Privacy Policy

1. Definitions

The following terms are used consistently throughout this Policy and carry the meanings defined below:

• Personal Data — Any information that identifies or could reasonably identify a living individual, either directly (e.g., full name, email address) or indirectly (e.g., IP address combined with other identifiers).
• Processing — Any operation performed on Personal Data, including collection, storage, retrieval, transmission, analysis, modification, and deletion.
• Controller — windin, the entity that determines the purposes and means of Processing your Personal Data.
• Processor — A third-party service provider that Processes Personal Data on behalf of windin, under written instruction and binding data protection obligations.
• Platform — The website https://windin.cam, including all subdomains, pages, and associated applications.
• Account — The personal player account created upon successful registration on the Platform.
• Cookies — Small text files placed on your device by the Platform to enable functionality, analytics, and personalization.
• KYC — Know Your Customer; the identity verification process conducted to confirm a Player's identity before processing withdrawals or as required by our compliance framework.

2. Data We Collect

windin collects several categories of personal data depending on how you interact with the Platform. The table below summarizes the categories and specific data points we process:

3. How We Collect Your Data

windin collects your Personal Data through the following channels:

3.1 Directly From You

• Registration: When you create an Account on the Platform, you provide identity, contact, and demographic data.
• KYC Submissions: When you upload verification documents to complete identity checks before your first withdrawal.
• Deposits and Withdrawals: When you initiate financial transactions, payment method details and transaction metadata are recorded.
• Support Interactions: When you contact us via live chat, email, or WhatsApp, we record the content and metadata of those communications.
• Surveys and Feedback: When you voluntarily complete satisfaction surveys or submit feedback through the Platform.

3.2 Automatically During Platform Use

• Cookies and Tracking Technologies: The Platform uses cookies and similar technologies to collect Technical Data including IP address, browser type, device identifiers, pages visited, and session duration. See Section 7 for full cookie details.
• Gameplay Logs: Our systems automatically log all game activity, including bet amounts, outcomes, game titles, and timestamps, for account integrity and dispute resolution purposes.
• Transaction Monitoring Systems: Automated fraud and anti-money laundering (AML) detection systems analyze transaction patterns in real time.

3.3 From Third Parties

• Payment Processors: Confirmation and transaction reference data from BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and cryptocurrency payment gateways.
• Identity Verification Services: KYC technology partners may return verification results and risk scores based on document analysis.
• Fraud Prevention Partners: Third-party fraud screening services may provide device fingerprinting signals and risk assessments.

4. Legal Basis for Processing

windin processes your Personal Data on one or more of the following legal bases, depending on the purpose of processing:

• Contractual Necessity: Processing required to create and manage your Account, process deposits and withdrawals, and provide gaming services as described in our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML and CTF obligations, identity verification requirements, and record-keeping mandates.
• Legitimate Interests: Processing conducted to operate and improve the Platform, detect and prevent fraud, ensure network and information security, and analyze aggregate usage patterns — provided these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit, informed, and freely revocable consent. You may withdraw consent at any time by contacting support or adjusting your Account settings.

5. How We Use Your Data

windin uses your Personal Data for the following specific purposes:

5.1 Account Management

To create, maintain, and administer your Account; authenticate your identity at login; process your deposits and withdrawals through local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay); and enforce the responsible gaming controls you have activated o n your Account.

5.2 Identity Verification (KYC)

To verify your identity and age in compliance with our Know Your Customer obligations before processing withdrawal requests. KYC data is used solely for compliance and fraud prevention purposes and is never used for marketing profiling.

5.3 Transaction Processing

To process deposits and withdrawals accurately and efficiently, maintain complete financial records, and reconcile transaction discrepancies. Financial transaction data is retained for a minimum of five (5) years in compliance with applicable record-keeping obligations.

5.4 Fraud Prevention & Security

To monitor account activity for suspicious patterns, detect and prevent unauthorized access, investigate potential fraud, bonus abuse, or money laundering activity, and protect the integrity of the Platform and the broader player community.

5.5 Customer Support

To respond to your inquiries, resolve disputes, and improve the quality of our support services. Live chat and email communications are retained for quality assurance and dispute resolution purposes.

5.6 Responsible Gaming

To monitor gaming patterns that may indicate problem gambling behavior, enforce deposit limits and self-exclusion requests, and proactively reach out to players who may need support. Account activity data is analyzed to identify at-risk behavior in accordance with our Responsible Gaming commitments.

5.7 Platform Improvement & Analytics

To analyze aggregated usage patterns, measure feature performance, and improve the overall player experience. Where possible, analytics are conducted on anonymized or pseudonymized data sets rather than individual-level Personal Data.

5.8 Marketing Communications

To send you promotional offers, bonus notifications, and seasonal campaign communications — but only where you have given explicit consent to receive such communications. You may opt out at any time by contacting [email protected] or adjusting your notification preferences in your Account settings.

6. Data Sharing & Disclosure

windin does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following circumstances and only to the extent strictly necessary:

6.1 Service Providers (Processors)

We engage trusted third-party service providers to perform functions on our behalf, including payment processing, KYC verification, fraud detection, cloud hosting, and customer support technology. All Processors are bound by written data processing agreements that prohibit them from using your data for any purpose other than fulfilling their contracted service to windin.

6.2 Payment Partners

When you make a deposit or request a withdrawal, transaction data is shared with the relevant payment provider — for example, BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, or cryptocurrency payment gateways — to the extent necessary to execute the transaction. Each payment provider operates under its own privacy policy and applicable financial regulations.

6.3 Legal and Regulatory Authorities

We may disclose Personal Data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts when we are legally required to do so, when disclosure is necessary to protect windin's legal rights, or when we have a good-faith belief that disclosure is necessary to prevent imminent harm or criminal activity.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving windin, your Personal Data may be transferred to the acquiring or successor entity. We will notify you via your registered email address before your data becomes subject to a materially different privacy policy as a result of any such transaction.

6.5 Aggregated and Anonymized Data

We may share aggregated, anonymized statistical data (e.g., total active players across Jakarta, Surabaya, and Bali; peak betting hours during BRI Liga 1 match days) with analytics partners or publish such data publicly. Anonymized data cannot be used to identify any individual player.

7. Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to deliver core functionality, improve performance, and — where you have consented — personalize your experience. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling analytics or marketing cookies will not affect your ability to play games or make transactions.

8. Data Retention

windin retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention schedules are as follows:

• Account and Identity Data: Retained for the lifetime of your Account plus a minimum of five (5) years after Account closure, in compliance with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• KYC Documents: Retained for the lifetime of your Account plus five (5) years after Account closure. Documents are stored in encrypted form with access restricted to authorized compliance personnel only.
• Support Communications: Retained for two (2) years from the date of the interaction, unless the communication relates to a dispute or legal matter, in which case it is retained until final resolution plus one (1) additional year.
• Technical and Log Data: Retained for twelve (12) months on active servers, then archived in compressed form for a further twelve (12) months before permanent deletion.
• Marketing Consent Records: Retained for the duration of your Account plus three (3) years, to demonstrate compliance with consent obligations.

When retention periods expire, Personal Data is permanently deleted or irreversibly anonymized. We conduct periodic data audits to ensure retention schedules are honored across all processing systems.

9. Your Privacy Rights

As a Data Subject, you hold specific rights over your Personal Data processed by windin. These rights are described below. To exercise any of them, contact us at [email protected] with the subject line "Privacy Rights Request — [Your Account Username]".

9.1 Right of Access

You have the right to request a copy of the Personal Data windin holds about you, along with information about how it is being processed. We will respond to access requests within thirty (30) days of receiving a verified request.

9.2 Right to Rectification

If any of your Personal Data is inaccurate or incomplete, you have the right to request correction. For data that cannot be self-corrected through your Account settings, contact our support team with supporting documentation.

9.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Please note that erasure requests may be declined where retention is required by law — for example, AML regulations require us to retain transaction records for five (5) years regardless of Account status.

9.4 Right to Restrict Processing

You may request that we restrict the processing of your data in certain circumstances — for example, while you contest the accuracy of your data or while an objection is being assessed. During a restriction period, we may store your data but will not actively process it for other purposes.

9.5 Right to Data Portability

Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller.

9.6 Right to Object

You have the right to object to processing based on legitimate interests, including profiling for fraud prevention purposes, where you believe your individual rights and freedoms override those interests. You also have an unconditional right to object to processing for direct marketing purposes.

9.7 Right to Withdraw Consent

Where processing is based solely on your consent — for example, marketing emails or non-essential cookies — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10. Data Security

windin implements a layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and the Platform is encrypted using industry-standard TLS 1.3 encryption protocols.
• At-Rest Encryption: Personal Data and financial records stored on our servers are encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. All internal staff with data access are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication (2FA): All administrative access to systems containing Personal Data requires multi-factor authentication.
• Regular Security Audits: We conduct periodic penetration testing and vulnerability assessments on our infrastructure, conducted by independent third-party security firms.
• Incident Response Plan: In the event of a data breach that poses a risk to your rights and freedoms, windin will notify affected players and relevant authorities within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable notification obligations.

While we implement robust security measures, no system is completely immune to risk. We encourage you to use a strong, unique password for your windin Account, enable two-factor authentication where available, and report any suspected security incidents to [email protected] immediately.

11. Minors & Age Restriction

The Platform is strictly for individuals who are 21 years of age or older. windin does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a minor has registered an Account or provided Personal Data without appropriate parental or guardian consent, we will immediately close the Account, delete all associated Personal Data, and refund any deposited balance minus any applicable processing costs.

If you are a parent or guardian and believe that your child has registered on the Platform, please contact us immediately at [email protected] with the subject line "Minor Account — Urgent". We will investigate and act within twenty-four (24) hours of receiving your report.

We also participate in industry-standard parental control initiatives and recommend that parents utilize device-level parental control tools to prevent unauthorized access by minors to gambling websites.

12. International Data Transfers

windin operates internationally, and your Personal Data may be transferred to and processed in countries outside of Indonesia, including countries where our hosting infrastructure, KYC verification partners, and payment processing systems are located. These countries may have data protection laws that differ from those applicable in Indonesia.

Where we transfer Personal Data internationally, we take steps to ensure an adequate level of protection is maintained through one or more of the following mechanisms:

• Binding contractual clauses between windin and the receiving party that impose data protection obligations equivalent to those applicable in the originating jurisdiction.
• Transfers only to countries or entities recognized as providing an adequate level of data protection.
• Pseudonymization or anonymization of data prior to transfer where full Personal Data transfer is not strictly necessary.

You may request further information about the specific safeguards in place for international transfers affecting your Personal Data by contacting [email protected].

13. Policy Amendments

windin reserves the right to update or revise this Privacy Policy at any time. Material changes — particularly those that affect how your Personal Data is used or your rights as a Data Subject — will be communicated to registered players via email to the address on file at least seven (7) days before the updated Policy takes effect.

The "Last Updated" date at the top of this document reflects the most recent revision. We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy.

14. Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way windin handles your Personal Data, please reach out to our Data Protection team through the following channels. All contact details are displayed as plain text only.

• Email: [email protected]
• Subject Line: "Privacy Inquiry — [Your Account Username]"
• Response Time: We acknowledge all privacy-related contacts within five (5) business days and provide substantive responses within thirty (30) calendar days.
• Live Chat: Available 24 hours a day, 7 days a week, via the in-platform support widget. Indonesian-speaking agents are available during peak hours (10:00–02:00 WIB).

If you are dissatisfied with our response to your privacy complaint, you have the right to escalate the matter to the relevant data protection or gaming regulatory authority in the jurisdiction governing your Account. windin will cooperate fully with any regulatory inquiry.