Privacy Policy

This Privacy Policy explains how your personal data is collected and used when you visit or use the online gambling services offered under the project Mobile Wins on the website winsmobile.com. It applies to players, prospective players, and other visitors to winsmobile.com who interact with our services, whether via desktop, mobile, or other devices. Please read it carefully before using our services. This Privacy Policy is effective from 6 November 2025.

Who We Are

The online gambling services for the project Mobile Wins on winsmobile.com are operated by ProgressPlay Limited ("ProgressPlay", "we", "us", "our"). ProgressPlay Limited is the data controller responsible for processing your personal data in connection with the Mobile Wins brand available on winsmobile.com for players in the United Kingdom.

Operator and legal entity
ProgressPlay Limited
Registered office: Soho Office, 3A, Punchbowl Centre, Elia Zammit Street, St. Julians, STJ3154, Malta
Legal form: Limited liability company incorporated in Malta
Primary gambling licence: United Kingdom Gambling Commission (UKGC) Remote Operating Licence no. 39335 (casino and related online gambling activities for, among others, the Mobile Wins brand on winsmobile.com).

ProgressPlay Limited operates winsmobile.com under the oversight of the UK Gambling Commission and must comply with UK gambling and anti-money-laundering rules, including enhanced Know Your Customer (KYC) and financial crime controls that may affect how we process your personal data.

Data Protection Officer (DPO) / privacy contact
If you have any questions about this Privacy Policy or how we process your personal data, you can contact our Data Protection Officer (DPO) or data protection team using the following details:

Email: privacy@winsmobile.com
Postal address: Data Protection Officer, ProgressPlay Limited, Soho Office, 3A, Punchbowl Centre, Elia Zammit Street, St. Julians, STJ3154, Malta

These contact details can be used for all privacy-related queries, including exercising your data subject rights, making complaints, or requesting further information about this Privacy Policy.

What Personal Data We Collect

We collect and process personal data that is necessary to provide our gambling services on winsmobile.com, to comply with legal and regulatory obligations, and to operate our business safely and responsibly. Depending on how you use our services, we may collect the following categories of personal data:

Identification and contact data

Identity details: full name, username, date of birth, nationality, gender, and copies or details of identification documents (such as passport, national ID card, driving licence) used for age verification and KYC checks.
Contact details: residential address, billing address, email address, telephone number, and communication preferences.

Account and verification data

Account information: player ID, account registration data, login history, account status (active, suspended, self-excluded, closed), responsible gambling settings and limits.
KYC and AML information: proof of address, source-of-funds and source-of-wealth information, occupation details, bank or payment method ownership evidence, and any additional documentation requested under UKGC and anti-money-laundering (AML) rules.

Payment and transactional data

Payment details: limited payment instrument details (such as masked card numbers or payment wallet identifiers), payment method type, issuer country, and related metadata. We do not store full card numbers in plain text.
Transaction data: deposits, withdrawals, bonus credits, wagering amounts, wins, losses, balance history, chargebacks, and other financial operations carried out on your account.

Technical and device data

Technical data: IP address, device identifiers, browser type and version, operating system, time zone setting, language settings, approximate location derived from your IP, and similar technical data collected when you access winsmobile.com.
Log and security data: access logs, login attempts, device fingerprinting data (where used), session IDs, and security-related event logs used to monitor and protect our systems and your account.

Usage and behavioural data

Gameplay and betting behaviour: games played, betting history, stakes, duration of sessions, session frequency, win/loss patterns, and responsible gambling indicators (e.g., cooling-off periods, time-outs, self-exclusion).
Website and app usage: pages visited, clicks, navigation paths, time spent on sections of the site, interaction with banners and promotions, and response to in-site messages.

Marketing and communication data

Marketing preferences: your choices regarding receiving marketing communications (email, SMS, push notifications, in-account messages) and records of consent or opt-out.
Communication history: records of emails, live chat transcripts, support tickets, complaints, and other correspondence with our customer support, responsible gambling team, or DPO.

Cookies and similar technologies

Cookies: small text files stored on your device, including strictly necessary, functional, analytics, and advertising cookies that help us remember your preferences, secure your sessions, and analyse how winsmobile.com is used.
Similar technologies: web beacons, pixels, tags, local storage, and SDKs used for analytics, fraud detection, and personalisation, including technologies provided by carefully selected third parties.

We may combine information from different sources (for example, registration data, gameplay data, and AML checks) to comply with regulatory obligations, detect fraud, support responsible gambling, and improve the services on winsmobile.com.

Legal Basis for Processing

We process your personal data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations ("PECR"), and, where applicable, the EU GDPR and relevant non-UK privacy laws. Our main legal bases are:

Performance of a contract

Providing our services: We process your identification, contact, account, payment, and gameplay data to create and manage your account on winsmobile.com, enable deposits and withdrawals, operate casino games, credit winnings, and provide customer support.
Executing promotions: We use your data to apply bonuses, loyalty rewards, and other offers that you are eligible for under our terms and conditions.

Compliance with legal and regulatory obligations

Gambling regulation and AML: As a UKGC-licensed operator, we must comply with the UK Gambling Commission's Licence Conditions and Codes of Practice, UK anti-money-laundering laws, counterterrorist financing rules, and other regulatory obligations. This requires KYC checks, ongoing monitoring of player behaviour, affordability assessments, record keeping, and reporting to authorities.
Tax, accounting and reporting: We maintain transactional and financial records for statutory retention periods and provide information to tax or regulatory bodies where required.
Responsible gambling: We process data to identify and interact with players who may be at risk of gambling-related harm, in line with regulatory expectations.

Legitimate interests

Service security and fraud prevention: We use technical, account, and behavioural data to prevent fraud, detect suspicious activity, protect the integrity of games, and ensure network and information security.
Business analytics and service improvement: We analyse aggregated and pseudonymised data to understand performance, improve user experience, and optimise our offerings on winsmobile.com.
Establishing and defending legal claims: We may retain and use personal data where necessary to establish, exercise, or defend legal claims or regulatory investigations.

Consent

Marketing communications: We rely on your consent to send electronic direct marketing (such as promotional emails or SMS) where required under PECR and similar regulations. You can withdraw your consent at any time.
Non-essential cookies and analytics: We rely on your consent for non-essential cookies and similar technologies that are not strictly necessary for the functioning of winsmobile.com, as explained in the Cookies & Tracking Technologies section.

Other grounds

Vital interests and public interest: In rare cases, we may process data to protect your vital interests or those of another person (for example, where there is a serious and imminent risk of harm) or to support public interest functions such as serious crime prevention.

Purpose of Processing

We use your personal data for clearly defined purposes and only where we have a lawful basis. The main purposes include:

Providing and managing your account: to register you as a player on winsmobile.com, verify your age and identity, maintain your profile, administer your balance, track your gameplay, and ensure that you can access and use our casino services.
Processing payments and transactions: to handle deposits, withdrawals, chargebacks, refunds, and bonus credits, and to maintain accurate records for accounting and regulatory purposes.
Compliance, KYC, and AML: to carry out mandatory KYC checks, source-of-funds and affordability assessments, monitor for suspicious or high-risk activity, and comply with reporting obligations to regulators and law enforcement.
Responsible gambling and player protection: to monitor betting patterns and session behaviour, apply limits, time-outs and self-exclusion, and intervene where there are indicators of potential harm in line with UKGC expectations.
Improving our services: to analyse how players use winsmobile.com, evaluate game performance, detect technical issues, and improve usability, reliability, and overall service quality.
Marketing and personalisation (with appropriate legal basis): to send you promotions, newsletters, and personalised offers based on your preferences and lawful profiling, and to manage your opt-in and opt-out choices.
Security and fraud prevention: to protect player accounts, prevent unauthorised access, detect and investigate fraud, bonus abuse, money laundering, or other misuse of our services.
Customer support and dispute management: to respond to queries, process complaints, resolve disputes (including with alternative dispute resolution bodies such as IBAS), and maintain service quality.
Legal, regulatory and business requirements: to comply with laws, enforce our terms and conditions, manage risks, conduct audits, and support corporate governance and business continuity.

Disclosure & Sharing

We treat your personal data as confidential and only share it with third parties where necessary, proportionate, and supported by a legal basis. When we share data, we implement appropriate contractual and technical safeguards, including data processing agreements and security requirements.

Service providers and technical partners

IT and hosting providers: companies providing hosting, cloud services, data storage, maintenance, and technical support for winsmobile.com and related systems.
Game providers and platform partners: suppliers whose casino games you play via winsmobile.com and platform partners that support game delivery, only to the extent necessary to operate and monitor game performance and compliance.
Payment processors and banking partners: payment service providers, card schemes, banks, and wallet providers that process your deposits, withdrawals, chargebacks, and financial transactions.
Analytics, security and anti-fraud providers: tools and services for fraud detection, risk scoring, device fingerprinting, geolocation checks, and analytics, used to keep our services secure and compliant.

Compliance, regulators and authorities

Regulators: the UK Gambling Commission and, where applicable, other supervisory bodies that oversee gambling, AML compliance, or data protection. We may share data as part of licence conditions, reporting obligations, inspections, or regulatory investigations.
Law enforcement and government bodies: police, tax authorities, and other public authorities where required by law or necessary to prevent or detect crime, fraud, or other illegal activities.
Alternative dispute resolution (ADR) bodies: where a gambling dispute is referred to an ADR provider such as the Independent Betting Adjudication Service (IBAS), we may share relevant personal and transactional data so that the dispute can be investigated.

Group companies and business partners

Affiliates and marketing partners: carefully selected partners who refer players to winsmobile.com or provide marketing services. Where required, data sharing for marketing purposes is based on your consent and subject to appropriate safeguards.
Corporate transactions: in the event of a merger, acquisition, restructuring, or sale of assets, we may share data with prospective or actual buyers and relevant advisers, subject to confidentiality obligations and compliance with data protection law.
Professional advisers: auditors, lawyers, consultants, and other professionals who require access to personal data to provide services to us, bound by confidentiality obligations.

We do not sell your personal data in exchange for money. We may share aggregated or anonymised information (which does not identify you) with third parties for analytics, reporting, or business purposes.

International Transfers

ProgressPlay Limited is based in Malta and operates winsmobile.com for players in the United Kingdom. Your personal data may therefore be processed in Malta, the UK, the European Economic Area (EEA), and in certain cases in countries outside the UK and EEA.

Transfers within the UK and EEA: Transfers between the UK and EEA (including Malta) are carried out in compliance with the UK GDPR and EU GDPR, using appropriate mechanisms where required.
Transfers to countries with adequacy decisions: Where we transfer data from the UK or EEA to a country that benefits from an adequacy decision (for example, where the UK Government or European Commission has recognised that country's data protection laws as essentially equivalent), we rely on that adequacy decision.
Transfers to other third countries: If we transfer data to countries that do not benefit from an adequacy decision, we implement appropriate safeguards, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission, together with the UK International Data Transfer Addendum or the UK International Data Transfer Agreement where applicable;
- Additional technical and organisational measures, such as encryption in transit and at rest, access controls, and data minimisation; and
- Transfer impact assessments to evaluate the level of protection in the destination country.

In all cases, we ensure that your personal data remains protected in line with UK GDPR standards, and we only transfer data internationally where it is necessary to provide our services, comply with legal obligations, or operate our business securely (for example, by using international cloud providers or specialist fraud-prevention tools).

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to comply with legal, regulatory, accounting, and reporting obligations, and to resolve disputes. Retention periods may vary depending on the category of data and applicable legal requirements, particularly under gambling and AML regulations.

Player account and identification data: retained for the duration of your active account and, after account closure, typically for up to 5 years, or longer where required by law (for example, for AML or regulatory purposes).
KYC and AML documentation: copies of identity documents, proof of address, source-of-funds information, and related records are generally kept for at least 5 years after the end of the business relationship or the date of the last transaction, and may be retained for up to 7 years where required by regulators or law enforcement.
Transactional and payment data: deposit, withdrawal, and gameplay transaction records are kept for the period required under tax, accounting, and gambling regulations, typically up to 7 years from the end of the relevant financial year.
Responsible gambling and risk data: information relating to self-exclusion, limits, risk assessments, interventions, and outcomes is retained for as long as necessary to comply with responsible gambling rules, usually at least for the duration of any exclusion and for several years thereafter.
Marketing and communication data: records of your marketing preferences and communications may be retained while you engage with our marketing and for a reasonable period after you opt out (so we can maintain a suppression list and demonstrate compliance), generally up to 5 years after your last interaction or until you request deletion where permitted.
Technical logs and security data: logs relating to system security, access, and fraud prevention are kept for periods needed to investigate incidents, support legal claims, and meet regulatory expectations, typically between 1 and 5 years, depending on the specific log type.

When data is no longer required, we either securely delete or irreversibly anonymise it so that it can no longer be associated with you. In some cases, we may retain limited data (for example, account ID and exclusion status) to comply with legal obligations or to ensure that self-exclusion requests are respected.

Your Rights

Under the UK GDPR and, where applicable, the EU GDPR and relevant non-UK laws, including Mexican privacy law, you have a number of rights in relation to your personal data. Some rights are not absolute and may be subject to legal exemptions and limitations, particularly in the context of regulated gambling and AML requirements.

Rights under UK and EU data protection law

Right to be informed: to receive clear and transparent information about how we use your personal data, which this Privacy Policy is designed to provide.
Right of access: to request confirmation of whether we process your personal data and to receive a copy of that data, together with information about how it is used.
Right to rectification: to have inaccurate personal data corrected and incomplete data completed.
Right to erasure ("right to be forgotten"): to request deletion of your personal data where there is no compelling reason for us to continue processing it, for example where you withdraw consent and no other legal basis applies. Due to gambling and AML regulations, we may be required to retain certain data for specific periods and may not always be able to erase it immediately.
Right to restriction of processing: to request that we limit the processing of your data in certain circumstances (for example, while we verify its accuracy or assess an objection).
Right to object: to object to the processing of your personal data where we rely on legitimate interests, including profiling for risk management or business analysis. You also have an absolute right to object to processing for direct marketing purposes at any time.
Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and to have that data transmitted to another controller where technically feasible and legally permitted.
Rights related to automated decision-making: to request human intervention and to contest decisions that are based solely on automated processing, where such decisions have legal or similarly significant effects (for example, certain risk or affordability assessments). Some decisions may still be required by law or regulation.
Right to withdraw consent: where we rely on your consent (for example, for certain marketing or cookie activities), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our DPO using the contact details in the "Who We Are" or "Complaints & Contacts" section. We may need to request specific information to confirm your identity and to ensure that personal data is not disclosed to an unauthorised person.

We aim to respond to all legitimate requests within 30 days of receipt and will provide the information free of charge, unless your request is manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse to act, as permitted by law). If we require more time due to complexity or volume, we will inform you and may extend the response period by up to a further 60 days, as allowed under the UK GDPR.

Alignment with Mexican privacy law

Where Mexican data protection law applies (for example, in relation to individuals in Mexico whose data is processed in connection with winsmobile.com), we also take into account the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and related regulations and guidelines.

ARCO rights: under Mexican law, data subjects have rights of Access, Rectification, Cancellation, and Opposition (ARCO), which in practice overlap closely with the GDPR rights of access, rectification, erasure, and objection.
Consent and revocation: Mexican law emphasises consent for certain processing activities and provides a right to revoke consent. Our approach to consent and withdrawal of consent for marketing and other non-essential processing is intended to be consistent with these principles.
Limiting use or disclosure: individuals may request that their data use or disclosure be limited, and we will assess such requests in light of both Mexican requirements and our obligations under gambling and AML regulations.

We respond to rights requests within a period that is at least as protective as the timelines under applicable Mexican law, while generally aiming to meet the 30-day timeframe described above. If local law prescribes a shorter maximum response time, we will seek to comply with that shorter period where technically and legally feasible.

Cookies & Tracking Technologies

We use cookies and similar tracking technologies on winsmobile.com to operate the site, enhance your experience, analyse performance, and deliver relevant content. Cookies are small text files stored on your device. Some cookies are placed by us (first-party cookies) and others by third parties (for example, analytics or advertising providers).

Types of cookies we use

Strictly necessary cookies: essential for the functioning of winsmobile.com and to provide the services you request, such as enabling secure login, maintaining sessions, and processing transactions. These cookies cannot be switched off in our systems, and you cannot use the site without them.
Functional cookies: used to remember your preferences (language, region, display settings), to provide enhanced features, and to improve your overall experience.
Analytics and performance cookies: used to collect information about how visitors use winsmobile.com, such as which pages are visited most often and whether users encounter error messages. This helps us measure and improve site performance. These cookies are often set by third-party analytics providers.
Advertising and targeting cookies: used to deliver personalised advertising and promotions, measure the effectiveness of campaigns, and limit how often you see certain offers. These may be set by us or by third-party advertising networks.

Cookie duration

Session cookies: temporary cookies that are deleted when you close your browser.
Persistent cookies: remain on your device for a specified period or until you delete them, and help us recognise you when you return to winsmobile.com.

Managing cookies and tracking

Consent management: where required by PECR and similar laws, we will ask for your consent before placing non-essential cookies (such as analytics and advertising cookies). You can change your cookie preferences at any time through our cookie banner or internal preference centre, where available.
Browser settings: you can configure your browser to refuse some or all cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of winsmobile.com may not function properly, and certain services may be unavailable.
Third-party technologies: third-party providers may use their own cookies or similar technologies in connection with our services. These are subject to the privacy and cookie policies of those providers, and we encourage you to review them where relevant.

Data Security

We take the security of your personal data very seriously and implement technical and organisational measures designed to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage. While no system can be guaranteed to be 100% secure, we continually assess and improve our security posture in line with industry standards and regulatory expectations.

Technical measures

Encryption: data transmitted between your browser and winsmobile.com is protected using Transport Layer Security (TLS) version 1.2 or higher. Where feasible, we also encrypt personal data at rest, especially in databases and backups containing sensitive information.
Access controls: we implement strict access controls, ensuring that only authorised personnel and service providers with a legitimate need can access personal data. Access is role-based and regularly reviewed.
Network and application security: we use firewalls, intrusion detection and prevention systems, anti-malware tools, and secure coding practices. We monitor our infrastructure and applications for suspicious activity and vulnerabilities.
Backup and resilience: we maintain secure backups and disaster recovery procedures to help ensure business continuity and data integrity.

Organisational measures

Policies and governance: we maintain internal policies and procedures governing information security, data protection, and incident management, aligned with recognised frameworks and industry best practices.
Training and awareness: employees and contractors with access to personal data receive regular training on data protection, information security, and responsible gambling obligations.
Vendor due diligence: we assess the security and data protection practices of key third-party providers and include appropriate contractual safeguards, including data protection and security clauses.
Audits and assessments: we carry out periodic security assessments, including vulnerability scans and, where appropriate, penetration tests. We aim to align our controls with international standards such as ISO 27001 and SOC 2 where applicable.

Incident response

Breach detection and response: we maintain procedures to detect, investigate, and respond to potential security incidents and personal data breaches.
Notification: where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, inform you without undue delay, in accordance with UK GDPR and other applicable laws.

Complaints & Contacts

If you have questions, concerns, or complaints about how we process your personal data in relation to winsmobile.com and the project Mobile Wins, please contact us first so we can try to resolve the issue directly.

How to contact us

Email (primary contact): privacy@winsmobile.com
Postal address: Data Protection Officer, ProgressPlay Limited, Soho Office, 3A, Punchbowl Centre, Elia Zammit Street, St. Julians, STJ3154, Malta

Internal complaint procedure

Submit your complaint: send us a detailed description of your concern, including any supporting documentation, using the email or postal address above.
Acknowledgement: we will acknowledge receipt of your complaint as soon as reasonably practicable, typically within a few working days.
Investigation: your complaint will be reviewed by our DPO or an appropriate member of our data protection or compliance team. We may contact you if we require additional information.
Response: we aim to provide a substantive response within 30 days of receiving your complaint. If the matter is complex or involves extensive investigation, we may need more time; in such cases, we will keep you informed of progress and provide an updated timeline.
Further steps: if you remain dissatisfied, you may escalate your complaint to the relevant supervisory authority, as described below.

Supervisory authorities and escalation

United Kingdom - Information Commissioner's Office (ICO): If you are in the UK or your issue relates to UK data protection law, you have the right to lodge a complaint with the ICO:
- Website: https://ico.org.uk/
- Telephone (UK): +44 303 123 1113
- Postal: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Mexico - National Institute for Transparency, Access to Information and Personal Data Protection (INAI): If Mexican data protection law applies to you and you are not satisfied with how we handle your personal data, you may contact INAI:
- Website: https://home.inai.org.mx/ (Spanish)
Other EEA or EU supervisory authorities: If the EU GDPR applies to your situation (for example, if you are located in the EEA), you may also lodge a complaint with your local data protection authority.

In addition, for gambling-related disputes concerning transactions or gaming outcomes on winsmobile.com, you may refer your complaint to the Independent Betting Adjudication Service (IBAS) or another ADR body as indicated in our terms and conditions. Such gambling complaints may involve the processing of your personal data, and we may need to share relevant information with the ADR provider to resolve the dispute.

Updates

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, regulatory guidance, or technical developments affecting winsmobile.com. When we make changes, we will revise the "Last updated" date at the end of this Privacy Policy and, where appropriate, provide additional notice.

How we will inform you of changes

On-site notices: we may display banners, pop-up notices, or other on-site messages on winsmobile.com to inform you of material changes.
Email notifications: where changes are significant or where required by law, we may notify you by email using the contact details associated with your account.
Account dashboard alerts: we may post notifications in your player account area to draw your attention to key updates.

Effective date and advance notice

Advance notice for significant changes: for material changes that significantly affect how we process your personal data, we will, where reasonably practicable, provide at least 30 days' prior notice before the changes become effective.
Your choices: if you do not agree with the updated Privacy Policy, you may close your account and stop using winsmobile.com. We will continue to process personal data as necessary to comply with legal obligations and to resolve any outstanding matters, even after account closure.
Historical versions: previous versions of this Privacy Policy may be available on request for reference and transparency.

Last updated: November 2025.