winjoy Privacy Policy

This Privacy Policy ("Policy") describes how winjoy ("winjoy", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "your", "Player") who access or use the winjoy online gaming and sports betting platform available at winjoy.club, including all associated services, features, and content (collectively, the "Platform").

winjoy is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection principles. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

This Policy applies to all personal data collected through the Platform, whether submitted by you directly during registration, gathered automatically through your use of the Platform, or obtained from third-party sources such as payment processors and identity verification providers.

winjoy acts as the data controller in respect of personal data processed through the Platform. As data controller, winjoy determines the purposes for which and the means by which personal data is processed.

If you have any questions about how winjoy processes your personal data, or if you wish to exercise any of your rights as described in Section 10, please contact our Data Protection team using the details provided in Section 14 of this Policy.

winjoy collects the following categories of personal data, depending on how you interact with the Platform:

winjoy does not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or health data, except where health-related information is voluntarily provided in the context of responsible gaming self-exclusion or problem gambling support requests.

winjoy collects personal data through the following methods:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey, you provide personal data directly to winjoy.
• Automated collection: When you access or use the Platform, winjoy's systems automatically record technical and usage data including your IP address, device identifiers, and session activity through server logs and cookies.
• Third-party sources: winjoy may receive identity verification data from third-party KYC providers, fraud-screening results from payment processors, and transaction confirmation data from mobile financial service providers such as bKash, Nagad, Rocket, and Upay.
• Publicly available sources: In limited circumstances, winjoy may verify information against publicly available records for the purpose of fraud prevention and anti-money laundering compliance.

winjoy processes personal data only where a valid legal basis exists. The following table sets out the primary purposes for which we process your data and the corresponding legal basis:

• Contract performance: Processing your registration information, account data, and financial transactions is necessary for us to provide the Platform and fulfil our contractual obligations to you.
• Legal obligation: We are required by applicable law to collect and retain identity and financial data for anti-money laundering (AML) compliance, age verification, and fraud prevention purposes.
• Legitimate interests: We process technical and usage data to maintain Platform security, detect and prevent fraudulent activity, improve Platform performance, and monitor for responsible gaming indicators — all of which constitute legitimate interests that do not override your fundamental rights.
• Consent: Where you have explicitly opted in to receive marketing communications from winjoy, we will send you promotional offers, bonus notifications, and event updates. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

winjoy does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: To facilitate deposits and withdrawals, your financial data is shared with mobile financial service providers (bKash, Nagad, Rocket, Upay) and banking partners (BRAC Bank, City Bank, Dutch-Bangla Bank, Islami Bank, Sonali Bank). These providers process payment data under their own privacy policies and applicable financial regulations.
• Identity verification providers: Third-party KYC service providers process identity documents and verification data on our behalf under strict contractual data processing agreements.
• Game and software providers: Certain technical data (e.g., session tokens, game round IDs) may be shared with third-party game studios such as Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi to ensure proper game functionality and to resolve disputes.
• Fraud prevention and security services: Anonymised or aggregated technical data may be shared with fraud screening and cybersecurity services to protect the Platform and all users.
• Legal authorities: winjoy may disclose personal data to government bodies, law enforcement agencies, financial intelligence units, or courts where required to do so by applicable law, judicial order, or regulatory mandate.
• Business transfers: In the event of a merger, acquisition, or transfer of assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

winjoy is built to serve the Bangladesh market and, where possible, processes personal data within infrastructure serving the South Asia region. In certain circumstances, the technical operation of the Platform or the use of third-party service providers may require your personal data to be transferred to and processed in a country outside Bangladesh.

Where such transfers occur, winjoy ensures that appropriate safeguards are in place to protect your personal data, including contractual clauses that require the recipient to apply data protection standards equivalent to those applied by winjoy. By using the Platform, you acknowledge and consent to such transfers where they are necessary to deliver the services you have requested.

winjoy retains personal data for the period necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal and regulatory requirements. The following general retention guidelines apply:

• Active account data: Retained for the duration of your account's active status, plus a period of up to 7 years after account closure to comply with anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required for financial compliance purposes.
• KYC and identity documents: Retained for the period required by applicable law from the date of verification, typically 5–7 years.
• Support and communication records: Retained for up to 3 years from the date of the last interaction, to support dispute resolution and service quality review.
• Marketing consent records: Retained for the duration of your consent and for a reasonable period thereafter as evidence of that consent.
• Technical and usage logs: Typically retained for 12 months for security and Platform performance purposes, after which they are anonymised or deleted.

When personal data is no longer required, winjoy will securely delete or anonymise it in accordance with our internal data lifecycle procedures.

winjoy uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the Platform. Cookies allow winjoy to recognise your device, maintain your session, and gather usage analytics.

The following categories of cookies are used on the winjoy Platform:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to understand how players interact with the Platform — which pages are visited most, where errors occur, and how navigation flows are used. This data helps winjoy improve the user experience. Analytics data is aggregated and does not identify individual users.
• Functionality cookies: Enable the Platform to remember your preferences, such as language settings and display options, to provide a more personalised experience.
• Responsible gaming cookies: Used to track session duration and play patterns for responsible gaming monitoring purposes, including delivering session time reminders.

You may control or delete cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. winjoy does not use third-party advertising or retargeting cookies.

winjoy recognises and respects the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with your account username and a description of your request.

winjoy will respond to valid rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

Please note that certain rights may be limited where winjoy has a legal obligation to retain data — for example, AML record-keeping requirements. In such cases, we will explain the applicable restriction in our response to your request.

The winjoy Platform is strictly intended for adults aged 18 years and above. winjoy does not knowingly collect or process personal data from individuals under the age of 18. Account registration requires users to confirm they are 18 or older, and winjoy employs age-verification procedures during the KYC process to enforce this requirement.

If winjoy becomes aware that personal data has been collected from a person under the age of 18, we will take immediate steps to close the relevant account, delete the associated personal data, and return any deposited funds to the payment source.

winjoy implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• Transport layer security: All communications between your device and winjoy's servers are encrypted using 256-bit SSL/TLS protocols.
• Data encryption at rest: Sensitive personal data, including identity documents and financial records, is encrypted when stored in our databases.
• Access controls: Access to personal data is restricted to authorised winjoy personnel who have a legitimate business need to access it, under strict role-based permissions and audit logging.
• Secure password storage: Account passwords are never stored in plain text. They are hashed using industry-standard cryptographic algorithms.
• Penetration testing and monitoring: winjoy conducts periodic security assessments and maintains continuous monitoring systems to detect and respond to potential security threats.
• Incident response: winjoy maintains a data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected players and relevant authorities in accordance with applicable law.

While winjoy applies robust security measures, no online platform can guarantee absolute security. You are responsible for keeping your own account credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

winjoy reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, Platform features, or applicable legal requirements. When we make material changes to this Policy, we will update the effective date at the top of this page and, where the changes are significant, we will notify registered players via email or an in-Platform notification.

Your continued use of the winjoy Platform after any amendment to this Policy constitutes your acknowledgement of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed about how winjoy protects your personal information.

If you have any questions, concerns, or complaints about this Privacy Policy or about the way winjoy processes your personal data, please contact us using the details below. We treat all privacy inquiries seriously and are committed to resolving your concerns promptly and fairly.

When submitting a privacy request, please include your registered account username, a clear description of your request, and — for identity verification purposes — confirmation of the mobile number or email address associated with your account. winjoy may ask for additional verification before processing requests involving access to or deletion of personal data.

If you are not satisfied with winjoy's response to your privacy inquiry, you may have the right to lodge a complaint with a relevant data protection authority. winjoy will cooperate fully with any such investigation and will not take any adverse action against you for exercising your privacy rights in good faith.