This privacy policy applies to all personal data processed by Winsly in connection with our online casino services. We act as the controller of your personal data and define how and why we process this information. The policy covers your use of our website and any associated mobile applications that link to this document. We reserve the right to update this policy at any time to reflect changes in our practices or legal requirements.

Our services include the operation of an online gambling platform where you may register, deposit funds, play games, and request withdrawals. When you create an account or use any feature of our platform, you are engaging with our services and accepting this policy. We process data necessary to provide these services effectively while maintaining security and regulatory compliance. This policy does not cover third-party websites that may link to our services or our services that may link to third-party sites.

You are responsible for keeping your login credentials secure and for reporting any unauthorised use of your account to us promptly. We treat all data subject to this policy as confidential and store it securely within our systems. Access to your personal data is restricted to those employees who need to know it to perform their duties. We implement technical and organisational measures to protect your data against accidental loss or unauthorised access.

The current version of this policy governs all processing activities unless stated otherwise in a specific communication to you. We may notify you of significant changes to this policy via email or a prominent notice on our website. This ensures you are aware of any material changes before they take effect. Any updated version will replace the previous one immediately upon publication on our site.

We process your personal data based on specific lawful grounds defined under the General Data Protection Regulation. Each category of data has a corresponding lawful basis that justifies its processing by our organisation. We identify these grounds clearly to ensure transparency in our data handling practices. We maintain a record of our processing activities to demonstrate compliance with our stated lawful basis. We regularly review our processing activities to ensure they remain compliant with current legislation.

Performance of contract is the primary basis for processing data required to provide our gambling services. We process this data to manage your account, process deposits and withdrawals, and deliver gaming services. Compliance with legal obligations requires us to process data for anti-money laundering checks and tax reporting. We process this data to meet our regulatory duties and avoid penalties from supervisory authorities. Legitimate interests cover fraud prevention and security monitoring of our platform and user activity.

We process your data for marketing purposes only where you have given explicit consent to receive communications. We provide you with clear information about our marketing purposes before we request your consent. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal. We ensure you have an easy mechanism to manage your communication preferences at all times. This includes opting out of marketing emails and SMS notifications via your account settings.

We maintain a table below to clarify the specific purposes of processing and their associated lawful grounds.

blocks

We share your personal data with third parties only when necessary to provide our services or comply with legal obligations. We do not sell your personal data to any third party for marketing or other commercial purposes. This ensures your data remains under our control and is used solely for its intended purpose. We require all third parties who process data on our behalf to sign data processing agreements.

Payment providers process your financial data to facilitate deposits and withdrawals of funds. Identity verification services check your documents against official databases to confirm your identity. Game suppliers receive gameplay data to ensure the integrity and fairness of the games you play. Regulators and law enforcement agencies receive data where required by law or court order.

We may transfer your data to countries outside the European Economic Area where our service providers are located. We implement appropriate safeguards to ensure your data receives an adequate level of protection in these jurisdictions. These safeguards include standard contractual clauses approved by the European Commission or binding corporate rules. We review the adequacy of data protection laws in the destination country before any transfer takes place.

We retain your personal data for specific periods determined by legal and regulatory requirements. We do not retain data for longer than necessary to fulfil the purpose for which it was collected. We review our retention schedules regularly to ensure they remain compliant with current laws. We delete or anonymise data once the retention period expires unless you have consented to further processing. This ensures we minimise the risks associated with data breaches and unauthorised access.

Account data and transaction records are retained for a minimum of five years from the date of your last activity. This requirement stems from our anti-money laundering and tax reporting obligations under UK law. Verification documents are deleted once the verification process is complete unless retention is required by law. Marketing consents are retained only for the duration of the consent period you specify. We review these consents annually to ensure they remain valid and up to date.

We maintain separate retention schedules for different categories of data to ensure compliance with all relevant laws. Account data is treated differently from marketing data to reflect their distinct purposes and legal requirements. We use automated systems to flag data nearing the end of its retention period for review. This ensures timely deletion or anonymisation without manual intervention for each record. We maintain a record of all deletions to demonstrate compliance with our retention policy.

We provide a table below to outline the specific retention periods for different data categories.

blocks

We implement technical and organisational measures to protect your personal data from unauthorised access and loss. These measures include encryption, access controls, and regular security audits of our systems. We review our security practices regularly to ensure they remain effective against evolving threats. We train our staff on data protection principles to ensure they understand their responsibilities. We maintain a culture of security awareness across all levels of our organisation.

We prioritise the security of your data at all times and invest in robust infrastructure to protect it. We use secure servers and encrypted connections to safeguard your information during transmission. We restrict access to your data to authorised personnel only on a need-to-know basis. We monitor our systems for suspicious activity and respond to potential breaches immediately. This ensures your data remains confidential and secure throughout its lifecycle.

You may complain to us first if you are dissatisfied with how we handle your personal data. We provide contact details on our contacts page for you to reach our data protection team. We aim to resolve any issues informally before they escalate to formal complaints. We maintain a record of all complaints received and their resolution for audit purposes. This allows us to improve our processes and prevent similar issues in the future.

If you are not satisfied with our response to your complaint, you may contact the relevant supervisory authority. In the United Kingdom, this is the Information Commissioner's Office. We encourage you to give us the opportunity to resolve your issue before contacting the regulator. This allows us to address your concerns efficiently and avoid unnecessary regulatory intervention.

We operate securely and transparently to maintain your trust in our handling of your data.

blocks