corewin Privacy Policy

Section 1

Data We Collect

When you register and use your corewin account, we collect personal data in several ways — information you provide directly to us, data generated automatically by your use of the platform, and in some cases information received from trusted third-party identity verification partners. The following sections describe each category in detail.

1.1 Registration and Account Data

When you create a corewin account, you are required to provide certain personal information. This includes your full legal name, date of birth, residential address, email address, and a valid mobile phone number registered in Bangladesh. This information is used to create your account, verify your identity , process transactions, and communicate with you about your account activity. Providing accurate registration data is a condition of using the platform — submitting false information constitutes a breach of the corewin Terms & Conditions.

1.2 Identity Verification (KYC) Documents

Before processing your first withdrawal, corewin is required to verify your identity in accordance with our Know Your Customer (KYC) obligations. This involves requesting a copy of a government-issued photo identity document — such as your Bangladesh National Identity Card (NID), passport, or driving licence — and in some cases a recent utility bill or bank statement confirming your residential address. These documents are handled with the strictest confidentiality and accessed only by authorised compliance staff.

1.3 Financial and Payment Data

To facilitate deposits and withdrawals, corewin collects information about the payment methods you use. This includes your bKash, Nagad, Rocket, or Upay mobile wallet numbers, or Visa/Mastercard card details where applicable. Full payment card numbers are never stored on corewin servers — card transactions are processed exclusively through certified payment gateways that handle sensitive card data under their own PCI DSS compliance frameworks. We retain records of transaction amounts, dates, and payment method references for account management and regulatory purposes.

1.4 Platform Usage Data

As you interact with the corewin platform, we automatically collect technical and behavioural data about your activity. This includes your IP address, device type, operating system, browser type and version, screen resolution, session duration, pages viewed, games played, bets placed, wager amounts, and the sequence of actions taken during each session. This data is used to maintain platform security, detect fraudulent activity, personalise your experience, and improve our services over time.

Data Category	Examples	Purpose
Registration Data	Name, date of birth, email, phone number, address	Account creation, identity verification, communications
KYC Documents	NID scan, passport copy, address proof	Identity verification, fraud prevention, AML compliance
Payment Data	bKash / Nagad number, card reference, transaction history	Deposit and withdrawal processing, transaction records
Usage Data	IP address, device type, session logs, betting history	Security monitoring, fraud detection, service improvement
Communications Data	Support chat transcripts, emails, submitted forms	Customer support, dispute resolution, quality assurance
Marketing Preferences	Opt-in/opt-out status, promotion interaction history	Sending relevant offers (where consent given), suppression list management

Section 2

How We Use Your Data

corewin processes your personal data for a number of distinct purposes, each grounded in a lawful basis. We rely primarily on contractual necessity (to deliver the services you have signed up for), legal obligation (to meet our compliance requirements), and legitimate interests (to maintain platform security and improve our offering). Where we rely on your consent — for example, to send you marketing communications — you may withdraw that consent at any time.

2.1 Delivering Platform Services

The primary purpose for which we process your personal data is to provide the corewin platform to you. This includes creating and managing your account, accepting and processing deposits, settling winning bets and casino payouts, executing withdrawal requests to your registered payment method, and responding to customer support enquiries. Without processing your personal data for these purposes, we cannot provide you with a corewin account or any of the associated services.

2.2 Identity Verification and Fraud Prevention

corewin processes your registration details and KYC documents to verify that you are who you claim to be, that you meet the minimum age requirement of 18 years, and that you are not on any self-exclusion or sanctions list. Your usage data — including IP address, device fingerprinting, and session behaviour — is also analysed to detect unusual patterns that may indicate fraudulent activity, account sharing, bonus abuse, or attempted money laundering. This processing is carried out in corewin's legitimate interests and in fulfilment of legal obligations.

2.3 Responsible Gaming Monitoring

corewin takes its responsible gaming obligations seriously. We use your betting history, session frequency, deposit patterns, and account activity data to monitor for indicators of problem gambling behaviour. Where our systems or support staff identify concerning patterns, we may proactively reach out to you with information about responsible gaming tools, or in some cases apply protective restrictions to your account in accordance with our Responsible Gaming policy.

• Account creation, management, and authentication.
• Processing deposits, withdrawals, and bet settlements in BDT.
• KYC identity and age verification before withdrawal release.
• Fraud detection, security monitoring, and bot identification.
• Anti-money-laundering (AML) screening and transaction monitoring.
• Responsible gaming monitoring and player protection interventions.
• Sending transactional communications (deposit confirmations, withdrawal updates, security alerts).
• Sending promotional communications where you have given consent to receive them.
• Platform analytics and service improvement.
• Legal compliance and responding to lawful authority requests.

Section 3

Data Sharing and Third Parties

corewin does not sell your personal data to any third party under any circumstances. However, in order to operate the platform and fulfil our legal obligations, we necessarily share certain data with a limited set of trusted third-party service providers and, where legally required, with regulatory or law enforcement authorities. Every third party that receives data from corewin is subject to strict contractual obligations requiring them to handle that data securely and to use it only for the specific purpose for which it was shared.

3.1 Payment Processing Partners

To process deposits and withdrawals, corewin shares the minimum necessary payment data with our licensed payment processing partners, including the mobile financial service providers bKash, Nagad, Rocket, and Upay, as well as Visa and Mastercard processing networks. These partners receive only the transaction data required to execute the specific payment and are contractually bound to process it solely for that purpose.

3.2 Game Technology Providers

The casino games and sports betting technology powering the corewin platform are supplied by certified third-party providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. These providers may receive a player session token and anonymised account identifier when you launch a game, but they do not receive your full personal profile, payment details, or KYC documents. Game provider data handling is governed by their own privacy policies and compliance frameworks.

3.3 Identity Verification Services

corewin may engage specialist identity verification service providers to assist in processing KYC documentation submitted by players. Where used, these providers receive a copy of the identity document and the name/date-of-birth details provided at registration for the sole purpose of verification. They are prohibited from retaining, sharing, or using this data for any other purpose.

3.4 Legal and Regulatory Disclosures

corewin may be required by law to disclose your personal data to competent authorities, law enforcement agencies, or regulatory bodies in response to a lawful request, court order, or legal process. In such cases, we will disclose the minimum amount of information required to satisfy the legal obligation and, where permitted by law, will endeavour to notify you of the disclosure.

Section 4

Cookies and Tracking Technologies

corewin uses cookies and similar tracking technologies on the platform to ensure it functions correctly, to maintain the security of your session, and to gather analytics data that helps us understand how the platform is used. A cookie is a small text file placed on your device by your browser when you visit the corewin website. Cookies do not contain executable code and cannot carry viruses. They are widely used across the internet to make websites work efficiently.

4.1 Categories of Cookies We Use

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your login session, authenticate your account, and prevent cross-site request forgery (CSRF). These cannot be disabled without breaking core platform functionality.	Session / up to 24 hours
Functional	Remember your language preferences, game lobby display settings, and responsible gaming limits you have set within your account.	Up to 90 days
Analytics	Collect anonymised data on page views, session durations, navigation paths, and device types to help us identify usability issues and improve the platform.	Up to 12 months
Security	Store device fingerprint tokens used to detect unusual login activity and flag potential account takeover attempts.	Up to 30 days

4.2 Managing Your Cookie Preferences

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block cookies entirely, delete existing cookies, or receive a notification before a cookie is placed. Please note that disabling strictly necessary cookies will prevent the corewin platform from functioning correctly — in particular, you will not be able to log in or maintain an authenticated session. Instructions for managing cookies in common browsers are available through the help documentation of your browser provider. corewin does not currently respond to browser "Do Not Track" signals, as there is no universally agreed standard for how these signals should be interpreted.

Section 5

Data Retention

corewin retains your personal data only for as long as it is necessary for the purposes described in this Privacy Policy, or as required by applicable law. The retention periods we apply are determined by the type of data, the purpose for which it was collected, and any legal or regulatory obligations that require us to hold records for a minimum period.

• Active account data — retained for the full duration of your account being open and active on the corewin platform.
• Transaction and financial records — retained for a minimum of 5 years following the date of the transaction, in accordance with anti-money-laundering record-keeping obligations.
• KYC identity documents — retained for a minimum of 5 years following account closure or the date of the last transaction, whichever is later.
• Customer support communications — retained for up to 3 years following the resolution of the support interaction.
• Marketing consent records — retained for as long as they are relevant to demonstrate consent status, or for 3 years following the last marketing interaction, whichever is longer.
• Session and usage logs — retained for up to 12 months in detailed form, then aggregated and anonymised for longer-term analytics purposes.
• Self-exclusion records — retained for a minimum of 5 years following the end of the self-exclusion period to prevent re-registration during the exclusion window.

When personal data reaches the end of its applicable retention period and there is no longer a legal basis for retaining it, corewin securely deletes or irreversibly anonymises it. Deletion processes are applied on a rolling basis across our data stores to ensure compliance with retention schedules.

Section 6

Your Privacy Rights

corewin respects your rights in relation to your personal data. The following rights are available to you as a corewin player. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request. We will respond within a reasonable timeframe and may ask you to verify your identity before processing your request, to ensure that we only action legitimate requests from the account holder.

6.1 Right of Access

You have the right to request a copy of the personal data that corewin holds about you. Upon receipt of a verified access request, we will provide you with a summary of the data categories we hold, the purposes for which they are processed, any third parties with whom the data has been shared, and the retention periods applicable to each category. We aim to fulfil access requests within 30 days of receipt.

6.2 Right to Rectification

If any of the personal data we hold about you is inaccurate or out of date, you have the right to request that we correct it without undue delay. For example, if you have moved to a new address in Dhaka, Chittagong, Sylhet, or elsewhere in Bangladesh, you may request an update to your registered address. Requests for rectification may be subject to identity verification before changes are applied.

6.3 Right to Erasure

You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you wish to withdraw consent and there is no other lawful basis for processing. Please note that this right is not absolute: corewin may be required to retain certain data for legal, regulatory, or fraud-prevention purposes even after you request erasure. We will explain clearly what data can and cannot be deleted and why.

6.4 Right to Object to Marketing

You have the right to object to the processing of your personal data for direct marketing purposes at any time. Once you exercise this right, corewin will cease processing your data for marketing purposes promptly. You can exercise this right by contacting support or by following the unsubscribe instructions included in any marketing email we have sent to you.

Section 7

Data Security Measures

corewin implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. While no online platform can guarantee absolute security against all threats, our layered security approach reflects industry best practice for the online gambling sector.

7.1 Technical Safeguards

• All data in transit between your device and corewin servers is encrypted using TLS 1.2 or higher protocols.
• Player passwords are stored using one-way cryptographic hashing — corewin staff cannot read your password in plain text.
• KYC documents are stored in encrypted form in access-restricted storage environments accessible only to authorised compliance personnel.
• Payment card data is processed exclusively through PCI DSS-compliant payment gateways — raw card numbers are never written to corewin servers.
• Platform infrastructure is protected by firewalls, intrusion detection systems, and automated threat-monitoring tools operating on a 24/7 basis.
• Session tokens are rotated regularly and expire after a period of inactivity to minimise the risk of session hijacking.

7.2 Organisational Safeguards

• Access to player personal data is restricted on a strict need-to-know basis — only staff with a clear operational requirement can access identifiable player records.
• All staff who handle personal data receive data protection and security training as part of their onboarding and on an ongoing annual basis.
• Third-party service providers who process data on behalf of corewin are vetted for their security practices and bound by data processing agreements.
• In the event of a data breach that poses a risk to player rights and freedoms, corewin will notify affected players and relevant authorities as required by applicable law, without undue delay.

Section 8

Privacy Contact and Policy Updates

If you have any questions, concerns, or complaints regarding the way corewin handles your personal data, or if you wish to exercise any of the privacy rights described in this policy, please contact us at [email protected]. We take all privacy enquiries seriously and aim to provide a substantive response within 5 business days of receipt during standard Bangladesh Standard Time (UTC+6) working hours.

8.1 Changes to This Privacy Policy

corewin reserves the right to update or modify this Privacy Policy at any time. When we make material changes to the policy — such as adding new data processing purposes, introducing new third-party sharing arrangements, or changing our retention periods — we will notify registered players by email (to the address registered on their account) and post a prominent notice on the corewin platform. The updated policy will display a revised effective date at the top of this page. Continued use of the corewin platform after the effective date of a revised policy constitutes acceptance of the updated terms.

8.2 Policy Version History

• Version 1.0 — 1 January 2026: Initial publication of the corewin Privacy Policy covering data collection, use, sharing, cookies, retention, player rights, and security measures for the Bangladesh market.