Privacy Policy —
winpesa Bangladesh

Section 1

Information We Collect

winpesa collects personal data through a range of interactions: at the point of account registration, during ongoing use of the Platform, and through automated technical means. The categories of information we collect are described below.

Registration & Account Data

When you create a winpesa account, we collect the following information: your full legal name, date of birth, email address, mobile phone number, and a chosen username. You may also be asked to provide a residential address during the identity verification process. This information is mandatory — without it, we cannot create or maintain a player account.

Identity Verification (KYC) Documents

To comply with anti-money laundering obligations and to verify that you meet the 18+ age requirement, winpesa may request copies of the following documents at any stage of the player relationship:

• National Identity Card (NID) or passport
• Driving licence (where applicable)
• Recent utility bill or bank statement as proof of address (issued within the last three months)
• Proof of payment method ownership (e.g., a screenshot of your registered bKash or Nagad account)

Financial Transaction Data

When you make a deposit or request a withdrawal, winpesa records the transaction amount (in BDT / ৳), the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard, or bank transfer), the transaction reference number, the date and time, and the resulting account balance. We do not store full card numbers or mobile banking PINs — payment tokenisation is handled by the respective payment provider.

Usage & Behavioural Data

We automatically collect data about how you interact with the winpesa platform, including pages visited, games played, bet amounts, session duration, device type, operating system, browser type and version, IP address, and approximate geographic location derived from your IP address. This data is used to improve platform performance, detect fraudulent behaviour, and personalise your gaming experience.

Communications Data

If you contact winpesa via live chat, email, or any other support channel, we retain records of those communications — including the content of messages, timestamps, and any supporting documentation you provide — for the purpose of resolving your query and for quality assurance.

Section 2

How We Use Your Data

winpesa processes personal data only for lawful, specified, and legitimate purposes. The table below summarises the primary purposes for which we use the information we collect and the legal basis for each processing activity.

winpesa will not use your personal data for any purpose incompatible with those listed above without first obtaining your explicit consent. Where we rely on consent as the legal basis for processing, you retain the right to withdraw that consent at any time by contacting support@winpesa, without prejudice to the lawfulness of processing carried out before the withdrawal.

Section 3

Data Sharing & Third Parties

winpesa does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may, however, share your information with carefully selected third parties in the following limited circumstances:

Payment Service Providers

To process deposits and withdrawals, winpesa shares the minimum necessary transaction data with our payment partners, including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. These partners process data solely to facilitate the specific transaction and are bound by their own privacy and security obligations.

Game Providers

Where you play games supplied by third-party providers — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi — certain technical and session data (such as player ID, session token, and game round data) is shared with the relevant provider to enable game delivery, calculate payouts, and resolve disputes. No sensitive personal identification data (e.g., NID, full name, or financial account details) is shared with game providers beyond what is strictly required for platform integration.

Identity Verification Services

winpesa may use accredited third-party identity verification services to assist with KYC and AML compliance procedures. These services receive only the documents and data necessary to perform the verification check and are prohibited from using that data for any independent purpose.

Legal & Regulatory Disclosure

winpesa may disclose personal data to law enforcement agencies, regulatory authorities, or other government bodies where required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure to the extent permitted by law.

Section 4

Cookies & Tracking Technologies

winpesa uses cookies and similar client-side technologies (such as local storage and session tokens) to provide a functional, secure, and personalised platform experience. This section explains what types of cookies we use, their purpose, and how you can manage your preferences.

Types of Cookies We Use

winpesa does not use cross-site advertising cookies or behavioural retargeting pixels from third-party ad networks. Analytics data is processed in aggregated, anonymised form wherever possible and is never linked back to a specific player's identity for marketing purposes.

Managing Cookie Preferences

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies via the privacy or settings menu. Please note that disabling strictly necessary cookies may impair the functionality of the winpesa platform, including your ability to log in and maintain a session. Disabling analytics or functional cookies will not prevent you from using any core platform feature.

Section 5

Data Retention

winpesa retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below represent our standard practice:

• Active account data — retained for the lifetime of your account and for a minimum of five years following account closure, in accordance with AML record-keeping requirements.
• KYC verification documents — retained for a minimum of five years from the date of submission or account closure, whichever is later.
• Financial transaction records — retained for a minimum of seven years to satisfy accounting and AML obligations.
• Customer support communications — retained for up to three years from the date of the last communication in the relevant thread.
• Usage and analytics data — anonymised and aggregated data may be retained indefinitely; personally identifiable usage logs are deleted after 24 months.
• Marketing consent records — retained until you withdraw consent and for one year thereafter as proof of the consent transaction.

Once the applicable retention period has expired, personal data is securely deleted or irreversibly anonymised. Requests for early deletion will be considered in accordance with the "Your Rights" section below, subject to any overriding legal obligations that require us to retain the data.

Section 6

Security Measures

winpesa employs a layered approach to data security, combining technical, organisational, and procedural controls to protect player information from unauthorised access, disclosure, alteration, or destruction.

Technical Controls

• All data transmitted between your device and the winpesa platform is protected by 256-bit SSL/TLS encryption.
• Player passwords are stored in hashed form using industry-standard cryptographic algorithms — plaintext passwords are never stored or logged.
• Access to production databases containing personal data is restricted to a limited number of authorised personnel and requires multi-factor authentication.
• Regular automated vulnerability scans and periodic penetration testing are conducted on platform infrastructure.
• Firewall rules, intrusion detection systems, and rate-limiting controls are in place to mitigate common attack vectors including brute-force login attempts and SQL injection.

Organisational Controls

• All winpesa staff who handle personal data are subject to confidentiality obligations and receive regular privacy and security training.
• A formal data breach response procedure is maintained; in the event of a breach affecting player data, affected players and relevant authorities will be notified in accordance with applicable legal requirements.
• Third-party service providers with access to player data are vetted for security compliance and are bound by data processing agreements.

Section 7

Your Rights & Choices

As a winpesa player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us at support@winpesa with the subject line "Privacy Request". We will respond within 72 hours of receiving your request.

Right of Access

You have the right to request a copy of the personal data winpesa holds about you. Upon verification of your identity, we will provide a structured summary of your data within 30 days of the request.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Minor corrections — such as updating your email address or mobile number — can be made directly via your account settings. Corrections to identity data (name, date of birth) require documentary evidence and will be processed by our support team.

Right to Erasure

You may request that winpesa delete your personal data ("right to be forgotten") where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis for processing applies. Please note that erasure requests cannot be fulfilled where we are required by law to retain the data — for example, financial transaction records subject to AML retention obligations.

Right to Restrict Processing

You may request that winpesa limit the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being evaluated.

Right to Object

Where winpesa processes your data on the basis of legitimate interest — such as for platform analytics or fraud prevention — you have the right to object to that processing. We will review your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Marketing Opt-Out

If you have previously opted in to receive promotional communications from winpesa, you may withdraw that consent at any time by emailing support@winpesa or by using the unsubscribe link included in any marketing email. Withdrawal of marketing consent does not affect transactional communications (such as account notifications, deposit confirmations, or security alerts), which we must send as part of the service.

Section 8

Contact & Privacy Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way winpesa handles your personal data, please contact our support team using the details below. All privacy-related communications are treated with strict confidentiality.

• Email: support@winpesa (subject line: "Privacy Request")
• Live Chat: Available 24/7 via the winpesa platform — ask to speak with the Privacy Team
• Response Time: Acknowledgement within 24 hours; full response within 30 calendar days
• Operating Hours: Bangladesh Standard Time (BST, UTC+6)

winpesa is committed to resolving privacy concerns raised directly by players. If you are dissatisfied with our response to a privacy enquiry, you retain the right to escalate your concern to the appropriate authority in your jurisdiction.

This Privacy Policy was last reviewed and updated on 1 January 2026. winpesa recommends that players revisit this page periodically to remain informed of any changes to our data practices. Material changes will always be communicated to registered players via email notification before taking effect.