your Data
- To register and manage your account (contractual necessity).
- To process deposits, bets, and withdrawals (contractual necessity).
- To fulfil AML, KYC, and licensing obligations (legal obligation).
- To prevent fraud, multi-accounting, and bonus abuse (legitimate interest).
- To send service messages and, when you opt in, marketing communications (consent).
- To improve the platform and games (legitimate interest, anonymised analytics where possible).
4. Cookies
We use first-party and third-party cookies for session management, security, analytics, and marketing measurement. You can manage cookie preferences via the banner shown on first visit and at any time through the link in our footer. Strictly necessary cookies cannot be disabled as the site will not function without them.
5. Sharing
We share data only with parties that help us deliver the service or that we must notify by law:
- Game providers and platform partners (under data processing agreements).
- Payment providers, including T&C Whitebox CY Limited (HE 419583, Cyprus).
- KYC, AML, and fraud prevention vendors.
- Cloud and hosting providers in the EEA, UK, and Curaçao.
- Regulatory authorities, including the Curaçao Gaming Control Board.
- Law enforcement agencies when compelled by valid legal process.
We do not sell your personal data to third parties.
6. International Transfers
Some of our processors are located outside the EEA. In those cases we rely on standard contractual clauses or other safeguards approved by the relevant data protection authority to protect your data to an equivalent standard.
7. Retention
We retain account and transaction data for at least 5 years after closure of your account, in line with AML law. Marketing data is kept while you remain opted in. Support records are retained for up to 24 months. Backups are securely deleted on a rolling schedule.
8. Your Rights
If you are in the EEA, UK, or a jurisdiction with similar laws, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete information.
- Request deletion of data we no longer need to hold.
- Restrict or object to certain types of processing.
- Receive a copy of data you provided in a portable format.
- Withdraw consent at any time where consent is the basis for processing.
- Lodge a complaint with the data protection authority in your country.
To exercise these rights, write to [email protected]. We respond within 30 days.
9. Security
We apply TLS encryption across all connections, hash and salt all stored passwords, segregate player funds in dedicated accounts, and use role-based access controls internally. Penetration testing is conducted every six months by an independent security firm.
10. Updates
If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. The date at the top of this page always reflects the latest revision.