Privacy Policy

Version: 1.0  |  Last updated: November 11, 2026

1. Introduction

Welcome to Tortuga Casino (hereinafter "we", "our" or "the Site"), available at tortuga-log.fr. We attach the utmost importance to protecting your personal data and to being transparent about how it is processed. This Privacy Policy (hereinafter "the Policy") describes in full the types of data we collect, the purposes for which we use it, the legal bases for that processing and the rights you have regarding your personal information.

This document is drafted in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679, applicable in France, and the amended French Data Protection Act (Loi Informatique et Libertés). By accessing the Site or registering, you acknowledge that you have read this Policy and accept the data processing practices described below. For any additional questions, please see our Terms and Conditions and our Responsible Gaming page.

2. Data we collect

We collect different categories of personal data when you use the Site. This data comes either directly from you when you register or interact with us, or automatically through tracking technologies.

2.1 Identification and contact data

• First and last name
• Email address
• Phone number
• Date of birth (to verify legal age: 18 minimum)
• Full postal address (country, city, postal code)
• Username and password (in hashed form)

2.2 Financial and payment data

To process your deposits and withdrawals, we collect the information required for the payment method you choose among the options available on the Site:

• Bank cards: Visa, Mastercard, Maestro
• E-wallets: PayPal, Skrill, Neteller
• Prepaid solutions: Paysafecard, Neosurf, CASHlib
• Mobile payment: Apple Pay, Google Pay
• SEPA bank transfer

We never store full bank card numbers; this data is processed exclusively by our PCI DSS-certified payment providers.

2.3 Identity verification data (KYC)

As part of our legal obligations regarding anti-money laundering (AML/CFT) and age verification, we may ask you for:

• A copy of your ID document (national ID card, passport)
• Proof of address issued within the last three months
• Proof of payment method (bank statement, e-wallet screenshot)

2.4 Usage and technical data

• IP address and approximate location
• Browser type, operating system and device used
• Pages visited, session duration, actions taken on the Site
• Connection logs and timestamps
• Gaming data: bets placed, wins, losses, session history

2.5 Communication data

• Content of your exchanges with our support team (chat, email, phone)
• Communication preferences and notification settings

3. How we use your data

Your personal data is used solely for legitimate and specified purposes. The main uses are as follows:

3.1 Managing your account and providing services

We use your data to create and manage your user account, enable you to access the games available on the Site, process your deposits and withdrawals in euros (€) and provide you with personalized support. Without this data, we would not be able to offer you our services.

3.2 Identity verification and legal compliance

In accordance with the legal obligations applicable in France, we carry out identity checks to confirm that you are at least 18 years old, that you are not listed on the National Register of Gambling Prohibitions (FNIJ), and to meet our AML/CFT obligations. These checks are essential to the operation of our business.

3.3 Fraud prevention and security

We analyze browsing behavior and financial transactions in order to detect and prevent any fraudulent activity, bonus abuse or money laundering attempts. This processing includes automated monitoring tools.

3.4 Responsible gaming

We use your gaming data to monitor your behavior and identify possible signs of problem gambling, in line with the commitments set out on our Responsible Gaming page. This processing may lead to the activation of limit-setting tools, personalized alerts or intervention by our team.

3.5 Communication and marketing

With your consent, we send you commercial communications, promotional offers and news about the Site. You can unsubscribe at any time using the unsubscribe link in every email or from your account settings.

3.6 Improving the Site

Anonymized or aggregated usage data allows us to analyze the Site's performance, identify the most popular features and continuously improve the user experience.

4. Legal bases for processing

Each processing of your personal data relies on a legal basis defined in Article 6 of the GDPR. The table below summarizes how our purposes match the legal bases relied on:

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw consent from your account settings or by contacting us at the address given in section 13.

5. Data sharing and third parties

We do not sell your personal data to third parties. However, in order to provide our services, we share certain information with clearly identified categories of recipients, in strict compliance with the GDPR and under appropriate contractual data processing agreements.

5.1 Technical service providers

We use subcontractors for data hosting, Site development, customer support management, audience analytics and messaging services. These providers act solely on our instructions and are not permitted to use your data for their own purposes.

5.2 Payment providers

The financial information needed to process your transactions is passed on to our payment partners (PCI DSS-certified institutions), including bank card issuers, e-wallet operators and correspondent banks. These transfers are strictly limited to the data essential to completing the transaction.

5.3 Game providers

The game software providers integrated into the Site may receive your player ID as well as session data required for the games to run properly. This information generally does not allow providers to identify you directly.

5.4 Competent authorities

We are required to disclose certain data to judicial, tax or supervisory authorities where applicable law so requires, in particular in the event of a request from an authorized public authority, legal proceedings or a reporting obligation under AML/CFT rules.

5.5 Analytics and marketing tools

We use third-party analytics tools (such as web audience analytics platforms) that may collect anonymized usage data. Where personal data is involved, we ensure that appropriate contractual safeguards are in place.

6. Cookies and tracking technologies

The Site uses cookies and similar technologies (tracking pixels, web beacons, local storage) to ensure it works properly and to improve your browsing experience. In accordance with French regulations (CNIL guidelines), we obtain your consent before placing any non-essential cookies.

6.1 Types of cookies used

• Strictly necessary cookies: essential for the Site to function (session management, security, navigation). They do not require consent.
• Preference cookies: remember your personalized settings (language, display). Placed with your consent.
• Analytics cookies: collect aggregated data on Site traffic and usage to improve our services. Placed with your consent.
• Marketing cookies: used to display personalized ads and measure their effectiveness. Placed with your consent.

6.2 Managing your preferences

You can change your cookie preferences at any time through our cookie management panel, accessible from the bottom of every page of the Site. You can also configure your browser to refuse all cookies; however, some features of the Site may no longer be available. Cookie retention periods range from a few minutes (session cookies) to a maximum of twenty-four months (persistent cookies).

7. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure or accidental destruction. These measures include:

• Encryption of communications via the TLS/SSL (HTTPS) protocol
• Secure password hashing with a salting algorithm
• Two-factor authentication (2FA) available for your account
• Access to personal data restricted to authorized staff who have signed a confidentiality agreement
• Continuous system monitoring and regular security testing (audits, penetration tests)
• Formalized security incident response procedures

In the event of a data breach posing a high risk to your rights and freedoms, we will inform you as soon as possible, in accordance with Article 34 of the GDPR. We will also notify the CNIL within 72 hours in accordance with Article 33 of the GDPR.

Despite these precautions, no electronic transmission or storage system is completely foolproof. We encourage you to protect your own account by using a strong password and not sharing it with anyone.

8. Data retention

We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected, or to meet legal obligations. The applicable retention periods are as follows:

• Active account data: for the entire duration of your contractual relationship with us.
• Closed account data: five (5) years from account closure, in accordance with French legal anti-money laundering obligations and civil limitation rules.
• KYC data (ID documents, supporting documents): five (5) years after the end of the business relationship.
• Financial transaction data: ten (10) years, in accordance with accounting and tax obligations.
• Communication data (customer service): three (3) years from the last contact.
• Analytics cookies: a maximum of twenty-four (24) months.

When these periods expire, your data is securely deleted or irreversibly anonymized.

9. Your rights

As a resident of the European Union and, more specifically, as a French resident, you benefit from a set of rights guaranteed by the GDPR and the French Data Protection Act. Below you will find details of each of these rights and how to exercise them.

9.1 Right of access (Art. 15 GDPR)

You have the right to ask us to confirm whether we process your personal data and, where applicable, to obtain a copy of it. This copy will be provided within one (1) month of receiving your request. A reasonable fee may be charged for repeated and manifestly excessive requests.

9.2 Right to rectification (Art. 16 GDPR)

If your personal data is inaccurate or incomplete, you have the right to request its correction or update without delay. You can also correct some information directly from your account settings.

9.3 Right to erasure ("right to be forgotten") (Art. 17 GDPR)

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent, or where you have objected to the processing. This right does not apply where processing is necessary to comply with a legal obligation or for the establishment, exercise or defense of legal claims.

9.4 Right to restriction of processing (Art. 18 GDPR)

In certain circumstances (you contest the accuracy of the data, the processing is unlawful but you do not want the data erased, the data is needed for legal claims), you may request restriction of processing. During the restriction period, we process your data only with your consent or for specific legal reasons.

9.5 Right to data portability (Art. 20 GDPR)

For processing based on your consent or on the performance of a contract, you may request to receive your data in a structured, commonly used and machine-readable format (for example, JSON or CSV), and transmit it to another controller if you wish.

9.6 Right to object (Art. 21 GDPR)

You may object at any time to the processing of your data based on our legitimate interest, in particular for direct marketing purposes. If you object to direct marketing, we stop the processing without delay. For other processing based on legitimate interest, we assess whether our interests override yours before continuing the processing.

9.7 Right not to be subject to automated decision-making (Art. 22 GDPR)

If we make decisions about you based solely on automated processing (for example, suspending your account following fraud detection), you have the right to obtain human intervention, to express your point of view and to contest the decision.

9.8 How to exercise your rights

To exercise any of these rights, please send us a written request at [email protected] or by post to the address given in section 13. We will acknowledge receipt of your request within forty-eight (48) hours and respond within a maximum of one (1) month. This period may be extended by a further two (2) months for complex or multiple requests, in which case we will inform you beforehand.

Your identity will be verified before your request is processed in order to protect your data from unauthorized access. If you believe we are not respecting your rights, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), available at cnil.fr.

10. International data transfers

As part of our activities, some of your data may be transferred to and processed outside the European Economic Area (EEA), in particular by hosting or analytics providers whose servers are located in third countries. Where such a transfer takes place, we apply the appropriate safeguards provided for by the GDPR:

• Use of countries subject to an adequacy decision by the European Commission;
• Use of the Standard Contractual Clauses (SCCs) adopted by the European Commission, which impose protection obligations equivalent to those in force in the EEA;
• Application of Binding Corporate Rules for the groups of companies concerned.

You can obtain information about the safeguards in place for international transfers by contacting us at [email protected]. No transfer is made to a third country unless an adequate safeguard has been put in place beforehand.

11. Minors

The Site is strictly reserved for persons aged at least 18 years. We do not knowingly collect any personal data concerning minors. At registration, we verify the declared age and may request supporting documents as part of the KYC process.

If we discover that a minor has provided personal data or that an account has been created by a person under 18, we will immediately close the account and delete the associated data, subject to any legal retention obligations that may apply to us. If you become aware of a minor using the Site, please report it to us without delay at [email protected]. Additional information on the protection of minors is available on our Responsible Gaming page.

12. Changes to this Policy

We reserve the right to amend this Policy at any time to reflect legislative or regulatory changes, changes in our processing practices or improvements to our services. Any material change will be notified to you by email at the address associated with your account and/or by a visible notice on the Site at least thirty (30) days before it takes effect.

The "Last updated" date at the top of this document will be updated with each new version. The current version is always available at /privacy-policy. By continuing to use the Site after the new version takes effect, you acknowledge that you have read it. If you do not accept the changes, we invite you to close your account and stop using the Site.

13. Contact details

For any question about this Privacy Policy, the exercise of your rights or our data protection practices, you can contact us through the following channels:

Our data protection team acknowledges receipt of your request within forty-eight (48) working hours and undertakes to provide a complete response within the deadlines set by the GDPR. If you wish to lodge a complaint with an independent supervisory authority, you can contact the CNIL (Commission Nationale de l'Informatique et des Libertés) at the following address: 3 Place de Fontenoy, TSA 80715 – 75334 Paris Cedex 07, or via its website cnil.fr.

FAQ — Frequently asked questions about privacy

Is my data sold to third parties?

No. Tortuga Casino never sells, rents or transfers your personal data to third parties for those third parties' own commercial purposes. The sharing described in section 5 is strictly governed by subcontracting agreements and limited to the Site's operational needs.

How can I delete my account and my data?

You can request the closure of your account and the erasure of your data by sending an email to [email protected]. After verifying your identity, we will process your request. Some data will be kept for the legally required period (see section 8), then permanently deleted.

Can I withdraw my consent to marketing?

Yes, at any time and without having to justify your decision. Use the unsubscribe link in each promotional email or change your communication preferences in your account settings. Your withdrawal of consent will be taken into account within a maximum of forty-eight (48) hours.

How can I change my cookie preferences?

Open the cookie management panel available at the bottom of every page of the Site. You can enable or disable non-essential cookie categories (analytics, marketing, preferences) at any time. Cookies strictly necessary for the Site to function cannot be disabled.

What happens if Tortuga Casino suffers a data breach?

In the event of a data breach posing a high risk to your rights, we will inform you without delay by email, in accordance with Article 34 of the GDPR. We also notify the CNIL within 72 hours (Art. 33 GDPR). We immediately take the necessary corrective measures to contain the incident and prevent it from happening again.

Where can I find help if I have a gambling problem?

Tortuga Casino is committed to responsible gaming. If you or someone close to you is struggling with gambling, the following organizations offer free and confidential help in France:

• Joueurs Info Service — 09 74 75 13 13 (non-premium-rate number) — joueurs-info-service.fr
• SOS Joueurs — 09 69 39 55 12 — sosjoueurs.fr
• Addict'Aide — addictaide.fr
• Fédération Addiction — federationaddiction.fr
• Gamblers Anonymes France — ga-france.fr
• IFAC (Institut Fédératif des Addictions Comportementales) — ifac-addictions.chu-nantes.fr
• ANJ – Évalujeu (anonymous self-assessment) — evalujeu.fr

For more information about our responsible gaming tools (deposit limits, self-exclusion, etc.), see our Responsible Gaming page.