Privacy Policy

This Privacy Policy explains how Universe Entertainment Services Malta Limited, operating the Tropez brand and the Tropez product on tropaze.com (the "Site"), collects, uses, stores and protects your personal data. It applies to visitors to the Site, registered players, and any person who contacts us or uses our services through the Site. By using the Site you acknowledge that your personal data will be processed in accordance with this Privacy Policy. Effective date: 1 January 2026.

Who We Are

The Site tropaze.com (including the Tropez product) is operated by Universe Entertainment Services Malta Limited ("we", "us", "our"). We are a limited liability company incorporated in Malta and licensed by the Malta Gaming Authority (MGA) to provide remote gaming services under license number MGA/B2C/249/2013. We are not licensed by the United Kingdom Gambling Commission (UKGC); therefore UK players do not benefit from UKGC consumer protections or UK-approved gambling ADR schemes in relation to gambling disputes, though this does not affect your privacy rights under applicable data protection laws.

Our registered office and full corporate details are available on the MGA licensee register and in the legal notices on the Site. For all questions about this Privacy Policy or our data protection practices, you may contact our data protection function as follows:

Data Controller: Universe Entertainment Services Malta Limited, operator of Tropez and Tropez on tropaze.com.
Postal contact: Universe Entertainment Services Malta Limited, Attn: Data Protection Officer, at the registered office address shown from time to time on the MGA register and in the Site's Terms & Conditions.
Email (primary contact): privacy@tropaze.com (or any replacement address notified on the Site).
Online contact: via the contact or support forms made available on tropaze.com and any related pages that link to this Privacy Policy.

Where we are required by law to appoint a Data Protection Officer (DPO), this function is performed by a senior member of our legal or compliance team, who may be contacted through the details above, clearly marking your communication "For the attention of the Data Protection Officer".

What Personal Data We Collect

We collect only the personal data that is necessary for lawful, transparent and secure operation of the Tropez product and related services on tropaze.com. Depending on how you interact with us, we may collect the following categories of data:

Identity data: full name, date of birth, gender (where provided), nationality, unique customer identifiers, copies of identification documents (such as passport, ID card or driving licence) used for age, identity and Know Your Customer (KYC) checks.
Contact data: email address, telephone number, postal address, country of residence, preferred language, and communication preferences.
Account & usage data: username, encrypted password and other authentication credentials, account settings, security questions and answers, login timestamps, and in-account activity (for example, pages visited within your account area).
Verification & compliance data: results of identity and age verification, KYC/AML (anti-money-laundering) checks, sanctions and politically exposed person (PEP) screenings, documentation supporting source of funds or source of wealth (such as bank statements or payslips), problem-gambling self-exclusion flags, and records required for responsible gambling obligations.
Payment & transaction data: partial payment card details (we do not store full card numbers in plain text), bank account or e-wallet details you provide, deposits and withdrawals, bonus usage, chargeback and refund information, transaction identifiers, currency, and relevant billing information.
Gaming & behavioural data: betting and game history, stakes and winnings, game type, session duration, frequency and pattern of play, clicks and navigation on the Site, actions taken (for example, accepting a promotion, setting limits, initiating self-exclusion), and interactions with customer support relating to your gameplay.
Technical & log data: IP address, approximate geolocation derived from IP, device identifiers, device type and operating system, browser type and version, language settings, time zone, log files, connection timestamps, and diagnostic data about how our systems are used.
Communication data: contents of emails, live chat and contact-form submissions, call recordings (where applicable and where you are notified), internal notes created to service your account, and records of complaints or requests.
Marketing & preference data: your choices regarding marketing communications (opt-in/opt-out), records of promotional campaigns you interacted with, and data about whether our emails or messages were opened or acted upon.
Cookies & tracking technologies: identifiers stored via cookies, web beacons, pixels and similar technologies, which can relate to your browsing session, preferences, analytics measurements or advertising attribution. More detail is provided in the "Cookies & Tracking Technologies" section.
Data from third parties: information from payment providers, KYC and fraud-prevention agencies, marketing affiliates, publicly available sources, and any other partner who is lawfully permitted to share your data with us for the purposes described in this Privacy Policy.

Legal Basis for Processing

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR where it applies, and other relevant laws (including, where relevant, Mexican data protection law). Depending on the purpose, our processing is based on one or more of the following legal grounds:

Performance of a contract: We process data that is necessary to create and manage your account on Tropez at tropaze.com, to provide access to games, to handle payments, to apply bonuses and promotions, to verify your eligibility, and to provide customer support. Without this data, we cannot provide the services you request.
Compliance with legal obligations: We are subject to AML, counter-terrorist financing, fraud-prevention, taxation, accounting, responsible gambling and other regulatory obligations under Maltese law, EU law, and in some cases other local laws. To comply, we must collect and retain specific personal data (for example, identity documents, transaction records, and responsible gambling records) and may need to disclose such data to competent authorities or regulators, including the Malta Gaming Authority.
Legitimate interests: We may process your personal data where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. These legitimate interests include:
- maintaining the security and integrity of our platforms, networks and systems;
- preventing abuse of our services, detecting and investigating fraud or other unlawful activity;
- improving our products, services and user experience through aggregated analytics and performance monitoring;
- tailoring some content and limited marketing to existing customers in a proportionate way, in line with applicable direct marketing rules;
- defending or establishing legal claims and managing disputes or regulatory inquiries.
Consent: In certain circumstances we rely on your consent, for example for:
- sending electronic marketing communications to you where consent is required by the UK Privacy and Electronic Communications Regulations (PECR) or similar laws;
- using certain non-essential cookies or tracking technologies for analytics or advertising;
- processing particular categories of data (for example, health-related information linked to responsible gambling tools) where the law requires explicit consent.
You may withdraw your consent at any time as explained in the "Your Rights" and "Cookies & Tracking Technologies" sections, without affecting the lawfulness of processing based on consent before its withdrawal.
Protection of vital interests and public interest: In rare cases we may process data to protect your vital interests or those of another person, or where the processing is necessary for reasons of substantial public interest recognised in applicable data protection laws, such as preventing serious crime or protecting vulnerable individuals.

Purpose of Processing

We use your personal data for clear, specific purposes and do not process it in ways that are incompatible with those purposes. In particular, we process your personal data for the following reasons:

Providing and administering our services: creating and maintaining your Tropez account on tropaze.com, enabling you to access games, processing deposits and withdrawals, managing bonuses and promotions, verifying eligibility, and delivering a secure and reliable gaming experience.
Customer support and communication: responding to enquiries, handling complaints or disputes, providing technical assistance, and communicating with you about operational issues such as account changes, security alerts, service interruptions or updates to this Privacy Policy and other legal documents.
Legal and regulatory compliance: satisfying our obligations under AML, counter-terrorist financing, sanctions, tax, accounting, gambling regulation, responsible gambling frameworks, and data protection laws, including the retention and reporting of certain data to regulators and competent authorities.
Risk management, fraud prevention and security: monitoring activity for suspicious patterns, verifying identity and payment information, enforcing our Terms & Conditions, preventing misuse of bonuses, and protecting our systems, players and business from fraud, money laundering, cyber attacks and other threats.
Analytics, service improvement and product development: analysing aggregated or pseudonymised data to understand how our services are used, measuring performance of games and features, improving usability and functionality, and developing new offerings and enhancements relevant to Tropez players.
Marketing and personalisation: subject to your choices and applicable legal requirements, sending you tailored offers and promotions, recommendations about games or features that may interest you, and newsletters or other marketing communications relating to Tropez and Tropez on tropaze.com. We may also use cookies or similar technologies to measure the effectiveness of our marketing campaigns.
Dispute resolution and legal claims: managing and resolving disputes with players, partners or regulators; cooperating with alternative dispute resolution (ADR) bodies where applicable (such as eCOGRA or MADRE if designated in our Terms & Conditions); and establishing, exercising or defending legal claims.

Disclosure & Sharing

We treat your personal data as confidential and only share it where necessary, lawful and subject to appropriate safeguards. Depending on the circumstances, we may disclose your personal data to the following categories of recipients:

Group companies and internal departments: other entities within our corporate group (including operators of related brands such as Europa Casino, Titan Casino and Casino Bellini, where relevant) and internal teams (for example, customer support, fraud, compliance, legal, finance, IT) who need access to perform their duties and support the Tropez product.
Payment and financial service providers: banks, card schemes, payment processors, e-wallet providers and other financial institutions that process deposits, withdrawals and refunds, or provide chargeback-related services. These providers act as independent controllers or processors depending on their role and contractual terms.
KYC, AML and fraud-prevention partners: identity verification providers, credit reference agencies, sanctions and PEP screening tools, address verification services, and fraud-prevention networks who assist us in verifying your identity, preventing financial crime, complying with regulatory duties and protecting our business and players.
Technology and infrastructure providers: hosting and cloud service providers, IT maintenance and security providers, content delivery networks, game suppliers, communications platforms (for email, SMS, push notifications or live chat) and other vendors who help us operate and secure tropaze.com. These parties typically act as data processors under our instructions and are bound by contractual data protection obligations.
Analytics, marketing and advertising partners: tools and service providers that support analytics, user experience testing, campaign management, affiliate tracking and (where permitted) online advertising. Where we use third-party cookies or pixels, data may be shared with advertising networks subject to your consent and applicable law. You may manage such preferences as described in the "Cookies & Tracking Technologies" section.
Business partners and affiliates: affiliate marketing partners and other commercial partners who refer you to our Site or promote Tropez, to the extent necessary to attribute referrals, pay commissions, and prevent abuse. Data sharing is limited to what is necessary and subject to contractual safeguards.
Regulators, authorities and dispute bodies: the Malta Gaming Authority (MGA) and other regulators or competent authorities, tax authorities, law enforcement agencies, courts and tribunals where required by law or reasonably necessary to protect our rights, players or the public. Where applicable under our Terms & Conditions, we may also share data with recognised ADR entities (such as eCOGRA or MADRE if designated) in order to manage gambling or service-related disputes; UK players should note that these ADR bodies are not appointed under the UKGC regime.
Professional advisers: lawyers, auditors, consultants, accountants and other professional advisers who assist us in running our business, complying with obligations and managing risks, under strict confidentiality commitments.
Corporate transactions: if we are involved in a merger, acquisition, sale of assets, restructuring, financing or similar corporate transaction, your data may be disclosed to prospective or actual counterparties and their advisers, subject to confidentiality, and may become subject to the policies of a successor entity in accordance with applicable law.

We do not sell your personal data in the sense of directly exchanging it for monetary consideration. Where we engage in data sharing for advertising or analytics that could be considered a "sale" or "sharing" under some non-UK regimes, we will honour any additional rights or opt-out mechanisms that may apply.

International Transfers

Universe Entertainment Services Malta Limited is established in Malta and operates the Tropez product globally via tropaze.com. As a result, your personal data may be transferred to and processed in countries other than the country in which you reside, including:

Malta and the European Economic Area (EEA): personal data of UK and other players is routinely processed in Malta and, where relevant, other EEA states in which our infrastructure or service providers are located. The UK currently recognises the EEA as providing an adequate level of protection, and the EU has adopted an adequacy decision in favour of the UK, which facilitates EU - UK data flows.
United Kingdom: personal data of non-UK players may be processed in the UK when we use UK-based providers or infrastructure. Such transfers are subject to EU adequacy decisions or appropriate safeguards where required.
Other third countries: some of our service providers or partners may be located, or may process data, outside the UK and EEA (for example, in states that do not benefit from an adequacy decision). In these cases we implement appropriate safeguards such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office (ICO);
- additional contractual and organisational measures, such as encryption, strict access controls and data minimisation; and
- transfer risk assessments where required by law to evaluate the level of protection in the destination country.

Where we rely on your consent for particular international transfers, we will clearly inform you of the risks associated with such transfers in the absence of an adequacy decision or appropriate safeguards, and you may withdraw your consent at any time.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, to comply with legal, regulatory or accounting obligations, and to protect or defend our rights. Retention periods may vary depending on the category of data and applicable law, but we generally apply the following principles:

Active account data: information related to your Tropez account (identity, contact, account settings, gaming history) is kept for as long as your account remains open and active, and for a further period where necessary to comply with obligations or manage disputes.
KYC, AML and compliance data: identity documents, verification records, source-of-funds documentation and AML-related data are typically retained for up to five (5) years after the end of the business relationship or the date of the last transaction, or longer where required by law or necessary for investigations or legal proceedings.
Payment and transaction records: financial records, including deposits, withdrawals and accounting entries, are retained for periods required under applicable tax and accounting rules, normally at least five (5) years from the end of the relevant financial year or from account closure.
Responsible gambling and exclusion data: records related to self-exclusion, limits and responsible gambling interventions may be retained for the duration of the exclusion or restriction and for a period thereafter (typically up to five (5) years) to ensure compliance with our obligations and prevent circumvention.
Marketing data: data relating to consent and marketing preferences is kept for as long as you remain opted-in and for a limited period after you opt out (for example, up to two (2) years) to demonstrate our compliance and ensure we respect your choices.
Technical logs and security data: logs used for security, auditing and troubleshooting are generally retained for shorter periods, often between six (6) months and two (2) years, unless a longer period is necessary for incident investigation or legal purposes.
Cookies and similar technologies: storage periods for cookies depend on their type and purpose. Session cookies usually expire when you close your browser, while persistent cookies can remain on your device for months or years unless you delete them. Specific durations are described in our Cookie notices or tools.

Once the relevant retention period expires, or where processing is no longer necessary, we will either securely delete or irreversibly anonymise the data, unless we are legally required or entitled to keep it for longer (for example, in connection with ongoing disputes or regulatory investigations). When you request deletion, we may retain certain limited data as permitted by law, such as to comply with AML or accounting obligations or to record your opt-out from marketing.

Your Rights

Depending on where you reside and which laws apply, you have a number of rights in relation to your personal data. We respect these rights under the UK GDPR, the EU GDPR, the UK Data Protection Act 2018 and, where applicable, Mexican privacy law, including the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). We handle all rights requests in a fair, consistent and non-discriminatory manner.

Rights under UK/EU GDPR and similar laws

Right of access: you may request confirmation as to whether we process your personal data and, if so, obtain a copy of that data together with information about the processing.
Right to rectification: you may request correction of inaccurate or incomplete personal data we hold about you. Where possible, you can update certain details directly in your Tropez account on tropaze.com.
Right to erasure ("right to be forgotten"): you may request deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected, or you withdraw consent and there is no other legal basis. This right is not absolute; for instance, we may need to retain certain records for AML, responsible gambling, regulatory or legal reasons.
Right to restrict processing: you may request that we restrict the processing of your data in specific situations, for example while we verify its accuracy or assess an objection.
Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop such processing unless we have compelling legitimate grounds or need the data for legal claims. You also have an unconditional right to object to processing of your data for direct marketing; if you do so, we will stop using your data for this purpose.
Right to data portability: in certain cases you may receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit it to another controller where technically feasible.
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time (for example, by changing your marketing preferences or cookie settings). This will not affect the lawfulness of processing before withdrawal.

Rights under Mexican privacy law (LFPDPPP) and alignment

Where Mexican privacy law applies to your relationship with us (for example, if you are habitually resident in Mexico and access Tropez on tropaze.com), you have rights often referred to as "ARCO" rights, which align closely with GDPR rights:

Access: to know what personal data we hold about you and how we use it.
Rectification: to request correction of inaccurate or incomplete data.
Cancellation (erasure): to request that we delete data when it is no longer necessary, subject to legal retention requirements.
Opposition: to object to certain processing activities, including for marketing purposes, where permitted by law.

We aim to treat GDPR and Mexican law requests in a harmonised way, applying the most protective standard where feasible and consistent with our legal obligations in Malta, the UK and other relevant jurisdictions.

How to exercise your rights

Submitting a request: you can exercise your rights by contacting us via privacy@tropaze.com or through any dedicated privacy or contact form on tropaze.com. Please specify which right(s) you wish to exercise and provide enough information for us to verify your identity and locate your data (for example, your username, registered email and country of residence).
Verification: to protect your account and personal data, we may request additional information or documentation to verify your identity before actioning your request, especially for access or deletion requests.
Response time and cost: we aim to respond to all valid requests within one (1) month / 30 days of receipt. If your request is particularly complex or we receive multiple requests from you, this period may be extended by a further two months, in which case we will inform you of the extension and reasons. We do not normally charge a fee, but may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, in accordance with applicable law.
Limitations: some rights may not apply in certain situations (for example, where disclosure would adversely affect the rights of others, or where we must retain data to comply with AML or regulatory duties). Where we decline your request in whole or in part, we will explain the reasons, unless restricted by law or regulatory requirements.

Cookies & Tracking Technologies

We use cookies and similar technologies on tropaze.com to operate the Tropez product, provide a secure and user-friendly experience, and, where permitted, improve our services and marketing. Cookies are small text files placed on your device when you visit the Site.

Types of cookies we use

Strictly necessary (functional) cookies: essential for the operation of the Site and your account, such as enabling page navigation, login, session management, security features and basic functionality. These cookies are usually set in response to actions you take and cannot be switched off using our consent tools, although you may block them in your browser (which may cause parts of the Site to stop working properly).
Preference cookies: used to remember choices you make, such as language, region, display settings, and other customisations, to provide a more personalised experience.
Analytics and performance cookies: help us understand how visitors use tropaze.com, which pages are most frequently visited, how users move around the Site, and whether error messages occur. This information is generally aggregated and used to improve performance and usability.
Advertising and tracking cookies: set by us or by third-party partners (such as affiliate networks or advertising providers) to deliver more relevant adverts, measure the effectiveness of campaigns, and understand how users arrive at the Site. These may track your browsing across different websites and build a profile of your interests. We only use such cookies where permitted by law and, where required, based on your consent.

Managing cookies and similar technologies

On-site tools: where available, you can manage your cookie preferences using banners, pop-ups or dedicated settings on tropaze.com, allowing you to accept or reject non-essential cookies.
Browser settings: most browsers allow you to delete cookies, block them entirely, or configure alerts when a cookie is set. Please consult your browser's help section for instructions. If you block or delete cookies, some features of Tropez may not function correctly.
Third-party opt-outs: some analytics and advertising partners provide their own opt-out mechanisms. Where applicable, we may link to these within our cookie notices or on the relevant partner's website.

For more detailed information about the specific cookies we use, their purposes and lifespans, please refer to any cookie-specific documentation or tools provided on tropaze.com.

Data Security

We take the security of your personal data very seriously and implement a combination of technical, organisational and physical measures designed to protect it against unauthorised access, loss, misuse or alteration. While no system can be guaranteed as completely secure, we continuously assess and improve our controls in line with recognised best practices.

Encryption in transit and at rest: data transmitted between your device and our systems is protected using industry-standard transport layer security (TLS 1.2 or higher), and sensitive data is encrypted or otherwise appropriately protected at rest, using strong cryptographic protocols and key-management practices.
Access controls and authentication: access to personal data is strictly limited to authorised personnel and service providers who need it to perform their duties, based on role and least-privilege principles. We use authentication and access-control mechanisms, including strong password policies and, where appropriate, multi-factor authentication.
Network and infrastructure security: we deploy firewalls, intrusion detection and prevention systems, anti-malware solutions, logging and monitoring to help detect and respond to suspicious activity on tropaze.com and associated back-end systems.
Secure development and testing: our systems and applications are developed with security in mind, including code reviews, vulnerability assessments and, where appropriate, penetration testing by internal teams or reputable third parties.
Organisational policies and training: we maintain internal policies and procedures covering data protection, information security, access management and incident response. Staff members with access to personal data receive training on privacy and security obligations and are bound by confidentiality commitments.
Incident detection and response: we maintain processes to detect, investigate and respond to security incidents. Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with applicable law.
Alignment with international standards: we design our information security controls with reference to recognised frameworks and standards (such as ISO 27001 and SOC 2) where appropriate. This does not imply formal certification unless we explicitly state otherwise in our corporate communications.

Complaints & Contacts

If you have any questions, concerns or complaints about how we process your personal data in relation to Tropez on tropaze.com, we encourage you to contact us first so that we can try to resolve the issue directly and efficiently.

How to contact us with privacy questions or complaints

Email: contact our data protection function at privacy@tropaze.com, clearly indicating that your message relates to "Privacy" or "Data Protection".
Online forms: use any dedicated privacy or contact forms available in your account area or on the "Contact Us" page of tropaze.com, providing your username, registered email address and a clear description of your concern.
Postal: write to Universe Entertainment Services Malta Limited, Attn: Data Protection Officer, at the postal address indicated from time to time in our legal notices and on the MGA register, including sufficient information for us to identify your account.

Internal complaint procedure

Submission: you submit your complaint or query using one of the channels listed above, including all relevant details and supporting documentation.
Acknowledgement: we aim to acknowledge receipt of your complaint within seven (7) days, providing a reference number where applicable.
Investigation: our data protection and/or compliance team will investigate your complaint, which may involve contacting you for additional information and consulting internal records or third parties as necessary.
Response: we will provide a written response with our findings and any proposed resolution as soon as reasonably possible and in any event within one (1) month / 30 days of receiving a complete complaint, unless a longer period is permitted by law due to complexity, in which case we will keep you informed.
Follow-up: if you remain dissatisfied, you may raise the matter again with us, providing any additional information, and/or escalate your complaint to a competent supervisory authority as described below.

Escalation to supervisory authorities

You have the right to lodge a complaint with a data protection authority if you believe that our processing of your personal data infringes applicable law. Without limitation, you may contact:

United Kingdom - Information Commissioner's Office (ICO): if you are located in the UK or your issue relates to UK GDPR compliance, you may contact the ICO via https://ico.org.uk or the address and phone numbers published there.
European Union supervisory authorities: if the EU GDPR applies to you (for example, you are located in an EEA Member State), you may lodge a complaint with the data protection authority in your country of habitual residence, place of work or place of the alleged infringement. Contact details are available via the European Data Protection Board website.
Mexico - National Institute for Transparency, Access to Information and Personal Data Protection (INAI): if Mexican privacy law applies to your relationship with us, you may lodge a complaint with INAI. Further information is available at https://www.inai.org.mx.

Nothing in this Privacy Policy limits your right to seek judicial remedies or to pursue other forms of dispute resolution that may be available under applicable law. Please note that, as Tropez is not regulated by the UKGC, UK-specific gambling ADR schemes (such as IBAS) do not apply to disputes about gaming outcomes; however, your data protection rights and access to data protection authorities remain unaffected.

Updates

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, regulatory guidance, or technological and business developments related to Tropez and tropaze.com. When we make changes, we will revise the "Last updated" date at the end of this document and, where appropriate, provide additional notice.

Notification methods: material changes may be communicated through prominent notices on the Site (such as banners or pop-ups), messages in your account area, and/or email notifications to the address associated with your Tropez account.
Advance notice for significant changes: where changes are likely to materially affect your rights or the way we process your personal data, we will, where reasonably practicable, provide notice at least 30 days before the new version takes effect, giving you time to review the updated terms.
Your options: if you do not agree with the changes, you may choose to discontinue using the Site and, where applicable, request closure of your account and exercise your rights (including data access or deletion) as described in the "Your Rights" section. Continued use of Tropez on tropaze.com after the effective date of an updated Privacy Policy will constitute your acknowledgment of the changes, to the extent permitted by law.
Version control and record-keeping: we may retain previous versions of this Privacy Policy for audit and compliance purposes. In case of conflict between versions, the most recent version published on tropaze.com will prevail, except where a previous version is expressly stated to remain in effect for specific processing.

Last updated: January 2026.