win25 Privacy Policy

win25 ("we", "us", "our") operates the online betting platform accessible at https://win25.ws and all associated subdomains and services (the "Platform"). This Privacy Policy describes how win25 collects, uses, stores, shares, and protects personal data provided by players ("you", "your") who register and use the Platform.

win25 is committed to handling your personal information with the highest standards of confidentiality and security. This Policy is written in plain English and is intended to give you a clear, honest account of our data practices — without obscuring important details behind unnecessarily complex legal language.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, all of which together govern your relationship with win25.

win25 collects personal data in two broad categories: information you provide directly, and information collected automatically through your use of the Platform. The table below summarises the categories of data we collect and the primary reason for collection.

win25 collects personal data through the following channels:

• Direct Submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Technical and usage data collected automatically via cookies, server logs, and similar technologies each time you interact with the Platform. This includes your IP address, browser fingerprint, and session activity.
• Third-Party Verification Providers: Identity and document verification data obtained from KYC partners engaged by win25 to validate documents such as KTP and passports against authoritative databases.
• Payment Service Providers: Transaction confirmations and fraud-screening signals received from our banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and cryptocurrency network data.
• Game Content Providers: Bet settlement data, game session records, and RNG certification signals from licensed providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft.
• Fraud & Security Services: Risk signals from third-party fraud prevention tools that help win25 detect multi-accounting, bonus abuse, and money-laundering patterns.

win25 uses the personal data it collects for the following purposes:

• Account Management: Creating, maintaining, and securing your win25 account, including authenticating your identity at login and managing session tokens.
• Age & Identity Verification (KYC): Confirming that you are at least 21 years of age and that the identity and payment methods on your account are genuinely yours — a mandatory requirement for all Indonesian players.
• Transaction Processing: Crediting deposits to your account balance and processing withdrawal requests to your verified local bank account (BCA, BRI, BNI, Mandiri, or CIMB Niaga), e-wallet (OVO, DANA, GoPay, ShopeePay, or LinkAja), or crypto wallet (USDT, BTC).
• Fraud Prevention & Platform Security: Detecting and preventing multi-accounting, bonus abuse, money laundering, unauthorised access, automated betting bots, and other prohibited activities.
• Responsible Gaming: Monitoring betting patterns to identify indicators of problem gambling and, where necessary, proactively contacting players or enforcing cooling-off periods in line with our Responsible Gaming Policy.
• Customer Support: Responding to support enquiries, resolving disputes, and maintaining records of communications for quality assurance.
• Marketing & Promotions: Sending bonus offers, seasonal promotions (Idul Fitri, Ramadhan, Imlek, Indonesian Independence Day), and Platform news — only to players who have opted in to receive such communications.
• Platform Improvement: Analysing anonymised and aggregated usage data to improve the win25 Platform interface, game selection, and overall player experience.
• Legal & Regulatory Compliance: Meeting obligations imposed by win25's international gaming licence, including anti-money-laundering (AML) record-keeping and cooperating with legitimate law enforcement requests.

win25 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfill the contract between you and win25 — specifically, to provide the betting and gaming services you have registered to use, to process your transactions, and to manage your account.
• Legal Obligation: Processing required to comply with win25's obligations under its international gaming licence, including KYC, AML screening, and record-keeping requirements.
• Legitimate Interests: Processing necessary for win25's legitimate business interests, including fraud prevention, Platform security, and improving service quality — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

win25 does not sell your personal data. We share personal data only in the following limited circumstances:

• KYC & Identity Verification Partners: Identity document data is shared with third-party KYC providers engaged by win25 to perform automated and manual document verification. These providers are contractually bound to process data only for the purpose of verification and to maintain equivalent security standards.
• Payment Service Providers: Financial data necessary to process your deposit or withdrawal is shared with the relevant banking partner, e-wallet operator, or cryptocurrency exchange. These entities are independent data controllers subject to their own privacy policies.
• Game Content Providers: Your account identifier and bet activity are shared with licensed game providers (Pragmatic Play, Evolution Gaming, etc.) to the extent required to operate the games you play. These providers are contractually prohibited from using this data for independent marketing purposes.
• Fraud Prevention & Security Services: Technical identifiers (such as IP address and device fingerprint) may be shared with third-party fraud detection services to screen for patterns associated with multi-accounting or financial crime.
• Legal & Regulatory Authorities: win25 may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, a valid court order, or the conditions of our gaming licence. We will notify you of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of win25's business operations, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and any material change in data processing practices.

win25 uses cookies and similar technologies (local storage, session tokens, pixel tags) to operate the Platform effectively and to understand how players interact with our services. The types of cookies we use are described below:

• Strictly Necessary Cookies: These cookies are essential for you to navigate the Platform and use its core features — including maintaining your login session, remembering your account preferences, and ensuring the security of your connection. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: These remember your choices (such as preferred language or display settings) to provide a more personalised experience. Disabling them may reduce Platform convenience.
• Analytical Cookies: Used to collect anonymised data about how players use the Platform — such as which pages are visited most frequently and where players encounter navigation difficulties. This data is used exclusively for internal Platform improvement and is never linked to individual identities.
• Marketing Cookies: Used only with your explicit consent to track engagement with win25 promotional content and, where applicable, to attribute player registrations to marketing campaigns. You may opt out of marketing cookies at any time.

win25 retains personal data for as long as necessary to fulfill the purposes for which it was collected, and in any case for the minimum periods required by applicable law and our gaming licence conditions. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account being open and active on the Platform.
• KYC & Identity Documents: Retained for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping obligations under our international gaming licence.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, for the same regulatory reasons.
• Support Communications: Retained for three (3) years from the date of the last interaction, for dispute resolution and training purposes.
• Marketing Preferences: Retained until you withdraw consent, and for a reasonable period thereafter to evidence that your opt-out request was honoured.
• Analytical Data: Aggregated and anonymised usage data may be retained indefinitely as it cannot be linked back to any individual player.

Following the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of identifiable information.

win25 implements a layered, defence-in-depth security architecture to protect your personal and financial data from unauthorised access, alteration, disclosure, or destruction. Our security measures include but are not limited to:

• 256-bit SSL/TLS Encryption: All data in transit between your device and win25 servers is encrypted using industry-standard TLS protocols. Our SSL certificate is maintained and renewed without interruption.
• Data Encryption at Rest: Sensitive personal data — including identity documents and financial account details — is encrypted at rest using AES-256 encryption on our secure servers.
• Access Controls: Strict role-based access controls ensure that only authorised win25 staff members can access personal data, and only to the extent necessary for their specific job function.
• Two-Factor Authentication: win25 strongly recommends enabling two-factor authentication (2FA) on your account. Internal administrative access to player data requires mandatory 2FA for all staff.
• Regular Security Audits: win25 conducts periodic internal and external security assessments, including penetration testing, to identify and address vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to player rights and freedoms, win25 will notify affected players promptly — and in any case within 72 hours of becoming aware of the breach.

As a win25 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our support team via live chat or at [email protected]. We will acknowledge your request within 5 business days (WIB) and aim to fulfill it within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data win25 holds about you, free of charge (subject to reasonable frequency limits).
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data on your account without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations (see Section 8). Note that KYC and transaction records must be retained for regulatory reasons even after account closure.
• Right to Restrict Processing: You may request that win25 temporarily restricts processing of your personal data in specific circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit that data to another service provider.
• Right to Object: You have the right to object to processing of your personal data where win25 relies on legitimate interests as the legal basis, or where your data is used for direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

The win25 Platform is intended exclusively for adults who are at least 21 years of age. win25 does not knowingly collect personal data from any person under the age of 21. Our registration process requires players to confirm their date of birth, and our KYC process verifies age through government-issued identity documents.

If win25 becomes aware that personal data has been collected from a person under 21 — whether through misrepresentation during registration or any other means — we will immediately close the account, void any bets placed, and securely delete or return any deposited funds (net of withdrawals already made). All data associated with the underage account will be deleted in accordance with our data retention obligations.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way win25 handles your personal data, please contact our Data Privacy team through any of the following channels:

• Email: [email protected] — include "Privacy Request" in the subject line for faster routing.
• Live Chat: Available 24/7 via the win25 Platform. Our Indonesian-speaking agents are on hand to assist players in the WIB (UTC+7) timezone and beyond.
• Response Time: We aim to acknowledge all privacy-related enquiries within 5 business days (WIB) and to resolve them fully within 30 calendar days of receipt.

win25 reserves the right to update or amend this Privacy Policy at any time. Where a change is material — meaning it substantively affects how we collect, use, or share your personal data — we will notify you by email (to the address on your account) and by posting a prominent notice on the Platform at least 14 days before the change takes effect. Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.