Thunderbolt's privacy policy and where South African law fits in
Thunderbolt's own terms promise confidentiality for identity and wagering data, and that promise sits inside a specific South African legal framework with its own named regulator.
Confidentiality
What Thunderbolt actually promises about your data
Under Thunderbolt's own terms, personal identity and wagering history are treated as confidential and are not reported outside the company. That promise covers the same identification documents, proof of residence and selfie-with-ID that get collected during account verification for withdrawals, meaning the data handed over to prove who you are is bound by that same confidentiality commitment, not treated separately from it.
In practice, that means the documents used to unlock a withdrawal aren't repurposed for anything beyond verifying identity and preventing fraud. Anyone uncomfortable uploading ID or proof-of-residence documents can weigh that confidentiality commitment against the specific legal protection described below, rather than relying on the promise alone.
Legal framework
Where South African data protection law fits in
Any operator processing personal information of South African residents falls under the Protection of Personal Information Act (POPIA), Act 4 of 2013, which sets out how personal data must be collected, used, secured and eventually disposed of. POPIA is enforced by South Africa's Information Regulator, a body separate from Thunderbolt itself and separate from the South African Responsible Gambling Foundation, giving players a specific, named channel to raise a data-handling concern that isn't routed through the casino's own support desk.
That distinction matters in practice: a dispute about how personal data is stored or shared is a different kind of complaint from a dispute about a bet, a bonus or a withdrawal delay, and POPIA's Information Regulator is the appropriate channel specifically for the data question, not a general-purpose complaints line.