TrueWin Privacy Policy: What Happens to Your Data From Sign-Up Onwards

Every account leaves a trail. A name typed into a form, a document uploaded, a card registered, a bet placed… each step adds to what the operator behind TrueWin Casino knows about a person, and its Privacy Notice and Cookie Policy explain what it does with it. This page follows that trail in order, restating the operator’s commitments and marking where the official documents say nothing. Two things first. The Notice covers visitors as well as registered players, on the website and in the mobile application alike, and “personal data” means any information from which someone’s identity can practicably be worked out. And, as on every page of this site: online betting and casino play are not permitted in every jurisdiction, so each person must independently confirm that such activity is lawful where they are before registering, depositing or playing.

The Data Trail of an Account

Rather than a list of data types, think of the moments at which data is created. The Notice covers six, each drawing on what the player provides, what the systems record and what outside providers return:

1. Registration – a phone number or email, full name, date of birth, nationality and address, so that the account can be created and deposits and withdrawals become possible;
2. Verification – passport or ID details with number and expiry date, a photograph or facial scan, and identity and screening results from KYC and compliance providers;
3. Payment – bank account and debit card numbers, and the record of every payment made by and to the player;
4. Play – games played and their outcomes, including gameplay data returned by the vendors that supply the games;
5. Every session – geolocation, IP address, device ID, browser type and version, time zone, how the site is used and which websites led to it;
6. Contact – anything shared while talking to customer care.

Because all customers must be over 21, the operator states that it neither seeks nor wants data about minors. Supplying only what the form asks for keeps the trail as short as it needs to be.

Legal Grounds, One by One

Each use of data is tied in the Notice to one of four justifications. The table sets them beside the purposes the operator files under each.

Ground	Purposes the operator lists under it
Contract with the player	Registration, delivering games and services, managing the account, contacting the player about winnings
Legal or regulatory duty	Eligibility checks on location, details and documents; verification under anti-money-laundering and counter-terrorist-financing law; disclosures to a regulator
Consent	Direct marketing about games and competitions, and notifications
Legitimate interests	Service optimisation and analytics, behaviour profiling, fraud detection, prevention of unlawful activity, identifying players who may be at risk

The Notice adds a consequence: if requested data is withheld, or consent is withdrawn for processing a service depends on, the operator will be unable to provide that service. Marketing consent, by contrast, can be switched off without touching the rest of the account.

Retention and Deletion

How long does the record last? The operator applies two tests together: the purpose the data serves, which sets how long it is needed, and any minimum retention period imposed by law or regulation. Once both are exhausted, it undertakes not to keep data in an identifiable form. Fixed retention periods are not published on the official website, and the right to erasure – covered below – is expressly not a general one, since anti-money-laundering duties can require certain records to be kept. A player can ask, in writing, what is still held and why.

Safeguards and Cross-Border Processing

Security is stated as a commitment to all reasonable and practicable technical and organisational measures, and its visible end is the account itself: a username fixed at registration, a password of 8-20 characters mixing upper and lower case letters, numbers and at least one symbol, monitoring and recording of account use, and a firm statement that the operator never asks for bank details by email, text message or telephone. The operator also describes itself as a global business that uses service providers abroad, so personal data may be transferred to other countries; where it is, the Notice promises protection in line with applicable legal requirements, without naming the countries. The one safeguard fully in the player’s hands is a password used nowhere else.

Who Sees the Data

The Notice names categories of recipient rather than leaving the list open, and binds third parties acting for the operator to equally stringent confidentiality undertakings.

Recipient	Why
Regulatory authorities and entities with standing	Where the law requires disclosure
Trusted providers, such as payment processors	To deliver something the player has requested
Suppliers acting for the operator – advisers, IT consultants, research and mailing houses	Systems, development and operations
Group and affiliated companies	Internal operations; marketing only with consent
Any party required by law, an investigation, enforcement of the terms, fraud or security protection, an emergency, or the safety of others	Legal and protective disclosure

Nothing in the document describes selling personal data. Questions about a specific recipient go to the privacy address at the end of this page.

Cookies and How to Manage Them

Cookies are small text files placed on the device to keep a session alive, remember preferences and measure performance. The Cookie Policy sorts them into four groups and names a few:

• strictly necessary – navigation, login session, security and fraud prevention; examples named are session id and cookie_consent, and these cannot be switched off;
• performance – anonymised statistics on page visits and error logs, first-party and third-party, Google Analytics being the example given;
• functionality – language, region and user settings;
• targeting – advertising across websites, set by third parties such as Meta, Google Ads and YouTube; examples named are _fbp, _gcl, _au and IDE.

All but the strictly necessary group can be managed or deleted through browser settings, and the policy links to the cookie pages of Chrome, Firefox, Safari and Edge. Blocking a category has stated consequences: videos may stop playing and the login may not persist. Five minutes in the browser settings, once, settles it.

Automated Decisions

The operator says openly that some decisions may be taken by systems rather than people: whether an account can be opened, whether a player remains eligible on the strength of the information supplied, how activity looks from a responsible-gaming standpoint, fraud detection and profiling. These are presented as necessary for regulatory compliance, with appropriate safeguards for the data involved. Whether a human review can be requested is not specified on the official website; questions about any such decision go to the privacy address below. Quote the username and the date of the decision.

Your Rights and How to Use Them

For every situation in which it collects, uses or stores data, the operator lists the rights a player may have and confirms they are free of charge: to be informed, of access, to rectification, to erasure with exceptions, to restrict processing including direct marketing, to data portability, to complain to a data protection regulator where one applies, and to withdraw consent at any time. Exercising one takes three steps:

1. Write to the privacy address, naming the right being invoked;
2. Include enough account detail to confirm who is asking – the registered username at minimum, never the password;
3. Expect a reply that, where an exception covers part of the request, says which part and why.

An access request once a year, even without a problem, shows exactly what is held.

Children, Reminders and Responsible Play

Protecting the safety and privacy of children is described as very important to the operator, and the practical rule is unambiguous: every customer must be over 21, age is proven with identification documents before an account opens, underage play is treated as illegal, and an account found to enable it faces corrective action up to and including a report. Personal data also serves responsible gaming. The operator may use it to identify players who appear at risk and contact them – by email or text reminder where notifications are enabled – and the account offers deposit limits and self-exclusion periods, with a “Talk to us” link to the team. Gaming on TrueWin is entertainment with financial risk, never income; set a limit before the first deposit.

Updates and Contact

A revised Notice takes effect the moment it is uploaded to the site. The operator commits to reasonable efforts to flag material changes by phone, email or social media, and advises reading the current version on each visit; continued use after a change is treated as acceptance. Privacy matters go to [email protected] – questions about how data is gathered, stored, shared or used, rights requests and automated-decision queries. Everything else – complaints, suspected account compromise, everyday questions – runs through [email protected], live chat, the Help Center and the operator’s social media accounts, with complaints accepted around the clock. The closing reminder is the opening one: confirm that online betting or casino play is permitted in your own jurisdiction before registering, depositing or placing a wager.