Winwinter logo
Winwinter logo
Menu
Wide cinematic winter night scene over a frozen lake, deep navy sky with drifting snow and warm amber light spilling across t

WinWinter Privacy Policy for Players Holding a WinWinter Account

What data we hold, why we hold it, how long it stays and what you can ask us to do.

What this policy covers

1.1 This privacy policy sets out the framework under which personal data collected from individuals holding a registered account on the platform is processed, stored, and managed.

1.2 The provisions contained herein apply exclusively to registered players and outline the specific categories of information required to provide the requested services, ensure security, and fulfil mandatory financial checks.

1.3 The following table provides a summary of the data categories held by the platform, the primary purposes for which they are processed, and the principles governing their retention periods.

Data we holdWhy we hold itHow long
Account detailsOperating the account and preventing fraudAs set out in the retention schedule
Verification documentsMeeting anti-money-laundering obligationsAs set out in the retention schedule
Payment recordsProcessing transactions and preventing fraudAs set out in the retention schedule
Gameplay recordsResponsible-gambling monitoring and dispute resolutionAs set out in the retention schedule
Marketing preferencesManaging communicationsUntil consent is withdrawn

1.4 Last updated: 30 October 2026

The data we collect and why

2.1 Registration Details. Upon the creation of a registered account, the platform collects specific personal details provided directly by the individual. This category includes the full legal name, date of birth, residential address, email address, and the chosen account credentials. The primary purpose of collecting this information is the establishment and ongoing operation of the account. Without this foundational data, the platform is unable to provide access to the games, process deposits, or maintain a secure environment for the individual. Furthermore, this information serves as the baseline for all subsequent security checks and account recovery procedures.

2.2 Verification Documents. To meet stringent anti-money-laundering obligations and financial checking requirements, the platform mandates the submission of verification documents before a first withdrawal is processed. This data category encompasses copies of a government-issued photo identity document and a recent proof of address, such as a utility bill or bank statement no older than three months. The collection and review of these documents are strictly purposed for identity verification, the prevention of identity theft, and the mitigation of financial fraud. The platform processes these documents to ensure that the individual operating the account is the legitimate owner of the registered details and the associated payment instruments.

2.3 Payment Data. The platform records all financial transactions initiated by the registered player, including deposits and withdrawals. This data category includes the masked details of the payment instrument used, the transaction amounts, the timestamps of each transfer, and the chosen payment method from the accepted list. The processing of payment data is necessary for the execution of the requested financial transactions, the reconciliation of account balances, and the enforcement of the rule that a payout must return to the same payment instrument used for the deposit. Additionally, the continuous monitoring of payment data is a fundamental component of the platform’s anti-money-laundering obligations and broader fraud prevention strategies.

2.4 Device and Session Data. During each interaction with the platform, specific technical data is collected automatically. This category includes the internet protocol address, browser type, device identifiers, operating system details, and the precise timestamps of account logins and logouts. The platform holds this data for the purpose of ensuring the technical security of the account and the integrity of the connection. By analysing session data, the platform can detect anomalous login attempts, prevent unauthorised access, and identify potential instances of automated software usage or collusion, thereby supporting the overarching goal of fraud prevention.

2.5 Records of Play. The platform maintains a comprehensive and immutable ledger of all gaming activity associated with the registered account. This data category covers the specific games accessed, the stakes placed, the outcomes of each round, the application of bonus funds, and the overall duration of gaming sessions. The primary purpose of processing gameplay records is the accurate settlement of wagers and the resolution of any disputes regarding game outcomes. Crucially, this data is also processed for responsible-gambling monitoring. By analysing patterns of play, the platform can identify behaviours that may indicate a loss of control, enabling the application of appropriate account limits or interventions in accordance with the platform’s responsible-gambling commitments.

2.6 Anti-Money-Laundering and Fraud Prevention. The aggregation of registration details, verification documents, payment data, and session data allows the platform to conduct holistic risk assessments. The processing of this combined data is a mandatory requirement for the platform to detect, investigate, and report suspicious activities. This includes the monitoring of deposit turnover rules and the verification of the legitimate source of funds.

2.7 Operating the Account. The seamless delivery of the requested services relies on the continuous processing of the aforementioned data categories. This encompasses the administration of the real balance and bonus funds, the provision of customer support, and the communication of critical account notices. The processing of personal data for these operational purposes is strictly limited to what is necessary for the performance of the agreement between the registered player and the platform.

How long we keep it and who we share it with

3.1. The retention of personal data is directly tied to the active life of the registered account and to the statutory periods that follow its closure or suspension. The operator maintains data only for as long as is strictly necessary to fulfil the purposes outlined in this policy.

3.2. Upon the closure of an account, certain categories of personal data must be retained to satisfy overarching legal obligations. These obligations include financial reporting requirements, the prevention of fraud and the mandatory financial checks that apply to the operator.

3.3. Where a specific retention figure or timeframe is not published within this document, the applicable period is set out in the retention schedule. This schedule is available for review within the account settings and dictates the automatic deletion or anonymisation of records once the specified period expires.

3.4. Personal data is not sold to third parties. It is shared exclusively with specific categories of recipient where such sharing is necessary for the provision of the platform and the execution of requested transactions.

3.5. The permitted categories of recipient include payment providers, identity-verification providers, game suppliers and IT service providers. Payment providers receive the data necessary to process deposits and withdrawals. Identity-verification providers process document scans to confirm player eligibility and prevent identity theft. Game suppliers receive anonymised or pseudonymised session data to facilitate gameplay and resolve technical errors. IT service providers host the infrastructure that securely stores the data.

3.6. In circumstances where data must be transferred to recipients located outside the original territory of collection, such transfers are conducted strictly on the basis of established data-protection mechanisms. These mechanisms ensure that the receiving entity applies a level of security and confidentiality equivalent to the standards enforced at the point of collection.

Cookies and tracking

4.1. The platform employs cookies and similar tracking technologies to maintain session security, facilitate user navigation and measure site performance. These technologies involve the placement of small data files on the device used to access the platform.

4.2. The exact application of these technologies, the specific categories in use and the methods by which consent is recorded are detailed comprehensively in the WinWinter cookie policy.

4.3. The tracking technologies are divided into essential categories, which cannot be disabled without disrupting the core functionality of the cashier and the login process, and non-essential categories, which are subject to user consent.

4.4. A player may adjust their tracking preferences and withdraw consent for non-essential cookies at any time through the consent panel provided on the site. Altering these preferences does not restrict access to the primary gaming services or the account balance.

Your rights and how to use them

5.1. A registered player holds specific and enforceable data-protection rights regarding their personal information. These rights are designed to ensure transparency and grant the individual control over how their data is processed.

5.2. The right of access allows a player to request a copy of the personal data currently held on their account. The right to rectification permits the correction of any inaccurate or incomplete information.

5.3. The right to erasure enables a player to request the deletion of their personal data, subject to the overriding statutory retention periods described in the retention schedule. The right to restriction of processing allows a player to halt the active use of their data while a dispute regarding its accuracy or lawful processing is resolved.

5.4. The right to data portability entitles a player to receive their provided personal data in a structured, commonly used and machine-readable format. The right to object allows a player to oppose the processing of their data where such processing is based on legitimate interests rather than strict contractual necessity.

5.5. To exercise any of the aforementioned rights, a player must submit a formal written request to [email protected]. This address serves as the sole designated channel for data-protection inquiries.

5.6. The written request must contain the exact email address associated with the registered account, a clear description of the specific right being exercised and sufficient detail to accurately identify the data in question.

5.7. The response timeframe for a valid data-protection request aligns with standard statutory expectations. An initial acknowledgement is provided upon receipt of the request. Complex requests or multiple concurrent requests may require an extended review period, as permitted by standard data-protection rules, in which case the player is notified of the delay and the reasons for it.

5.8. If a player considers that the processing of their personal data infringes upon applicable data-protection standards, they retain the right to lodge a formal complaint with the supervisory authority for data protection. This authority oversees electronic communications and privacy compliance independently of the platform.

5.9. Marketing preferences constitute a separate category of consent. A player may manage these preferences directly within the account settings or by using the unsubscribe function included in every promotional communication.

5.10. Withdrawing consent for marketing communications takes effect immediately upon processing and does not affect the legality of any prior communications. The withdrawal of marketing consent has no impact on the receipt of essential administrative notices, such as security alerts or updates to the governing terms.