Winboost Casino Privacy Notice

Who Controls Your Data, Cookie Choices and Complaints to the ICO

Brightlane Gaming Ltd, based in London, United Kingdom, is the data controller for personal data processed through winboost.io, and this notice is written under the UK GDPR and the Data Protection Act 2018. We use strictly necessary cookies to keep you signed in and to run the cashier, plus analytics cookies that measure page performance. Under the Privacy and Electronic Communications Regulations (PECR) we set non-essential cookies only after you accept them in the cookie notice, and you can withdraw consent at any time through the same notice or your browser settings. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, and we ask that you raise it with us first so we can try to resolve it.

Who We Share Your Data With

We share only the data each recipient needs. Payment providers, namely PayPal, Skrill, Neteller, Visa and Mastercard, receive your name, payment details and transaction amounts so that deposits and withdrawals can be processed. Crypto payments over the Bitcoin, Ethereum and Litecoin networks expose the wallet address and amount on the public ledger. Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Hacksaw Gaming, Play’n GO, Nolimit City and Microgaming receive a session identifier and account currency so that a round can run and be logged, and they do not receive your documents. The UK Gambling Commission and law enforcement receive data where the law requires it.

Where Your Data Travels, Your Rights and What We Collect

Some of our game studios and payment partners process data outside the UK. Where a recipient is in a country without UK adequacy regulations, we rely on the ICO International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

You have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have data erased where no legal duty requires us to keep it, to restrict or object to processing, and to receive your data in a portable format. We respond to a request within one month.

We collect registration data (name, date of birth, address, email address and password hash), payment data (method, amounts and transaction history), KYC documents (passport or UK photocard driving licence, and a utility bill, council tax bill or bank statement), gameplay and bonus history, and technical data such as IP address, device type, browser and server logs.

What Happens to Your Data After You Close Your Account

When an account is closed, we stop marketing to you immediately and remove the profile from active systems. Transaction records, KYC documents and gambling activity logs are kept for five years after the end of the relationship, because the Money Laundering Regulations 2017 and our licence conditions require it. Records tied to a self-exclusion are kept for the length of the exclusion so that we can enforce it. After the retention period, the data is deleted or anonymised.

How We Decide the Lawful Basis for Processing

Each purpose has one primary lawful basis under the UK GDPR, and we record which one applies before we start using the data.

How to Send a Personal Data Request

Send access, correction, erasure, objection or portability requests to [email protected] from the email address registered to the account, and state the right you are exercising. We may ask for a copy of your ID to confirm it is you, and the one-month response period starts when that check is done. If you use live chat, an agent will direct you to the same email process, because a written record keeps the request traceable.