The platform collects personal data needed to provide lawful services and meet compliance duties in Bangladesh.

• Identity details: full name, date of birth, nationality, NID or passport copies when required.
• Contact details: email, mobile number, residential address.
• Account details: username, hashed password, language and preferences.
• Payment and transaction details: payment instrument tokens, deposit and withdrawal records, billing country, account holder name.
• Technical data: IP address, device identifiers, browser type, approximate location, log files, cookies.
• Usage data: pages visited, session duration, gameplay logs, responsible gaming settings.
• KYC/AML data: verification results, sanctions and adverse media checks required by law.

Why this collection occurs:

• Provide and maintain the account and services.
• Process payments and prevent fraud.
• Verify age and identity and support responsible gaming.
• Comply with AML/CFT, tax, and legal reporting.
• Improve security, performance, and user experience.

Security measures:

• Encryption in transit (TLS) and at rest where feasible.
• Strict access controls, role-based permissions, and multi-factor authentication.
• Network segregation, firewalls, and continuous monitoring.
• Regular security testing, vulnerability management, and audits.
• Staff training, confidentiality agreements, and incident response procedures.
• Payment data handled by PCI DSS certified providers.
• Data minimisation, pseudonymisation, and secure backups.

Your rights:

• Access a copy of personal data.
• Request correction of inaccurate information.
• Request deletion where no legal obligation requires retention.
• Restrict or object to certain processing.
• Withdraw consent for marketing and cookies.
• Request portable copies in a common format.

WinWin applies principles consistent with the Cyber Security Act 2023, the ICT Act 2006 (as amended), Bangladesh anti-money laundering rules, and international standards including GDPR.

Personal data is processed for specific purposes on lawful bases and never sold.

• Account creation and service delivery: to run the online platform and user account under a contract.
• Transactions and payments: to process deposits and withdrawals, and to keep accurate records.
• Customer support: to respond to requests, complaints, and dispute resolution.
• Marketing based on consent: to send email, SMS, in-app messages; users can opt out at any time.
• Analytics and improvement: to analyse service performance and fix issues.
• Security and fraud control: to detect misuse and protect user accounts.
• Legal and regulatory compliance: AML/CFT screening, sanctions checks, and reporting required by law.

Processing by WinWin follows necessity, proportionality, and transparency principles.

Users can access, update, or delete personal information through the account or by contacting the Privacy Team.

• Access: go to Account Settings > Privacy to download a copy in JSON or CSV, or submit a request through the support form.
• Correction: update fields in the profile or submit evidence for changes that require documents.
• Deletion: request closure of the account; data not required for legal obligations will be erased or anonymised.
• Response times: a response will be provided within 30 days; complex requests may need up to 60 days.
• Identity checks: verification may be required to protect the account.
• Marketing consent: unsubscribe from marketing in Preferences or via the link in messages.

By using WinWin, the user consents to security checks, KYC verification, and payment data processing by approved payment providers and banks.

WinWin is intended only for persons aged 18+.

• Age cannot be verified without documents; identity verification may be requested.
• If data about a minor is discovered, the account will be closed and personal data deleted, subject to legal retention.
• Parents or guardians can request deletion by contacting the Privacy Team and providing proof of relationship and identity.
• Funds will be returned to source where legally permitted.

Personal data may be stored or processed outside Bangladesh where service and support partners operate.

• Use of the site indicates consent to international transfers related to the services.
• Transfers rely on contractual safeguards such as standard contractual clauses or equivalent protections.
• Partners must follow confidentiality duties, data minimisation, and purpose limitation.
• Encryption, access controls, and logging protect data during transfer and at rest.
• A copy of key transfer safeguards can be requested through the support form.

WinWin selects processors that meet robust security and privacy standards.

• Certain legal disclaimers may modify how rules apply when required by law or regulator guidance.
• Where deletion conflicts with statutory retention, the legal requirement prevails.
• This policy takes effect once the user accepts it by signature, click acceptance, or accession through the website or app.
• If a court or authority requires disclosure, the scope may be limited to what is necessary and proportionate.
• The policy should be read together with the Terms and Responsible Gaming rules published by WinWin.

Cookies are small text files stored on a device by websites to remember a user and improve services.

• Purpose: statistics, behaviour analysis, personalisation, and site improvement.
• Types: essential, performance, analytics, and advertising cookies.
• Retention: cookies set by this site are kept for up to 1 year unless deleted earlier.
• Control: manage choices in the cookie banner or browser settings; consent can be withdrawn at any time.
• Third-party cookies may be set by analytics or advertising partners according to their policies.

WinWin uses cookie data only for the purposes described in this policy.

• Use of the site or apps means full acceptance of this Privacy Policy.
• The most current version published on this page prevails over earlier versions.
• Continued use after updates signifies acceptance of the revised document.
• Users should review this document periodically and keep a saved copy for records.

Using WinWin services constitutes acceptance without reservation.

Personal information may be shared in limited cases.

• Legal duties: courts, regulators, law enforcement, tax authorities, or anti-money laundering units.
• Dispute and risk: chargebacks, fraud investigations, and recovery actions.
• Service providers under contract: payment processors, identity verification and sanctions screening vendors, cloud hosting, analytics.
• Purpose and scope: categories of recipients and purposes are listed on the site; if a recipient list is not available, details will be provided before or at the time of sharing.
• Consent: providing personal data and using the services is consent for necessary sharing under this policy.
• All recipients must use data only for the agreed purpose and keep it confidential under binding agreements.

WinWin does not sell personal data.

• The site may include links to third-party websites or apps that have their own privacy policies.
• Responsibility for data handling on those sites lies with the third party.
• Users should review those policies before providing any personal information.
• WinWin is not responsible for how external sites collect or use data.