Privacy Policy

1. Introduction

1.1 About This Policy

This Privacy Policy ("Policy") describes how Koala 88 ("we", "us", "our", or "the Platform"), operated through the website koala88casino-online.com, collects, processes, stores, uses, and shares personal information relating to players, visitors, and any other individuals who interact with our services (collectively, "you" or "Users").

We are fully committed to protecting your privacy and handling your personal information in a responsible, transparent, and lawful manner. This Policy has been prepared in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained therein, as amended by the Privacy and Other Legislation Amendment Act 2024, along with all other applicable Australian privacy and data protection legislation.

1.2 Scope of This Policy

This Policy applies to all personal information that we collect through:

• Your use of the Koala 88 website and gaming platform;
• Account registration, verification, and identity confirmation processes;
• Deposits, withdrawals, and all financial transactions conducted via the Platform;
• Customer support communications, including live chat, email, and telephone;
• Marketing communications you have opted into;
• Automated technologies such as cookies, pixels, and analytics tools;
• Any offline interactions with our support team.

1.3 Relationship with Other Documents

This Policy should be read in conjunction with our Terms and Conditions and our Responsible Gaming Policy, which together form the complete framework governing your relationship with Koala 88. By registering an account or continuing to use our services, you acknowledge that you have read and understood this Policy.

1.4 Consent

Where we rely on your consent to process certain categories of personal information, you have the right to withdraw that consent at any time without prejudice to the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent may, in some instances, limit your ability to access or use certain features of the Platform.

2. Data We Collect

2.1 Information You Provide Directly

When you register an account or interact with our Platform, we collect information that you voluntarily provide, including but not limited to:

2.1.1 Identity Data

• Full legal name
• Date of birth (used to verify that you meet the minimum age requirement of 18 years)
• Gender (optional)
• Government-issued identification documents, including passport, driver's licence, or Medicare card numbers (for identity verification purposes)

2.1.2 Contact Data

• Email address
• Mobile and/or landline phone number
• Residential or postal address

2.1.3 Financial Data

We collect payment-related information to facilitate deposits and withdrawals. Accepted payment methods available to Australian players include:

• Visa and Mastercard debit cards
• PayPal
• Bank transfer / Direct bank deposit
• PayID
• POLi Payments
• BPAY
• Neosurf vouchers
• Paysafecard
• Skrill
• Neteller
• Cryptocurrency (Bitcoin, Ethereum, and other supported digital assets)
• Flexepin vouchers

Please note that in accordance with Australian law, credit cards are not accepted for online wagering transactions, consistent with the ban introduced on 11 June 2024. We do not store full card numbers on our servers; payment card data is handled by PCI-DSS-compliant third-party payment processors.

2.1.4 Account and Profile Data

• Username and account password (stored in hashed form)
• Account preferences, language settings, and currency selection (AUD)
• Responsible gaming settings, including deposit limits, time-out periods, and self-exclusion status
• Marketing communication preferences

2.2 Information Collected Automatically

When you access the Platform, we automatically collect certain technical and behavioural data, including:

2.2.1 Technical Data

• IP address and geolocation (country/region level)
• Browser type, version, and operating system
• Device type, model, and unique device identifiers
• HTTP referrer URLs
• Time zone and language settings

2.2.2 Usage and Behavioural Data

• Pages visited, features accessed, and time spent on the Platform
• Games played, bet sizes, win/loss history, and session duration
• Clickstream data and navigation paths
• Deposit and withdrawal transaction logs and timestamps

2.2.3 Communications Data

• Records of customer support interactions (live chat transcripts, email correspondence)
• Responses to surveys and promotional campaigns

2.3 Information Received from Third Parties

We may receive personal information from the following external sources:

• Identity verification providers — to verify your identity, age, and address as required by applicable Know Your Customer (KYC) obligations;
• Anti-money laundering (AML) screening services — to comply with obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
• Payment processors and banking institutions — to confirm the status or legitimacy of financial transactions;
• Fraud prevention and risk management partners — to detect and prevent fraudulent or suspicious activity;
• BetStop – National Self-Exclusion Register — to check whether you are registered on Australia's self-exclusion register before allowing account creation or access to gambling services;
• Publicly available sources — such as public records or electoral rolls, where lawfully permitted.

2.4 Sensitive Information

In limited circumstances, we may collect sensitive information as defined under the Privacy Act 1988 (Cth), including health information relevant to responsible gambling assessments or information relating to your identity documents. We only collect sensitive information with your explicit consent, or where required or authorised by applicable law. Such information is subject to heightened safeguards and is not used for marketing purposes.

3. How We Use Your Data

3.1 Primary Purposes

We use your personal information for the following primary purposes:

• Account creation and management — establishing, maintaining, and administering your player account;
• Identity and age verification — ensuring that all users meet the minimum age requirement of 18 years in accordance with Australian law, and fulfilling KYC obligations;
• Service delivery — providing access to games, processing bets, crediting winnings, and facilitating all platform features;
• Financial transaction processing — executing deposits and withdrawals using your chosen payment method in Australian Dollars (AUD);
• Customer support — responding to queries, complaints, and technical issues;
• Responsible gambling — implementing and monitoring responsible gaming tools, including limits, self-exclusion, and player protection measures, as detailed in our Responsible Gaming Policy.

3.2 Compliance and Legal Obligations

• Complying with AML/CTF obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
• Responding to requests from regulators, law enforcement, and competent authorities;
• Maintaining records as required by applicable gaming, financial, and tax regulations;
• Detecting, investigating, and reporting suspicious transactions or fraudulent activity;
• Verifying registration status against the BetStop National Self-Exclusion Register.

3.3 Business Operations and Improvement

• Analysing platform usage and gaming patterns to improve user experience;
• Conducting internal audits, risk assessments, and performance analytics;
• Developing and testing new features, products, and services;
• Training customer support and compliance staff;
• Maintaining the security and integrity of the Platform.

3.4 Marketing and Communications

Where you have provided explicit consent, we may use your contact details and behavioural data to send you personalised promotional offers, bonus notifications, newsletters, and event invitations. You may withdraw your consent and opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email;
• Updating your preferences in your account settings;
• Contacting our support team at [email protected].

Opting out of marketing communications will not affect the delivery of transactional or service-related messages.

3.5 Automated Decision-Making

We may use automated processing to assist with fraud detection, risk scoring, and responsible gambling monitoring. Where automated processing produces decisions that significantly affect you — such as account restriction or flagging for AML review — you have the right to request human review of that decision by contacting our compliance team.

4. Legal Bases for Processing

4.1 Overview

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), we are required to process personal information only where lawfully permitted. The following table outlines the principal legal grounds on which we rely:

4.2 Legitimate Interests Assessment

Where we rely on legitimate interests as a basis for processing, we have conducted a balancing assessment to ensure that our interests do not override your fundamental privacy rights. You may request further information about any such assessment by contacting our Privacy Officer.

5. Data Sharing & Third Parties

5.1 Categories of Recipients

We do not sell your personal information to any third party. We may share your information only with the following categories of recipients, and only to the extent necessary for the stated purpose:

5.1.1 Service Providers and Data Processors

• Identity verification and KYC providers — to authenticate your identity and verify your age;
• Payment processors and financial institutions — to facilitate secure deposits and withdrawals in AUD;
• Game software providers — game studios whose titles are hosted on our platform may receive anonymised or aggregated gameplay data for technical purposes;
• Cloud infrastructure and hosting providers — who store and process platform data on our behalf;
• Fraud prevention and risk management vendors — to identify and mitigate fraudulent activity;
• Customer support platform operators — to manage live chat and support ticket systems;
• Marketing and analytics providers — to deliver campaigns and measure platform performance (subject to your consent preferences).

All third-party processors are required to handle your data in accordance with this Policy and applicable Australian privacy law, and are bound by contractual data processing agreements.

5.1.2 Regulatory and Legal Authorities

We may disclose personal information to government agencies, regulatory bodies, law enforcement authorities, and courts where:

• We are required to do so by law, court order, or regulatory direction;
• Disclosure is necessary to prevent, detect, or report a crime or fraudulent activity;
• Disclosure is necessary to protect the rights, property, or safety of Koala 88, its users, or the public;
• We are required to report under AML/CTF obligations, including submitting suspicious matter reports (SMRs).

5.1.3 BetStop – National Self-Exclusion Register

We are required to verify all new account applicants against the BetStop National Self-Exclusion Register prior to granting access to gambling services. Relevant data is shared with BetStop solely for this verification purpose, in accordance with the Australian Customer Identification Procedure (ACIP) requirements effective from 29 September 2024.

5.1.4 Business Transfers

In the event of a merger, acquisition, restructure, or sale of assets, your personal information may be transferred to a successor entity, subject to equivalent privacy protections being maintained. We will notify you of any such transfer that materially affects your rights under this Policy.

5.2 No Sale of Personal Data

We do not, and will not, sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

6. Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They enable the website to remember information about your visit, making it more useful and personalised. We also use related technologies such as web beacons, pixel tags, local storage objects, and session replay tools.

6.2 Types of Cookies We Use

6.3 Managing Your Cookie Preferences

Upon your first visit to the Platform, you will be presented with a Cookie Consent Banner through which you may accept or decline non-essential cookies. You may update your preferences at any time through our Cookie Settings panel, accessible in the footer of the website.

Additionally, most web browsers allow you to control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform, including your ability to maintain an active session or access personalised features.

6.4 Third-Party Tracking

Some of our third-party service providers — including analytics and advertising partners — may set their own cookies on your device. We do not control these cookies and recommend that you review the privacy policies of those providers directly.

7. Data Security

7.1 Technical and Organisational Measures

We take the security of your personal information seriously and implement a range of technical and organisational safeguards designed to protect your data from unauthorised access, loss, misuse, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS/SSL encryption) — all data transmitted between your browser or device and our servers is encrypted in transit;
• Encryption at rest — sensitive data, including identity documents and financial records, is encrypted when stored on our systems;
• Access controls — personal information is accessible only to authorised personnel with a documented business need, and access is governed by role-based permission systems;
• Password hashing — user passwords are never stored in plain text; industry-standard hashing algorithms are applied;
• Multi-factor authentication (MFA) — available to users and required for administrative access to our internal systems;
• Regular security audits and penetration testing — we engage third-party security specialists to conduct periodic assessments of our infrastructure;
• Intrusion detection and monitoring systems — real-time monitoring of network activity to detect and respond to threats;
• Staff training — all personnel with access to personal data undergo regular privacy and security training.

7.2 Data Breach Response

In the event of a data breach that is likely to result in serious harm to affected individuals, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme contained within the Privacy Act 1988 (Cth). This includes:

• Promptly assessing and containing the breach;
• Notifying the Office of the Australian Information Commissioner (OAIC) as required;
• Notifying affected individuals as soon as practicable, with a description of the breach, the information affected, and recommended steps they should take;
• Implementing remediation measures to prevent recurrence.

7.3 Limitation of Liability

While we employ commercially reasonable security standards, no method of electronic transmission or storage is entirely secure. We cannot guarantee the absolute security of your data and encourage you to use strong, unique passwords for your account and to notify us immediately if you suspect any unauthorised access.

8. Data Retention

8.1 General Principle

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, accounting, and compliance obligations. When personal information is no longer required, it is securely deleted or irreversibly anonymised.

8.2 Retention Schedule

8.3 Extended Retention

We may retain personal information beyond the periods specified above where: (a) it is necessary for ongoing legal proceedings, regulatory investigations, or dispute resolution; (b) we are required to do so by court order; or (c) you have specifically requested that we retain certain data for your reference.

9. Your Rights

9.1 Rights Under the Australian Privacy Principles

As an individual whose personal information we hold, you have the following rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles:

9.1.1 Right of Access (APP 12)

You have the right to request access to the personal information we hold about you. We will provide this information within 30 days of receiving a valid request, unless an exception applies (such as where access would be unlawful or would unreasonably impact the privacy of another individual). In exceptional circumstances, we may charge a reasonable fee for providing access.

9.1.2 Right to Correction (APP 13)

If you believe that personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you have the right to request that we correct it. We will correct or annotate the information within a reasonable timeframe, typically within 30 days, at no charge to you.

9.1.3 Right to Complain

You have the right to lodge a complaint with us regarding an alleged breach of the Australian Privacy Principles. We will acknowledge receipt of your complaint within 5 business days and provide a substantive response within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9.1.4 Right to Withdraw Consent

Where processing is based on your consent (e.g. for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

9.1.5 Right to Request Erasure

Under certain circumstances, you may request the deletion of your personal information. We will comply with such requests where we are not legally obligated to retain the data. Requests to delete account data subject to mandatory retention periods (e.g. AML/CTF records) may not be fulfilled until the relevant retention period expires.

9.1.6 Right to Object to Marketing

You may opt out of direct marketing communications at any time. We are required to give effect to your opt-out request promptly in accordance with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

9.2 Exercising Your Rights

To exercise any of the rights listed above, please submit a request to:

• Email: [email protected]
• Subject line: "Privacy Rights Request – [Your Name]"

To protect your privacy and security, we will verify your identity before processing any access or correction request. We reserve the right to decline requests that are manifestly unfounded, repetitive, or excessive.

9.3 Responsible Gambling Data

For information about your rights in relation to self-exclusion records, deposit limits, and other responsible gaming data, please refer to our Responsible Gaming Policy.

10. International Data Transfers

10.1 Cross-Border Disclosure

As an online platform utilising global infrastructure and service providers, we may transfer your personal information to recipients located outside of Australia. Such transfers may occur when we engage cloud hosting providers, game software developers, fraud detection services, or payment processors that operate internationally.

10.2 Safeguards for International Transfers

In accordance with APP 8 (Cross-border disclosure of personal information), before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles your information in a manner consistent with the Australian Privacy Principles. These steps may include:

• Entering into contractual data processing agreements that impose APP-equivalent obligations on overseas recipients;
• Transferring data only to countries that have been assessed as providing substantially similar privacy protections to those available under Australian law;
• Conducting due diligence on the privacy and security practices of overseas processors;
• Implementing technical safeguards, including encryption and access controls, for data in transit and at rest.

10.3 Accountability

Where we have taken the reasonable steps described in section 10.2, we remain accountable for any acts or practices of overseas recipients that are inconsistent with the APPs, to the extent required by APP 8.1. However, if you expressly consent to the transfer, or the transfer is required or authorised by law, this accountability may be modified as permitted by the Privacy Act.

11. Minors

11.1 Age Restriction

Access to Koala 88 is strictly restricted to individuals who are 18 years of age or older. This minimum age requirement applies to all users regardless of their location or the applicable state or territory law, and is consistent with Australian federal law and all relevant state-based gambling legislation.

11.2 Age Verification

We collect your date of birth during account registration and conduct mandatory age verification as part of our identity verification (KYC) process. We will not knowingly create an account for, or provide services to, any individual under the age of 18.

11.3 Discovery of Minor's Data

If we discover or have reason to believe that personal information belonging to a person under 18 years of age has been collected without appropriate verification, we will:

• Immediately suspend the associated account;
• Delete all personal information collected in relation to that minor as soon as practicable;
• Refund any deposits made, minus any applicable processing fees, to the payment method used;
• Report the matter to the relevant authorities where required.

11.4 Reporting Underage Access

If you believe a minor has accessed or is attempting to access the Platform, please notify us immediately at [email protected] or via our live chat feature.

12. Changes to This Policy

12.1 Right to Amend

We reserve the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance, or business operations. The most current version of this Policy will always be accessible on our website at /privacy-policy.

12.2 Notification of Material Changes

Where we make material changes to this Policy — that is, changes that significantly affect how we collect, use, or share your personal information, or that affect your rights — we will notify you by:

• Displaying a prominent notice on the Platform's homepage or login page;
• Sending an email notification to the address registered on your account;
• Presenting an updated consent prompt where required by law.

Notification will be provided at least 14 days prior to the effective date of any material change, except where immediate amendment is required to comply with applicable law, in which case we will notify you as soon as practicable.

12.3 Continued Use

Your continued use of the Platform following the effective date of any amendments constitutes your acceptance of the updated Policy. If you do not agree to the revised Policy, you should discontinue your use of the Platform and close your account in accordance with the process described in our Terms and Conditions.

12.4 Version History

13. Contact Information

13.1 How to Contact Us

We welcome any questions, requests, or concerns you may have regarding this Privacy Policy or the handling of your personal information. Please contact us using the details below:

13.2 General Support & Enquiries

13.3 Privacy Officer / Data Protection Contact

13.4 External Regulatory Body

If you are not satisfied with our response to a privacy complaint, you may lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC):

This Privacy Policy was last reviewed and updated on 9 September 2026 and is effective as of that date. Please also refer to our Terms and Conditions and our Responsible Gaming Policy for additional information governing your use of the Koala 88 Platform.