4tuna Casino privacy: data collection, retention and rights
Play with bonus
ALPECA LIMITED, Cyprus company HE 464760, is the published data controller for 4tuna Casino personal data. The policy covers information from forms, communications and surveys, payment and transaction records, and technical, location and visit data.
For former customers, the published Privacy Policy states a minimum retention period of 5 years after the last transaction. Information may be retained for longer where legal or technical reasons require it.
Published privacy rights include access, correction, erasure where applicable, restriction, portability, objection, withdrawal of consent and the ability to challenge automated-only decisions. Data-protection requests can be directed to [email protected].
| Privacy item | Published rule |
|---|---|
| Data controller | ALPECA LIMITED, Cyprus HE 464760 |
| Data categories | Forms, communications, surveys, payment and transaction records, technical, location and visit data |
| Processing bases | Contract, legal obligation, consent and legitimate, public or vital interests where applicable |
| Former-customer retention | Minimum 5 years after the last transaction, potentially longer for legal or technical reasons |
| Published rights | Access, correction, erasure where applicable, restriction, portability, objection, consent withdrawal and challenge to automated-only decisions |
| Data-protection contact | [email protected] |
Who controls 4tuna Casino personal data
The published data controller is ALPECA LIMITED, registered in Cyprus under company number HE 464760.
The data-controller role identifies the legal entity responsible for the privacy processing described in the policy. It should not be confused with the consumer-facing 4tuna Casino brand or with separate questions about gambling licensing.
What personal data is processed and why
The published policy identifies several categories of personal and account-related information.
| Area | Published scope |
|---|---|
| Forms | Information submitted through forms |
| Communications | Messages and other communications with the operator |
| Surveys | Information provided through surveys |
| Payments and transactions | Payment and transaction records |
| Technical information | Technical data associated with site or account use |
| Location information | Location-related information collected within the published policy scope |
| Visit and log data | Records connected with visits and technical activity |
The published processing bases include performance of a contract, legal obligations and consent. Legitimate interest, public interest and vital interest may also be used where applicable.
These categories describe the types of information identified in the policy. They should not be treated as an exhaustive list of every individual database field held for every account.
How long personal data is retained
The Privacy Policy and the Terms contain two retention statements with different starting points, so they should be kept separate.
| Published rule | Starting point | Retention period |
|---|---|---|
| Privacy Policy | Last transaction | Minimum 5 years, potentially longer for legal or technical reasons |
| Terms | Account closure | At least 5 years |
The Privacy Policy states that personal data relating to closed or former customers is kept for a minimum of 5 years after the last transaction. Longer retention may apply for legal or technical reasons.
The Terms separately state that closed-account data is retained for at least 5 years after account closure. Because the two published rules use different reference events, they should not be combined into one assumed deletion date.
Data security and who information may be shared with
The Privacy Policy describes several security measures used by the operator.
| Area | Published statement |
|---|---|
| AWS access | Role-based access controls are described |
| Back-office activity | Back-office audit measures are described |
| KYC records | Access to verification records is restricted |
| Oversight | DPO oversight is included in the published security framework |
| Law enforcement | Personal data may be disclosed within this recipient category |
| Regulators | Personal data may be disclosed to relevant regulators |
| Group entities | Group companies are listed among recipient categories |
| Introduction partners | Introduction partners are included among published recipient categories |
| Service providers | Requested service providers are included among published recipient categories |
These are operator-published security and recipient categories. They do not amount to a guarantee that a data-security incident can never occur, and the recipient categories should not be expanded into an invented list of specific vendors.
Privacy rights and DPO contact
The published privacy material lists a set of rights that can apply to personal data processing.
- Request access to personal data.
- Request correction of inaccurate information.
- Request erasure where applicable.
- Request restriction of processing.
- Exercise data portability where applicable.
- Object to processing where the relevant right applies.
- Withdraw consent where processing is based on consent.
- Challenge decisions made solely through automated processing.
The published data-protection contact for 4tuna.nz is [email protected].
No fixed DPO response deadline is established in the published material used here, so a specific response time should not be assumed.
Cookies and consent settings
Cookies form a separate part of the site’s privacy controls. The published cookie categories are Necessary, Preference, Statistics and Marketing.
Cookie choices can be managed through the cookie banner and Cookie Settings, while browser settings may also be used to block cookies. The policy also states that third-party analytics and advertising providers may set cookies.
The individual categories, their stated purposes and available controls are explained on the dedicated cookies page.
Account closure, deletion and retained records
Closing an account can include an option to delete some profile information and submitted verification documents. That does not establish that every personal-data record will be deleted immediately.
Legal retention requirements can continue to apply after closure or a deletion request. This is consistent with the published minimum-retention rules for former and closed accounts.
Erasure is therefore described as a right where applicable rather than an unconditional guarantee that every record can always be removed immediately.
The consequences of selecting account closure with profile-data deletion are covered in more detail under close account.
Frequently asked questions
The published data controller is ALPECA LIMITED, Cyprus company HE 464760.
The published categories include information from forms, communications and surveys, payment and transaction records, and technical, location and visit data.
They include contract, legal obligation and consent, plus legitimate, public or vital interests where applicable.
The Privacy Policy states a minimum of 5 years after the last transaction, with longer retention possible for legal or technical reasons.
No. The Terms separately state at least 5 years after account closure, while the Privacy Policy uses the last transaction as its reference point.
The published measures include role-based AWS access, back-office audit controls, restricted KYC-record access and DPO oversight.
Published recipient categories include law enforcement, regulators, group entities, introduction partners and requested service providers.
The published rights include access, correction, erasure where applicable, restriction, portability, objection, withdrawal of consent and the ability to challenge automated-only decisions.
The published DPO contact for 4tuna.nz is [email protected].
No exact response deadline is established in the published material used here.
No. Erasure applies where applicable, and legal retention requirements can continue to apply.
The cookie policy separates Necessary, Preference, Statistics and Marketing cookies and provides consent-management controls.
Yes. The published policy states that third-party analytics and advertising providers may set cookies.
No such complete and immediate deletion is established. Some profile information and submitted verification documents can be deleted, while legally required records may still be retained.
No. Privacy-policy provisions do not establish New Zealand online-casino licensing or local gambling eligibility.