Privacy Policy
of winbidi

Section 1

Data We Collect

winbidi collects personal data only to the extent necessary to deliver a secure, compliant, and high-quality gaming experience. We collect data directly from you when you register, make a deposit or withdrawal, contact support, or interact with our platform. We also collect certain technical data automatically when you visit our website. The categories of personal data we may collect are described below.

Section 2

How We Use Your Data

winbidi processes your personal data on clearly defined legal bases. We do not use your data for any purpose beyond what is described in this Privacy Policy. The primary purposes for which we process your data are set out below, together with the legal basis for each activity.

Where we rely on your consent as the legal basis for processing — specifically for promotional communications — you may withdraw that consent at any time by updating your notification preferences within your Account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

Section 3

Data Sharing & Third Parties

winbidi does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share data only in the limited circumstances described below, and only to the minimum extent required to fulfil the stated purpose.

• Payment processors: We share necessary financial and identity data with payment partners including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card processors to execute and verify your transactions. These partners are contractually bound to process your data only for payment-related purposes.
• Game technology providers: Game studios and platform providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive session and bet data to facilitate gameplay, resolve disputes, and maintain RNG integrity. No additional personal identity data is passed beyond what is operationally necessary.
• Identity verification services: Third-party KYC and document verification providers may process copies of your identity documents on our behalf to confirm your age and identity. These providers operate under strict data processing agreements and do not retain your documents beyond the verification period.
• Fraud and AML screening: We may share transactional and identity data with fraud detection and anti-money-laundering screening services to identify patterns consistent with financial crime.
• Regulatory and law enforcement bodies: Where required by applicable law, court order, or lawful request from a competent authority, winbidi will disclose personal data to the relevant body. We will notify you of such disclosure where we are legally permitted to do so.
• Analytics providers: Aggregated and anonymised technical data may be processed by analytics platforms to help us understand platform usage patterns. No personally identifiable information is included in these data sets.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. You will be notified via your registered contact details before any such transfer takes place, and the acquiring entity will be bound by this Privacy Policy.

Section 4

Cookies & Tracking

winbidi uses cookies and similar tracking technologies on its website to ensure the platform functions correctly, to secure your session, and to understand how Players interact with our pages. A cookie is a small text file placed on your device by the web server when you visit our site. The types of cookies we use are described below.

You may control cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the core winbidi platform, but may affect the functionality of certain features such as personalised recommendations and saved preferences. winbidi does not use third-party advertising cookies or retargeting pixels.

Section 5

Data Retention

winbidi retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide. Individual circumstances — such as an ongoing investigation or legal dispute — may require data to be retained for a longer period.

1. Active account data: All personal data associated with an active account is retained for the lifetime of the account plus a minimum of five years following account closure. This satisfies record-keeping obligations related to financial transactions and responsible gaming history.
2. Identity verification documents: Copies of identity documents (National ID, passport, utility bill) are retained for five years from the date of verification or from the date of account closure, whichever is later.
3. Transaction records: Full records of all deposits, withdrawals, wagers, and bonus transactions are retained for a minimum of seven years in line with standard financial record-keeping requirements.
4. Support communications: Customer support tickets, live chat transcripts, and complaint records are retained for three years from the date of closure of the relevant case.
5. Technical and log data: Server logs and session data are retained for a maximum of 90 days, after which they are automatically purged unless they are required as part of an active fraud or security investigation.
6. Marketing consent records: Where you have opted in to promotional communications, a record of your consent is retained for as long as you remain subscribed, plus two years following any opt-out, to demonstrate compliance with consent obligations.
7. Self-exclusion records: Records of self-exclusion requests and their duration are retained indefinitely to prevent re-registration under the same identity during an active exclusion period.

Upon expiry of the applicable retention period, winbidi will securely delete or anonymise your personal data in a manner that prevents its reconstruction. Where full deletion is not technically feasible within a specific system, access to the data will be restricted and the data will be isolated from active processing until deletion is possible.

Section 6

Security Measures

winbidi applies industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework is reviewed and updated on a regular basis to address emerging threats.

• Encryption in transit: All data exchanged between your browser and the winbidi platform is encrypted using 256-bit TLS/SSL. This protects login credentials, payment details, and personal information from interception during transmission.
• Encryption at rest: Sensitive data stored in our databases — including identity documents and payment method references — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to winbidi employees and authorised service providers who have a legitimate operational need. All access is logged and subject to regular audit review.
• Two-factor authentication: Player accounts are protected by two-factor authentication (2FA) to prevent unauthorised access even in the event of password compromise.
• Vulnerability management: winbidi conducts regular security assessments, penetration tests, and vulnerability scans to identify and remediate weaknesses before they can be exploited.
• Incident response: In the event of a personal data breach that poses a risk to Players, winbidi will notify affected individuals and relevant authorities within the timeframes required by applicable law. Notifications will be sent to your registered mobile number and/or email address.

Section 7

Your Privacy Rights

As a user of winbidi, you hold meaningful rights over your personal data. These rights may be exercised at any time by contacting our Data Protection Officer (DPO) at the address set out in Section 8. winbidi will acknowledge all rights requests within 48 hours and respond substantively within 30 calendar days.

winbidi will not discriminate against you in any way for exercising your privacy rights. Certain rights may be subject to limitations where winbidi is required to retain data to comply with legal obligations — for example, transaction records subject to financial record-keeping requirements cannot be deleted on request alone. We will always explain clearly if a limitation applies to your specific request.

Section 8

Contact & Complaints

winbidi has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and handling all data-related enquiries and complaints. If you have any question about how we handle your personal data, or if you wish to exercise any of the rights described in Section 7, please contact our DPO using the details below.

When submitting a privacy rights request, please include your registered mobile number or account username so that we can verify your identity before processing the request. This step is necessary to ensure that we do not disclose personal data to, or act on instructions from, an unauthorised party.

If you are dissatisfied with winbidi's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or consumer protection body in your jurisdiction. winbidi will cooperate fully with any lawful investigation by a competent supervisory authority.