Boho Casino Privacy and Data Policy
Last updated: 17 June 2026
This policy explains what personal information Boho Casino may collect, why it is used, how long it may be retained and what controls are available to players regarding their data.
Boho Casino is operated by Metlait SRL, registration number 3-102-911867, registered at El Guayaval, Residencial La Campina Casa Numero Q-11, Cartago, El Guarco, Tejar, 30801, Costa Rica.
Metlait SRL acts as the data controller for personal information processed in connection with the platform and determines the purposes and methods of that processing.
1. Information We Handle
We collect only information that is relevant to operating accounts, processing transactions, meeting regulatory requirements, maintaining platform security and providing casino services.
| Information Type | Examples |
|---|---|
| Identity details | Full name, username, date of birth, gender, nationality and official identification numbers. |
| Contact details | Residential address, proof of address, telephone number and other account contact information. |
| Financial information | Banking details, payment card information, transaction records and documents relating to source of funds or source of wealth. |
| Gaming records | Games played, wagers, login activity, bonus use and responsible gambling interventions. |
| Technical information | IP address, approximate location, browser, operating system, device information, time zone and login data. |
| Preferences and communications | Marketing preferences and records of interactions with support or other service channels. |
| Information supplied voluntarily | Additional personal details provided when using account features or contacting support. |
2. Where Personal Data Comes From
Information can be collected directly from the player or received from service providers involved in account operation and regulatory checks.
- Information submitted during registration or through an account
- Identity and verification providers
- Financial institutions and payment processors
- AML, sanctions and politically exposed person databases
- Regulatory authorities
- Responsible gambling databases where applicable
- Marketing and affiliate partners
Information received from external sources may be used to verify details already associated with an account or to meet legal and security requirements.
3. Why We Use Personal Information
Personal information is processed only where there is an appropriate legal basis and a defined purpose.
| Purpose | Reason for Processing |
|---|---|
| Providing casino services | To create and manage accounts, provide games and carry out services required under the user relationship. |
| Regulatory compliance | To complete KYC, AML, responsible gambling and other checks required by applicable rules. |
| Fraud and risk management | To detect suspicious activity and protect players, transactions and platform integrity. |
| Marketing and personalisation | To manage communication preferences and, where permitted, personalise promotional content. |
| Service analysis | To understand platform performance, resolve technical issues and improve functionality. |
| Security | To identify threats, maintain system availability and protect stored information. |
| AI-assisted support | To help organise customer interactions, analyse support requests and assist with service responses. |
4. How Long Information Is Kept
Personal data is retained only for as long as it is required for the purpose for which it was collected or for a period required by law.
Some records must remain available after an account is closed. Anti-money laundering requirements, for example, may require relevant information to be retained for at least five years from account closure.
Other retention periods may apply to tax records, transaction information, disputes or regulatory obligations.
When information is no longer required, it may be securely deleted, anonymised or otherwise de-identified according to the applicable data-protection requirements.
5. When Data May Be Shared
Some personal information needs to be provided to third parties in order to operate casino services, process payments, complete verification or comply with legal requirements.
Recipients can include:
- Companies within the same corporate group
- Casino game providers
- Payment processors and financial service providers
- Marketing and affiliate partners
- Regulatory and competent public authorities
- Technical and infrastructure providers
- AML and KYC verification services
- Legal, accounting and professional advisers
- Conversational AI service providers
AI-related service providers may include Anthropic, OpenAI and Gemini services where these tools are integrated into customer messaging, support or related operational workflows.
Access provided to external processors is limited to what is needed for the relevant service. Contractual and security requirements are used to govern how those providers handle personal information.
If the business is reorganised, sold, acquired or merged, relevant personal information may also form part of that transaction where permitted by law.
6. International Data Transfers
Some services used by Boho Casino may process information outside the country where a player is located. This can occur for services such as hosting, account verification, technical infrastructure or customer support.
Where an international transfer requires additional protection, appropriate safeguards may be used. These can include European Commission Standard Contractual Clauses or transfers to jurisdictions recognised as providing an adequate level of protection.
The aim is to maintain comparable safeguards for personal information even when processing takes place in another jurisdiction.
7. Your Privacy Rights
Depending on applicable data-protection law, players may have several rights concerning their personal information.
- Request access to personal information held about them
- Ask for inaccurate or incomplete details to be corrected
- Request deletion where legal retention rules do not prevent it
- Ask for processing to be restricted in certain circumstances
- Request data portability where the right applies
- Object to processing based on legitimate interests
- Object to direct marketing
- Withdraw consent where processing depends on consent
- Submit a complaint to the relevant data-protection authority
Some requests cannot result in immediate deletion of all information. Records may still need to be retained where legal, regulatory, financial or dispute-related requirements apply.
8. Automated Processing
Boho Casino does not normally rely on decisions made entirely by automated systems.
If automated decision-making is introduced in circumstances where applicable law requires specific notice or additional rights, the relevant information will be provided separately.
9. Information Relating to Minors
Casino services are intended only for people who have reached the legal gambling age that applies in their jurisdiction, with a minimum age of 18.
Boho Casino does not knowingly collect personal information from people below the applicable legal age. If such information is identified, appropriate steps may be taken to remove it and restrict use of the associated account in accordance with legal requirements.
10. How Personal Information Is Protected
Technical and organisational controls are used to reduce the risk of unauthorised access, disclosure, alteration or loss of personal information.
Physical Protection
Systems used to process personal information are hosted in facilities with physical and digital security controls. Access is limited to authorised personnel.
Authentication and System Access
Systems that handle personal information use authentication and access controls. Individual user credentials are used to help prevent unauthorised system access.
Access Based on Role
Access to files, systems and programs is limited according to operational need. Staff and service providers should only have access to information required for their responsibilities.
Secure Data Disposal
Processes are maintained for securely removing information that is no longer required for its original purpose or for legal retention obligations.
Internal Privacy Controls
Organisational measures are used to keep personal information separated appropriately and reduce accidental access or mixing of records. Privacy and security responsibilities are supported by designated data-protection oversight and staff training.
11. Privacy Policy Updates
This policy may be revised when data practices, legal requirements or the services used by Boho Casino change.
The date at the top of this page indicates when the current version was last updated. Players should review the policy periodically to understand how their information is being handled.