PRIVACY POLICY

3-102-949565 SOCIEDAD DE RESPONSABILIDAD LIMITADA | Last updated: 2026-06-17

winari.com (the "Website")

The English version prevails.

This Privacy Policy explains how Company collects, uses, stores, shares and protects personal data in connection with the Website and Services.

1. Who We Are

1.1 The data controller of your personal data is3-102-949565 SOCIEDAD DE RESPONSABILIDAD LIMITADA, a company registered in accordance with the Law of Costa Rica with the registered address at Province 01 San Jose, County 02 Escasu, San Rafael, Guachipelin, 400 Meters North of Construplaza, Latitud Norte Building, Third Floor, In the Offices of Quatro Legal, and company registration number 3-102-949565, which is licensed by the Tobique Gaming Commission since 13 Feb 2026 to offer services under license number 0000146 according to the TGC Gaming Act 2023*.*

1.2 For questions about this Privacy Policy or personal data processing, contact the Data Protection Officer at [email protected]

1.3 By visiting the Website, registering an Account or using the Services, you acknowledge that you have read and considered this Privacy Policy.

2. Definitions

Account means an account provided to you upon registration and acceptance of the Terms and Conditions. GDPR means the General Data Protection Regulation (EU) 2016/679, as amended, replaced or superseded where applicable. Services means the services provided through the Website. User, you or your means any person who registers an Account or accesses the Website.

3. Principles of Processing

3.1 We process personal data lawfully, fairly and transparently; for specified, explicit and legitimate purposes; only to the extent necessary; with reasonable efforts to keep data accurate and updated; and using appropriate technical and organisational security measures.

3.2 We comply with applicable data protection laws and statutory obligations as data controller, including obligations under gambling, AML/KYC, fraud prevention, responsible gambling, payment processing and regulatory reporting rules.

4. Personal Data We Process

4.1 Technical Data: IP address, device information, general communication data, browsing data, cookies, logs and preferences relating to the Website.

4.2 Registration and Operational Data: name and surname, email, telephone number, date of birth, residential address, nationality, login details, account status, payment details, transaction data, gameplay data, bonus data and customer support communications.

4.3 KYC/AML Data: proof of identity, proof of address, proof of payment method, selfie/biometric comparison data where used, source-of-funds and source-of-wealth evidence, sanctions/PEP/adverse media screening results, risk ratings, due diligence records, transaction monitoring alerts and investigation records.

4.4 Responsible Gambling Data: self-exclusion, time-out, deposit/loss/time limits, responsible gambling interactions, operator-imposed controls and indicators of potential problem gambling.

4.5 Any other personal data you provide directly in communications with us or that we are required or permitted to collect under law or regulatory requirements.

5. Purposes and Legal Bases

5.1 Contract performance: to provide and administer the Services, register and manage Accounts, process bets, deposits and withdrawals, provide support, and verify compliance with the Terms and Conditions.

5.2 Legal obligation: to comply with AML/KYC, sanctions, fraud prevention, tax, responsible gambling, age verification, payment, record keeping, regulatory reporting, complaints and law enforcement obligations.

5.3 Legitimate interests: to secure the Website, prevent fraud and abuse, manage risk, improve Services, maintain business records, enforce rights, manage complaints and communicate service-related information.

5.4 Consent: to send certain marketing communications, promotions and optional communications where consent is required. You may withdraw consent at any time without affecting processing already carried out and without this withdrawal being used as a basis to refuse the core Services, unless separate legal or regulatory grounds apply.

6. Recipients and Access to Data

6.1 We may provide access to or transmit personal data to hosting providers, IT and security providers, game providers, payment providers, crypto PSPs, data analytics providers, KYC/AML/sanctions/fraud prevention providers, customer support providers, marketing partners where permitted, group companies and professional advisers.

6.2 Personal data may be disclosed to the Tobique Gaming Commission, Direct Licensee, authorised external agencies, licensing and regulatory staff, auditors, courts, FIUs, law enforcement, tax authorities, payment schemes, fraud prevention networks and other authorities where required or permitted by law or regulatory requirements.

6.3 Personal data may also be disclosed to sporting bodies policing the integrity and rules of a sport or game where we have reasonable grounds to suspect breach of such rules, match-fixing, misuse of inside information, or threats to the integrity of the relevant sport or game.

6.4 Our data processors are required by contract to process personal data only on documented instructions and to maintain appropriate confidentiality, security and data protection controls.

7. International Transfers

7.1 Personal data may be transferred outside your country of residence and outside the European Economic Area, including to jurisdictions where the Tobique Gaming Commission, Direct Licensee, payment providers, game providers, hosting providers, KYC/AML providers or other service providers are located.

7.2 Where required by applicable law, we implement safeguards for international transfers, such as adequacy decisions, standard contractual clauses, contractual confidentiality obligations, technical security controls or other lawful transfer mechanisms.

8. Data Security and Confidentiality

8.1 We use appropriate organisational, technical and procedural security measures designed to protect personal data against unauthorised or accidental access, processing, deletion, alteration, disclosure or loss.

8.2 Personal data is processed by authorised personnel and service providers subject to confidentiality obligations. Access is granted on a need-to-know basis and is reviewed periodically.

8.3 Payment card data is handled in accordance with PCI DSS requirements where applicable. KYC/AML and transaction records are stored securely and protected against unauthorised alteration or deletion.

9. Retention

9.1 We retain personal data for as long as necessary for the purposes described in this Policy, including service provision, legal obligations, regulatory reporting, AML/KYC, fraud prevention, responsible gambling, dispute resolution and enforcement of rights.

9.2 KYC, CDD, official identification, account files, business correspondence, transaction records, originator/payer information and beneficiary/payee information are retained for at least five years after the business relationship ends or after the date of the occasional transaction, or longer where required by law, regulatory direction, investigation or litigation hold.

9.3 After the applicable retention period, personal data is deleted, anonymised or archived in accordance with applicable law and internal retention procedures.

10. Your Rights

10.1 Subject to applicable law and regulatory restrictions, you may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent.

10.2 Requests must be sent in writing to [insert email for support]. We may need to verify your identity before responding. Some rights may be limited where data must be retained for AML/KYC, fraud prevention, legal claims, regulatory reporting or public interest reasons.

11. Your Obligations

11.1 You must provide accurate, complete and up-to-date personal data. If your data changes, you must inform us promptly.

11.2 If you provide false, incomplete or misleading information, or if we reasonably suspect this, we may reject registration, suspend or terminate your Account, request additional documents, restrict transactions, or report the matter in accordance with the Terms and AML/KYC Policy.

12. Cookies

12.1 The Website uses cookies and similar technologies. For details, please review the Cookie Policy available on the Website.

13. Changes

13.1 We may amend this Privacy Policy. Material changes will be communicated to you where required, and the updated version will take effect when published on the Website unless otherwise stated.