Privacy Policy

Version 1.0  |  Last Updated: 17 August 2026

This Privacy Policy explains how Aztec Wins (operating at aztec-wins.org.uk) collects, uses, stores, shares, and protects personal data when you use our Website or Services. We are committed to processing your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Please read this Policy carefully alongside our Terms & Conditions and our Responsible Gaming Policy. By registering an Account or using the Services, you acknowledge that you have read and understood this Policy.

1. Introduction

1.1. Who We Are

We are the operator of Aztec Wins, accessible at aztec-wins.org.uk. We act as the data controller in respect of the personal data you provide to us and the data we collect about you in connection with your use of the Services. As data controller, we determine the purposes and means by which your personal data is processed.

1.2. Data Protection Officer

If you have any questions or concerns about how we handle your personal data, or to exercise any of your data subject rights, please contact our Data Protection Officer (DPO) at:

• Email: [email protected]

2. Data We Collect

2.1. Data You Provide Directly

We collect the following categories of personal data that you voluntarily provide to us:

• Identity Data: full legal name, date of birth, gender, nationality;
• Contact Data: email address, postal address, telephone number;
• Account Data: username, password (hashed), account preferences;
• Financial Data: payment method details (partial card number, e-wallet identifiers), transaction history, Deposit and Withdrawal records;
• Verification Data: copies of identity documents (passport, driving licence), proof of address documents, source of funds documentation;
• Communications Data: records of your correspondence with our support or compliance teams.

2.2. Data We Collect Automatically

When you access and use the Website, we automatically collect certain technical and behavioural data, including:

• Technical Data: IP address, browser type and version, operating system, device type, screen resolution;
• Usage Data: pages visited, Games played, session duration, click paths, wagering patterns;
• Log Data: server logs, error logs, access timestamps;
• Cookie Data: data collected through cookies and similar tracking technologies as further described in Section 6.

2.3. Data We Receive from Third Parties

We may receive personal data about you from the following third-party sources:

• Payment Processors: confirmation of transactions and payment status;
• Identity Verification Agencies: verification of your identity, age, and address;
• Fraud Prevention Services: fraud risk scores and alerts;
• Self-Exclusion Registers: confirmation of self-exclusion status (e.g., GamStop);
• Analytics Providers: aggregated and de-identified behavioural data.

3. How We Use Your Data

We use your personal data for the following purposes:

• Account Registration & Management: to create and administer your Account, verify your identity, and manage your relationship with us;
• Provision of Services: to allow you to access and use Games, process Deposits and Withdrawals, and apply Bonuses;
• Legal & Regulatory Compliance: to comply with our obligations under applicable anti-money laundering, counter-terrorism financing, and data protection legislation; to carry out KYC checks; and to respond to requests from regulatory and law enforcement authorities;
• Responsible Gaming: to monitor gambling behaviour, identify and support Players showing signs of problem gambling, and apply Player protection measures in accordance with our Responsible Gaming Policy;
• Fraud Prevention & Security: to detect and prevent fraud, money laundering, cheating, and other prohibited activities;
• Customer Support: to respond to your queries, complaints, and requests;
• Marketing & Promotions: to send you relevant promotional communications where you have consented to receive them; you may withdraw this consent at any time;
• Website Improvement: to analyse usage patterns, test new features, and improve the performance and content of the Website;
• Dispute Resolution: to investigate and resolve disputes, complaints, and legal claims.

4. Legal Bases for Processing

We rely on the following lawful bases under UK GDPR to process your personal data:

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to ensure that our interests are not overridden by your rights and interests. You may request a copy of our balancing test assessment by contacting [email protected].

5. Data Sharing & Third Parties

5.1. Categories of Recipients

We may share your personal data with the following categories of third parties:

• Payment Processors & Financial Institutions: to process Deposits and Withdrawals;
• Identity & Age Verification Providers: to fulfil our KYC and AML obligations;
• Game Software Providers: to facilitate access to their Games on our platform;
• IT & Cloud Service Providers: to host and maintain the Website and our systems;
• Customer Support Platforms: to manage customer enquiries and support tickets;
• Analytics & Marketing Partners: to analyse usage and deliver relevant communications, subject to your consent;
• Fraud Prevention & Security Services: to detect, investigate, and prevent fraudulent activity;
• Self-Exclusion Registers: to verify and enforce self-exclusion decisions;
• Legal & Professional Advisers: where necessary for the conduct of legal proceedings or regulatory investigations;
• Regulatory & Law Enforcement Authorities: where required or permitted by applicable law.

5.2. No Sale of Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

5.3. Third-Party Processors

All third-party service providers acting as data processors on our behalf are required to process your personal data only on our documented instructions, to implement appropriate technical and organisational security measures, and to comply with applicable data protection law. We maintain data processing agreements with all such providers.

6. Cookies & Tracking Technologies

6.1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies (such as pixel tags, web beacons, and local storage) to enhance your experience on the Website, to remember your preferences, and to gather analytical information.

6.2. Types of Cookies We Use

• Strictly Necessary Cookies: essential for the operation of the Website (e.g., maintaining your session and Account login). These cannot be disabled.
• Functional Cookies: used to remember your preferences (e.g., language, currency display). Disabling these may affect Website functionality.
• Performance & Analytics Cookies: used to collect information about how visitors use the Website (e.g., pages viewed, session duration). We use this information to improve the Website. These cookies are only placed with your consent.
• Marketing & Targeting Cookies: used to deliver relevant advertisements and measure the effectiveness of marketing campaigns. These are only placed with your consent.

6.3. Managing Cookies

You can manage your cookie preferences via our cookie consent tool, which is displayed when you first visit the Website. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website. For further information about managing cookies, visit www.allaboutcookies.org.

7. Data Security

7.1. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: all data transmitted between your device and our servers is encrypted using SSL/TLS technology;
• Access Controls: access to personal data is restricted to authorised personnel on a need-to-know basis;
• Password Security: Account passwords are stored in hashed format using industry-standard algorithms;
• Regular Security Testing: we conduct periodic security assessments and vulnerability testing;
• Staff Training: all personnel with access to personal data receive regular data protection training.

7.2. Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with our legal obligations. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

8. Data Retention

8.1. Retention Periods

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. Our standard retention periods are as follows:

• Account & Identity Data: retained for the duration of your Account and for 5 years following Account closure (to comply with AML legislation);
• Financial & Transaction Data: retained for 5 years from the date of the transaction;
• KYC & Verification Documents: retained for 5 years following Account closure;
• Communications Data: retained for 3 years from the date of the last communication;
• Marketing Data: retained until you withdraw your consent or for 2 years from your last interaction with our marketing communications, whichever is sooner.

After the applicable retention period has expired, personal data is securely deleted or anonymised.

9. Your Rights

9.1. Data Subject Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of Access: to request a copy of the personal data we hold about you (Subject Access Request);
• Right to Rectification: to request correction of inaccurate or incomplete personal data;
• Right to Erasure: to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected (subject to our legal retention obligations);
• Right to Restriction: to request that we restrict the processing of your personal data in certain circumstances;
• Right to Data Portability: to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request its transfer to another controller where technically feasible;
• Right to Object: to object to processing based on legitimate interests or for direct marketing purposes;
• Rights Related to Automated Decision-Making: to request human review of any decision made solely by automated means that significantly affects you.

9.2. How to Exercise Your Rights

To exercise any of the above rights, please contact us at [email protected]. We will respond to your request within one (1) calendar month of receipt. We may need to verify your identity before processing your request. There is ordinarily no charge for exercising your rights, unless a request is manifestly unfounded or excessive.

9.3. Right to Complain

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the UK:

• Website: www.ico.org.uk
• Telephone: 0303 123 1113

10. International Data Transfers

10.1. Transfers Outside the UK

Some of our third-party service providers may be located in or process data in countries outside the United Kingdom. Where this is the case, we ensure that such transfers are subject to appropriate safeguards as required by UK GDPR, including:

• Transfer to countries with an adequacy decision from the UK Secretary of State;
• Use of UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses;
• Other appropriate safeguards as recognised under applicable data protection law.

You may request further information about the safeguards in place for international transfers by contacting [email protected].

11. Minors

11.1. Age Restriction

The Services are strictly for individuals aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will promptly delete such data and close the associated Account. Parents and guardians who believe their child may have registered an Account should contact us immediately at [email protected].

12. Changes to This Policy

12.1. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where changes are material, we will notify you via email or a prominent notice on the Website prior to the changes taking effect. The date of the most recent revision will always be displayed at the top of this page.

We encourage you to review this Policy periodically. Your continued use of the Services following the posting of any changes constitutes your acknowledgement of those changes.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us using the details below:

• Data Protection / Privacy Enquiries: [email protected]
• General Support: [email protected]
• Website: aztec-wins.org.uk

We are committed to resolving any privacy-related concerns promptly and transparently.