Privacy policy
Last checked 1 October 2026
Who is responsible for your data
This policy explains what happens to personal data when you use the English section of this website and the Winplace casino account behind it. Because we offer our services to people in the United Kingdom, UK players’ data is handled according to the UK GDPR, with the Data Protection Act 2018 sitting alongside it, plus any other law that applies to us.
The controller
The controller is Fortaprime SRL, the Costa Rican company that runs Winplace. That company sets the purposes and methods of processing and is accountable for them.
Getting in touch about privacy
Questions, requests and complaints about personal data go to our support address with “Privacy” in the subject line. Live chat can take a first message too, but for anything involving documents we will move you to email so there is a written record.
What we collect
Details you give us
At registration: your full name, email, mobile or landline number, date of birth, home address and the currency of your account. For verification: a copy of your photo ID, a document confirming your address and, on occasion, a photo of your debit card with the middle digits hidden. If you contact support, we keep the conversation.
Data created as you play
Every deposit, withdrawal, bet, bonus and limit you set leaves a record. We also log technical details such as IP address, device type, browser, language and login times. These help us keep the account secure and spot sign-ins that do not look like you.
Information from other sources
Payment providers tell us whether a payment went through. Identity and fraud-check services may confirm that your details match public records. Game studios send us the result of each round you play. We do not buy marketing lists.
Why we use it, and the legal grounds
Each use needs a lawful basis under UK data protection law. Ours are set out below.
Running your account
Most processing is needed to perform our contract with you: opening the account, taking deposits, settling bets, crediting bonuses and paying out. Without that data we simply cannot run an account for you.
Legal duties
Age checks, identity checks, anti-money-laundering monitoring, record keeping and replying to lawful requests from authorities are duties the law places on us, and they apply to every account.
Legitimate interests
We use some data to prevent fraud and bonus abuse, to keep the site secure, to look after players who show signs of harmful gambling and to improve how the lobby works. We weigh these interests against your rights and you can object to them, as explained further down.
Consent
Marketing emails, text messages and the statistics and campaign cookies described in our cookie policy rely on your consent. You can withdraw it whenever you like, through your account settings, the unsubscribe link in any email or the cookie choice link in the footer.
Sharing and international transfers
Who receives your data
We share data only where there is a reason to. Recipients include payment processors and banks, identity verification services, game providers (who see a player ID and game activity, not your name), our hosting and email providers, and professional advisers. We may also disclose data to police, courts or regulators where the law requires it. We never sell personal data.
Transfers outside the UK
We are based in Costa Rica, and several of our providers operate elsewhere, so your data does leave the UK. Where the destination has no UK adequacy decision, we rely on safeguards such as the EU standard contractual clauses with the UK addendum attached, or the UK International Data Transfer Agreement. We will send a copy of the safeguard used on request.
How long we keep it
Retention periods
We keep data for as long as the purpose needs it and then delete or anonymise it. The main periods are:
- account, transaction and betting records: five years after the account is closed, to meet anti-money-laundering rules;
- identity and address documents: five years after the account is closed;
- live chat transcripts and support emails: two years after the last message, longer if they are part of an open complaint;
- self-exclusion records: for the whole exclusion and as long afterwards as we need to stop the account being reopened during it;
- marketing preferences: until you withdraw consent, plus a short suppression record so a stray email never reaches you again;
- cookie consent: twelve months in your browser, as the cookie policy explains.
Accounts that go quiet
If an account has no activity for a long stretch, we contact you before closing it. The retention clock for that account starts from the closure date.
Your rights under UK GDPR
What you can ask for
You have the right to a copy of your data, to have mistakes corrected, to have data deleted where we no longer need it, to restrict or object to some uses, and to get the data you provided back in a portable, machine-readable file. You can also object at any time to direct marketing, and that objection is always honoured. We answer within one month. For complicated requests that can be extended by two further months, and we will tell you if it is. We may need to confirm your identity first, which protects you as much as us.
Limits to those rights
Some data cannot be erased on request while a legal duty still applies, records needed for anti-money-laundering checks being the usual example. If that happens we will say which rule stops us and when the data will be removed.
Complaining to the ICO
Not happy with the way your data has been treated? Tell us first and we will try to put it right. A complaint can also go straight to the Information Commissioner’s Office, which regulates data protection in the UK: write via ico.org.uk or phone 0303 123 1113.
Security and updates
How we protect your data
Connections to the site are encrypted, staff see only what their role needs, and documents you upload are stored apart from day-to-day account data. If a breach puts your rights at real risk, we will tell you and, where required, the ICO.
Changes to this policy
We revise this policy when our practices or the law change. Whichever revision date sits under the heading marks the current text, and we let you know by email or at login before any significant change takes effect.
