32red Privacy Policy: What Data the Operator Collects and How It Is Handled
This page summarises the privacy rules 32red publishes for its players, and the operator’s own Privacy Notice and Cookie Policy remain the authoritative documents. If you play at 32red Casino, a fair amount of personal data changes hands — here is exactly what the operator collects, why it collects it, and what control you keep over it.
What information does 32red collect?
32red groups the data it collects into a few clear areas, with identity and verification data sitting at the centre of it all. This information is gathered to meet the operator’s legal obligations under anti-money laundering (AML) and age verification rules, so it is not optional — it is part of holding a player account.
Identity and verification data
To satisfy AML and age checks, 32red asks for photographic ID such as a passport or driving licence. This is the core of the verification process: the operator needs to know who you are before money moves in or out of your account. Account registration details sit alongside this, and the signup flow itself is covered in more depth here: 32red sign-up process.
Account, gameplay and service data
Beyond ID documents, the operator collects the data needed for account operation and service provision — the day-to-day information that keeps your profile, balance and play history running. This feeds two documented purposes: account operation and service provision, plus responsible gambling and player safety monitoring.
Cookies and tracking
32red maintains a separate cookies policy covering tracking technologies on its site. The operator documents this as part of its published Privacy Notice and Cookie Policy, so the detail on what is dropped on your device lives in that dedicated document.
How does 32red use your information?
The operator lists five stated purposes for processing player data, and every piece of information collected maps onto one of them. None of them is vague — each is tied to a specific function of running the casino.
- Legal and regulatory compliance — meeting AML, age verification and licensing obligations.
- Responsible gambling and player safety — monitoring play to protect players; more on the tools around this here: 32red responsible gambling.
- Account operation and service provision — keeping your account working, from login to payouts.
- Marketing and personalisation — tailoring offers and communications to your activity.
- Business improvement and analytics — using aggregated insight to refine the service.
Marketing communications
Marketing and personalisation is one of the five documented purposes, meaning the operator may use your data to shape the offers you see. Because consent sits behind this, you can withdraw it at any point — that right is spelled out below.
How does 32red protect and share your data?
32red documents security measures and a data retention policy as part of its privacy framework, with a named data controller responsible for how information is handled. The operator also sets out how long data is kept and who else touches it.
Data retention
The operator maintains a defined data retention approach, keeping records for as long as its legal and regulatory obligations require — particularly where AML and verification rules demand records be preserved after an account closes.
Third-party recipients
Your data does not always stay inside 32red. The operator names two recipients in its privacy documentation:
- GB Group (GBG) — used for identity and verification checks.
- Risepoint Limited (formerly Trannel) — a further named recipient of player data.
Who is in charge of your data?
32red identifies a data controller in its privacy documentation and provides a DPO contact — a Data Protection Officer you can reach directly with any privacy question or request. That contact point is your route for exercising every right listed below.
What rights do you have over your data?
32red recognises the full set of data subject rights, and you can exercise any of them through the operator’s DPO contact. These are not theoretical — the operator lists each one explicitly.
- Access — ask for a copy of the personal data held about you.
- Rectification — have inaccurate details corrected.
- Erasure — request deletion of your data where the law allows.
- Restriction — limit how your data is processed.
- Portability — receive your data in a transferable format.
- Object — object to certain processing, including direct marketing.
- Withdraw consent — pull consent at any time where processing relies on it.
Deleting your data is not always immediate — retention obligations tied to AML rules can override an erasure request until the legal holding period ends. Opting out of marketing is simpler: withdrawing consent stops the personalisation and promotional use of your data. The broader rules governing your account sit alongside this page here: 32red terms and conditions.
For background on who publishes this independent review and how it relates to the operator, see: about 32red.
Want to see the operator’s full privacy documentation first-hand? Head over to 32red and read the original Privacy Notice and Cookie Policy.