Dark navy winter night sky with glowing cyan and electric blue aurora lights, falling snow, and icy bokeh for casino hero ban

Data Protection Notice

WinWinter Privacy Policy: How WinWinter Casino Handles Your Data

This policy explains what personal data we collect, why we hold it, how long we keep it and the rights you can exercise over it. Last updated 14 March 2025.

What This Policy Covers

Working document structure last updated: 14 March 2025. This document serves as an operational data protection framework pending the formal incorporation of designated entity details and localised retention schedules.

This Privacy Policy governs the collection, processing, management, and preservation of personal data acquired from users of winwinteruk.com throughout the life cycle of a customer profile. The following schedule outlines the primary categories of personal data processed, the operational necessity behind each classification, the applicable lawful bases under United Kingdom data protection law, and the associated statutory retention requirements.

Data category	Why we collect it	Lawful basis	How long we keep it
Registration data	Account establishment, age verification, and service communication	Performance of a contract; Legal obligation	Duration of the active customer relationship and subsequent statutory record-keeping intervals
Verification documents	Customer due diligence and prevention of financial malfeasance	Legal obligation	Mandatory statutory periods established under anti-money-laundering legislation
Payment data	Transaction clearance, accounting reconciliation, and fraud prevention	Performance of a contract; Legitimate interests	Operational life of the profile plus accounting audit limits mandated by applicable fiscal law
Gameplay activity	Bet settlement, responsible gaming oversight, and dispute resolution	Performance of a contract; Legitimate interests	Period of account operation supplemented by dispute-resolution limits outlined in internal policy
Technical data	System security, fraud mitigation, platform stability, and service delivery	Legitimate interests	Rolling intervals determined by server security protocols and diagnostic cycles
Marketing preferences	Distribution of promotional material, newsletters, and bespoke offers	Consent	Until explicit withdrawal of consent or termination of the customer profile

1.1. In accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, this policy defines our responsibilities as a data controller. We process personal information strictly within the established bounds of data protection legislation to ensure the integrity, confidentiality, and legitimate management of user records.

1.2. Users entering into a services arrangement with WinWinter acknowledge that the processing of personal information described herein represents an integral requirement for operating a player account, executing financial transactions, and maintaining system integrity across our digital platforms.

1.3. Where particular operational metrics, retention thresholds, or internal system processors are not explicitly quantified in this general schedule, processing practices defer directly to the internal technical specifications and account conditions published within the authenticated user environment.

What We Collect

2.1. Registration Data: During the customer intake and profile setup process, we capture specific personal information necessary to identify the individual and confirm their eligibility to participate in interactive gaming services. This collection includes your full legal name, permanent residential address, date of birth, contact telephone number, personal email address, chosen account currency, and authentication credentials including encrypted passwords and unique security passphrases.

2.2. Verification Documents: In accordance with required customer identification protocols, we require documentary evidence validating profile information prior to the release of withdrawals or upon reaching elevated transaction volumes. Such records include photographic copies of government-issued identification instruments—specifically a valid passport or a current driving licence—alongside documentary proof of address dated within the preceding three months, including utility invoices, council tax notifications, or verified bank account statements. For elevated monitoring scenarios, documentation affirming legitimate source of wealth or source of funds, including official wage slips, tax filings, or investment statements, may be collected.

2.3. Payment Data: To enable deposits, withdrawals, and ledger balances, our transactional systems process payment method identification details. This encompasses masked debit card numbers, account holder names, bank transfer clearing identifiers, virtual wallet reference tokens, and public cryptographic ledger transaction hashes. We do not store raw, unencrypted card verification values or comprehensive debit card security codes within our core production environments.

2.4. Gameplay Activity: Every discrete transaction conducted on the platform generates an audit trail. This information captures specific records of wagers placed, game titles accessed, time stamps of game rounds, live-dealer interactions, sports betting slips, rake figures, session durations, win and loss outcomes, promotional bonus activations, and the progression of playthrough requirements associated with promotional funds.

2.5. Technical Data: When you access our digital platform via web browsing software or mobile client interfaces, our server infrastructure logs infrastructural and diagnostic data points. These technical classifications include the user’s internet protocol (IP) address, operating system architecture, hardware model, browser family and version, regional language settings, screen display parameters, network carrier details, system crash reports, and digital device fingerprints generated to detect unauthorised proxy connections or multi-accounting attempts.

2.6. Marketing Preferences: We maintain centralised records of communication choices declared by the account holder. This category tracks direct marketing opt-in selections, subscriptions to specialised electronic newsletters, preferences regarding promotional contact pathways (including electronic mail and SMS communications), alongside administrative logs documenting the exact timestamps of consent granting, amendment, or total revocation.

Why We Collect It

3.1. Performance of a Contract: The primary justification for processing your registration, transaction, and gameplay records is the execution and maintenance of the customer agreement formed between you and the platform. Lawful processing under this basis is executed to:

3.1.1. Create, operate, and maintain your personal gaming profile;

3.1.2. Facilitate the placement and automatic settlement of wagers across sports and casino products;

3.1.3. Process incoming real-money deposits and process payout requests to verified destinations;

3.1.4. Apply promotional rules, monitor wagering turnover requirements, and allocate legitimate bonus balances;

3.1.5. Provide administrative customer support, manage system updates, and deliver transactional notifications.

3.2. Compliance with Legal Obligations: Certain operational aspects of our platform are mandated by overarching statutory frameworks, independent of contractual terms. The processing of identity documents, verification profiles, and transactional ledgers is legally grounded in our mandatory duties under anti-money-laundering legislation. This basis obligates us to:

3.2.1. Positively establish and verify the legal identity and physical residential location of users;

3.2.2. Verify that every participant has attained the minimum legal age of 18 years prior to engaging in real-money transactions;

3.2.3. Screen customer profiles against international sanctions registries and politically exposed persons (PEP) databases;

3.2.4. Trace financial transactions to counter illicit money movement, financing of terrorism, and systemic payment fraud;

3.2.5. Implement protective safer-gambling limits, enforce requested account pauses, and maintain strict adherence to responsible gambling interventions.

3.3. Legitimate Interests: Processing is conducted where necessary to support the prudent, secure, and commercially viable management of our services, provided such operations do not override your fundamental individual rights and freedoms. Legitimate interest grounds encompass:

3.3.1. Investigating and preventing unauthorised multi-accounting, syndicate wagering, and the deployment of automated arbitrage bots;

3.3.2. Safeguarding digital infrastructure against distributed denial-of-service (DDoS) attempts, SQL injections, and network breaches;

3.3.3. Performing statistical assessments to optimise catalogue navigation, lobby presentation, and platform usability;

3.3.4. Managing internal corporate reporting, audit readiness, and defending the company against legal claims, disputed balances, or chargebacks.

3.4. Consent: Where operations involve non-essential data collection or specific forms of promotional interaction, processing is predicated entirely on explicit, unambiguous user consent. Under this basis, we manage:

3.4.1. The distribution of customised promotional communications and exclusive bonus offers via email or SMS channels;

3.4.2. The execution of tailored advertising campaigns across external marketing channels based on segmented player behaviour;

3.4.3. The storage of non-mandatory analytics and tracking mechanisms, subject to individual preferences recorded through our dedicated consent tool.

4.1. Payment Service Providers: To process account funding and outward withdrawals across our 17 supported payment options—including debit cards, direct bank transfer systems, electronic wallet intermediaries, and digital asset processing gateways—necessary financial identifiers and transaction quantities are transferred to integrated financial processors. These external providers handle transaction verification, currency conversion, and anti-fraud payment checks under contractually binding confidentiality requirements.

4.2. Identity and Verification Contractors: Personal data, residential records, and scans of identification documents are transmitted to specialist credit reference bureaus and automated identity validation agencies. These third parties check submitted details against governmental registers, electoral rolls, and international compliance databases to confirm age, mitigate identity fraud, and validate source-of-wealth documentation.

4.3. Software and Platform Suppliers: To deliver games within our library of more than 3,000 titles, technical data, randomised customer session tokens, and transaction outcomes are securely shared with game development studios—including Evolution, Pragmatic Play, Play’n GO, Nolimit City, Hacksaw Gaming, BGaming, and Push Gaming. These studios receive pseudonymised session records required to execute game logic, compute payouts, and resolve technical discrepancies occurring during live dealer or automated rounds.

4.4. Information Technology and Infrastructure Hosts: Core operational infrastructure, relational database clusters, firewall routing software, and automated support communication systems are maintained on secure servers managed by specialised cloud infrastructure providers. These entities process encrypted operational data strictly under our administrative instruction, maintaining rigorous physical and cryptographic barriers to unauthorised access.

4.5. Law Enforcement and Statutory Authorities: Where formal, legally binding disclosures are issued by law enforcement bodies, state judicial courts, or domestic anti-financial-crime units, we are obliged to transmit specific account dossiers, transaction histories, and identity verifications. Disclosures of this nature are conducted strictly within the boundaries of legal obligations defined by current statutory procedures and the Information Commissioner’s Office (ICO).

International Transfers

5.1. Personal information collected by WinWinter is primarily stored, indexed, and processed within the United Kingdom and the European Economic Area (EEA). However, the global nature of electronic services, integrated game hosting, technical diagnostic infrastructure, and distributed technical support operations means that your personal records may, under specific operating circumstances, be accessed from or routed to server facilities located in territories outside the UK or the EEA.

5.2. Where data transfers occur to jurisdictions that have not received a formal adequacy finding from the relevant UK authorities or the European Commission, we implement robust contractual, technical, and operational safeguards to guarantee that your data is afforded a degree of protection equivalent to that required within the United Kingdom.

5.3. The standardised legal mechanisms utilised to govern these international transmission flows comprise:

5.3.1. Standard Contractual Clauses (SCCs) issued or approved by data protection authorities, supplemented by the UK International Data Transfer Addendum;

5.3.2. Mandatory implementation of supplementary technical safeguards, including persistent end-to-end encryption of data in transit and cryptographic hashing of identifying elements prior to cross-border routing;

5.3.3. Strict operational assessments evaluating the domestic surveillance legislation and legal protections present within the recipient jurisdiction to confirm that local administrative frameworks do not undermine contractual data subject protections.

5.4. Users may submit an administrative enquiry to our internal data protection handlers to obtain documented summaries of the relevant data transfer safeguards active across our integrated operational networks.

How Long We Keep It

6.1. General Principles of Retention. Personal data collected by WinWinter is retained only for as long as necessary to fulfil the specific purposes for which it was captured, including the performance of contractual services, compliance with statutory obligations, the resolution of disputes, and the enforcement of our contractual agreements. The determination of specific retention intervals is governed by the nature of the data, the operational necessity of maintaining the record, and the relevant legislative mandates established under the laws of the United Kingdom.

6.2. Anti-Money-Laundering and Statutory Fiscal Mandates. In accordance with applicable anti-money-laundering legislation and financial reporting requirements, we are legally required to retain specific categories of personal records beyond the operational lifespan of a customer relationship. Consequently, customer identification records, verification documents—including submitted copies of photographic identity documents, such as a passport or a driving licence, and proofs of address—alongside complete transactional histories of deposits, wagers, and withdrawals, must be retained for a mandatory statutory duration following the formal closure of an account. The standard retention period mandated by anti-money-laundering legislation generally extends to a minimum of five years from the date upon which the business relationship formally ceases, subject to any statutory amendments or instructions issued by competent authorities requiring prolonged preservation.

6.3. Effect of Account Closure on Stored Information. An account closure requested by a player, or an administrative termination executed by WinWinter, does not result in the immediate or total erasure of existing records. While operational access to the account is suspended and the profile is marked inactive, personal data required for statutory compliance remains held securely in restricted-access archives. Players must note that exercising an account closure does not override our statutory obligations to retain transaction histories, audit trails, and anti-money-laundering verification files. Once the relevant statutory retention period has expired without further legal or operational claim, the associated records are scheduled for permanent destruction or irreversible anonymisation.

6.4. Marketing and Communication History. Contact details and communication preferences held for marketing purposes are maintained only for the period during which an active consent remains valid or where a legitimate interest persists without objection. When a data subject withdraws marketing consent, their preference is updated immediately across active marketing platforms, and their details are added to an internal suppression file to ensure no further promotional correspondence is dispatched. Customer support correspondence, including transcripts of live chat sessions and electronic messages sent to [email protected] or [email protected], is retained for an operational duration necessary to review service standards, manage ongoing enquiries, and address potential complaints, following which it is systematically expunged.

6.5. Technical Data and Telemetry Logs. Technical information collected automatically through web server logs, including Internet Protocol (IP) addresses, browser header strings, operating system indicators, and session telemetry, is retained for a restricted duration necessary to monitor network integrity, prevent automated intrusion, identify fraud, and verify system performance. These technical records are routinely rotated and purged in accordance with our internal data management schedules, unless a specific subset of logs is required as evidence in an active security investigation, anti-fraud review, or dispute procedure.

6.6. Secure Disposal and Anonymisation Protocols. Upon the expiry of the applicable retention schedule for any category of personal information, WinWinter initiates secure disposal procedures. Electronic files are subjected to cryptographic erasure or permanently overwritten using industry-standard sanitisation utilities, rendering the information irrecoverable. Physical documentation, where temporarily handled during verification workflows, is destroyed via secure cross-cut shredding. Where data is retained for aggregated statistical analysis or operational reporting beyond statutory windows, it is stripped of all direct and indirect identifiers, rendering it entirely anonymous under applicable data protection standards.

Your Rights

7.1. Summary of Rights Under UK GDPR. Under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, data subjects are granted specific statutory rights regarding the collection, processing, and storage of their personal information. These entitlements allow individuals to maintain visibility and control over how their data is utilised. WinWinter facilitates the exercise of these statutory rights through defined operational procedures, subject to the lawful exceptions recognised under relevant legislation.

7.2. Right of Access (Subject Access Requests). Every registered user possesses the right to request confirmation as to whether WinWinter processes personal data relating to them and, where such processing occurs, to receive a copy of that personal information alongside supplementary details regarding the processing purposes, categories of data concerned, recipients, and anticipated storage durations. Requests must be submitted in writing from the verified email address linked to the account. WinWinter provides the requested summary without undue delay and at the latest within one calendar month of receipt, subject to verification of identity.

7.3. Right to Rectification. Data subjects have the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Where stored information is incomplete, individuals may provide supplementary statements to ensure accurate records are maintained. Players may update certain details directly through the profile settings interface within their account. For core identity parameters, including legal name and date of birth, documentary proof must be submitted to verify the accuracy of the proposed amendment before changes are applied across our records.

7.4. Right to Erasure (‘Right to Be Forgotten’). Individuals may request the deletion of their personal data where the information is no longer necessary in relation to the purposes for which it was collected, where consent has been withdrawn and no alternative lawful basis exists, or where processing is deemed unlawful. However, the right to erasure is not absolute. WinWinter is legally prohibited from erasing data where processing remains necessary for compliance with a statutory legal obligation, particularly obligations arising under anti-money-laundering legislation, fiscal record-keeping requirements, or for the establishment, exercise, or defence of legal claims.

7.5. Right to Restriction of Processing. A data subject possesses the right to obtain the restriction of processing under defined statutory circumstances. This applies where the accuracy of the personal data is contested by the individual, allowing time for verification; where the processing is unlawful but the individual opposes erasure, requesting restriction instead; where WinWinter no longer requires the data for processing purposes but it is required by the individual for legal claims; or where an objection to processing is pending verification of whether our legitimate grounds override those of the individual. During restriction, data is securely stored but not subjected to active processing without specific consent.

7.6. Right to Data Portability. Where processing is carried out by automated means and is based either on consent or on the performance of a contract, individuals have the right to receive their personal data in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller without hindrance from WinWinter, where technically feasible. This right applies strictly to data provided directly by the user and does not encompass proprietary analysis, risk scorings, or derived internal metrics.

7.7. Right to Object to Processing. Individuals are entitled to object at any time, on grounds relating to their particular situation, to the processing of personal data based on legitimate interests. Upon receipt of such an objection, WinWinter ceases processing unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights, and freedoms of the individual, or where processing is necessary for legal defence. Individuals maintain an unconditional right to object at any time to the processing of personal information for direct marketing purposes, including profiling related to direct marketing.

7.8. Withdrawal of Consent and Cookie Management. Where the lawful basis for processing rests upon explicit consent, the data subject retains the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal. For technical tracking tools, advertising tags, and browser-stored identifiers, consent settings and preferences can be managed directly by reviewing our WinWinter cookie policy. The modification of browser settings or the revocation of consent on cookie collection does not prejudice essential operational processes necessary for basic account security.

7.9. Submission and Processing of Rights Requests. To exercise any of the statutory rights specified herein, the data subject must transmit a formal written notice to [email protected] detailing the exact scope of the request. To safeguard individual privacy and prevent unlawful disclosure, we may request supplementary proof of identity before initiating processing. We respond to all valid requests within one calendar month. Where requests are complex or voluminous, this timeline may be extended by up to two additional months, in which case the applicant will be informed of the extension and the reasons for delay within the initial month.

7.10. Supervisory Authority and Complaints. If a data subject considers that the processing of personal data relating to them infringes the UK GDPR or relevant statutory provisions, they have the right to lodge a formal complaint with the competent supervisory authority in the United Kingdom, namely the Information Commissioner’s Office (ICO). Detailed guidance on submitting an enquiry or complaint to the data protection supervisory authority can be obtained directly via the official portal of the Information Commissioner’s Office. We encourage users to contact our dedicated team at [email protected] in the first instance to achieve a direct and swift resolution.

Security

8.1. Organisational Safeguards. WinWinter deploys comprehensive technical and organisational measures engineered to preserve the confidentiality, integrity, and availability of personal data, preventing accidental loss, unlawful access, alteration, or unauthorised disclosure. Internal access to personal information is strictly restricted to authorised personnel whose duties expressly require access to those specific records. All employees and operational contractors permitted access to customer data are bound by formal confidentiality obligations and receive regular training regarding data protection, identification handling, and information security standards.

8.2. Technical and Network Infrastructure Defences. Electronic data transmissions between the player’s web client and our systems are secured using Transport Layer Security (TLS) cryptographic protocols, ensuring that session data, authentication tokens, and personal inputs remain encrypted during transit. Server environments are hosted within secure data centre facilities protected by perimeter firewalls, intrusion detection mechanisms, automated threat monitoring, and structured vulnerability management routines. Systems holding personal data are segregated logically from general network environments and subjected to regular patch management.

8.3. Payment and Transaction Integrity. Financial operations are processed via dedicated, encrypted interfaces designed to protect sensitive transaction information. WinWinter adheres to rigorous data-handling standards to ensure that complete debit card credentials and financial account access tokens are not held on publicly accessible server environments. Tokenisation and industry-standard verification mechanisms are utilised to validate deposits and process withdrawals securely across all supported banking and financial channels.

8.4. Incident Detection and Breach Management. We maintain formalised incident response procedures designed to detect, contain, investigate, and remediate any potential personal data breach. In the event of a security compromise resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, WinWinter assesses the associated risk to the rights and freedoms of affected individuals. Where required under applicable data protection legislation, notifications will be provided to the Information Commissioner’s Office within 72 hours of becoming aware of the breach. Where the breach presents a high risk to individual rights, direct notification will be dispatched to affected data subjects without undue delay.

8.5. Account Credential Security. The integrity of an individual account relies fundamentally on the confidentiality of access credentials. Users are strictly responsible for maintaining the confidentiality of their registered password, email access, and authentication tokens. WinWinter will never contact a player requesting their account password. Users are advised to employ unique, high-entropy passwords, avoid using automated credentials on shared hardware, and immediately notify [email protected] if any unauthorised access or compromise of credentials is suspected.

Changes to This Policy

9.1. Review and Revision Procedures. This Privacy Policy is subject to periodic review and revision to reflect evolving operational practices, updates to technical architecture, amendments to internal structures, or changes in statutory legal frameworks. WinWinter reserves the right to update this document whenever necessary to ensure sustained compliance with applicable UK data protection mandates.

9.2. Notification of Material Updates. Where alterations made to this document are deemed material—such as introducing new categories of data collection, altering the lawful bases for processing, or establishing novel processing purposes—we will provide notification in advance of the effective date. Notifications may be communicated via prominent notices displayed within the account interface, service banners on the website, or direct electronic communication dispatched to the registered email address of account holders.

9.3. Continued Participation and Review. Following the publication of any revised Privacy Policy, the continued access to our services, logging into an account, or submission of personal details constitutes acknowledgment of the updated terms. If a registered user objects to any revised provision of this policy, they must refrain from further use of the services, cease deposits, and initiate an account closure procedure through the designated support channels.

9.4. Effective Status. The provisions contained within this document remain in full operational effect from the date of publication. The date of the most recent revision is recorded below for reference.

Date of Last Update: 14 March 2025.

Contact

10.1. Primary Data Protection Enquiries. For all communications, formal inquiries, subject access requests, or issues arising in connection with the collection, processing, and retention of personal information under this Privacy Policy, individuals should contact our designated data compliance team by electronic mail at [email protected]. General enquiries regarding website navigation or general platform questions may alternatively be addressed to [email protected].

10.2. Processing Formal Requests. All formal correspondence submitted in relation to individual rights under data protection laws must specify the subject’s full registered name, account identification number, and the precise nature of the request. To maintain rigorous data security and prevent fraudulent disclosures, our team will process requests only after verifying that the communication originates from the registered email address associated with the specific customer profile.

10.3. Dedicated Correspondence Address. WinWinter handles personal data matters exclusively through our direct electronic communication channels hosted on this project’s own domain. We do not operate external telephone helplines or secondary third-party communication portals for privacy governance. All written requests directed to [email protected] receive formal tracking and acknowledgment within standard operational schedules, ensuring an auditable and direct route of escalation for every registered user.