Privacy Notice

Updated on 24 September 2026

Who is responsible for your data

The controller of your personal data is Tekuno Technologies S.R.L., the company registered in Costa Rica that operates WinZoria under a licence from the Tobique Gaming Commission. As a player based in the United Kingdom, you are protected by the UK General Data Protection Regulation and the Data Protection Act 2018, and we apply those rules to the data we hold about you. If you have questions about this notice, write to our privacy team, and a person on our data protection team will reply.

This notice explains what we collect, why, on which legal basis, how long we keep it and what you can ask us to do. It covers the website, the installable web app and our customer support channels.

What we collect

Information you give us

Registration details: name, date of birth, email address, home address, phone number and currency.
Verification documents: identity document, proof of address and, when we ask for it, a photo of your payment card.
Messages you send to support, including chat transcripts and emails.
Limits and preferences you set, such as deposit limits, time-outs or marketing choices.

Information created when you play

Deposits, withdrawals, balances and the payment methods used.
Bets, game rounds, bonus activity and session times.
Technical data: IP address, device type, browser, approximate location and login history.

Information from others

Payment providers confirm whether a transaction went through. Identity verification and fraud prevention services tell us whether the details you gave match public or commercial records. Game studios send us the results of rounds played in their games. If you arrived through a partner's link, we receive a reference showing which partner sent you.

Why we use it and on what basis

Under UK GDPR every use of personal data needs a lawful basis. Ours are these:

To open and run your account, process payments and pay out winnings, we rely on the contract between us.
To verify your age and identity, check the source of funds and prevent money laundering, we act under legal obligations and the conditions of our licence.
To spot unusual play that may point to harm, apply your limits and honour self-exclusion, we rely on legal obligations and our legitimate interest in keeping play safe.
To detect fraud, protect accounts and improve the site, we rely on legitimate interests that we have weighed against your privacy.
To send you offers by email or text, and to use marketing cookies, we ask for your consent, which you can withdraw at any time.

We do not make decisions with legal effect about you based only on automated processing. Our systems flag patterns, for example a sudden rise in deposits, and a member of staff reviews the flag before anything happens to the account.

Who we share it with

We share data only where it is needed: with payment processors and banks, identity and fraud checking services, game studios, hosting and email providers, and our professional advisers. Each of them works under a written agreement and may use the data only for the service they provide to us. We also disclose information to the Tobique Gaming Commission, law enforcement or courts when the law requires it. We never sell your personal data.

International transfers

Because our operator is based in Costa Rica and some suppliers operate in other countries, your data may be processed outside the United Kingdom. When that happens we use safeguards recognised under UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with technical measures like encryption in transit and at rest.

How long we keep it

Account, transaction and verification records are kept for five years after the account is closed, because anti-money laundering rules require it. Records of self-exclusion are kept for as long as needed to keep the exclusion working, and longer if you ask us to. Chat transcripts and emails are kept for two years. Marketing preferences are kept until you change them. Technical logs are deleted after twelve months unless they are needed to investigate a security incident. When a period ends, data is erased or made anonymous.

Your rights

Under UK GDPR you can ask us to:

give you a copy of the personal data we hold about you;
correct details that are wrong or incomplete;
delete data we no longer have a reason to keep;
restrict how we use data while a question about it is being resolved;
send data you provided to you or another company in a common electronic format;
stop processing based on legitimate interests, and stop all direct marketing.

Email our privacy team from the email address linked to your account. We may ask you to confirm your identity before we act. We answer within one month, and if a request is complex we will tell you within that month if we need up to two more. There is no charge, unless a request is plainly excessive.

Some rights are limited by law. For example, we cannot erase verification records while the retention period required for anti-money laundering is still running. We will always explain the reason if we cannot do what you ask.

Security

The site uses TLS encryption on every page. Documents you upload are stored encrypted, and access is limited to staff who need it for their work. Logins are protected against repeated failed attempts, and staff access is logged. If a breach affects your data in a way likely to put your rights at risk, we will tell you without undue delay.

Cookies and marketing

We use cookies to keep you logged in, remember your settings and, with your consent, measure traffic and show relevant offers. The details are on the cookie policy. You can unsubscribe from marketing using the link in any email, by replying STOP to a text, or by switching it off in your account settings.

Complaints

If you are unhappy with how we handle your data, please contact our privacy team first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection authority, at ico.org.uk, or to the supervisory authority in the country where you live or work.

Changes to this notice

We review this notice at least once a year and whenever our processing changes. If an update changes how we use your data in a meaningful way, we will let you know in your account or by email before it applies. General contact details are on the contact page.