Privacy Policy
This notice sets out how Mr Fortune handles the personal information of registered players and website visitors. It covers the categories of data we hold, the legal grounds we rely on, and the choices available to you.
Who acts as controller
Mr Fortune is the data controller for information gathered through this website and our gaming client. Processing takes place under our Malta Gaming Authority licence MGA/B2C/445/2017 and is governed by Maltese data protection law together with the EU General Data Protection Regulation.
Players resident in Canada retain the rights granted by PIPEDA and by applicable provincial privacy statutes. Where a Canadian entitlement is broader than the European standard, we apply the broader entitlement.
Our Data Protection Officer supervises this notice and signs off any material change to how player records are used. Written enquiries reach the DPO through the privacy contact route listed at the foot of this page.
Categories of information we hold
Identity and contact records include your full name, date of birth, residential address, email address, telephone number, and the identity documents supplied during verification. These are mandatory under anti-money-laundering rules and cannot be opted out of while an account remains open.
Transactional records cover deposits, withdrawals, bonus credits, wager history, and the masked payment instrument used for each movement of funds. We never store a full card number; tokenisation is handled by our acquiring partners.
Technical records include IP address, approximate geolocation derived from it, device fingerprint, browser and operating system version, and server timestamps. These support fraud prevention, licence-mandated geo-restriction, and diagnosis of faults reported to support.
Why we process it and on what basis
Contractual necessity covers account creation, game delivery, payment processing, and settlement of disputes. Without this data we cannot provide the service you registered for.
Legal obligation covers age verification, source-of-funds review, sanctions and politically-exposed-person screening, safer-gambling monitoring, and retention of gaming logs for regulatory inspection.
Legitimate interest covers fraud detection, collusion and bonus-abuse analysis, and platform security. Consent is used only for optional purposes such as marketing email, SMS campaigns, and non-essential analytics cookies; withdrawing consent is a one-click action in your preference centre and never affects your ability to play.
Sharing, transfers, and retention
We disclose data to payment service providers, identity verification bureaux, game studios supplying content, hosting and anti-fraud vendors, and professional advisers. Each acts under a written processing agreement limiting use to the instructed purpose.
Disclosure to the Malta Gaming Authority, financial intelligence units, or law enforcement occurs where we are legally compelled, and in those cases we are sometimes prohibited from notifying you. Transfers outside the European Economic Area rely on adequacy decisions or on standard contractual clauses supplemented by a transfer risk assessment.
Closed accounts are retained for a minimum of five years after the final transaction to satisfy anti-money-laundering record-keeping duties, after which identity records are erased or irreversibly anonymised. Self-exclusion registers are kept longer, since deleting them would let an excluded player re-register.
Exercising your rights
You may request a copy of your record, correction of inaccuracies, restriction of certain processing, portability of data you supplied to us, or erasure where no retention duty applies. We respond within one calendar month and will explain plainly if a legal obligation prevents us from complying in full.
Requests are authenticated before disclosure, because releasing a gaming and financial history to an impostor would cause far greater harm than a short delay. Expect to confirm ownership of the registered email address and to supply identification if the request originates elsewhere.
If our response does not satisfy you, you may complain to the Office of the Information and Data Protection Commissioner in Malta or to the Office of the Privacy Commissioner of Canada. We would appreciate the opportunity to resolve the matter with you first.
Where to find help
- Mr Fortune Data Protection Officer — written requests via the privacy form in the Help Centre, acknowledged within three business days
- Mr Fortune customer support — live chat and email for account-level questions about your stored information
- Office of the Privacy Commissioner of Canada — 1-800-282-1376 for independent complaints about handling of Canadian personal data
This notice is written in plain language for clarity and is not a substitute for legal advice. Where it conflicts with binding obligations under Maltese law, the GDPR, our licence conditions, or applicable Canadian privacy legislation, those obligations take precedence.