Privacy Policy

1. Introduction

1.1 About This Policy

This Privacy Policy ("Policy") governs how Crazy Tower ("we", "us", "our"), the operator of the online gaming platform accessible at crazytower.mobile (the "Platform"), collects, uses, stores, shares and protects your personal information. This Policy forms an integral part of our broader suite of user-facing documents, which includes our Terms & Conditions and our Responsible Gaming Policy.

We are committed to protecting the privacy of all individuals who visit, register on, or interact with our Platform. This commitment extends to our compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as amended by the Privacy and Other Legislation Amendment Act 2024, along with all other applicable Australian privacy and data-protection legislation.

1.2 Scope

This Policy applies to all personal information we collect through your use of the Platform, including but not limited to:

• Browsing and visiting the Platform without creating an account;
• Registering for and maintaining a player account;
• Making financial deposits and withdrawals;
• Participating in games, promotions or tournaments;
• Contacting our customer support team; and
• Any other interaction with our services or communications.

1.3 Acceptance

By accessing or using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal information as described herein. If you do not agree with any part of this Policy, you must cease using the Platform immediately.

2. Data We Collect

2.1 Information You Provide Directly

When you register an account or interact with the Platform, we collect information that you actively provide to us, including:

• Identity Data: Full legal name, date of birth, gender;
• Contact Data: Residential address, email address, telephone number;
• Identity Verification Data: Government-issued identification documents (e.g. Australian passport, driver's licence), used to verify your age and identity in accordance with anti-money laundering obligations;
• Account Data: Username, password (stored in hashed form), security questions and answers;
• Financial Data: Payment method details, deposit and withdrawal history, transaction records, and — where required — source-of-funds documentation;
• Communications Data: Messages, emails, chat logs and other correspondence you send to us via support channels;
• Responsible Gaming Data: Self-imposed limits, self-exclusion requests, and any information you voluntarily provide in relation to your gaming behaviour.

2.2 Information Collected Automatically

When you access the Platform, certain data is collected automatically by our systems:

• Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution;
• Usage Data: Pages visited, games played, session duration, click-through patterns, timestamps of activity;
• Location Data: General geographic location derived from your IP address (not precise GPS location unless you explicitly grant permission);
• Cookie & Tracking Data: Data collected via cookies, web beacons, pixels and similar technologies (see Section 6 for full details).

2.3 Information Received from Third Parties

We may receive personal information about you from trusted third parties, including:

• Identity verification and Know Your Customer (KYC) service providers;
• Anti-money laundering (AML) and fraud detection agencies;
• Payment processors and financial institutions processing your transactions;
• Marketing partners and affiliate networks (where you have interacted with their services);
• Credit reference and sanctions-screening agencies.

2.4 Special Categories of Data

We do not intentionally collect sensitive personal information (as defined under Australian privacy law, including health or biometric data) unless strictly required for responsible gaming assessments or legally mandated harm-minimisation purposes. Any sensitive data collected in such contexts will be handled with the highest degree of care and processed only on the lawful bases outlined in Section 4 of this Policy.

3. How We Use Your Data

3.1 Primary Purposes

We use the personal information we collect for the following primary operational purposes:

• Creating, verifying and managing your player account;
• Verifying your age (minimum 18 years) and identity to prevent underage gambling;
• Processing deposits, withdrawals and other financial transactions in Australian Dollars (AUD);
• Providing you with access to the Platform's games and services;
• Responding to your customer support inquiries and resolving disputes;
• Administering promotions, bonuses and loyalty programmes in accordance with our Terms & Conditions.

3.2 Compliance and Legal Obligations

Your data is used to meet our regulatory and legal obligations, including:

• Conducting Know Your Customer (KYC) and anti-money laundering (AML) checks in line with AUSTRAC requirements;
• Monitoring activity for responsible gambling compliance as described in our Responsible Gaming Policy;
• Detecting and preventing fraud, chargebacks, abuse and other prohibited activities;
• Maintaining records required by applicable law and regulatory authorities;
• Complying with court orders, subpoenas and government requests.

3.3 Platform Improvement

We use aggregated and anonymised data to:

• Analyse usage patterns and improve the Platform's features and user experience;
• Conduct internal research, analytics and performance measurement;
• Test new products, features and services.

3.4 Marketing and Communications

With your explicit prior consent, we may use your contact information to send you promotional offers, newsletters, bonus notifications and other marketing communications. You may withdraw your consent to marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at support@crazytower.mobile. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal.

3.5 Automated Decision-Making

In accordance with the Privacy and Other Legislation Amendment Act 2024, we disclose that certain automated processes may be used on our Platform, including fraud scoring, AML risk assessment and responsible gaming monitoring. These processes may produce decisions that have a significant effect on your account status. You have the right to request human review of any automated decision that materially affects you by contacting us at the details in Section 13.

4. Legal Bases for Processing

4.1 Overview

We only process your personal information when we have a lawful basis to do so. The following table summarises the primary legal bases we rely upon:

4.2 Withdrawal of Consent

Where we rely on consent as a legal basis, you have the right to withdraw that consent at any time without detriment to your continued use of the Platform, except where the withdrawal of consent makes it impossible to provide a particular service. Withdrawal requests should be directed to privacy@crazytower.mobile.

5. Data Sharing & Third Parties

5.1 Categories of Recipients

We do not sell your personal information to third parties. We may, however, share your data with carefully selected third parties in the following circumstances:

5.1.1 Service Providers and Processors

We engage trusted third-party vendors who process data on our behalf and under our instruction, including:

• Payment Processors: Entities facilitating the processing of deposits and withdrawals via supported payment methods on the Platform (see Section 5.3);
• Identity Verification Providers: Organisations that assist us with KYC and AML compliance;
• Cloud Hosting & Infrastructure Providers: Companies providing secure server, storage and network infrastructure;
• Customer Support Platforms: Tools enabling live chat, email and ticketing systems;
• Analytics Providers: Vendors supplying anonymised usage analytics and platform performance data;
• Marketing & Affiliate Partners: Where you have been referred through an affiliate channel and with your consent.

5.1.2 Regulatory and Law Enforcement Authorities

We may disclose your personal information to regulatory bodies, law enforcement agencies, courts or other governmental authorities where required by law or where we have a good-faith belief that such disclosure is necessary to:

• Comply with a legal obligation or court order;
• Report suspicious transactions to AUSTRAC in accordance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
• Protect the rights, property or safety of Crazy Tower, our users or the public.

5.1.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets, your personal information may be transferred to a successor entity. We will notify you of any such change and ensure that any successor entity is bound by obligations no less protective than those set out in this Policy.

5.2 Data Processing Agreements

All third-party processors are required to enter into binding data processing agreements with us that impose obligations consistent with applicable privacy law and require them to implement appropriate technical and organisational security measures.

5.3 Payment Methods

The Platform supports the following payment methods for Australian players, each operated by independent third parties subject to their own privacy policies. Financial data shared with these providers is limited to what is strictly necessary to process your transaction:

We encourage you to review the privacy policies of any payment provider you use before initiating a transaction.

6. Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device and remember certain information about your preferences or past actions. We also use related technologies such as web beacons, pixels, local storage objects and session tokens for similar purposes.

6.2 Types of Cookies We Use

6.3 Managing Your Cookie Preferences

On your first visit to the Platform, you will be presented with a Cookie Consent Banner that allows you to accept or decline non-essential cookies. You may update your preferences at any time through the Platform's cookie settings panel or by adjusting your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Platform.

Most web browsers allow you to control cookies through their settings. For more information on how to manage cookies in your browser, visit www.aboutcookies.org or your browser's official help documentation.

6.4 Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. Our Platform does not currently alter its data collection practices in response to DNT signals, as no universally accepted standard for interpreting such signals has been established. We will reassess this position as industry standards evolve.

7. Data Security

7.1 Security Measures

We implement comprehensive technical and organisational security measures to safeguard your personal information against unauthorised access, disclosure, alteration, loss or destruction. These measures include, but are not limited to:

• Encryption: All data transmitted between your device and our servers is protected using TLS 1.2/1.3 encryption. Sensitive data at rest (including payment details and identity documents) is encrypted using industry-standard AES-256 encryption;
• Access Controls: Strict role-based access controls ensure that only authorised personnel with a legitimate need can access your personal data;
• Multi-Factor Authentication (MFA): MFA is enforced for all administrative system access;
• Firewalls & Intrusion Detection: Advanced firewall systems and real-time intrusion detection and prevention tools protect our infrastructure;
• Regular Security Audits: We conduct periodic penetration testing, vulnerability assessments and security audits carried out by independent third-party specialists;
• Staff Training: All staff who handle personal data receive regular data protection and cybersecurity training;
• Vendor Due Diligence: All third-party processors are assessed for security compliance before engagement and monitored on an ongoing basis.

7.2 Data Breach Response

We maintain a documented Data Breach Response Plan consistent with the requirements of the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach that is likely to result in serious harm to affected individuals, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
• Notify affected individuals directly where required; and
• Take immediate steps to contain the breach and prevent further harm.

8. Data Retention

8.1 General Principles

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, including meeting legal, regulatory, accounting and reporting obligations. Our retention practices comply with the intersection of our privacy obligations and applicable AML/CTF and gaming regulatory requirements.

8.2 Retention Schedule

8.3 Deletion and Anonymisation

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with our documented data destruction schedules. Where deletion is not technically feasible (e.g. due to backup systems), the data will be isolated and protected from further processing until deletion is possible.

9. Your Rights

9.1 Overview of Your Privacy Rights

As a data subject whose information is processed by Crazy Tower, you have the following rights under the Australian Privacy Principles and applicable privacy legislation. We are committed to facilitating the exercise of these rights promptly and without charge.

9.2 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to our Privacy/DPO contact at privacy@crazytower.mobile. To protect your privacy and security, we may require you to verify your identity before processing any request. We will respond within 30 days of receiving a verified request. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

9.3 Complaints to the OAIC

If you are unsatisfied with our response to a privacy request or complaint, you have the right to lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5218, Sydney NSW 2001

10. International Data Transfers

10.1 Cross-Border Disclosures

In providing our services, some of the personal information we collect may be transferred to, stored in, or processed in countries outside of Australia. This may occur where our third-party service providers — including cloud hosting providers, payment processors and technology vendors — operate from overseas locations.

10.2 Safeguards for International Transfers

Where personal information is transferred outside of Australia, we take all reasonable steps as required under Australian Privacy Principle 8 to ensure that the overseas recipient does not handle your personal information in a manner inconsistent with the APPs. These steps include:

• Entering into binding contractual arrangements with overseas recipients that impose privacy obligations equivalent to those under Australian law;
• Only engaging overseas service providers located in countries assessed to have an adequate level of data protection;
• Conducting due diligence on the privacy and security practices of overseas recipients prior to and during engagement.

10.3 User Acknowledgement

By using the Platform and providing your personal information, you acknowledge and consent to the potential transfer of your data to overseas recipients in accordance with the safeguards described in this Section. Where we are unable to ensure an equivalent level of protection, we will notify you and seek your express consent before any such transfer takes place.

11. Minors

11.1 Age Restriction

The Platform is strictly intended for individuals who are 18 years of age or older. We do not knowingly collect, process or store personal information from individuals under the age of 18. Participation in any real-money gaming activity on the Platform by persons under the legal minimum age is strictly prohibited, as further detailed in our Terms & Conditions and Responsible Gaming Policy.

11.2 Age Verification

As part of our account registration process, all users are required to undergo mandatory identity and age verification. This process requires the submission of valid government-issued identification confirming that you are at least 18 years of age. Registration and access to real-money features will be suspended or denied where verification cannot be completed within the required timeframe.

11.3 Discovery of Underage Users

If we become aware that we have inadvertently collected personal information from an individual under the age of 18, we will:

• Immediately suspend the relevant account;
• Refund any deposits made, where the funds can be traced;
• Permanently delete all personal information associated with the underage individual from our systems; and
• Report the matter to relevant authorities where required by applicable law.

11.4 Support Resources for Underage Gambling

If you are concerned about underage gambling, the following organisations offer assistance:

12. Changes to This Policy

12.1 Right to Amend

Crazy Tower reserves the right to update, modify or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory guidance or operational requirements. All amendments will be published on this page at crazytower.mobile/privacy-policy with an updated "Last Updated" date at the top of the document.

12.2 Notification of Material Changes

Where we make material changes to this Policy — that is, changes that significantly affect how we collect, use or share your personal information — we will provide you with prominent notice through one or more of the following means:

• A notification displayed on the Platform upon your next login;
• An email notification sent to the address registered on your account; or
• A banner or pop-up message on the Platform's homepage.

Material changes will not take effect until at least 14 days after the notification is provided, unless the change is required immediately by law or regulatory direction.

12.3 Continued Use Constitutes Acceptance

Your continued use of the Platform after the effective date of any changes to this Policy constitutes your acceptance of those changes. If you do not accept the updated Policy, you must stop using the Platform and may request account closure in accordance with our Terms & Conditions.

12.4 Version History

13. Contact Information

13.1 General Support

For general queries about your account, technical issues or any other Platform-related matter, please contact our customer support team:

13.2 Privacy & Data Protection Enquiries

For all matters specifically relating to your privacy rights, data correction requests, erasure requests, consent withdrawal or data breach notifications, please contact our Privacy Officer directly:

13.3 What to Include in Your Request

To help us process your request efficiently and verify your identity, please include the following in your privacy enquiry:

• Your full name as registered on your account;
• Your registered email address;
• A description of your request and the specific right(s) you wish to exercise;
• Any relevant account identifiers (e.g. username or account number); and
• A copy of a government-issued identity document (for verification purposes only).

13.4 Regulatory Body

If you believe your privacy rights have been violated and are not satisfied with our response, you may escalate your complaint to the Australian privacy regulator: