Privacy Policy

1Introduction

1.1. About This Policy

Welcome to WinBeast ("we", "us", "our"), accessible at winnsbeast.uk. We are committed to safeguarding the privacy and personal data of every individual who visits, registers with, or uses our platform. This Privacy Policy ("Policy") describes what personal data we collect, why we collect it, how we process and protect it, and the rights you hold as a data subject.

This Policy applies to all users of winnsbeast.uk, including registered account holders, visitors who browse the site without registering, and individuals who contact us for support or information. It forms part of our broader legal framework together with our Terms & Conditions and our Responsible Gaming Policy. You are encouraged to read all three documents to understand your full relationship with WinBeast.

1.2. Regulatory Framework

WinBeast processes personal data in compliance with the following applicable legislation and standards:

• UK General Data Protection Regulation (UK GDPR) — the retained version of the EU GDPR as it applies in the United Kingdom following exit from the European Union.
• Data Protection Act 2018 (DPA 2018) — the primary UK statute that supplements and gives effect to the UK GDPR.
• Privacy and Electronic Communications Regulations 2003 (PECR) — governing electronic marketing and cookies.
• Anti-Money Laundering (AML) regulations and Know Your Customer (KYC) obligations applicable to online gambling operators.

1.3. Data Controller

WinBeast, operating via winnsbeast.uk, acts as the data controller in respect of all personal data processed under this Policy. As data controller, we determine the purposes and means of processing your personal information and are accountable for ensuring that processing is lawful, fair, and transparent.

2Data We Collect

WinBeast collects only the personal data that is necessary and proportionate for the purposes described in this Policy, in accordance with the data minimisation principle under UK GDPR Article 5(1)(c). The categories of data we collect are set out below.

2.1. Identity & Registration Data

• Full legal name — required for account registration and identity verification.
• Date of birth — to verify that you meet the minimum age requirement of 18 years.
• Gender (optional, where voluntarily provided).
• Username and password — for account access and security.
• Nationality — where required for KYC or regulatory compliance purposes.

2.2. Contact Data

• Email address — primary communication channel for account notifications, support, and marketing (where consented).
• Residential address — including postcode, for identity verification and fraud prevention.
• Telephone number — for two-factor authentication and customer support.

2.3. Identity Verification (KYC) Documents

• Government-issued photo identification (e.g., passport, driving licence).
• Proof of address (e.g., utility bill, bank statement dated within three months).
• Source of funds documentation — where required by AML obligations or as part of enhanced due diligence.

2.4. Financial & Transaction Data

• Payment method details (e.g., partial card numbers, e-wallet identifiers — we do not store full card numbers).
• Deposit and withdrawal history, including amounts, dates, and transaction references.
• Currency preference (GBP – Pound Sterling).
• Accepted payment methods, which may include: Visa, Mastercard, Maestro, PayPal, Skrill, Neteller, Apple Pay, Google Pay, Paysafecard, Bank Transfer, Trustly, and Revolut Pay.

2.5. Gaming & Behavioural Data

• Game session history, including games played, session duration, wagering amounts, and outcomes.
• Bonus usage, promotional participation, and loyalty programme activity.
• Responsible gaming interactions — including self-imposed limits, cool-off periods, and self-exclusion requests. This data is processed as part of our obligations under our Responsible Gaming Policy.
• Customer service interaction records, including chat logs and support tickets.

2.6. Technical & Device Data

• IP address and approximate geolocation (derived from IP).
• Device type, operating system, browser type and version.
• Session timestamps, page views, and clickstream data.
• Referral URLs and traffic source attribution.

2.7. Data Collected from Third Parties

In certain circumstances, we may receive data about you from third-party sources, including:

• Identity verification providers — for automated KYC checks.
• Fraud prevention agencies — to screen for fraudulent or high-risk activity.
• Credit reference agencies — where affordability checks are required.
• Self-exclusion schemes (e.g., GAMSTOP) — to fulfil our responsible gaming obligations.

3How We Use Your Data

We process your personal data for the following defined and documented purposes:

3.1. Marketing Communications

Where you have provided explicit consent, we may contact you by email or push notification with promotional content relating to WinBeast's products and services. You may withdraw your consent at any time by clicking the "unsubscribe" link in any marketing email, adjusting your account notification preferences, or contacting us directly at [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

3.2. Automated Decision-Making & Profiling

WinBeast may employ automated processing — including profiling — for purposes such as fraud detection, responsible gaming risk assessments, and personalisation of offers. Where automated decisions produce significant effects on you (for example, account restrictions), you have the right to request human review of that decision. Please see Section 9 (Your Rights) for further detail.

4Legal Bases for Processing

Under UK GDPR Article 6, every processing activity must rest upon a valid legal basis. WinBeast relies on the following legal bases, applied on a purpose-by-purpose basis:

4.1. Performance of a Contract (Article 6(1)(b))

Processing is necessary to deliver the services you have requested under our Terms & Conditions, including account management, gameplay, and payment processing. Without this processing, we cannot provide the services to you.

4.2. Legal Obligation (Article 6(1)(c))

We are required by law to process certain data to comply with regulatory requirements, including:

• Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Know Your Customer (KYC) and customer due diligence requirements.
• Responsible gambling obligations mandated by applicable gambling regulation.
• Tax reporting and financial record-keeping obligations.
• Responding to lawful requests from regulatory authorities, law enforcement, and courts.

4.3. Legitimate Interests (Article 6(1)(f))

We process data where it is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This includes:

• Platform security and fraud prevention.
• Business analytics and service improvement.
• Responsible gaming monitoring beyond minimum legal requirements.
• Defending or prosecuting legal claims.

We carry out a Legitimate Interests Assessment (LIA) for each processing activity relying on this basis and can provide a summary upon request.

4.4. Consent (Article 6(1)(a))

Where processing is not required by law or contract, we seek your explicit consent — most notably for direct marketing communications and the use of non-essential cookies. Consent is always freely given, specific, informed, and unambiguous. You may withdraw it at any time without detriment.

5Data Sharing & Third Parties

WinBeast does not sell, rent, or trade your personal data to third parties for their independent marketing purposes. We share data only as set out below, and always under appropriate contractual safeguards.

5.1. Categories of Third-Party Recipients

5.2. Data Processor Obligations

All third parties that process data on our behalf do so under a written Data Processing Agreement (DPA) that obliges them to process data solely on our documented instructions, implement appropriate technical and organisational security measures, and assist us in responding to your data subject rights requests. We conduct due diligence on all third-party processors before engaging them.

5.3. Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving WinBeast, your personal data may be transferred to the relevant acquiring entity. We will notify you via email and/or a prominent notice on our website before your data is transferred and becomes subject to a materially different privacy policy.

6Cookies & Tracking Technologies

6.1. What Are Cookies?

Cookies are small text files placed on your device when you visit winnsbeast.uk. They allow us to recognise your browser, remember your preferences, and gather information about how you interact with our platform. Similar technologies such as web beacons, pixel tags, local storage objects, and session tokens may also be used for equivalent purposes.

6.2. Categories of Cookies We Use

6.3. Managing Your Cookie Preferences

When you first visit winnsbeast.uk, you will be presented with a Cookie Consent Banner allowing you to accept, reject, or customise non-essential cookies. You may update your preferences at any time via the Cookie Settings link in the website footer. Additionally, most web browsers allow you to manage cookies through their settings panels. Disabling certain cookies may impair your experience of the platform.

6.4. Third-Party Cookies

Some third-party service providers (including analytics and advertising partners) may set their own cookies on your device when you visit our site. These are governed by the respective third parties' privacy policies. We recommend reviewing those policies for further information.

7Data Security

7.1. Technical & Organisational Measures

WinBeast implements a comprehensive set of technical and organisational security measures (TOMs) to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• Encryption: All data transmitted between your browser and our servers is protected using TLS 1.2 / TLS 1.3 encryption. Sensitive data at rest is encrypted using industry-standard algorithms.
• Access Controls: Personal data is accessible only to authorised personnel on a strict need-to-know basis, enforced via role-based access control (RBAC) and multi-factor authentication (MFA).
• Penetration Testing: We commission regular third-party security assessments and penetration testing to identify and remediate vulnerabilities.
• Data Pseudonymisation: Where feasible and appropriate, personal data is pseudonymised to reduce the risk of re-identification in the event of a security incident.
• Audit Logging: All access to personal data is logged and monitored. Logs are retained for security audit purposes.
• Incident Response Plan: We maintain a documented data breach response procedure to ensure timely detection, containment, and notification of any security incidents.
• Staff Training: All personnel who handle personal data receive regular data protection training commensurate with their role.

7.2. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, WinBeast will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with UK GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by UK GDPR Article 34.

8Data Retention

8.1. Retention Principles

WinBeast retains your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. We apply the storage limitation principle under UK GDPR Article 5(1)(e) and conduct periodic reviews of the data we hold to identify and securely delete data that is no longer required.

8.2. Retention Schedule

8.3. Secure Deletion

When data reaches the end of its applicable retention period, it is either securely deleted (using methods that prevent recovery) or permanently anonymised so that it can no longer be linked to any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical analysis and business reporting purposes.

8.4. Retention Following Legal Claims

Where data is relevant to a pending or reasonably anticipated legal claim, dispute, or regulatory investigation, we may retain it beyond the standard retention period until the matter is fully resolved.

9Your Rights

As a data subject under UK GDPR, you are entitled to the following rights. These rights are not absolute; some are subject to exemptions and qualifications as prescribed by law. We will respond to all valid requests within one calendar month of receipt, extendable by a further two months where requests are complex or numerous (in which case we will inform you of the extension).

9.1. Right of Access (Article 15)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data along with information about the purposes, categories, recipients, and retention periods. You may submit a Subject Access Request (SAR) free of charge to [email protected].

9.2. Right to Rectification (Article 16)

You have the right to require us to correct any inaccurate personal data we hold about you and to complete any incomplete data, having regard to the purposes of the processing. You may update certain information directly via your account settings or by contacting our support team.

9.3. Right to Erasure (Article 17)

You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no overriding legal basis for continued processing. Please note that this right is not absolute: we may be required to retain data to comply with legal obligations (such as AML record-keeping) or to defend legal claims, even following a valid erasure request.

9.4. Right to Restriction of Processing (Article 18)

You may request that we restrict processing of your data in certain circumstances, such as while we verify the accuracy of data you have disputed, or while we assess a legitimate interests objection you have raised.

9.5. Right to Data Portability (Article 20)

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to transmit that data to another controller without hindrance.

9.6. Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately. For objections to legitimate interest processing, we will cease unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

9.7. Rights Relating to Automated Decision-Making (Article 22)

Where we make decisions about you solely through automated means that produce significant legal or similarly significant effects, you have the right to: (a) request human review of the decision; (b) express your point of view; and (c) contest the decision. Please contact us at [email protected] to exercise this right.

9.8. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out prior to the date of withdrawal.

9.9. Right to Lodge a Complaint

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concern directly before you contact the ICO. Please reach out to us at [email protected] in the first instance.

10International Data Transfers

10.1. Transfers Outside the UK

Some of our third-party service providers and technology partners operate in countries outside the United Kingdom. This means that your personal data may be transferred to, and processed in, countries that may not have data protection laws equivalent to those of the UK.

10.2. Safeguards for International Transfers

Where we transfer personal data to countries outside the UK that are not covered by an adequacy decision issued by the UK Secretary of State, we ensure that appropriate safeguards are in place to protect the data. These safeguards include:

• UK International Data Transfer Agreements (IDTAs) — the UK-specific equivalent of Standard Contractual Clauses, approved by the ICO.
• UK Addendums to EU Standard Contractual Clauses (SCCs) — where the transferring arrangement involves parties that also operate under EU GDPR.
• Adequacy Decisions — transfers to countries that the UK has deemed to provide an adequate level of data protection are permitted without additional safeguards.
• Binding Corporate Rules (BCRs) — where applicable for intra-group transfers within a multinational organisation.

10.3. Further Information

You may request a copy of the specific safeguards applied to any international transfer of your personal data by contacting us at [email protected].

11Minors

11.1. Minimum Age Requirement

WinBeast's platform is strictly intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data from minors. Age verification is a mandatory step in our registration process, and we employ both automated and manual KYC checks to verify the age of all new registrants.

11.2. Accidental Collection from Minors

If we become aware — whether through our own monitoring, a parental report, or any other means — that we have inadvertently collected personal data from an individual under the age of 18, we will take the following steps promptly:

• Immediately suspend access to the account.
• Permanently delete all personal data associated with the minor.
• Return any funds deposited, in accordance with our Terms & Conditions.
• Record the incident and implement any further steps necessary to prevent recurrence.

11.3. Reporting Underage Access

If you believe a minor has accessed or registered on our platform, please notify us immediately at [email protected]. Parents and guardians are encouraged to use internet filtering tools to restrict access to gambling websites.

11.4. Responsible Gaming Resources

Our commitment to protecting vulnerable individuals — including minors — is further described in our Responsible Gaming Policy. We also signpost users to the following UK organisations that provide support in relation to problem gambling:

12Changes to This Policy

12.1. Policy Updates

We may update or revise this Privacy Policy from time to time to reflect changes in our data processing activities, applicable legislation, or regulatory guidance. All changes will be published on this page at winnsbeast.uk/privacy-policy with a revised "Last Updated" date and version number displayed prominently at the top of the document.

12.2. Material Changes

Where a change is material — meaning it significantly affects your rights or how we process your personal data — we will provide advance notice via email to your registered address and/or via an in-platform notification, no fewer than 14 days before the change takes effect. Where required by law, we will seek fresh consent for any new processing activities.

12.3. Continued Use

Your continued use of winnsbeast.uk following notification of any change to this Policy constitutes your acknowledgement of the revised terms. If you do not agree with the changes, you should cease using our platform and may request account closure by contacting [email protected].

12.4. Archived Versions

Previous versions of this Privacy Policy are available upon request. To obtain a copy of an archived version, please contact us at [email protected] stating the version or approximate date of the version you require.

13Contact Information

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how WinBeast handles your personal data, you may contact us through the following channels:

13.1. Response Timeframes

We endeavour to respond to all general support enquiries within 2 business days. For formal data subject rights requests submitted to [email protected], we will acknowledge receipt within 5 business days and provide a substantive response within one calendar month, as required by UK GDPR Article 12(3).