Privacy Policy

1. Who is responsible for your information

UPCOZ PTY LTD (ABN 93621899634, ACN 621 899 634) of 101 Sheridan Street, CAIRNS QLD 4870 is the entity responsible for the personal information collected through upcoz.co. We are bound by the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, and by the record-keeping obligations that come with our wagering licence.

Privacy questions, access requests and complaints go to privacy@upcoz.co or to the postal address above, marked to the attention of the Privacy Officer.

2. What we collect

Information you give us

Identity: full name, date of birth, and where required a document number from a driver licence, passport or Medicare card.
Contact and address: residential address, email address and phone number.
Financial: the debit card, PayID or bank account details used to deposit and withdraw, and the transaction records that result.
Account activity: bets placed, deposit limits set, self-exclusion requests and correspondence with us.
Support contact: anything you tell us when you contact our team, including complaint details.

Information collected automatically

Device and browser type, operating system, screen size and language.
IP address and derived approximate location, used to confirm you are in Australia when you bet.
Pages viewed, referring page and interaction events, where you have consented to analytics cookies.

Information from third parties

Verification results from identity-verification providers and credit reporting bodies, used only to confirm identity and age — not to assess creditworthiness.
The status of your registration on the National Self-Exclusion Register (BetStop).
Payment confirmations and chargeback notices from payment providers and banks.

3. Why we collect it

We collect personal information because we cannot lawfully open or operate a wagering account without it. Specifically:

to verify your identity and confirm you are 18 or over, as required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
to check the National Self-Exclusion Register before opening an account and before accepting bets;
to operate the account: accept bets, settle markets, process deposits and withdrawals, and apply your deposit limit;
to detect and prevent fraud, money laundering, match-fixing and unauthorised account access;
to meet reporting obligations to the Office of Liquor and Gaming Regulation, AUSTRAC, sporting controlling bodies and law enforcement;
to respond to your enquiries and complaints;
to send service messages, and marketing only where you have opted in.

If you choose not to provide the information we ask for, we cannot open your account or accept bets from you.

4. Who we disclose it to

We do not sell personal information. We disclose it only where it is necessary for the purposes above, to:

Categories of recipients and the reason for disclosure
Recipient	Reason
Identity verification providers	Confirming your name, date of birth and address
Payment providers and banks	Processing deposits, withdrawals and chargebacks
The Office of Liquor and Gaming Regulation	Licence conditions, audits and regulatory enquiries
AUSTRAC	Anti-money laundering reporting obligations
BetStop (National Self-Exclusion Register)	Checking and honouring registrations
Sporting controlling bodies	Integrity agreements and suspicious betting reports
IT, hosting and security providers	Running and protecting the service under contract
Professional advisers, courts, police	Legal advice, court orders and lawful requests

Our hosting and support providers are located in Australia. Where a provider operates overseas, we take reasonable steps under Australian Privacy Principle 8 to ensure it handles your information consistently with the Australian Privacy Principles, and we remain accountable for it.

5. Direct marketing

We send marketing only where you have opted in, and never to a person who is self-excluded, who has asked us to stop, or who is under 18. Every marketing message contains an unsubscribe mechanism that works, and you can also turn marketing off in your account. Opting out does not stop service messages about your account, security or regulatory obligations.

6. Storage, security and retention

Personal information is held in access-controlled systems, encrypted in transit, and available only to staff who need it for their role. We use multi-factor authentication for administrative access, log administrative activity, and test our controls periodically. No system is perfectly secure; if a data breach is likely to cause you serious harm we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

We retain account, transaction and verification records for at least seven years after the account closes, because anti-money laundering and wagering licence obligations require it. Records that are no longer needed for any purpose and are not required to be kept are destroyed or de-identified.

7. Cookies and tracking

We use cookies and similar technologies. Necessary cookies keep the site working; analytics and advertising cookies are set only with your consent, which you can change at any time through . Full detail is in our Cookie Policy.

8. Your rights

Access: you can ask for a copy of the personal information we hold about you. We respond within 30 days and do not charge for making the request.
Correction: you can ask us to correct information that is inaccurate, out of date or incomplete.
Marketing: you can opt out of direct marketing at any time.
Complaint: you can complain to us about how we have handled your information.
Anonymity: you may deal with us anonymously for general enquiries, but not for anything that requires an account, because identity verification is a legal requirement.

We may refuse access or correction where the law allows — for example where giving access would reveal a suspicious matter report. If we refuse, we tell you why in writing and how to complain.

9. Complaints

Send privacy complaints to privacy@upcoz.co. We acknowledge within five business days and aim to resolve within 30 days. If you are not satisfied with our response you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

10. Changes to this policy

We review this policy at least annually and whenever our practices or the law change. The current version is always published on this page with its effective date. Material changes are notified to account holders before they take effect.