TrueWin Privacy Policy: Nine Questions About Your Data, Answered
Privacy documents tend to be written for regulators and read by nobody. This page takes a different route: the questions a player actually asks – what do you hold on me, why, for how long, who else sees it – each answered from the Privacy Notice and Cookie Policy published by the operator behind TrueWin Casino, without the legalese. Nothing is invented; where the official documents give no answer, that absence is stated as the answer. The Notice applies to visitors and account holders alike, on the website and in the mobile application, and it is meant to be read together with the terms. Before any of the nine questions, the one that governs all of them… online betting and casino play are not permitted in every jurisdiction. Each person must independently confirm that such activity is lawful where they are before registering, depositing or playing.
What Is Collected, and From Where?
The Notice groups data by origin rather than by type: some a player hands over knowingly, some is captured while the site runs, and some arrives from outside providers.
| Origin | What it includes |
|---|---|
| Provided by the player | Name, date of birth, nationality, residential address; passport or ID details with number and expiry date; a photograph or facial scan; email, phone number, bank account and debit card numbers |
| Recorded by the systems | Payments to and from the player; games played and their outcomes; customer-care conversations; geolocation, IP address, device ID, browser type and version, time zone, usage patterns and referring websites |
| Returned by third parties | Transaction data, gameplay records from game vendors, geolocation from authorised providers, identity verification and screening results from KYC and compliance providers |
Because every customer must be over 21, the operator states that it neither seeks nor wants the personal data of minors. Provide exactly what the form asks for, and no more.
Why Is It Processed?
Seven purposes are listed, each paired with its legal ground – the contract with the player, a legal or regulatory duty, consent, or the operator’s legitimate interests:
Registration – creating the player profile so that deposits and payouts become possible;
Eligibility – checking location, personal details and documents against the rules;
Verification – document copies to confirm identity or a claim to winnings, under anti-money-laundering and counter-terrorist-financing law;
Playing the games – delivering games and services, managing the account, contacting the player about winnings;
Communication – notifying changes to the terms or the Notice and answering queries, complaints and disputes;
Marketing and analytics – content about games and competitions, service optimisation and behaviour profiling, with direct marketing only where consent has been given;
Regulatory compliance and responsible gaming – disclosures to regulators, fraud detection, prevention of unlawful activity and identifying players who may be at risk.
Withhold the requested data, or withdraw consent a service depends on, and the operator states it cannot provide that service; marketing consent alone can be switched off freely.
For How Long?
Two tests decide the answer, applied together: how long the data is needed for the purpose it serves, and any minimum period that law or regulation imposes. When both have run out, the operator undertakes not to keep the data in an identifiable form. Fixed periods in months or years are not published on the official website. Is that vague? Somewhat – but the Notice is candid about why: anti-money-laundering duties can require records to be kept regardless of a player’s wishes, which is also why the right to erasure comes with exceptions. A written question to the privacy address will say what is still held and on what ground.
How Is It Protected?
The operator commits to all reasonable and practicable technical and organisational measures, and the part of that commitment a player can see is the account: a username fixed at registration, a password of 8-20 characters mixing upper and lower case letters, numbers and at least one symbol, and monitoring and recording of account use. The operator also states that it never asks for bank details by email, text message or telephone. Data may leave the country, since the operator describes itself as a global business that uses service providers abroad; where a transfer happens, protection in line with applicable legal and regulatory requirements is promised, though destination countries are not named. A password used nowhere else is the one measure entirely in the player’s hands.
Who Else Sees It?
Recipients are named by category, and third parties acting for the operator are bound to equally stringent confidentiality undertakings. Data may go to:
regulatory authorities and other entities with standing, where the law requires disclosure;
trusted providers delivering something the player has requested, a payment provider handling a deposit being the example given;
suppliers working on the operator’s behalf – professional advisers, IT consultants, research and mailing houses;
group and affiliated companies, for internal operations and, with consent, for marketing;
any party to whom disclosure is required by law, an official investigation, enforcement of the terms, fraud or security protection, an emergency, or the safety and rights of others.
Selling personal data is not described anywhere in the Notice. Questions about a particular recipient belong at the privacy address.
Which Cookies Are Set?
The Cookie Policy describes cookies as small text files placed on the device to keep a session alive, remember preferences and measure how the site is used, and it sorts them into four groups.
| Group | Purpose | Set by | Examples named | Can be disabled |
|---|---|---|---|---|
| Strictly necessary | Navigation, login session, security, fraud prevention | Operator | session id, cookie_consent | No |
| Performance | Anonymised statistics and error logs | Operator and third parties such as Google Analytics | Not listed | Yes |
| Functionality | Language, region, user settings | Operator | Not listed | Yes |
| Targeting | Relevant advertising across websites | Third parties such as Meta, Google Ads, YouTube | _fbp, _gcl, _au, IDE | Yes |
Management happens in the browser, and the policy links to the cookie settings of Chrome, Firefox, Safari and Edge. Consequences are stated plainly: block the wrong group and embedded videos may stop playing or the login may not persist. Review the settings once, deliberately.
Which Decisions Are Automated?
Some, and the operator says so. Whether an account may be opened, whether a player remains eligible, how activity looks from a responsible-gaming standpoint, fraud detection and profiling may all be decided by systems rather than people. The Notice presents these as necessary for legal and regulatory compliance and states that appropriate measures safeguard the data involved; whether a human review can be requested is not specified on the official website. Questions about an automated outcome go to the privacy address; quote the username and the date of the decision.
What Can I Ask For?
Everywhere it collects, uses or stores data, the operator lists the rights a player may have and confirms they are free of charge: to be informed; of access; to rectification; to erasure, with exceptions; to restrict processing, including direct marketing, honoured through a blocked list although refusal may be lawful in some cases; to data portability in a structured, commonly used, machine-readable format; to complain to a data protection regulator where one applies; and to withdraw consent at any time without affecting earlier processing. A request should name the right being exercised and carry enough account detail to confirm the sender – the username, never the password. Where an exception applies to part of a request, the reply says which part and why. An access request once a year, even without a grievance, is worth the five minutes.
What About Children and Responsible Play?
Protecting the safety and privacy of children is described as very important to the operator. Every customer must be over 21, age is proven with identification documents before an account opens, underage play is treated as illegal, and an account found to enable it faces corrective action up to and including a report of the illegal use. Personal data also serves responsible gaming on TrueWin: the operator may use it to identify players who appear at risk and to contact them, by email or text reminder where notifications are enabled. Deposit limits by day, week or month and self-exclusion periods of the player’s choosing are set from the account, and a “Talk to us” link leads to the team. Gaming is entertainment with financial risk, never income. Set the limit first.
How Do I Get in Touch, and What Changes?
A revised Notice takes effect the moment it is uploaded, the operator commits to reasonable efforts to flag material changes by phone, email or social media, and continued use counts as acceptance – so read the current version on each visit. Privacy questions, rights requests and automated-decision queries go to [email protected]. Everything else runs through [email protected], live chat, the Help Center and the operator’s social media accounts, with complaints accepted around the clock. And the ninth answer is the first one restated: confirm that online betting or casino play is permitted in your own jurisdiction before registering, making a deposit or placing a wager.