Last updated: 18 June 2026 · Privacy enquiries: info
What personal data joefortune.co.nz collects, why, how long it is held, who receives it, and what rights you have under Australian and EU law.
joefortune.co.nz is an independent online casino review platform run from Sydney, Australia. This site is not a casino. It does not operate gambling services, accept deposits, process withdrawals or hold player accounts. Data processing here is narrow by design — this is an informational publisher, and the privacy obligations reflect that.
Joe Fortune Casino — the operator reviewed on this site — is a separate legal entity run by a third party under a Curaçao licence. Its privacy practices are governed by its own policy on its own website and are entirely outside the control of this site.
When you email this site, the following is received:
When you visit any page on this site, the hosting infrastructure and analytics tools automatically collect:
Real name, home address, phone number, financial details and government identifiers are not collected through any automatic mechanism, and data from anyone under 18 is not knowingly collected.
| Purpose | Data used | Legal basis (where GDPR applies) |
|---|---|---|
| Responding to your enquiry | Contact form data, email | Legitimate interest / consent |
| Site analytics (aggregate traffic trends) | Anonymised IP, pages viewed, device type | Legitimate interest |
| Affiliate attribution (tracking referrals) | Click identifier passed to operator | Legitimate interest |
| Security and abuse prevention | IP address, user-agent, request patterns | Legitimate interest |
| Compliance with legal obligations | Server logs | Legal obligation |
Your data is not used to build advertising profiles, remarketing lists are not operated, and personal data is not sold, rented or traded to third parties for marketing purposes.
A small number of processors are relied on to run the site. Each has its own privacy policy, which governs its specific processing:
Where these processors transfer data internationally, standard contractual clauses and published adequacy mechanisms are relied upon. Each third party lists its sub-processors in its own documentation.
| Category | Retention period |
|---|---|
| Contact-form submissions and email correspondence | 12 months after last interaction, unless longer is needed to resolve an ongoing matter |
| Server access logs (full IP) | 90 days |
| Aggregated analytics (GA4, no PII) | Up to 26 months per GA4 default retention |
| Affiliate click events | Per the affiliate network's policy, typically up to 24 months |
| Editorial records required by correction policy | Retained as long as the corresponding article is live, for audit of the correction log |
When a retention period expires, data is deleted or anonymised. Backup copies rotate on a shorter cycle and expire automatically — data is not held in backups beyond what the main retention schedule allows.
As an Australian resident, you have the right to:
If you are resident in the EU or the UK, rights to data portability, restriction of processing, objection to processing and erasure (the right to be forgotten) also apply, subject to applicable exemptions.
Email info with "Privacy" in the subject line. Responses are sent within 30 days. Identity is verified before any personal data is disclosed. The full process is at the contact page.
There is no charge to exercise rights. If a request is manifestly unfounded or excessive — repeated identical requests, for instance — a reasonable administrative fee may be applied or the request declined, as permitted by law.
Cookies and similar technologies are used for analytics, security and basic site function. A full list of each cookie, its purpose, retention period and browser opt-out is on the cookie policy page.
Core processors (Cloudflare, Google Analytics) operate global infrastructure, so data may transit or be accessed from outside Australia — typically the United States and Europe. Those transfers rely on standard contractual clauses and the adequacy decisions published by each processor.
If you have a legal right to object to international transfer and wish to exercise it, email the privacy address above. In practice, objecting usually means requesting deletion rather than a different transfer path.
The site runs over TLS 1.2+ with current cipher suites. The admin side of hosting uses two-factor authentication. Contact-form submissions and email sit in a mailbox protected by a strong unique credential and monitored only by the editorial team.
No online system is perfectly secure. If a breach affects your personal information, those affected will be notified and the OAIC informed under the Notifiable Data Breaches scheme, alongside any equivalent EU or UK obligation where applicable.
This site, the review and all casinos discussed here are for adults aged 18 or over. Personal information from anyone under 18 is not knowingly collected. If you are a parent or guardian and believe a minor has submitted data through this site, contact the privacy address above and the data will be removed promptly.
This policy is revised when practices change — adding or dropping a processor, adjusting retention periods, or responding to a shift in legal requirements. A material change moves the "last updated" date forward; minor edits do not.
This document is the current statement of privacy practices for this site. Earlier versions are available on request via the contact page.
Further reading on this site: Joe Fortune Casino online, about this site, Cooper Hayes author profile, how we test casinos, how we rate casinos, affiliate disclosure, responsible gambling guide, terms of use, and sitemap.
