Privacy & Personal Data Management
Goawin acts as the data controller for Personal Data collected through its platforms and services. This Policy sets out the categories of data we collect, the purposes for processing, the legal bases we rely on, how data may be shared, the safeguards for international transfers, how long data is retained, the rights of individuals, and the practical measures we employ to protect your information.
Scope, Controller & Contact
This Policy applies to Goawin websites, applications and services that link to it. Goawin determines the purposes and means of processing Personal Data. For queries regarding this Policy or data rights, you may contact the Goawin Data Protection Office at [email protected].
Categories of Personal Data We Collect
- Contact Data: name, address, email, phone number.
- Identity Data: date of birth, identity document numbers, government-issued IDs as required for verification.
- Account & Activity Data: account username, login history, transaction history, bets placed, wagers, bonuses, and withdrawals.
- Technical Data: device identifiers, IP address, browser and operating system information, network information.
- Financial Data: payment method details, funds source, and last four digits of payment instruments where applicable.
- Marketing & Preference Data: marketing communications preferences, consent records, and opt-out status.
Purposes of Processing & Legal Bases
We process Personal Data for the purposes listed below, supported by the corresponding legal bases. Some data may be processed for multiple purposes under different grounds.
- Account Creation & Management: establish and service your account. Legal basis: contractual necessity.
- Identity Verification & AML/KYC: verify identity, prevent impersonation and comply with anti-money laundering requirements. Legal basis: legal obligation and legitimate interests.
- Security & Fraud Prevention: protect accounts, funds, and the integrity of our services. Legal basis: legitimate interests and contractual necessity where applicable.
- Customer Support & Communications: respond to inquiries, provide assistance, and notify you about service changes. Legal basis: legitimate interests.
- Account Monitoring & Responsible Gaming: monitor activity to prevent problem gambling and enable self-exclusion. Legal basis: legitimate interests and regulatory obligations.
- Personalisation & Service Improvement: tailor experiences, offerings and communications. Legal basis: legitimate interests and contractual necessity.
- Marketing (consent-based): send promotions and information where you have consented. Legal basis: consent.
- Legal Compliance & Reporting: fulfill licensing, tax, and regulatory requirements. Legal basis: legal obligation.
- Profiling & Risk Assessment: automated analyses for AML, fraud detection, and risk scoring. We rely on legitimate interests but do not base final decisions on automated profiling alone; human review is required for any consequential outcomes. Legal basis: legitimate interests and regulatory obligations.
Data Retention
We retain Personal Data only for the period necessary to fulfill the purposes described in this Policy and to comply with applicable law. Transactional data is retained for a minimum of five years, or as required by law or regulatory obligations. When data is no longer required, we will securely delete or anonymise it.
Sharing & Disclosure
We may disclose Personal Data to the following categories of recipients:
- Service providers and partners who process data on our behalf (hosting, payment processing, game providers, IT security, analytics).
- Regulators, law enforcement, or as required by law, regulation, or court order.
- Parties involved in corporate transactions, including mergers, acquisitions or asset sales, where data may be transferred as part of the business assets.
We do not sell Personal Data to third parties. All disclosures are made in accordance with applicable law and with appropriate safeguards.
International Data Transfers
Where Goawin transfers Personal Data to recipients in jurisdictions outside your home country, we implement safeguards to protect the data in line with data protection laws. These safeguards may include standard contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms. If you require details about the specific transfer mechanism affecting your data, please contact the Goawin Data Protection Office.
Security & Data Protection
Goawin maintains appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. This includes:
- Encryption of data in transit using TLS 1.2 or higher.
- Encryption of sensitive data at rest where practicable.
- Access controls with least-privilege and multi-factor authentication for employees and contractors.
- Regular security assessments, logging, and incident response planning.
Cookies & Tracking Technologies
We use cookies and similar technologies to operate and improve our Services, personalize experiences, and analyse usage. Cookies are categorised as essential, functional, performance, or marketing. You may adjust browser settings to manage cookies; disabling cookies may affect service functionality. We do not rely on cookies for marketing purposes without your explicit consent where required by law.
Your Rights
You have the following rights regarding your Personal Data. To exercise them, contact the Goawin Data Protection Office. We will respond within one month unless a longer period is justified by complexity or the volume of requests.
- Right of Access: obtain a copy of your Personal Data.
- Right to Rectification: correct inaccurate or incomplete data.
- Right to Erasure: request deletion of data when no longer needed or when consent is withdrawn and no other legal ground applies.
- Right to Restrict Processing: limit processing under certain circumstances.
- Right to Data Portability: receive your data in a structured, commonly used format and transmit to another controller where feasible.
- Right to Withdraw Consent: withdraw consent for processing based on consent, without affecting lawful processing before withdrawal.
- Right to Object: object to processing based on legitimate interests or for direct marketing reasons.
There is no fee for exercising these rights. If you require assistance, contact the Goawin Data Protection Office.
Automated Processing, Profiling & Decisions
Where we conduct profiling or automated processing for AML, risk assessment or service improvements, the processes are designed to support legitimate interests and regulatory compliance. No final decision that adversely affects you will be made solely by automated means; a human review will be involved before any consequential action is taken. You may request human intervention or challenge any automated result that affects you.
Changes to This Policy
We may update this Policy from time to time. We will provide notice of material changes on the site or via email where required by law. The date of the last update will be shown at the top of the Policy.
Complaints & How to Contact
If you have concerns about how your Personal Data is handled, you may contact the Goawin Data Protection Office at [email protected] or file a complaint with the relevant supervisory authority in your jurisdiction.
