Privacy Policy

This Privacy Policy explains how Chan, operated via the website located at https://chan-au.com, collects, uses, discloses and protects personal information of players and website visitors. It applies to all individuals who access or use chan-au.com, create an account, participate in gambling services, or interact with our support channels. By using chan-au.com you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is effective as of 6 November 2025 and is intended to remain in force and be interpreted consistently through at least 2026, subject to updates described below.

Who We Are

OBSERVE: Identify the operator, registration details and contact person for privacy matters. EXPAND: Clarify offshore nature, payment subsidiary and main communication channel. REFLECT: Present a clear legal identity and a stable point of contact for privacy issues.

The online casino services reviewed and made available via Chan on the domain chan-au.com (the "Website") are operated by:

Operator: Dama N.V., a public limited company (N.V.) incorporated under the laws of Curaçao.
Registration number: 152125.
Registered and legal address: Scharlooweg 39, Willemstad, Curaçao.
Gaming licence: Dama N.V. operates under licence 8048/JAZ2020-013, issued to Antillephone N.V. by the Government of Curaçao and treated as valid at least through 2026.

Certain payment processing and related services may be provided on behalf of Dama N.V. by its subsidiary:

Payments subsidiary: Strukin Ltd, a limited liability company registered in Cyprus (exact address may be provided upon written request).

The main contact for all questions, requests and complaints relating to privacy and data protection for Chan and chan-au.com is:

Data Protection Contact / DPO Function: Data Protection Officer, Dama N.V.
Email: [email protected] (please include "Privacy request" in the subject line).
Postal contact: DPO, Dama N.V., Scharlooweg 39, Willemstad, Curaçao.

Chan is not operated by an Australian-incorporated entity and does not maintain a physical office in Australia. Access to some related domains (including casinochan.com) may be subject to blocking or restrictions by Australian regulators such as the Australian Communications and Media Authority (ACMA). This Privacy Policy nevertheless aims to reflect high international privacy standards appropriate for users located in Australia.

What Personal Data We Collect

OBSERVE: Identify all main data categories processed through chan-au.com. EXPAND: Distinguish between data actively provided by users and data automatically collected, including cookies and behavioural logs. REFLECT: Provide a clear, categorical overview to support transparency and later rights exercises.

Account and Identification Data

Personal identification data: full name, date of birth, gender (where provided), residential address, nationality, and copies or details of identification documents (such as passport, ID card, driver's licence) provided for age verification, KYC and anti-money laundering (AML) purposes.
Contact details: email address, phone number, and any other contact channel you provide to us (e.g. messaging handles where applicable).
Account data: username, password hash, preferred language, account settings, communication preferences, verification status, and associated internal identifiers.

Technical and Usage Data

Technical identifiers: IP address, device identifiers, operating system, browser type and version, screen resolution, and basic device configuration.
Log and session data: date and time of access, pages visited, clicks, navigation paths, referral URLs, session duration and similar usage metrics collected through our servers and analytics tools.
Security-related technical data: login attempts, authentication events, changes to device or connection patterns, and system events used for fraud and security monitoring.

Payment and Financial Data

Transaction data: payment amounts, currencies, timestamps, transaction identifiers, method used (e.g. card, e-wallet, cryptocurrency where supported), bonuses credited, withdrawals requested and processed.
Payment instrument data: limited card or wallet details as necessary for processing (for example, masked card numbers and expiry dates), collected and processed by us and/or Strukin Ltd and other authorised payment service providers in accordance with applicable payment security standards.
AML/KYC financial data: information and documents to verify source of funds or comply with AML/CTF obligations, such as proof of income or bank statements, where required by law or our internal policies.

Behavioural and Gambling Data

Gameplay information: betting and wagering history, games played, time spent per session, stakes, wins and losses, bonus usage, and participation in tournaments or promotions.
Interaction data: clicks on banners or offers, interaction with responsible gambling tools, participation in VIP or loyalty programs, and responses to surveys or feedback forms.
Risk and profile indicators: internally generated indicators used for responsible gambling analytics, fraud detection and AML monitoring (e.g. unusual patterns of transactions or gameplay).

Communication Data

Support and correspondence data: contents of messages sent to [email protected], transcripts of live chat sessions, records of telephone or VoIP conversations where applicable, and metadata relating to your communications with us.
Marketing communication data: preferences regarding newsletters, promotional offers, consent records, opt-in/opt-out history, and interactions with marketing emails (e.g. opens, clicks, unsubscribes).

Cookies and Similar Technologies

Cookies: small text files stored on your device that may contain identifiers, preferences, or technical information to support navigation, security, analytics and advertising.
Similar technologies: web beacons, pixel tags, local storage, and software development kits (SDKs) used to track performance of our Website and campaigns, or to ensure proper functioning of the casino platform.

Where we collect personal data from third parties (for example, identity verification providers, payment processors, affiliates or advertising partners), we process such data in accordance with this Privacy Policy and the information provided to you at the time of collection.

Legal Basis for Processing

OBSERVE: Identify the main legal grounds that justify data processing (consent, contract, legitimate interests, legal obligations). EXPAND: Clarify how these grounds apply in the online gambling context, including KYC/AML and security. REFLECT: Enable users to understand why their data is required and under which framework it is processed.

Performance of a Contract

Account creation and management: We process your identification, contact, and account data to register you as a player, verify your eligibility to use the services, and manage your casino account.
Provision of gambling services: We process behavioural, gameplay and transaction data to accept your bets, credit winnings, manage balances and provide bonuses, promotions and tournaments.
Customer support: We use your communication data and account information to respond to your queries, assist with technical issues, and handle complaints or disputes.

Compliance with Legal Obligations

KYC/AML and responsible gambling: We process identification, financial and behavioural data to comply with anti-money laundering, counter-terrorism financing and player protection requirements applicable in our licensing jurisdiction and under generally recognised industry standards.
Record-keeping and reporting: We may keep transaction and account records for tax, accounting and regulatory reporting purposes for periods required by applicable law or licensing conditions.
Regulatory and law enforcement requests: We may process and disclose personal data in response to lawful requests by courts, regulators, law enforcement or other competent authorities.

Legitimate Interests

Security and fraud prevention: We process technical, behavioural and transaction data to detect and prevent fraud, abuse of bonuses, account takeovers, money laundering schemes and other harmful or illegal activities.
Service improvement and analytics: We analyse aggregated and pseudonymised usage data to improve the Website's performance, optimise user experience, and develop new features or offerings.
Protection of rights and interests: We process data as necessary to establish, exercise or defend legal claims, enforce our Terms and Conditions, and ensure the integrity of our games and systems.

Consent

Marketing communications: We send you newsletters, promotional offers and personalised advertising by email or other electronic means only where you have given your explicit consent or where permitted by applicable law, and you may withdraw such consent at any time.
Optional cookies and tracking: We use certain non-essential cookies and similar technologies (for example for advertising or extended analytics) only after obtaining your consent via our cookie banner or settings, where required.
Additional uses: If we intend to process your data for new purposes not covered by this Privacy Policy, we will inform you in advance and, where necessary, ask for your consent.

Where different legal bases may apply in parallel (for example, both legal obligation and legitimate interest), we rely on each basis as appropriate and retain records to demonstrate compliance.

Purpose of Processing

OBSERVE: List the main purposes for which different categories of data are used. EXPAND: Connect each purpose with specific operations of chan-au.com (casino gameplay, payments, security, marketing). REFLECT: Present a transparent mapping between user expectations and our internal data uses.

Provision and operation of casino services: To register and authenticate users, allow deposits and withdrawals, process wagers, determine game outcomes, calculate bonuses and jackpots, and operate all features of the chan-au.com casino platform.
Account administration: To manage your profile, account limits, self-exclusion tools, verification status, and communication preferences, and to provide tailored customer support.
Regulatory compliance: To comply with obligations relating to age verification, KYC/AML, responsible gambling, taxation, reporting, record-keeping and other legal or licensing duties.
Fraud detection and risk management: To monitor and analyse transactions and gameplay behaviour for signs of fraud, collusion, money laundering, self-exclusion breaches, bonus abuse or other prohibited activities, and to take appropriate measures.
Service quality and optimisation: To perform analytics on aggregated and pseudonymised data, measure performance of games and features, test new functionalities, improve stability and security, and tailor the user interface.
Marketing and personalisation: To send permitted marketing communications, display tailored offers, bonuses and recommendations, perform campaign analysis, and manage loyalty or VIP programs, subject to your consent where required.
Communication and dispute handling: To respond to inquiries, feedback and complaints sent to [email protected], to manage internal records of communications, and to resolve disputes or enforce our Terms and Conditions.
Legal protection: To prevent misuse of our services, protect our rights, property and safety, and to establish, exercise or defend legal claims in administrative, judicial or other proceedings.

Disclosure & Sharing

OBSERVE: Identify typical categories of recipients in an online gambling ecosystem. EXPAND: Explain the conditions under which data is shared with each category, including cross-border implications. REFLECT: Provide safeguards and clarify that data is not sold for unrelated purposes.

Service Providers and Processors

Payment service providers: Banks, card processors, e-wallet providers, cryptocurrency processors and other financial intermediaries, including Strukin Ltd and its partners, receive transaction and limited identification data strictly as necessary to process deposits, withdrawals and refunds, and to comply with financial regulations.
Technical and hosting providers: Companies that host our servers, provide content delivery networks, security services, cloud infrastructure, IT support and maintenance may have access to technical and usage data under strict confidentiality obligations.
Verification and KYC providers: Identity verification, fraud prevention and AML/CTF screening providers may receive identification documents and related data to perform checks on our behalf.
Analytics and customer engagement tools: Providers of analytics, emails, ticketing or live chat platforms may process communication and usage data to enable us to analyse and respond to your interactions.

Affiliates, Partners and Advertising Networks

Affiliate partners: We may share limited data such as aggregated performance metrics or pseudonymised identifiers with affiliates who referred you to chan-au.com, for the purpose of verifying traffic sources, calculating commissions and combating fraud.
Marketing and advertising networks: With your consent where required, we may use cookies and tracking technologies provided by third-party advertising networks to measure campaign performance and present relevant offers. Personal data used in this context is generally pseudonymised or aggregated.

Corporate Structure and Legal Recipients

Group companies: Dama N.V., Strukin Ltd and other current or future group entities may share data internally for centralised administration, compliance, risk management, IT security and reporting, subject to appropriate safeguards.
Regulators and authorities: We may disclose personal data to regulators, licensing authorities (including those in Curaçao), law enforcement agencies, courts and other public bodies when required by law, regulation or a valid legal process.
Business transfers: In connection with a merger, acquisition, restructuring or sale of some or all of our assets, personal data may be transferred to the relevant counterparties, subject to confidentiality protections and continued adherence to applicable privacy laws.

We do not sell your personal data to third parties for their independent marketing purposes. All disclosures are limited to what is necessary for the purposes described in this Privacy Policy and are governed by appropriate contractual and legal safeguards.

International Transfers

OBSERVE: Recognise that Chan is operated from Curaçao with cross-border infrastructure and partners. EXPAND: Indicate main regions involved (EU/Cyprus, other EEA or non-EEA countries) and typical safeguards. REFLECT: Explain how we aim to maintain an adequate level of protection for international users, including those located in Australia.

Due to the international nature of online gambling services and our corporate structure, your personal data may be transferred to and processed in countries other than the country of your residence. These countries may have different data protection standards and laws, which in some cases may provide a lower level of protection than those in your home jurisdiction.

Primary processing locations: Data is primarily processed in Curaçao by Dama N.V. and in Cyprus by Strukin Ltd and related payment or support providers.
Infrastructure and support: Hosting, cloud storage, analytics, communications and security services may be provided from within the European Economic Area (EEA) or other jurisdictions, depending on the provider's infrastructure.
Safeguards: Where we transfer personal data to countries that are not recognised as providing an adequate level of data protection, we implement appropriate safeguards such as:
- standard contractual clauses (SCCs) or equivalent data transfer agreements approved by relevant data protection authorities;
- robust contractual confidentiality and security commitments with our service providers;
- technical measures including encryption in transit and at rest, access controls and data minimisation; and
- internal policies restricting onward transfers and ensuring that processing is consistent with this Privacy Policy.

By using chan-au.com, you understand that your data may be transferred internationally as described above and that we will take reasonable steps to ensure that your privacy is protected in line with recognised international standards.

Data Retention

OBSERVE: Define how long different categories of personal data are stored. EXPAND: Align retention with gambling, AML, accounting and dispute resolution obligations. REFLECT: Provide clear timeframes and criteria for deletion or anonymisation.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to meet legal, regulatory, accounting or reporting requirements, and to resolve disputes. Retention periods may vary depending on the data category and applicable legislation in our licensing and operational jurisdictions. We apply the following general principles:

Account and identification data: Typically kept for the duration of your active account and for up to five (5) years after account closure or your last interaction with us, whichever is later, in order to comply with AML/KYC obligations and to handle potential legal claims.
Transaction and financial data: Retained for at least five (5) years from the date of the relevant transaction or account closure (whichever is later), or longer where required by tax, accounting or AML/CTF laws.
Gameplay and behavioural data: Retained for the life of the account and then generally for up to five (5) years after closure in pseudonymised or aggregated form, for responsible gambling monitoring, fraud detection and statistical analysis.
Communication and support data: Retained for as long as necessary to resolve your request or complaint and for a period of up to three (3) years thereafter for reference and quality assurance, unless a longer period is necessary for legal reasons.
Marketing data: Retained while you remain subscribed to marketing communications and for a reasonable period after you unsubscribe (typically up to two (2) years) to document consent history and demonstrate compliance with marketing regulations.
Cookies and similar technologies: Stored on your device for periods indicated in our cookie settings or cookie table (session or persistent, usually up to 24 months), unless you delete them earlier using your browser or device settings.

Once retention periods expire, or when data is no longer needed for the specified purposes, we will securely delete, anonymise or aggregate the data in a way that prevents re-identification, unless continued retention is required by law, regulation or for the establishment, exercise or defence of legal claims.

Your Rights

OBSERVE: Align user rights with high international standards, particularly those analogous to GDPR, and reflect on cross-references to Mexican frameworks noted in the brief while recognising the AU user focus. EXPAND: Describe each right, how to exercise it, and applicable limitations. REFLECT: Provide a practical, step-by-step procedure, timelines and cost conditions.

Regardless of your place of residence, Chan aims to handle personal data in a manner broadly consistent with recognised international privacy principles, including those reflected in the EU General Data Protection Regulation (GDPR) and comparable frameworks from other jurisdictions. Without limiting any mandatory rights you may have under local laws, you may be able to exercise the following rights in relation to your personal data:

Right of Access

You may request confirmation as to whether we process personal data about you and, where that is the case, obtain a copy of such data together with information about the purposes, categories, recipients, retention periods and applicable safeguards.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete data. In many cases you can update your own details directly via your account settings; where this is not possible, [email protected] will assist you.

Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data where:
- the data is no longer necessary for the purposes for which it was collected;
- you have withdrawn consent (where consent is the only legal basis);
- you have successfully objected to processing; or
- the data has been unlawfully processed.
This right may be limited where continued processing is required for legal or regulatory reasons (for example, AML/CTF and record-keeping obligations) or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing

You may request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of the data, assess an objection, or where you require us to retain the data for legal claims while we would otherwise delete it.

Right to Object

You may object at any time to processing of your personal data based on our legitimate interests, including profiling related to such interests. We will cease processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or processing is required for legal claims.
You have an unconditional right to object at any time to processing of your personal data for direct marketing purposes, including profiling to the extent it is related to such direct marketing. If you object, we will stop processing your data for these purposes.

Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you may request to receive the personal data you provided to us in a structured, commonly used and machine-readable format and to have this data transmitted directly to another controller, where technically feasible.

Right to Withdraw Consent

Where processing is based on your consent (for example, email marketing, certain cookies), you may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing based on consent before its withdrawal.

How to Exercise Your Rights

Submit a request: Contact us at [email protected] with a clear description of the right you wish to exercise and sufficient information to identify your account (such as username, registered email and country of residence).
Verification: For your security, we may request additional information to verify your identity before acting on your request, particularly for access, portability and erasure requests.
Response timeframe: We aim to respond to all valid requests within one (1) month / 30 days of receipt. Where requests are complex or numerous, we may extend this period by up to a further two months and will inform you of any such extension and reasons.
Fees: We will handle your request free of charge, unless it is manifestly unfounded or excessive (for example, repetitive). In such exceptional cases we may charge a reasonable fee or refuse to act on the request, and will explain our reasons.

Your rights may be subject to conditions, limitations or exemptions under applicable data protection laws, including those in our licensing jurisdiction and any mandatory rules of your place of residence. Nothing in this Privacy Policy is intended to limit rights granted by such laws.

Cookies & Tracking Technologies

OBSERVE: Categorise cookies used on chan-au.com and their purposes. EXPAND: Explain session vs. persistent and first-party vs. third-party cookies, as well as user controls. REFLECT: Provide clear tools for managing consent and settings.

Types of Cookies

Strictly necessary cookies: Essential for operating chan-au.com and enabling core features such as page navigation, secure login, payment processing and preference management. These cookies are generally session-based and are required for the casino to function properly.
Functional cookies: Remember your settings and choices (such as language, region, display preferences and login persistence) to provide an enhanced and more personalised experience.
Analytics and performance cookies: Collect information about how visitors use our Website, such as pages visited, time spent and error messages encountered. We use this information in aggregated form to improve our services and identify performance issues.
Advertising and targeting cookies: Used, with your consent where required, to deliver relevant promotions, measure the effectiveness of our campaigns, and limit the number of times you see a particular advertisement. These cookies may be set by us or by authorised third-party advertising networks.
Third-party cookies: Set by domains other than chan-au.com (for example, analytics providers, affiliate platforms or social media services) when you interact with embedded content or follow links. Their use is governed by the respective third parties' privacy and cookie policies.

Managing Cookies

Browser controls: Most browsers allow you to view, manage, delete or block cookies using their settings. Please refer to your browser's help section for instructions. Note that blocking essential cookies may affect the functionality of chan-au.com and prevent you from using some services.
Internal settings: Where available, we may provide a cookie or privacy settings panel on chan-au.com, allowing you to adjust your preferences for non-essential cookies (such as analytics and advertising) at any time.
Opt-out of marketing: You may also manage certain advertising cookies through industry opt-out platforms, subject to their availability in your region.

Further details about specific cookies and their lifespans may be provided in a dedicated cookie notice or within our cookie settings interface.

Data Security

OBSERVE: Identify key technical and organisational measures relevant to online gambling operations. EXPAND: Cover encryption, access controls, audits, staff training and incident response. REFLECT: Indicate our commitment to aligning with recognised international standards where feasible.

We take the security of your personal data seriously and implement a combination of technical, organisational and procedural safeguards designed to protect it against unauthorised access, alteration, disclosure or destruction.

Technical Measures

Encryption in transit: Data transmitted between your device and chan-au.com is protected using up-to-date transport layer security protocols (TLS 1.2 or higher), helping to ensure confidentiality and integrity.
Encryption at rest: Where appropriate, sensitive data (including passwords and certain financial details) is stored using strong cryptographic mechanisms and hashing algorithms.
Access controls: Personal data is accessible only to authorised personnel and service providers who require such access to perform their duties, based on role-based access control and the "need-to-know" principle.
Multi-factor authentication: Administrative access to critical systems is protected using multi-factor authentication and other layered security controls.
Network and system security: Firewalls, intrusion detection/prevention systems, anti-malware tools and regular vulnerability management processes are employed to protect our infrastructure.

Organisational Measures

Policies and procedures: We maintain internal data protection and security policies that define how personal data must be handled throughout its lifecycle.
Staff training: Employees and contractors with access to personal data are subject to confidentiality obligations and receive periodic training on data protection, information security and responsible handling of player information.
Vendor due diligence: We carefully select service providers and require them to implement appropriate security and privacy safeguards, including, where relevant, adherence to recognised security frameworks such as ISO 27001 or SOC 2, or equivalent practices.

Monitoring and Incident Response

Regular audits and testing: We conduct periodic security assessments, reviews and testing of our systems and controls to identify and address vulnerabilities.
Incident detection and response: We maintain procedures to detect, investigate and respond to security incidents. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and any relevant authorities without undue delay, in accordance with applicable laws.

While we take reasonable and proportionate steps to protect your data, no system can be guaranteed to be entirely secure. You are responsible for keeping your login credentials confidential and for taking appropriate steps to secure your own devices.

Complaints & Contacts

OBSERVE: Provide clear contact channels for privacy questions and complaints. EXPAND: Describe an internal escalation process and external recourse, recognising that primary regulation stems from our licensing jurisdiction while users may also seek protection under their own local laws. REFLECT: Emphasise cooperation with supervisory authorities and timely handling.

Contacting Us

Email: For any questions, requests or complaints relating to this Privacy Policy or our handling of your personal data, please contact our Data Protection Officer function at [email protected].
Postal address: Data Protection Officer, Dama N.V., Scharlooweg 39, Willemstad, Curaçao.
Online: Where available, you may also use any secure messaging or support channels within your chan-au.com account to submit a privacy-related request, clearly marked as such.

Internal Complaint Procedure

Submission: Send your complaint or concern, including relevant details and evidence, to [email protected] or via the secure account interface.
Acknowledgement: We will acknowledge receipt of your complaint within seven (7) days wherever reasonably possible.
Investigation: Your complaint will be reviewed by our Data Protection Officer function and any relevant internal teams. We may contact you for additional information if necessary.
Response: We aim to provide a substantive response within one (1) month / 30 days of receiving your complete complaint. For complex matters, this period may be extended; if so, we will inform you of the extension and reasons.

Escalation to Supervisory Authorities

If you are not satisfied with our response or believe that we are processing your personal data in violation of applicable laws, you may have the right to lodge a complaint with a competent data protection or privacy authority. Depending on your location and the context of processing, this may include:

Regulators in our licensing jurisdiction: You may contact the relevant supervisory or regulatory authorities overseeing data protection and gambling regulation in Curaçao (contact details available on the official government and licensing body websites).
Regulators in your place of residence: Where available under your local law (for example, in the European Union, Mexico or other jurisdictions that provide such mechanisms), you may lodge a complaint with your local data protection authority or other competent regulator.
Australian context: While Chan is operated offshore and may not be subject to all provisions of Australian privacy law, individuals located in Australia may direct general concerns related to privacy practices of overseas online services to the Office of the Australian Information Commissioner (OAIC) or consult information provided by the Australian Communications and Media Authority (ACMA) regarding online gambling and privacy.

We will cooperate in good faith with competent authorities and comply with any binding decisions or instructions relating to personal data processing that apply to us.

Updates

OBSERVE: Explain that the Privacy Policy may change over time. EXPAND: Detail mechanisms for notifying users, including effective dates, versioning and advance notice for material changes. REFLECT: Empower users with options when they do not accept changes.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, technological developments or business operations relating to Chan and chan-au.com. When we make changes, we will take appropriate steps to inform you.

Notification Procedures

Website publication: The most current version of this Privacy Policy will always be available on https://chan-au.com. The "Last updated" date at the top or bottom of the Policy indicates when it was most recently revised.
Email notifications: For material changes that significantly affect how we process your personal data or your rights, we will endeavour to notify you via email sent to the address registered on your account.
On-site notices: We may display banners, pop-up notices or account dashboard alerts on chan-au.com to draw your attention to important updates.

Advance Notice and User Options

Advance notice: Where reasonably practicable and where changes are material, we will provide you with at least thirty (30) days' advance notice before the updated Privacy Policy becomes effective, particularly when changes could meaningfully impact your rights or the legal bases for processing.
Continued use: Your continued use of chan-au.com after the effective date of an updated Privacy Policy will be deemed acceptance of the changes, to the extent permitted by applicable law.
Objection and account closure: If you do not agree with the updated Privacy Policy, you may object by contacting us at [email protected] and/or close your account. We will then apply the previous Policy to the extent required by law and will continue to process your data only as necessary to comply with legal obligations and legitimate interests as described above.

Last updated: November 2025 (intended to remain consistent through at least 2026, subject to subsequent updates communicated in accordance with this section).