TrueWin Privacy Policy: Ten Terms From the Notice, Explained for Players
Privacy notices are built from a small set of load-bearing words \- personal data, legal ground, retention, recipient \- and once those words are clear the whole document opens up. This page takes ten such terms from the Privacy Notice and Cookie Policy published by the operator behind TrueWin Casino and explains each in plain language, using only what the operator states and marking where it states nothing. It is a glossary with the platform’s own rules attached. The Notice applies to visitors and account holders alike, on the website and in the mobile application, and it is meant to be read with the terms. One term is missing from the ten because it belongs to a different document entirely, and it comes first: jurisdiction. Online betting and casino play are not permitted everywhere, and each person must independently confirm that such activity is lawful where they are before registering, depositing or playing.
Personal Data
In the operator’s definition, personal data is any information from which a person’s identity can practicably be worked out. A name qualifies obviously; a device identifier qualifies once it is tied to an account. The Notice groups the data it processes by origin. Supplied by the player: name, date of birth, nationality, address, passport or ID details with number and expiry date, a photograph or facial scan, email, phone, bank account and debit card numbers. Recorded by the systems: payments in and out, games played and their outcomes, customer-care conversations, geolocation, IP address, device ID, browser type and version, time zone, usage and referring websites. Received from third parties: transaction data, gameplay records from game vendors, geolocation from authorised providers, and identity and screening results from KYC and compliance providers. Because every customer must be over 21, the operator neither seeks nor wants data about minors.
Legal Ground
Every purpose the operator pursues rests on one of four grounds, and the Notice pairs them explicitly:
- Contract \- registering the player, delivering games and services, managing the account, contacting the player about winnings;
- Legal or regulatory duty \- eligibility checks on location, details and documents; verification under anti-money-laundering and counter-terrorist-financing law; disclosures to a regulator;
- Consent \- direct marketing about games and competitions, and notifications;
- Legitimate interests \- service optimisation, analytics, behaviour profiling, fraud detection, prevention of unlawful activity, identifying players who may be at risk.
Withhold data the service depends on, or withdraw consent for such processing, and the operator states it cannot provide that service. Consent for marketing, by contrast, is switched off without touching anything else \- a setting to revisit now and then.
Retention
The operator keeps data for as long as the purpose requires and for any minimum period the law imposes, whichever runs longer, and after that undertakes not to hold it in an identifiable form. No fixed periods in months or years are published on the official website. Why the hedge? Because anti-money-laundering duties can oblige the operator to keep certain records regardless of a player’s wishes, which is also why the right to erasure is expressly not a general one. A written request to the privacy address will say what is still held and on which ground.
Safeguards
Security is expressed as a commitment to all reasonable and practicable technical and organisational measures, and the part a player can see is the account: a username fixed at registration, a password of 8-20 characters combining upper and lower case letters, numbers and at least one symbol, and monitoring and recording of account use. The operator states that it never asks for bank details by email, text message or telephone… a single sentence that defeats most impersonation attempts on its own. The one safeguard fully in the player’s hands is a password used nowhere else.
Transfer
The operator describes itself as a global business that uses service providers abroad, so personal data may be transferred to other countries. Where that happens, the Notice promises protection and transfer in line with applicable legal and regulatory requirements; the destination countries are not named on the official website. Players who want to know which providers handle their data in a given case can ask through the privacy address, naming the transaction or service concerned.
Recipient
Recipients are named by category, and third parties acting for the operator are bound to similar and equally stringent undertakings of confidentiality. Data may go to:
- regulatory authorities and other entities with standing, where the law requires disclosure;
- trusted providers delivering something the player has requested, such as a payment provider handling a deposit;
- suppliers working on the operator’s behalf \- professional advisers, IT consultants, research and mailing houses;
- group and affiliated companies, for internal operations and, with consent, for marketing;
- any party to whom disclosure is required by law, an official investigation, enforcement of the terms, fraud or security protection, an emergency, or the safety and rights of others.
Selling personal data appears nowhere in the Notice.
Cookie
A cookie is a small text file placed on the device to keep a session alive, remember preferences and measure how the site is used. The Cookie Policy sorts them into four groups.
| Group | Purpose | Set by | Named examples | Adjustable |
|---|---|---|---|---|
| Strictly necessary | Navigation, login session, security, fraud prevention | Operator | session id, cookie\_consent | No |
| Performance | Anonymised statistics and error logs | Operator and third parties, e.g. Google Analytics | Not listed | Yes |
| Functionality | Language, region, user settings | Operator | Not listed | Yes |
| Targeting | Advertising across websites | Third parties, e.g. Meta, Google Ads, YouTube | \_fbp, \_gcl, \_au, IDE | Yes |
Management happens in the browser, and the policy links to the cookie settings of Chrome, Firefox, Safari and Edge. Block the wrong group and embedded videos may stop playing or the login may not persist \- a trade-off the operator states rather than hides.
Automated Decision
Some decisions are taken by systems rather than people, and the operator says so: whether an account can be opened, whether a player remains eligible on the information supplied, how activity looks from a responsible-gaming standpoint, fraud detection and profiling. These are presented as necessary for legal and regulatory compliance, with appropriate measures in place to safeguard the data involved. Whether a human review can be requested is not specified on the official website; questions about any such decision go to the privacy address, ideally with the username and the date of the decision.
Rights
Wherever it collects, uses or stores data, the operator lists the rights a player may have and confirms they are free of charge. The table sets each beside what to expect.
| Right | What it means in practice |
|---|---|
| To be informed and of access | To know that data is processed and to obtain details of it |
| To rectification | Correction of inaccurate or incomplete data |
| To erasure | Deletion where no compelling reason to keep the data remains, subject to exceptions |
| To restrict processing | Objecting to use, including direct marketing, honoured through a blocked list; refusal may be lawful in some cases |
| To data portability | The data in a structured, commonly used, machine-readable format |
| To complain and to withdraw consent | A complaint to a data protection regulator where one applies; consent withdrawn at any time without affecting earlier processing |
A request names the right invoked and includes enough account detail to confirm the sender \- the username, never the password. Where an exception covers part of it, the reply says which part and why. Once a year, even without a grievance, is a sensible rhythm for an access request.
Update
A revised Notice takes effect the moment it is uploaded, the operator commits to reasonable efforts to flag material changes by phone, email or social media, and continued use after a change counts as acceptance. The version on the site at any given moment is the one that applies, so the current text is worth a glance on each visit.
Two closing points sit outside the ten terms but inside the Notice. Children: every customer must be over 21, age is proven with identification documents before an account opens, underage play is treated as illegal, and an account found to enable it faces corrective action up to and including a report. Responsible play: personal data may be used to identify players who appear at risk and to contact them, by email or text reminder where notifications are enabled; deposit limits and self-exclusion are set from the account and a “Talk to us” link leads to the team, because gaming on TrueWin is entertainment with financial risk, never income. Privacy matters go to [email protected]; everything else to [email protected], live chat or the Help Center, where complaints are accepted around the clock. And the term that came first comes last: confirm that online betting or casino play is permitted in your own jurisdiction before registering, depositing or placing a wager.