Mraud Privacy Policy

This Privacy Policy explains how Mraud, also written Mr aud, handles personal information about visitors and registered players in Australia. It should be read together with our Terms and Conditions and Cookie Policy. By registering with or using Mraud, you acknowledge that we process your information as described below.

Who We Are and How to Contact Our DPO

Mraud (“we”, “our”, “us”) determines how and why your personal information is handled, which makes us the data controller for the purposes of this policy. We handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and the conditions of the gambling licence under which we operate. Australian law does not formally use the term “data controller”, but we use it here to describe our accountability.

Our Data Protection Officer (DPO) oversees compliance, advises on privacy risk and manages your requests. You can contact the DPO at privacy@[operator-domain] or by post at [registered business address], marked “Attention: Data Protection Officer”. We aim to acknowledge every message within five business days.

Personal Information We Collect

We collect only the information reasonably necessary to operate your account and meet our legal duties. Depending on how you use our services, this includes:

Identity data: name, date of birth, nationality, and identification documents.
Contact data: email address, phone number, and residential address.
Financial and payment data: card details, bank account or e-wallet details, deposits, withdrawals, and source-of-funds documents.
Gameplay and transaction data: games played, stakes, wins, bonuses, and account activity.
Device, IP and geolocation data: IP address, browser type, device identifiers, and location signals.
Marketing preferences: your consent choices, communication history, and promotional interests.

We also record your communications with customer support. We do not knowingly collect information from anyone under 18.

Why We Use Your Information and Our Legal Basis

The APPs do not prescribe lawful bases in the way European law does. We therefore rely on equivalent grounds: consent, contractual necessity, legal obligation and legitimate business interests.

Account registration, payments and gameplay: necessary to perform our contract with you.
Identity, age and location verification, and financial crime reporting: required to meet legal and licensing obligations.
Responsible gambling tools, such as limits and self-exclusion: legal obligation and our legitimate interest in player protection.
Fraud prevention, security monitoring and service improvement: our legitimate interests.
Promotional emails, SMS and personalised offers: your consent, which you may withdraw at any time.
Non-essential cookies: your consent.

Where we rely on legitimate interests, we balance them against your rights and expectations.

KYC and AML Verification

As a gambling operator, we must know who our players are. We therefore verify your identity, age, source of funds and location, including through geolocation checks. We process this data to meet anti-money-laundering and counter-terrorism financing obligations, including requirements modelled on the AML/CTF Act 2006 (Cth), and the conditions of our licence.

Verification may occur at registration, before a withdrawal, or when account activity triggers a risk review. We may ask for identity documents, proof of address, bank statements or evidence of wealth. We may also screen you against sanctions lists and politically exposed person databases.

If you do not provide the requested information, we may restrict, suspend or close your account and withhold withdrawals as required by law. We may be prohibited from telling you when we have made a report to a financial intelligence authority.

Cookies, Storage and Security

We use cookies, pixels and similar technologies to keep you logged in, remember your settings, detect fraud, measure performance and, with your consent, deliver relevant advertising. You can change your choices at any time through our cookie banner or your browser settings. Further details are in our Cookie Policy.

We protect your information with layered safeguards:

TLS encryption for data in transit and strong encryption for sensitive data at rest.
Role-based access controls, so staff see only what their role requires.
Multi-factor authentication for administrative systems.
Regular security testing, monitoring and staff training.
Contractual security obligations for service providers.

If a breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

Sharing, International Transfers and Retention

We do not sell your personal information. We share it only where necessary with:

Payment providers and banks to process transactions.
KYC and verification vendors to confirm identity and location.
Game providers to deliver and settle gameplay.
Regulators, law enforcement and other authorities when legally required.
Approved affiliates and marketing partners, only where you have consented, and limited to non-excessive data.

Some recipients are located outside Australia. Before disclosing information overseas, we take reasonable steps under APP 8 to ensure it is protected, typically through contractual safeguards and security due diligence.

We keep personal information only as long as needed for the purposes above. AML, financial and transaction records are generally retained for at least seven years after account closure, or longer if the law requires. Other data is deleted or de-identified when no longer needed.

Your Rights, Marketing Choices and Complaints

You may request access to your information, ask us to correct it, object to certain processing, or withdraw consent. Where applicable, you may also request deletion or a portable copy of your data. Some requests may be limited where we must retain records by law, and we will explain any refusal in writing.

To make a data subject access request (DSAR), email our DPO at privacy@[operator-domain]. We may verify your identity first and will respond within 30 days.

You can opt out of marketing at any time by using the unsubscribe link, adjusting your account settings or contacting support. Service and security messages will continue.

If you are dissatisfied with our response, you may complain to the OAIC at oaic.gov.au.

This policy may be amended to reflect legal or operational changes. Material updates will be notified on our site or by email. Last updated: 15.10.2026.