PRIVACY
POLICY.

01Categories of Personal Information We Collect

To provide our legal wagering services and comply with regulatory duties, we collect various categories of personal data:

• Identity Data: legal name, date of birth, gender, government-issued identification numbers.
• Contact Data: residential address, email address, mobile phone number.
• Account & Transaction Data: registration credentials, deposit/withdrawal records, wagering history, balances, gaming patterns.
• Financial Data: permitted debit card details, bank account details, funding transaction logs.
• Technical & Usage Data: IP address, device fingerprints, browser cookies, geolocation logs, system interaction data.
• Communications Data: inquiries, contact logs, support tickets, voluntary survey responses.

02How and Why We Use Your Personal Information

We process personal information only for legitimate business purposes and regulatory obligations:

• Providing and managing wagering and racing services.
• Conducting mandatory identity and age verification.
• Meeting AML/CTF requirements.
• Processing payment transactions safely.
• Preventing fraud, collusive play, and prohibited activities.
• Regulatory reporting to Northern Territory Racing and Wagering Commission.
• Deploying responsible gambling monitoring tools.
• Offering system upgrades, marketing, and customer support.

03Disclosure of Personal Information to Third Parties

Puntx.co does not sell or lease customer databases. Disclosure only to:

• Regulators & Integrity Bodies: Northern Territory Racing and Wagering Commission, sports governing bodies, racing authorities.
• Law Enforcement: when required by law or legal warrants.
• Financial Infrastructure Providers: payment processors, banks.
• Identity Verification Partners: authorized age/AML verification services.
• National Self-Exclusion Register (BetStop): compliance with exclusions.

04Data Retention

Personal data retained as necessary for active agreements and statutory record-keeping. Under AML/CTF laws, financial records and identity checks preserved for at least 7 years post-account closure. Then securely destroyed or anonymized.

05Direct Marketing

We may send targeted promotions. Opt-out via account settings or unsubscribe links. No marketing to individuals on BetStop register.

06Data Breach Notification

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If a breach may cause serious harm, we immediately notify you and the OAIC.

07Children's Privacy

Services strictly limited to persons aged 18+ Australians only. We do not knowingly collect information from under-18s. Underage accounts instantly locked, data removed.

08How We Protect Your Personal Information

Strict security measures protect our systems and your data:

• Cryptographic Standards: full TLS encryption for all data in transit and at rest.
• Access Controls: system access restricted strictly to employees with an immediate business need.
• Intrusion Testing: continuous monitoring, automated threat detection, and robust penetration testing.
• Physical Security: compliance-certified Australian cloud data centers.

09Access, Correction and the Privacy Officer

You can request access to and correction of personal information via Help Centre or Privacy Officer. We process these requests in alignment with Australian Privacy Principles.

10Complaints

Lodge complaints with our Privacy Officer. We aim to respond within 30 business days. Escalation is always available to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11Overseas Disclosure of Personal Information

We prioritize Australian data boundaries. Where overseas disclosure occurs, rigorous contractual commitments ensure APP-equivalent data protection.