Privacy Policy

Version: 1.0  |  Last Updated: 4 November 2026

1. Introduction

Welcome to Winnita ("we", "us", "our"), operated through the website winnita-uk.com (the "Platform"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, with whom we share it, and what rights you hold under applicable data protection law.

This Policy applies to all users who access the Platform, register an account, place wagers, or otherwise interact with our services. It should be read alongside our Terms & Conditions and our Responsible Gaming page, which together form the complete framework governing your use of Winnita.

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Information Commissioner's Office (ICO) is the relevant supervisory authority for data protection matters in the United Kingdom. By using the Platform, you acknowledge that you have read and understood this Policy.

2. Data We Collect

We collect only the minimum personal data necessary to provide, operate, and improve our services in a lawful, fair, and transparent manner. The categories of data we collect are described below.

2.1. Data You Provide Directly

• Identity data: full name, date of birth, gender, username.
• Contact data: email address, residential address, telephone number.
• Account credentials: encrypted password and security question responses.
• Financial data: payment card details (processed via PCI DSS-compliant providers), bank account information, e-wallet identifiers, transaction history.
• Verification documents: copies of government-issued photo ID, proof of address, and source-of-funds documentation required for identity verification (KYC) and anti-money laundering (AML) compliance.
• Responsible gaming self-disclosures: deposit limits, cooling-off requests, self-exclusion elections, and any information you share when seeking support.

2.2. Data We Collect Automatically

• Technical data: IP address, browser type and version, device identifiers, operating system, screen resolution, and time-zone settings.
• Usage data: pages visited, features accessed, session duration, game history, wagering patterns, and click-stream data.
• Cookie and tracking data: information collected via cookies and similar technologies (see Section 6 for full details).

2.3. Data We Receive from Third Parties

• Identity verification providers: electronic KYC checks confirming your identity, age (minimum 18 years), and address.
• Payment processors: transaction status confirmations, fraud scores, and chargeback notifications.
• Fraud prevention and AML agencies: sanctions screening results and politically-exposed-person (PEP) alerts.
• Affiliate and marketing partners: referral source information where you have consented to sharing with that partner.

2.4. Special Category Data

We do not intentionally collect special category data (e.g., health, racial or ethnic origin, religious beliefs) unless strictly required. However, where your gambling behaviour indicates a potential gambling-related harm, inferences made for responsible-gaming purposes may be treated as health-adjacent data under Article 9 UK GDPR. In such cases, processing is based on substantial public-interest grounds and our safeguarding obligations.

3. How We Use Your Data

We use the personal data we collect for clearly defined, specific purposes. We will not process your data in a manner incompatible with the purpose for which it was originally collected.

Where we send you promotional communications, you can opt out at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at [email protected]. Withdrawing marketing consent does not affect the lawfulness of processing based on other legal grounds.

4. Legal Bases for Processing

Under UK GDPR Article 6, every processing activity must rest on a valid legal basis. We rely on the following legal bases:

4.1. Performance of a Contract (Article 6(1)(b))

Processing your identity, contact, and financial data is necessary to create and manage your account, execute transactions, and deliver the gaming services you have requested. Without this processing, we cannot fulfil our contractual obligations to you.

4.2. Legal Obligation (Article 6(1)(c))

Certain processing activities — including KYC verification, AML checks, age verification, record-keeping, and mandatory regulatory reporting — are required by law. We cannot waive these obligations regardless of your preferences.

4.3. Legitimate Interests (Article 6(1)(f))

We process technical, usage, and behavioural data to protect the Platform against fraud, ensure network security, improve service quality, and conduct internal analytics. We have assessed these interests against your rights and determined that our legitimate interests do not override your fundamental freedoms, particularly because we apply pseudonymisation and data-minimisation techniques wherever possible.

4.4. Consent (Article 6(1)(a))

We rely on your freely given, specific, informed, and unambiguous consent for direct marketing communications and for non-essential cookies. You may withdraw consent at any time without detriment to your account. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third Parties

We do not sell your personal data to third parties. We share your data only where necessary and under appropriate legal safeguards.

5.1. Categories of Recipients

• Payment service providers: banks, card schemes (Visa, Mastercard), and e-wallet operators (PayPal, Skrill, Neteller, Paysafecard, Apple Pay, Google Pay, Pay by Bank) for processing deposits and withdrawals in GBP (£).
• Identity and AML verification services: electronic KYC bureaux and sanctions screening providers used to meet our legal obligations.
• IT infrastructure and cloud providers: hosting, storage, and disaster-recovery suppliers who process data under data processing agreements (DPAs) containing the safeguards required by UK GDPR Article 28.
• Customer support platforms: software tools used to manage support tickets and live-chat sessions.
• Analytics and performance providers: aggregated, pseudonymised data for performance measurement and product improvement.
• Responsible gaming partners: GAMSTOP and similar self-exclusion schemes through which we may share the minimum data necessary to honour your exclusion elections.
• Regulatory and law-enforcement authorities: where we are legally compelled to disclose data, for example, in response to a court order, regulatory investigation, or statutory reporting obligation.
• Affiliate partners: limited referral data only where you have provided prior consent to such sharing.

5.2. Data Processor Obligations

All third-party processors are contractually bound to process your data only on our documented instructions, to implement adequate technical and organisational security measures, and to assist us in fulfilling data-subject requests and breach-notification obligations.

6. Cookies & Tracking Technologies

We use cookies, web beacons, pixel tags, and similar tracking technologies to operate and improve the Platform. Below is an overview of the types we deploy.

6.1. Types of Cookies

• Strictly necessary cookies: Essential to the functioning of the Platform — maintaining your session, remembering login state, and enabling secure transactions. These cannot be disabled.
• Functional cookies: Remember your preferences such as language, currency display, and responsible-gaming settings to personalise your experience.
• Analytical/performance cookies: Collect pseudonymised data about how visitors interact with the Platform (pages visited, session duration, error reports) to help us improve performance. Activated only with your consent.
• Marketing and targeting cookies: Used to deliver relevant promotional content and to measure campaign effectiveness. Activated only with your consent.

6.2. Managing Your Cookie Preferences

When you first visit the Platform, a cookie-consent banner allows you to accept or reject non-essential cookies. You can update your preferences at any time via the cookie settings panel accessible in the Platform footer. You may also disable cookies through your browser settings; however, disabling strictly necessary cookies will impair your ability to use core features of the Platform.

For further information about cookies and how to manage them, visit the ICO's guidance at ico.org.uk.

7. Data Security

We implement comprehensive technical and organisational security measures proportionate to the risk posed by the processing activities we undertake.

7.1. Technical Measures

• Encryption: All data transmitted between your device and our servers is protected by TLS (Transport Layer Security). Sensitive data at rest — including payment details — is encrypted using industry-standard algorithms.
• Access controls: Strict role-based access controls ensure that only authorised personnel can access personal data, and only to the extent required for their specific function.
• Firewalls and intrusion detection: Our infrastructure is protected by multi-layer firewalls, real-time intrusion detection systems, and regular vulnerability assessments.
• Payment security: Card payment processing complies with PCI DSS standards; full card numbers are never stored on our servers.

7.2. Organisational Measures

• Staff handling personal data receive regular data protection training.
• Data processing activities are documented in a Record of Processing Activities (RoPA).
• Data protection is embedded in system design from the outset (privacy by design and default).

7.3. Personal Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, or reporting requirements.

• Account and transaction data: Retained for a minimum of five (5) years following the closure of your account or the last transaction date, to comply with AML and financial record-keeping obligations.
• Identity verification documents: Retained for the period required by applicable AML legislation, typically five years from the end of the business relationship.
• Marketing data: Retained until you withdraw consent or for up to two years of inactivity, whichever is sooner.
• Cookie and analytics data: Session cookies expire when you close your browser; persistent cookies are retained for periods specified in our cookie settings panel (typically 12 months).
• Responsible gaming and self-exclusion records: Retained for the minimum period required by responsible gaming obligations, which may extend beyond account closure.

When data is no longer required, we securely delete or anonymise it in a manner that prevents reconstruction. Anonymised data may be retained indefinitely for statistical analysis.

9. Your Rights

As a data subject under UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and are subject to exemptions and conditions set out in applicable law.

9.1. Right of Access

You have the right to request a copy of the personal data we hold about you, together with information about how we process it. We will respond to verified subject access requests (SARs) within one calendar month of receipt. This period may be extended by a further two months where the request is complex or numerous, in which case we will notify you within the initial month.

9.2. Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will update your data promptly upon verification. For regulated data (e.g., KYC records), we may require supporting documentation before making changes.

9.3. Right to Erasure ("Right to be Forgotten")

You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing based on legitimate interests and your interests override ours. This right does not apply where retention is required by law — for example, under AML or financial record-keeping legislation.

9.4. Right to Restriction of Processing

You may ask us to restrict processing — meaning we continue to store your data but stop using it — while the accuracy of data is contested, while you have objected to processing, or where processing is unlawful but you prefer restriction to erasure.

9.5. Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another data controller where technically feasible.

9.6. Right to Object

You have the right to object at any time to processing based on our legitimate interests, including profiling carried out for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately and without question.

9.7. Rights Related to Automated Decision-Making

Where we make decisions about you based solely on automated processing — including profiling — that produce legal or similarly significant effects, you have the right to request human review of that decision, to express your point of view, and to contest the outcome. We will inform you when automated decision-making is applied.

9.8. How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to [email protected]. We may ask you to verify your identity before processing your request. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline the request.

9.9. Right to Lodge a Complaint

If you believe we have processed your personal data in breach of UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

We encourage you to contact us first so that we have the opportunity to address your concerns before you escalate to the ICO.

10. International Data Transfers

Our primary servers and processing operations are located within the United Kingdom. However, some of our third-party service providers — including cloud-hosting and analytics partners — may process your personal data outside the UK.

Where personal data is transferred to a country not deemed by the UK Government to provide an adequate level of data protection, we ensure appropriate safeguards are in place. These safeguards may include:

• UK International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the ICO;
• Binding Corporate Rules (BCRs) where the recipient is part of a corporate group with approved BCRs in place;
• Adequacy decisions recognised by the UK Secretary of State in respect of the destination country.

You may request further information about our international transfer safeguards and obtain copies of relevant agreements by contacting us at [email protected].

11. Minors

Our Platform is strictly intended for individuals aged 18 years or older. We do not knowingly collect personal data from anyone under the age of 18. As part of our registration and ongoing compliance process, we conduct electronic age verification checks on all account holders.

If we discover or are notified that a person under 18 has registered an account or provided personal data, we will promptly suspend or close that account and securely delete all associated data to the extent permitted by applicable law. Any winnings generated by an underage account will be voided.

If you are concerned that a minor is using the Platform, please contact us immediately at [email protected]. For information on tools to prevent underage access, please visit our Responsible Gaming page.

12. Changes to This Policy

We review this Privacy Policy periodically and will update it to reflect changes in our data processing practices, applicable legislation, or regulatory guidance. The version number and "Last Updated" date at the top of this document will reflect the most recent revision.

Where changes are material — meaning they significantly affect your rights or the way in which we process your data — we will notify you by email to the address registered to your account and/or by displaying a prominent notice on the Platform, with a minimum of 14 days' notice before the changes take effect. For non-material updates (e.g., minor clarifications or formatting changes), the updated Policy will apply immediately upon publication.

Continued use of the Platform after the effective date of any revision constitutes your acknowledgement of the updated Policy. We encourage you to review this page regularly to stay informed about how we protect your data.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please do not hesitate to contact us:

We aim to acknowledge all privacy-related enquiries within 5 business days and to resolve them fully within the statutory one-month timeframe. For urgent data-protection concerns, please mark your email subject line with "URGENT – DATA PROTECTION" to ensure expedited handling.

Responsible Gambling Support

Winnita is committed to player wellbeing. If you or someone you know is experiencing problems with gambling, the following UK organisations offer free, confidential support:

• GamCare — National Gambling Helpline: 0808 8020 133 (free, 24/7) | gamcare.org.uk
• GambleAware — National Gambling Support Network | begambleaware.org
• Gordon Moody / Gambling Therapy — Residential treatment and online support | gordonmoody.org.uk
• Gamblers Anonymous UK — 12-step peer support groups | gamblersanonymous.org.uk
• NHS National Problem Gambling Clinic — Specialist NHS treatment for England and Wales | cnwl.nhs.uk
• Betknowmore UK — Peer support and outreach for gambling harms | betknowmoreuk.org

For details on self-exclusion tools, deposit limits, and other responsible-gaming controls available on the Platform, please visit our Responsible Gaming page.