Privacy Policy

1 Introduction

1.1 About This Policy

WinBeast operates the website located at winbeast-plays.uk (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits or registers on our Platform. This Privacy Policy ("Policy") sets out the types of personal data we collect, the lawful bases upon which we process that data, how we use and share it, and the rights you hold under applicable United Kingdom data-protection law.

This Policy must be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the contractual and regulatory framework governing your use of WinBeast.

1.2 Applicable Law

We process personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR) as it forms part of the law of England, Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018;
• The Data Protection Act 2018 (DPA 2018), including Schedule 1 conditions for special-category data;
• The Privacy and Electronic Communications Regulations 2003 (PECR) as amended;
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and associated AML obligations;
• Any other legislation applicable to online gambling and consumer financial services in the United Kingdom.

1.3 Data Controller

WinBeast, operating through winbeast-plays.uk, acts as the data controller in respect of all personal data collected through the Platform. As data controller, we determine the purposes and means of processing your personal data and bear responsibility for ensuring that processing is conducted lawfully, fairly and transparently.

2 Data We Collect

2.1 Identity & Account Data

When you register for an account or update your profile, we collect:

• Full legal name (first name, surname)
• Date of birth — to verify you are 18 years of age or over
• Gender (where voluntarily provided)
• Residential address, including postcode
• Email address
• Telephone number
• Username and encrypted password
• Copies of identity documents (e.g. passport, driving licence, utility bill) submitted for Know Your Customer (KYC) and age-verification purposes

2.2 Financial & Transaction Data

To facilitate deposits, withdrawals and anti-money-laundering checks, we collect:

• Payment instrument details (masked card numbers, payment-method tokens)
• Bank account information or e-wallet identifiers
• Deposit and withdrawal history, including amounts, timestamps and transaction references
• Source-of-funds documentation where required by AML regulation
• Currency preferences (GBP is the default currency for UK accounts)

We support the following payment methods for UK players:

• Visa Debit & Visa Credit
• Mastercard Debit & Mastercard Credit
• PayPal
• Skrill
• Neteller
• Paysafecard
• Apple Pay
• Google Pay
• Bank Transfer (Faster Payments)
• Trustly (Open Banking)

2.3 Usage & Behavioural Data

We automatically collect technical and behavioural information when you interact with the Platform:

• IP address, device identifiers and browser type/version
• Operating system and screen resolution
• Pages visited, session duration and click paths
• Game history, wagering patterns and session data
• Geolocation data (country and region level)
• Referral URLs and marketing attribution data

2.4 Responsible Gaming Data

In line with our obligations under our Responsible Gaming Policy, we may collect and process data relating to your gambling behaviour, including self-exclusion requests, deposit limits, cooling-off periods and interactions with safer gambling tools. This data is processed to protect your welfare and to fulfil our duty-of-care obligations.

2.5 Communications Data

When you contact our customer support team or submit a complaint, we retain records of that communication, including emails, chat transcripts and call recordings (where applicable), together with any personal information you choose to share within those communications.

2.6 Special-Category Data

3 How We Use Your Data

We use your personal data only for specified, explicit and legitimate purposes. The table below summarises our key processing activities:

3.1 Marketing Communications

We will only send you direct marketing communications by email, SMS or push notification where you have given us your explicit prior consent. You may withdraw that consent at any time by clicking the unsubscribe link in any marketing email, adjusting your communication preferences in your account settings, or contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

3.2 Automated Decision-Making & Profiling

We may use automated means to assess certain aspects of your account, such as identifying unusual gambling patterns, evaluating AML risk or determining promotional eligibility. Where any automated decision produces a significant effect on you (for example, a temporary account restriction), you have the right to request human review of that decision. Please contact us using the details in Section 13 to exercise this right.

4 Legal Bases for Processing

Under UK GDPR, every processing activity must rest on a valid lawful basis. We rely on the following bases:

4.1 Performance of a Contract (Article 6(1)(b))

Processing is necessary to perform our contract with you — that is, to provide the gaming services described in our Terms & Conditions. This includes account creation, transaction processing and customer support.

4.2 Legal Obligation (Article 6(1)(c))

Certain processing is necessary for compliance with our legal obligations, including age verification, Know Your Customer (KYC) checks, anti-money laundering record-keeping and responsible gaming requirements imposed by the applicable regulatory framework.

4.3 Legitimate Interests (Article 6(1)(f))

We process personal data for our legitimate interests or those of relevant third parties, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include fraud prevention, Platform security, service improvement and the establishment of legal claims. We carry out a Legitimate Interests Assessment (LIA) for each activity relying on this basis.

4.4 Consent (Article 6(1)(a))

Where we rely on consent, this is obtained separately and explicitly — for example, for direct marketing communications and certain types of profiling. Consent can be withdrawn at any time without detriment to your use of the Platform.

4.5 Vital Interests (Article 6(1)(d))

In exceptional circumstances — for example, where a player shows signs of a serious gambling disorder that may endanger their safety — we may process personal data to protect their vital interests or those of another person.

5 Data Sharing & Third Parties

5.1 Categories of Recipients

We may share your personal data with the following categories of third parties:

• Payment processors and banking partners — to facilitate the processing of deposits and withdrawals through your chosen payment method.
• Identity and age-verification providers — to fulfil KYC and age-verification obligations using electronic checks against trusted databases.
• AML and fraud-detection services — to screen transactions and flag suspicious activity in accordance with our regulatory obligations.
• Game software providers and platform technology partners — who supply the gaming content and back-end infrastructure that power our Platform.
• Analytics and performance-monitoring providers — who help us understand Platform usage and improve the user experience.
• Customer support tools — including live-chat, ticketing and helpdesk software providers who handle support communications on our behalf.
• Marketing technology providers — only where you have provided consent to receive marketing communications.
• Legal, audit and professional advisers — including solicitors, accountants and auditors, where necessary for legal or compliance purposes.
• Law enforcement and regulatory authorities — where we are legally required to disclose information, or where disclosure is necessary to prevent crime or protect public safety.
• Responsible gaming networks — such as Gamstop (the UK's national self-exclusion scheme) and equivalent multi-operator exclusion services, as required.

5.2 Data-Processing Agreements

All third parties who process personal data on our behalf are required to enter into written data-processing agreements (DPAs) that impose obligations equivalent to or exceeding those required by UK GDPR. We conduct due diligence on all third-party processors prior to engagement and review those arrangements periodically.

5.3 No Sale of Personal Data

We do not, and will never, sell, rent or trade your personal data to any third party for their own independent commercial purposes.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of our business assets, personal data held by us may be transferred to the successor entity. You will be notified of any such transfer and of any material changes to the processing of your data that may result from it.

6 Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. We also use related technologies such as web beacons, pixel tags, local storage and session storage. These technologies allow us to recognise your device, remember your preferences and gather information about how the Platform is used.

6.2 Types of Cookies We Use

6.3 Managing Your Cookie Preferences

When you first visit the Platform, you will be presented with a cookie consent banner allowing you to accept, reject or customise non-essential cookies. You may change your preferences at any time via the cookie settings link in the Platform footer. You can also manage cookies through your browser settings; however, disabling strictly necessary cookies may impair Platform functionality. For further information, visit www.aboutcookies.org.

6.4 Third-Party Cookies

Some cookies are placed by third-party services operating on the Platform (such as analytics providers and advertising networks). These third parties have their own privacy policies governing the use of data collected via their cookies. We are not responsible for those policies and encourage you to review them directly.

7 Data Security

7.1 Technical Safeguards

We implement a range of industry-standard technical measures to protect your personal data against unauthorised access, disclosure, alteration or destruction:

• Transport Layer Security (TLS 1.2+) encryption for all data transmitted between your device and our servers;
• AES-256 encryption for sensitive data stored at rest, including payment credentials and identity documents;
• Firewalls and intrusion-detection systems monitoring network traffic for anomalous activity;
• Multi-factor authentication (MFA) for administrative access to systems holding personal data;
• Tokenisation of payment card data in compliance with PCI DSS requirements;
• Regular penetration testing and vulnerability scanning by qualified security professionals.

7.2 Organisational Measures

• Access to personal data is restricted on a strict need-to-know basis using role-based access controls;
• All personnel with access to personal data receive regular data-protection training;
• We maintain an up-to-date Record of Processing Activities (RoPA) as required by UK GDPR Article 30;
• Data protection considerations are embedded in the design of new systems and processes (Privacy by Design and Default);
• Data-Protection Impact Assessments (DPIAs) are conducted for high-risk processing activities.

7.3 Data Breach Procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by Article 33 UK GDPR. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay, providing details of the breach, its likely consequences and the steps we are taking to address it.

8 Data Retention

8.1 Retention Principles

We retain personal data for no longer than is necessary for the purpose for which it was collected, taking into account our legal and regulatory obligations, contractual requirements and legitimate business needs. Once the applicable retention period expires, data is securely deleted or anonymised in a manner that prevents reconstruction.

8.2 Retention Periods

8.3 Early Deletion Requests

If you request deletion of your personal data (see Section 9.4), we will evaluate your request against our legal retention obligations. Where we are legally required to retain data (for example, under AML regulations), we will retain only the minimum data necessary and will restrict further processing during that period.

9 Your Rights

Under UK GDPR and the Data Protection Act 2018, you hold the following rights in respect of your personal data. These rights are not absolute and may be subject to exceptions and limitations as permitted by law.

9.9 How to Exercise Your Rights

To exercise any of the rights described above, please contact our privacy team at [email protected]. We may need to verify your identity before processing your request. We will respond within one calendar month of receipt of a valid request. Where a request is complex or numerous, we may extend this period by a further two months, and will inform you accordingly.

9.10 Right to Lodge a Complaint

If you are dissatisfied with our handling of your personal data or our response to a rights request, you have the right to lodge a complaint with the UK supervisory authority:

10 International Data Transfers

10.1 Transfer Scenarios

Some of our third-party service providers operate in countries outside the United Kingdom. Where we transfer personal data to such countries, we take all necessary steps to ensure that an equivalent level of data protection is maintained.

10.2 Safeguards for International Transfers

We rely on the following lawful transfer mechanisms under UK data protection law:

• UK Adequacy Regulations — transfers to countries that the UK Secretary of State has determined provide an adequate level of data protection;
• International Data Transfer Agreements (IDTAs) — the UK equivalent of Standard Contractual Clauses, approved by the ICO, which contractually bind recipients to UK GDPR standards;
• UK Addendum to EU SCCs — where appropriate, for transfers involving EU-based entities operating under the EU-UK adequacy framework;
• Binding Corporate Rules (BCRs) — where a third-party group has obtained ICO approval for intra-group transfers.

10.3 Transfer Risk Assessments

Prior to any transfer to a third country, we conduct a Transfer Risk Assessment (TRA) to evaluate whether the protections afforded in the destination country supplement the chosen safeguard to an adequate standard. Where a TRA identifies material risk, we apply additional technical or contractual measures before proceeding.

11 Minors

11.1 Age Verification

All players are required to verify that they are aged 18 or over before they may access real-money gaming. We use electronic identity-verification services to cross-check submitted date-of-birth information against trusted UK databases. Where verification cannot be completed electronically, you will be asked to provide supporting documentation (e.g. a copy of your passport or driving licence).

11.2 Discovery of Under-Age Accounts

If we discover or have reason to believe that a person under 18 has registered on the Platform or provided us with personal data, we will immediately:

1. Suspend the account and halt all real-money transactions;
2. Notify the individual (or, where identifiable, their parent or guardian);
3. Permanently delete or anonymise all personal data associated with the account, subject to any legal obligations that require retention;
4. Report the matter to the relevant regulatory authority where required by law.

11.3 Parental Controls

We encourage parents and guardians to make use of parental-control software to restrict access to online gambling websites. The following resources may be helpful:

• GamStop — gamstop.co.uk — national self-exclusion scheme for UK-licensed gambling sites
• GamBan — gamban.com — device-level gambling-blocking software
• NetNanny — parental-control application with category-based website filtering

12 Changes to This Policy

12.1 Right to Amend

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our business practices or our data-processing activities. All revisions will be published on this page with an updated Version number and Last Updated date at the top of the document.

12.2 Notification of Material Changes

Where a change to this Policy is material — that is, where it significantly affects how we process your personal data or your rights in respect of it — we will provide you with advance notice by:

• Sending a notification to the email address registered to your account;
• Displaying a prominent banner or pop-up on the Platform for a minimum of 30 days prior to the change taking effect; and/or
• Requesting fresh consent where required by applicable law.

12.3 Continued Use

Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you must cease using the Platform and may close your account by contacting our support team. This Policy should be read in conjunction with our Terms & Conditions and Responsible Gaming Policy, both of which may also be updated periodically.

13 Contact Information

13.1 General Support

For general enquiries, account questions or assistance with the Platform, please contact our Customer Support team. Our team is available 24 hours a day, 7 days a week.

13.2 Privacy & Data Protection Enquiries

For all matters relating to this Privacy Policy, the exercise of your data-subject rights, or any concern about how we handle your personal data, please contact our dedicated privacy function:

13.3 Responsible Gambling Support

If you or someone you know needs help with gambling-related issues, the following free and confidential support services are available in the United Kingdom:

For further information about our safer gambling tools and commitment to player protection, please visit our Responsible Gaming Policy.