PRIVACY POLICY

Version: 2.0.1

Definitions

Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Processing means means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Profiling means means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

Controller means means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Recipient means means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data;

Consent of the data subject of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Group of undertakings means a controlling undertaking and its controlled undertakings;

Supervisory authority means an independent public authority which is established by a Member State pursuant to Article 51 GDPR;

General

This notice together with the General Terms and Conditions available on the site sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By registering a Player Account with the Website you confirm your acceptance of this Privacy Policy. Please be advised that if you do not accept the terms outlined in this Privacy Policy and choose not to provide the necessary personal information, your access to certain features and services offered on this website may be limited.

Please note that this Privacy Policy constitutes an agreement between you and the Company. It is important to note that this Privacy Policy may be periodically updated and revised. While we will make reasonable efforts to inform you of any significant changes, we recommend that you review this Privacy Policy regularly to stay informed of our current practices regarding the collection, use, and protection of your personal information. Your continued use of the Website and/or its services will constitute your acceptance of the Privacy Policy.

www.luckywins.com values your integrity and privacy immensely and is committed to managing all your personal data in a transparent, fair and lawful manner. This privacy policy (together with the Terms & Conditions and the Cookie Policy) sets out the basis upon which www.luckywins.com collects, stores, and uses your personal data when you visit our website, as well as what your rights are, and how the law protects those rights according to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

This website is solely intended for persons over the age of 21, and we do not knowingly collect data relating to persons under such age. If it becomes apparent to us that we have collected personal data relating to persons under the age of 21, due to reasons relating to abuse of our website, we do our best to ensure that such data is handled in accordance with applicable law.

About us

The website www.luckywins.com ("Casino", "Website", “Company”, "We", "Us", "Our") is owned and operated by KingsWin Online OÜ, a private limited company registered and established under the laws of Estonia, with registration number 11535738 and registered address at Vesivärava tn 50-301, Tallinn, Estonia, 10152. KingsWin Online OÜ is licensed and regulated by Estonian Tax and Customs Board. License no. HKT000017, granting the right to organize games of chance and activity license no. HKL000425, granting the right to organize games of chance by way of remote gambling.

As a data controller, we have a legal obligation under gambling regulations to process personal data from players in order to allow them to participate in games and provide them with ancillary services.

When we mention “Company”, “Group”, “we”, “us” or “our” in this privacy notice, we are referring to the KingsWin Online OÜ.

We take your privacy seriously. For this reason we have appointed a data protection officer (“DPO”) whose responsibility is to oversee that the company is compliant with its legal obligations in respect of the processing of your personal data, and who is your contact point for any questions relating to this Privacy Policy. Should you have any queries about this policy, including any request to exercise your legal rights, and complaints about violation of your rights please contact our DPO using email [email protected].

Contact Us

You may always contact us in regards to this Policy should you wish to:

1. Confirm the accuracy of the personal information we have collected about you;
2. Enquire about our use of your personal information;
3. Prohibit future use of your data for direct marketing purposes;
4. Receive a copy of personal information stored about you;

If you have agreed to receive promotional materials during registration, we may use your Personal Information, including your email address and phone number, to send you marketing communications regarding products, services and promotions, based on your consent. This may include information about products and services from our business partners, such as casino game providers. You can configure your marketing preferences in your personal account by following the link www.luckywins.com/profile

1. Update or rectify any information that you have provided us (in such cases you shall provide any evidence we may reasonably require to effect such changes). Note it is illegal to provide us with false information about you and it is your responsibility to ensure that we are always updated with your correct data..

To fulfill your requests in accordance with this privacy policy, you can use the following means of communication:

Please note that in some cases emails may end up in spam or may not reach the addressee at all for technical reasons.

If your request is not answered within 10 days we strongly recommend you to contact us again for clarification using alternative methods of communication.

We respect and value your privacy. You can always contact the Data Protection Officer via [email protected] in cases where

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Information we collect

During the course of delivering services to you, we are also working closely with third party data processors, joint or/and independent data controllers (including, for example, business partners, sub-contractors in technical, payment and delivery services as well as for delivery of marketing information (such as CRM Tool Providers, Email Marketing Partners, SMS Providers, Direct Mail Distributors and Outbound Call providers,) advertising networks and affiliate networks, analytics providers, due diligence intelligence companies, search information providers, credit reference agencies). This category includes information we receive from our Publishers, Advertisers and other Partners that we work with to help us deliver ads and personalized content to you and recognize you across browsers and devices. This may include pseudonymous advertiser identifiers that some Advertisers or other third-party ad platforms choose to share with us. Data processors process personal data according to our written instructions and their activities will be limited to those that are needed from them to assist us deliver the service to you.

Categories of Data We Store About You

Personal data means any information about an individual from which that person can be identified directly or indirectly. It does not include data where the identity has been removed (anonymous data).

The personal data collected and processed on you can be grouped into the following categories:

Identity Data includes first name, middle name, last name, email, username or similar identifier, date of birth, gender.

Contact Data includes residential address, email address, telephone numbers other available means of communication.

Financial Data includes details of your salary and wealth, details of the sources of funds used to deposit with us, as well as bank account, payment card or payment account details, including information contained within any bank statements, scans of documents, confirming your income and similar documentation collected for KYC Purposes.

Transaction Data includes details about deposits and withdrawals, wagering and other details of games you have played on our sites.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.

Usage Data includes information about how you use our website, products and services, online identifier to login (email), password (encrypted), games played, login and logout times, duration of play, bonuses and promotions claimed, responsible gaming information, limits and history and AML classification.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Special Categories of Personal Data. In the event that you provide us with such information yourself and In fulfillment of our legal obligations, we must also collect some Special Categories of Personal Data about you such as

How we can use your information

Information you give to us:

– to carry out our obligations arising from the terms and conditions entered into between you and us and to provide you with gaming services that you request from us, to accept your deposits and process your withdrawals, to carry out fraud management processes, to answer to any query or complaint that you may have as well as other ancillary matters related to the main services we are providing to you;

– provided that you have granted consent to contact you with marketing information from the Group, to provide you with information about our services, bonuses schemes and promotions and information about the products and promotions of related sites operated by the Group or it’s brands;

– to provide customized advertising on the site based on your interactions with the site or your Usage Data;

– to notify you about changes to our service;

– to meet obligations arising from Anti-Money Laundering Legislation and rules and regulations thereunder and all other laws that we may be subject to from time to time.

Information we collect about you:

– to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. Such information will typically be collected through the use of Cookies. For more information on Cookies please refer to our Cookie Notice which also provides guidance on the manner in which Cookies may be disabled;

– to contact you with marketing information, to provide you with information about services, bonuses schemes and promotions and information about the products and promotions, present or future, offered by the brand you registered or with marketing information about brand partners in case you have expressed your consent to receive such materials;

– to carry out fraud management and risk management activities, including assigning a risk profile or a risk status to your account;

– to assess your behavior and patterns through the site which will be used to help build a detailed customer profile on you, on different subject matters, including but not limited to:

- A register of bonus abusers may be created by the company and persons on this list may be excluded from any future promotions or even blocked from using the services of the Company. This includes analysis of other types of fraud and fraudulent behavior.

- We will also screen and monitor your transactions and behavior for reasons of responsible gambling, ensuring that your interaction with us remains fun and entertainment and not dangerous to you. We may assign a Responsible Gambling score to your account based on the information we collect and responsible gambling questionnaire, which may at times be provided to you to fill. As a result of our assessment you may be tagged as a ‘Problem Gambler’ or vulnerable to the risks of gambling addiction.

- As part of our commitment to prevent money laundering and terrorist financing, we may also analyze your personal data and compare it to third party data sources, build an AML profile on you and risk score your account based on the information you have provided to us and the information we have collected about you. We shall also keep a register of all high risk customers from an Anti-Money Laundering perspective.

Please note that for these purposes we partially use profiling with the end decision performed by humans, however logic behind the profiling and information about it cannot be revealed since it would enable customers to bypass these control mechanisms aimed at the protection of Our business and compliance with legal obligations.

– to improve our site to ensure that content is presented in the most effective manner for you and for your computer;

– to allow you to participate in interactive features of our service, when you choose to do so;

– as part of our efforts to keep our site safe and secure;

– to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant promotions to you;

– to make suggestions and recommendations to you about our products.

– We also may collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

Information we receive from other sources:

We will combine this information with information you give to us and information we collect about you. We will use this information and combined information for the purposes set out above (depending on the types of information we receive). Other sources include third party service providers of age verification tools, identity or address verification services, regulators or entities that keep central databases of problem gamblers, providers of PEP and Sanction searches, and other similar providers who we may contract with from time to time. We may also receive information about you collected from the other sites operated by the Group which helps us deliver a better service to you or to keep away bonus abusers, problem gamblers from our services.

Lawful Basis for Processing of Personal Data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. In regards to processing personal data based on a legal obligation, we refer to the provisions of the Anti-Money Laundering Directive (EU) 2015/849 of the European Parliament and the Council.

Sharing of data

Due to the nature of our service, in order to process your data as explained above of this Privacy Policy, we may need to share your personal data with a number of trusted third parties. These third parties include:

- Any member of the Group which requires access to your personal information in order to provide the services you request. Data we receive and collect on you maybe shared with any member of the Group and such data may be used by them for fraud and bonus abuse prevention, AML and Responsible Gaming Reasons in fulfillment of the Group’s legal obligations and legitimate business interests;

- To all members of the Group for the purposes of such other group entities to contact you with information on their products and services, provided that you have consented to receive direct marketing related to other sites operated by the Group.

- Employees of the Company, more specifically Data Protection Officer, Money Laundering Officer, Payments & Anti-Fraud analysts, Customer Support agents, Customer Retention team members, VIP player managers as well as other selected employees, shall also have access to your Personal Information for the purpose of executing their duties and providing you with assistance as well as to provide the services you requested

Our employees who have access to, or are associated with the processing of the player’s personal information, have signed confidentiality agreements (NDA) to respect the confidential nature of the player’s information.

- Game providers – sometimes our game providers would require access to select data attributes (such as username and IP address, for instance), in order to provide us with the games you play on our website. To check their privacy notice please visit the relevant website of Game provider;

When you play casino games developed by NetEnt, NetEnt’s Privacy Policy also applies. This policy can be found here.

- Payments providers and related service providers – similarly, we may share some of your personal data with the payment providers you use to make and receive payments on our website. To check their privacy notice please visit the relevant website of Payment provider you’ve used;

- Marketing partners - where you give us your consent to send you marketing and promotions, we may share your contact details (such as email address or mailing address) with our marketing partners who take care of sending out all our marketing material to you including promotional emails and SMS, direct mail, and at times to makes calls to you.

- Governmental or regulatory authorities - We may, if necessary or authorized by law, provide your personal data to law enforcement agencies, governmental or regulatory organizations, courts or other public authorities. We may dispute such demands when we believe that the requests are disproportionate, vague or lack proper authority, but we do not promise to challenge every demand;

- Client communication software – we use a third-party software to help us communicate with you. This software enables us to send you emails and chat with you on live chat whenever you have queries;

- AML and fraud verification tools, suppliers of age and identity verification tools and other suppliers that can verify Know Your Client (KYC) information generally– we may use third party software to conduct certain AML and fraud verification checks which are required to satisfy our legal obligations in this regard.

- In addition to the above, we may also release personal data if we acquire any new businesses. Should the Company undergo any changes to its structure such as a merger, acquisition by another company or a partial acquisition, it is most likely that our customers’ personal data will be included within the sale or transfer. We will, as part of our Policy, inform our players by email prior to affecting such transfer of personal data.

- Selected third parties, under a data processing agreement with us that ensures the safeguard of your personal information, including:

– with our lawyers, advisors, consultants who we may engage from time to time to manage risks, obtain professional advice, or to establish and defend our legal claims, whether in court or in an out-of-court procedure. This may require to gain access to personal information;

– with governmental bodies, regulatory authorities who register problem gamblers or for any other responsible gaming purpose.

– with any company, governmental body, regulatory authority that maintains a register or database having the objective of preventing crime, money laundering or terrorist and proliferation financing.

We always ensure that any third party having access to your personal data is bound to respect the security of your personal data, and to process it in a lawful manner at all times and in compliance with our Privacy Policy and strict codes of conduct. We do not allow any third-party service providers to use your personal data for their own purposes. Processing by such third parties (also known as “Data Processors”) is solely carried out for specific purposes and in accordance with our instructions as Data Controller and on our behalf, and such third parties may only use your personal data to the extent to which we ourselves are entitled. Furthermore, in all cases, we strive to ensure that we do not share more data than is necessary to be shared for the service providers to carry out the processing activities in accordance with our instructions.

Transfers of personal data outside of the EEA

It may be necessary for us or our service providers to transfer your personal data to countries outside of the European Union (EU), the European Free Trade Association (EFTA) regions, and the European Economic Area (EEA) in order to provide you with our services or engage with service providers and data processors. However, In accordance with the General Data Protection Regulation (GDPR), we are obliged to ensuring the protection of your personal data during these transfers.

This transfer may be necessary in order to provide you with our services such as:

a) Processing your bets and payment transactions;

b) Providing you with gaming and other ancillary services that you seek from our Website;

c) Identifying and performing the necessary verification checks;

To guarantee an appropriate level of protection for your personal data during transfers to third countries, we implement appropriate safeguards such as European Commission’s standard contractual clauses for data protection. We also take all necessary measures to ensure that your information and data is treated securely and in accordance with this Privacy Policy and all applicable data protection laws.

By using our services and accessing our website, you accept possible transfer of your personal data to third countries and the implementation of these safeguards. If you have any questions or concerns regarding these transfers, please do not hesitate to reach out to us.

Data Retention

We shall only retain your personal data for as long as necessary in view of the purposes for which they were collected. Such purposes could include the satisfaction of any legal, accounting, or reporting requirements.

When determining the appropriate retention period applicable to your data, we take several factors into consideration, such as the purposes for which we collect and process such data, the applicable laws and/or regulatory requirements imposed on us, the nature and sensitivity of the personal data, and the potential risks surrounding the unauthorised use or disclosure of such data.

As stated under our Terms and Conditions both, you and the Casino can decide to have your Player Account closed at any time. Following closure of your account, we will retain your personal data on record for as long as required by law. This data shall only be used should it be required by competent authorities in cases of enquiries regarding financial and fiscal records, fraud, money laundering or investigations into any other illegal activity.

We may also keep anonymized derivatives of your data to improve our content and marketing communications where no automated decision making is involved.

You are to note that due to anti-money laundering regulations in licensed gaming jurisdictions in the European Union, we are obliged to retain personal data of players submitted during registration and any data passed on during the operative period of a Player Account for a minimum of five years from last player transaction or account closure. Therefore, requests for erasure prior to the lapse of this period cannot be entertained.

Your Rights

Data protection law gives you, as a data subject, certain rights in certain circumstances. In accordance with law, you have a right to:

- Request access to your personal data - This means that you have a right to request, free of charge, a copy of the personal data we hold about you;

- Request the correction of your personal data – This means that if any personal data we hold about you is incomplete or incorrect, you have a right to have this corrected. Keep in mind, however, that we may need you to provide evidence and documentation (such as your ID documentation or proof of address) to support your request. It can be declined due to our legal obligations

- Request the erasure of your personal data - This means that you may request the erasure of your personal data where we no longer have a legal basis to continue processing it or retaining it. Please be aware that this right is not absolute – meaning that we are not able to satisfy your request where we are obliged under a legal obligation to retain the data, or where we have reason that the retention of data is necessary for us to defend ourselves in a legal dispute;

- Object to the processing of your personal data where we rely on our legitimate interests (or those of a third party) to process your data and you feel that our processing of your data in such a manner impacts your fundamental rights and freedoms. However, in some cases, we may be able to demonstrate that we have a compelling legitimate ground to process your data which may override your rights and freedoms. You may submit your objections to processing of your personal data on the grounds of the above-mentioned legitimate company interests by contacting our DPO;

- Request the restriction of the processing of your personal data – You may ask us to temporarily suspend the processing of your personal data in one of the following scenarios: (a) where you want us to establish the accuracy of the data, (b) where our use of the data is unlawful but you do not wish for us to delete it, (c) where you need us to retain your data even when we no longer need it in order for you to establish, exercise, or defend legal claims, or (d) where you have objected the use of your data but we need to verify whether we have overriding legitimate grounds to use it;

- Request the transfer of your personal data (i.e. data portability) – This means you may request us to provide you with certain data we process about you so you may transfer it to another controller. This right only applies to data acquired through automated means which you initially provided consent for us to use, or where we used the data to perform our obligations under a contract with you;

- Withdraw your consent at any time where we rely on your consent to process the data. You may withdraw your consent at any time through the account profile settings on the website;

- Lodge a complaint with a supervisory authority;

In order to exercise your rights as explained above, we may need to request specific information about you to help us verify your identity. This is a security measure to ensure that we are certain that the person to whom we disclose your personal data is really you.

We will do our utmost to respond to all legitimate requests within a one-month timeframe from the submission of a request. If your request is particularly complex, or if you have made multiple requests in a certain time period, it may take us a little longer. In such a case, we will notify you of this extension.

Automated Decision Making

In establishing and carrying out our business relationship, we generally do not make use of fully automated decision making. If we use this procedure in individual cases, we shall inform you of this separately, provided it is a legal requirement.

Security of your Data

We hereby acknowledge that in collecting and processing your Personal Information for the purposes of managing your Player Account, we are bound by strict legal provisions on the protection of personal data.

Consequently, we endeavor to protect your personal information and respect your privacy in accordance with best business practices, applicable regulations and state of the art. Being committed to providing secure services to players, we will take all reasonable precautions to ensure that all the data that you have submitted to us remains safe.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthoriяed way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

Player Accounts can only be accessed with the player’s unique ID and password. You may also set up two-factor authentication (2FA) as additional protection from unauthorized use of your account. You are responsible for keeping your login information confidential and making sure it cannot be accessed by another person.