Privacy Policy

Who We Are

Buffalo Racing Pty Ltd (ABN 23 543 443 002), trading as BuffaloBet, is a licensed bookmaker regulated by Racing NSW under the Racing Administration Act 1998 (NSW). We operate the online sports wagering platform at buffalobet.com. Our head office is located at Level 8, 100 Creek Street, Brisbane QLD 4000. References to "we", "us" and "our" refer to Buffalo Racing Pty Ltd throughout this Policy.

Our Privacy Officer can be contacted at [email protected]. We aim to acknowledge all privacy enquiries within 5 business days and to provide a substantive response within 30 days. If your enquiry is urgent, please mark it "URGENT — Privacy" in the subject line.

Information We Collect

We collect personal information that is reasonably necessary to provide our wagering services, prevent fraud and meet our legal obligations. The categories of personal information we may collect include:

• Identity information: full legal name, date of birth, gender, nationality and citizenship
• Contact details: email address, mobile number, residential and postal address
• Identity documents: passport, driver's licence, Medicare card, or other government-issued ID (for KYC verification)
• Financial information: bank account details, credit and debit card numbers (stored as tokens only), payment history and transaction records
• Wagering data: bet history, stake amounts, markets accessed, winnings, losses and betting patterns
• Device and usage data: IP address, browser type, operating system, pages visited, session duration, referring URLs
• Location data: general geographic location derived from IP address (used to confirm Australian residence)
• Communications data: records of customer support interactions, emails, live chat transcripts and phone call notes
• Responsible gambling data: deposit limit settings, self-exclusion status, session time limits and reality check configurations

We collect this information directly from you when you register, verify your identity, deposit funds, place bets or contact our support team. We also collect data indirectly through our website analytics tools, cookies and in some cases through identity verification and fraud prevention partners.

How We Use Your Information

We use personal information only for the specific, legitimate purposes for which it was collected. These purposes include:

• Verifying your identity and confirming you are 18 or older before activating your account (mandatory under Australian law)
• Processing deposits, withdrawals and bet settlements accurately and in a timely manner
• Detecting, investigating and preventing fraud, identity theft, money laundering and other criminal activity
• Providing responsive, personalised customer support and resolving complaints
• Complying with our obligations to Racing NSW, AUSTRAC and other regulatory bodies
• Sending you account notifications, security alerts and critical administrative communications
• Sending promotional offers and marketing materials — only where you have opted in
• Improving our platform and services through anonymised analytics and user research
• Fulfilling our responsible gambling obligations, including monitoring for indicators of problem gambling behaviour
• Maintaining records required by law, including transaction histories for AML/CTF compliance

We will not use your personal information for any purpose that is incompatible with the above list without first obtaining your express consent.

Disclosure of Information

We do not sell, rent or trade your personal information. We may share your information with carefully selected third parties in the following circumstances:

• Racing NSW and regulators: as required by our bookmaker's licence conditions
• AUSTRAC: for mandatory AML/CTF suspicious matter and threshold transaction reporting
• Payment processors: to facilitate deposits and withdrawals (subject to their own privacy frameworks)
• Identity verification providers: to perform KYC and age verification as required by law
• Fraud prevention services: to detect and prevent fraudulent account activity
• Cloud infrastructure providers: who host our platform under strict data processing agreements
• Law enforcement and courts: where required by a court order, subpoena, warrant or applicable Australian law
• Prospective acquirers: in the event of a merger, acquisition or sale of business assets, subject to strict confidentiality obligations

Where we share data with overseas service providers (for example, cloud infrastructure hosted internationally), we take all reasonable steps to ensure those providers maintain protections equivalent to the Australian Privacy Principles.

Data Security

We implement multiple layers of technical and organisational controls to protect your personal information from unauthorised access, disclosure, alteration or destruction.

• All data in transit between your device and our servers is encrypted using 256-bit TLS/SSL
• Sensitive data at rest (including payment details and identity documents) is encrypted using AES-256
• Payment card data is handled by PCI-DSS Level 1 compliant processors — we never store raw card numbers
• Access to personal data is restricted to authorised personnel on a strict need-to-know basis
• All staff with access to personal data undergo annual privacy and security training
• We conduct quarterly internal security reviews and annual independent penetration testing
• Two-factor authentication is available and encouraged for all customer accounts

While we apply rigorous security controls, no online system can guarantee absolute security. We encourage you to use a strong, unique password for your BuffaloBet account and to enable two-factor authentication.

Data Retention

We retain your personal information for as long as your account remains active and for such additional periods as required by law or legitimate business purposes. Key retention periods include:

• Transaction records and identity documents: minimum 7 years after the transaction date, as required by our AML/CTF obligations
• Wagering records: up to 7 years for regulatory compliance and dispute resolution
• Customer communications: up to 3 years after the most recent contact
• Marketing preferences: retained until you withdraw consent
• Closed accounts: retained for 7 years post-closure where required by law, then securely deleted

You may request deletion of data that is no longer required to be retained by contacting [email protected]. We will process deletion requests within 30 days.

Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct any inaccurate, incomplete or out-of-date information
• Delete personal information that we are no longer legally required to retain
• Complain if you believe we have breached the APPs
• Opt out of marketing communications at any time

To exercise any of these rights, contact our Privacy Officer at [email protected] or write to GPO Box 0000, Brisbane QLD 4000. We will respond within 30 days. If we are unable to meet your request, we will explain why in writing. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Cookies & Tracking Technologies

We use cookies and similar tracking technologies including web beacons and local storage to maintain your session, remember your preferences, analyse site usage and deliver relevant content. For full details on cookie types, durations, opt-out mechanisms and third-party cookies, please see our Cookies Policy.

Children's Privacy

BuffaloBet is a wagering platform strictly for persons aged 18 and over. We do not knowingly collect personal information from persons under 18. If we become aware that a person under 18 has provided us with personal information, we will delete that information immediately and close the associated account. If you believe a minor has registered an account, please contact us at [email protected].

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology or legal obligations. When we make material changes, we will notify you by email and by posting a prominent notice on our website at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

Contact

Privacy Officer
Buffalo Racing Pty Ltd
GPO Box 0000, Brisbane QLD 4000
Email: [email protected]