Privacy Policy — How 6winr Protects Your Data

1 Data Controller Information

6winr operates as an internationally licensed online gaming platform serving the Bangladesh market. For the purposes of this Privacy Policy, 6winr is the data controller responsible for the personal data of all registered and unregistered visitors to the platform at 6winr.net and its associated mobile application.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data 6winr holds about you, you may contact our data protection team at any time:

• Email: [email protected]
• Subject line: "Privacy / Data Request — [Your Registered Username]"
• Response time: All privacy-related inquiries are acknowledged within 48 hours and resolved within 30 calendar days.

2 Personal Data We Collect

6winr collects personal data in three primary ways: information you provide directly when registering or using the platform, information generated automatically through your use of the platform, and information received from third-party service providers such as payment processors and identity verification services. The categories of data collected are detailed below.

Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address, email address, and mobile phone number.
• Identity verification (KYC) data: Copies of government-issued photo identification (national ID card, passport, or driving licence), proof of address documents, and selfie verification images where required.
• Payment data: Mobile wallet account references (bKash, Nagad, Rocket, Upay numbers registered in your name), bank account details for bank transfer methods, and card details for Visa or Mastercard transactions. Full card numbers are never stored on 6winr servers — they are tokenised by the relevant payment processor.
• Support communications: The content of emails, live chat transcripts, and any other messages you send to 6winr support, including any attachments you choose to share.
• Responsible gaming preferences: Self-exclusion requests, deposit limit settings, cooling-off period activations, and session reminder configurations.

Data Collected Automatically

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and mobile device identifiers.
• Usage data: Pages visited, time on page, navigation paths, game titles played, session duration, wager amounts and frequencies, and login timestamps.
• Location data: Approximate geographic location derived from IP address. 6winr does not collect precise GPS location data.
• Cookie data: Session identifiers, preference cookies, and analytics cookies as described in Section 6 of this policy.

Data from Third Parties

• Payment processors: Transaction confirmation status, reference numbers, and payment method verification outcomes received from bKash, Nagad, Rocket, banking institutions, and card scheme processors.
• Identity verification providers: Document authentication results and fraud-risk scores returned by third-party KYC service providers.
• Fraud and AML screening services: Politically exposed person (PEP) screening results and sanctions list check outcomes from compliance database providers.

Data Collection Summary Table

3 Legal Basis for Processing

6winr processes your personal data only where a valid legal basis exists. The applicable legal bases for our data processing activities are as follows:

• Contractual necessity: Processing required to create and operate your account, process deposits and withdrawals, settle wagers, and deliver the services you have contracted with 6winr to receive. Without this processing, we cannot provide the platform.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering (AML) regulations, age verification obligations, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing carried out for the purpose of fraud prevention, platform security, responsible gaming monitoring, improving our services, and conducting internal analytics — where these interests are not overridden by your privacy rights.
• Consent: Processing carried out only where you have given clear, informed, and freely withdrawable consent. This applies specifically to marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4 How We Use Your Data

The personal data collected by 6winr is used exclusively for the following purposes:

Account Operation

Your registration and KYC data is used to create and maintain your account, verify your identity and age, process deposits and withdrawals, track your wagering activity, and provide you with a personalised gaming experience. This processing is essential to the delivery of the 6winr service and cannot be opted out of while you hold an active account.

Payment Processing

Payment reference data is used solely to initiate, confirm, and record financial transactions between your mobile wallet or bank account and your 6winr balance. 6winr does not store raw payment credentials; all sensitive payment data is handled by the relevant payment processor under their own security frameworks.

Fraud Prevention & Security

Technical data including IP addresses, device identifiers, and behavioural patterns are analysed to detect unauthorised account access, duplicate account registration, collusion, and other forms of gaming fraud. This processing is carried out on the basis of 6winr's legitimate interests in maintaining a fair and secure platform for all players.

Responsible Gaming Monitoring

Gaming activity data — including session frequency, session duration, wager size, and deposit patterns — is monitored to identify players who may be exhibiting signs of problem gambling. Where concerning patterns are detected, 6winr may proactively reach out to offer support tools such as deposit limits or a cooling-off period. This processing is carried out in the interest of player welfare and is a core commitment of the 6winr platform.

Legal & Regulatory Compliance

KYC documentation, transaction records, and account activity logs are retained and, where required by law, disclosed to relevant authorities to fulfil 6winr's obligations under applicable anti-money laundering, counter-terrorism financing, and gaming regulatory frameworks.

Marketing Communications

With your prior consent, 6winr may use your email address and mobile number to send you promotional offers, seasonal bonus announcements (such as BPL season promotions or Eid bonus events), and platform news. Marketing communications are only sent to players who have explicitly opted in. Each communication includes a clear and functional unsubscribe mechanism.

Platform Improvement

Anonymised and aggregated usage data is analysed to understand how players navigate the platform, which games are most popular, and where technical improvements may be needed. This analysis does not involve personal identification and is used solely to enhance the 6winr experience for all players.

5 Data Sharing & Third Parties

6winr does not sell or rent your personal data to any third party. Your data is shared only in the limited circumstances described below, and only with parties who are contractually bound to handle it securely and in accordance with applicable data protection law.

Payment Service Providers

Transaction data is shared with our payment processing partners — including bKash, Nagad, Rocket, Upay, and partnered banking institutions — solely to facilitate the processing of deposits and withdrawals. Each payment provider operates under its own privacy policy and data security framework.

Identity & Compliance Vendors

Where required for KYC verification or AML screening, document images and personal details may be shared with specialist third-party identity verification and compliance screening services. These vendors are bound by strict data processing agreements and are prohibited from using your data for any purpose other than the verification or screening task for which it was shared.

Game Providers

To facilitate gameplay in games supplied by providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, 6winr transmits a unique player session token to the relevant provider's game server. This token does not include your name, address, or payment details — it is an anonymised session reference that allows the game to function correctly and results to be recorded in your account.

Legal Authorities

6winr will disclose personal data to law enforcement, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or binding regulatory instruction. In such cases, 6winr will disclose only the minimum data necessary to satisfy the legal requirement.

Business Transfers

In the event of a merger, acquisition, or sale of all or part of 6winr's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified in advance of any such transfer by email, and the acquiring entity will be required to honour the terms of this Privacy Policy.

6 Cookies & Tracking Technologies

6winr uses cookies and similar tracking technologies on the platform to ensure it functions correctly, to keep you securely logged in, and to understand how the platform is used. A cookie is a small text file placed on your device by the website. The cookies used by 6winr fall into the following categories:

Managing Your Cookie Preferences

You may manage non-essential cookie preferences through your browser settings. Most modern browsers — including Chrome, Firefox, Safari, and Edge — allow you to view, block, or delete cookies stored by websites. Please note that disabling functional cookies may affect the quality of your experience on the 6winr platform, and disabling strictly necessary cookies will prevent you from logging in or completing transactions.

6winr does not use third-party advertising cookies or social media tracking pixels. No cross-site tracking of your browsing activity outside of 6winr.net is conducted by 6winr or on 6winr's behalf.

7 Data Retention Periods

6winr retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted from all active systems and backup archives. Where full deletion is not technically feasible within a single cycle — for example, data held in offline backup tapes — the data is isolated, access-restricted, and scheduled for deletion at the next available backup rotation.

8 Data Security Measures

6winr takes the security of your personal data seriously and implements a layered set of technical and organisational security controls to protect it against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Encryption in transit: All data transmitted between your device and 6winr's servers is encrypted using TLS 1.3, the current industry-leading transport security standard.
• Encryption at rest: Personal data stored on 6winr servers is encrypted using AES-256 encryption. This includes account records, KYC documents, and transaction logs.
• Access controls: Access to personal data within 6winr's internal systems is restricted on a strict need-to-know basis. Staff access is role-based, logged, and regularly reviewed. No employee has unrestricted access to the full dataset.
• Two-factor authentication: All internal staff systems that access personal data require multi-factor authentication. Players are strongly encouraged to enable 2FA on their own accounts.
• Penetration testing: 6winr's platform and infrastructure undergoes regular security assessments, including penetration testing by qualified third-party security professionals.
• Incident response: 6winr maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights, affected players will be notified promptly and, where required, the relevant supervisory authority will also be notified within the legally required timeframe.
• Third-party vendor security: All third-party vendors with access to personal data are required to maintain security standards equivalent to or exceeding those described in this policy, as a condition of their service agreements with 6winr.

9 Your Privacy Rights

Depending on the jurisdiction from which you access the 6winr platform and the legal basis on which your data is processed, you may hold some or all of the following privacy rights. 6winr honours all of these rights for Bangladesh-based players in full:

• Right of Access: You have the right to request a copy of all personal data 6winr holds about you, along with information about how it is used, where it came from, and with whom it has been shared. Requests are processed within 30 calendar days.
• Right to Rectification: If any personal data 6winr holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update some data directly in your Account Settings; for data that cannot be self-edited, contact [email protected].
• Right to Erasure: In certain circumstances, you have the right to request that 6winr deletes your personal data. This right is subject to overriding legal obligations — for example, 6winr is legally required to retain transaction records and KYC documentation for defined periods even after account closure. Where erasure is possible, it will be completed within 30 days of a valid request.
• Right to Restriction of Processing: You may request that 6winr restricts processing of your personal data in specific circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where data is processed on the basis of your consent or a contractual necessity, you have the right to receive your personal data in a structured, machine-readable format (such as CSV or JSON) for transfer to another service.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring or fraud prevention. 6winr will assess the objection and cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

How to Exercise Your Rights

To exercise any of the above rights, contact 6winr's data protection team at [email protected] with the subject line "Privacy Rights Request — [Your Registered Username]". To protect your privacy, we will verify your identity before processing any request. Verification typically involves confirming details linked to your registered account.

All valid requests will be acknowledged within 48 hours and fulfilled within 30 calendar days. Where a request is complex or involves a large volume of data, this period may be extended by a further 30 days; you will be informed if such an extension is necessary.

10 International Data Transfers

6winr operates as an international platform, and some of the third-party service providers used by the platform — including game providers such as Pragmatic Play and Evolution Gaming, and certain identity verification or analytics vendors — may process personal data in countries outside Bangladesh.

Where personal data is transferred internationally, 6winr ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. These safeguards may include:

• Standard contractual clauses (SCCs) approved under international data protection frameworks.
• Binding corporate rules applicable to the receiving organisation's group-wide operations.
• Data processing agreements that impose obligations on the recipient equivalent to those applicable within 6winr's primary operating jurisdiction.

By using the 6winr platform and accepting this Privacy Policy, you acknowledge that your personal data may be processed in jurisdictions outside your country of residence as part of the normal operation of the platform.

11 Children's Privacy

The 6winr platform is strictly for adults aged 18 years and above. 6winr does not knowingly collect personal data from individuals under the age of 18. All players are required to declare their age at registration, and 6winr applies active age verification measures to enforce this restriction.

If you are a parent or guardian and believe that a minor has accessed the 6winr platform or submitted personal data without your consent, please contact us immediately at [email protected]. Upon confirmation, 6winr will immediately close the account, void all associated activity, and securely delete all personal data relating to the underage individual as quickly as technically possible.

12 Changes to This Privacy Policy

6winr reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

For material changes — those that meaningfully affect how your personal data is collected, used, or shared — registered players will be notified by email to the address on file at least 14 days before the change takes effect. Continued use of the 6winr platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to remain informed about how 6winr protects your personal data. If you have any questions about a recent change, contact our team at [email protected].