dmwin Privacy Policy — Your Data, Your Rights

Our Core Privacy Commitments

What This Policy Covers

1Introduction and Scope

This Privacy Policy describes how dmwin collects, processes, stores, and protects personal data provided by users of the dmwin platform at https://dmwin.ws. It applies to all registered account holders, visitors to the dmwin website, and any person whose personal data is processed by dmwin in connection with the provision of its services to the Bangladesh market.

By registering an account or using the dmwin platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Privacy Policy, you must not use the dmwin platform. This policy should be read alongside the dmwin Terms & Conditions, which govern the overall use of the platform.

2Personal Data We Collect

dmwin collects personal data in three broad categories: information you provide directly when registering and using the platform; information generated automatically by your use of the platform; and information obtained from third-party service providers where necessary to deliver dmwin's services.

Information You Provide Directly

• Registration details: full name, date of birth, mobile phone number, and the mobile wallet account (bKash, Nagad, or Rocket) used for transactions.
• Identity verification (KYC) documents: copies of national ID card, passport, or other government-issued identification documents where requested by dmwin's compliance process.
• Communications you send to dmwin support, including emails, live chat transcripts, and any documentation submitted as part of a formal complaint or dispute.
• Voluntary survey responses or feedback you choose to provide in connection with dmwin promotions, seasonal offers, or platform improvement requests.

Information Generated by Your Platform Use

• Device and technical data: device type and model, operating system version, mobile browser type, IP address, and approximate geographic location derived from IP address.
• Session and usage data: pages visited, games played, betting markets accessed, session duration, login and logout timestamps, and clickstream data within the platform.
• Transaction data: deposit amounts, withdrawal amounts, transaction timestamps, payment method used (bKash, Nagad, or Rocket), and transaction reference numbers. Your mobile wallet PIN and authentication credentials are never part of this data — they remain within your mobile wallet app at all times.

Information from Third-Party Providers

• Transaction confirmation data from bKash, Nagad, and Rocket: confirmation of payment success or failure, transaction reference, and timestamp — used to reconcile your account balance.
• Identity verification results from KYC service providers where dmwin uses third-party identity verification tools to confirm the age and identity of account holders.
• Fraud and risk intelligence data from fraud prevention partners, used only to detect and prevent account fraud, money laundering activity, or unauthorised access attempts against dmwin accounts.

3How We Use Your Personal Data

dmwin processes personal data only for specified, lawful purposes. The table below sets out the primary purposes for which dmwin uses your data and the legal basis for each.

4Payment Data and Mobile Wallet Privacy

dmwin facilitates payments through bKash, Nagad, and Rocket — the three principal mobile wallet services used by players in Bangladesh. When you make a deposit or request a withdrawal, the payment transaction is initiated and authenticated entirely within your mobile wallet app. dmwin receives only the confirmation of payment (success or failure), the transaction reference number, and the amount — it never receives, processes, or stores your mobile wallet PIN, OTP (one-time password), or any authentication credentials associated with your bKash, Nagad, or Rocket account.

Transaction records — including deposit amounts, withdrawal amounts, timestamps, and payment method used — are retained on dmwin's secure servers for account reconciliation, responsible gaming monitoring, and compliance with applicable financial record-keeping requirements. These records are stored for a period of five years from the date of the transaction, after which they are securely deleted in accordance with dmwin's data retention schedule.

5Cookies and Tracking Technologies

dmwin uses cookies and similar lightweight tracking technologies to ensure the platform functions correctly on your device, to maintain your session while you are logged in, and to understand aggregate patterns in how players use the platform. dmwin does not use advertising cookies, third-party marketing trackers, or cross-site tracking technologies.

Types of Cookies Used by dmwin

• Essential cookies: required for the platform to function. These include session authentication tokens, security tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Analytics cookies: used to collect anonymous, aggregated data about how players navigate the dmwin platform. This data is used solely to improve the platform's usability, performance, and mobile compatibility. Analytics data is not linked to individual player identities.
• Preference cookies: store lightweight user interface preferences (such as language selection) to improve your experience across sessions. These contain no personally identifiable information.

You can manage cookie preferences through your mobile browser's settings. Disabling essential cookies will prevent the dmwin platform from functioning correctly and you will not be able to log in or access your account. Disabling analytics or preference cookies will not affect your ability to use the platform but may result in a less personalised experience.

6Data Sharing and Third-Party Disclosure

dmwin does not sell or rent personal data. We share personal data with third parties only in the following limited and specific circumstances:

• Payment processing partners (bKash, Nagad, Rocket): dmwin shares only the minimum data required to initiate and confirm a payment transaction. This does not include any account credentials or sensitive personal information beyond the transaction amount and reference.
• KYC and identity verification providers: where dmwin uses a third-party service to verify the age or identity of an account holder, the relevant identity documents are shared with that provider under a strict data processing agreement. Verification providers do not retain copies of identity documents beyond the period required to complete verification.
• Fraud prevention and security providers: aggregated or anonymised signals may be shared with fraud prevention partners to identify and block suspicious activity. No raw personal data identifying individual players is shared for this purpose beyond what is strictly necessary.
• Legal and regulatory obligations: dmwin will disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, valid legal process, or court order. dmwin will, where legally permissible, notify the affected account holder of such a disclosure request before complying.

In all cases where data is shared with third parties, dmwin ensures that appropriate contractual safeguards are in place, including data processing agreements that require third parties to handle personal data securely, use it only for the specified purpose, and delete it when it is no longer required.

7Data Retention

dmwin retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply: account registration data and KYC documents are retained for the duration of your active account and for five years following account closure; transaction records (deposit and withdrawal history) are retained for five years from the date of the transaction; session and usage logs are retained for 12 months; support correspondence is retained for three years from the date of the last communication in the relevant thread.

When personal data reaches the end of its applicable retention period, dmwin securely deletes or anonymises it in accordance with its internal data disposal procedures. Where anonymisation is used in preference to deletion, the resulting data contains no information that could reasonably be used to identify any individual player, and it is retained solely for aggregate platform analytics.

8Your Data Rights

As a dmwin account holder, you have the following rights in respect of your personal data held by dmwin. To exercise any of these rights, contact dmwin support at [email protected] with the subject line "Data Rights Request" and your registered mobile number.

• Right of access: you may request a copy of all personal data dmwin holds about you. dmwin will provide this within 30 days of a verified request.
• Right to rectification: if any personal data dmwin holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Account details such as your registered mobile number can be updated directly through dmwin support.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent is the basis for processing), or where you object to processing based on legitimate interests. Note that dmwin may be required to retain certain data (such as transaction records) for legal compliance purposes even after account closure.
• Right to restrict processing: you may request that dmwin restricts its processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing and dmwin is considering that objection.
• Right to object: you have the right to object to dmwin processing your personal data where that processing is based on legitimate interests. dmwin will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

dmwin will acknowledge all data rights requests within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or involves multiple data sets, dmwin may extend the response period by a further 30 days, in which case it will notify you of the extension and the reason for it before the original 30-day deadline expires.

9Data Security Measures

dmwin implements technical and organisational security measures appropriate to the sensitivity of the personal data it holds. These include: SSL/TLS encryption for all data in transit between your device and dmwin's servers; encryption at rest for all databases containing personal data; role-based access controls ensuring that dmwin staff can access personal data only to the extent required by their specific job function; regular internal security reviews and vulnerability assessments of the platform's infrastructure; and two-factor authentication requirements for all administrative access to dmwin's backend systems.

No data security system is impenetrable, and dmwin cannot guarantee the absolute security of your personal data in all circumstances. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, dmwin will notify affected account holders without undue delay, providing details of the nature of the breach, the data affected, and the steps dmwin is taking to address it. You should also take reasonable steps to protect your own account security by using a strong, unique password and never sharing your login credentials.

10Children and Under-21 Users

dmwin is strictly an adult platform. Registration and use of the platform is permitted only for individuals aged 21 years and above. dmwin does not knowingly collect personal data from anyone under the age of 21. If dmwin becomes aware that personal data has been collected from a person under 21, it will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that your child has registered with dmwin, please contact [email protected] immediately with the subject line "Under-Age Account" so that dmwin can investigate and take appropriate action.

11Changes to This Privacy Policy

dmwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, changes in how dmwin processes personal data, or changes to the platform's features and services. When material changes are made, dmwin will update the "Last Updated" date at the top of this page. Where the changes are significant, dmwin will also notify registered account holders via the mobile number associated with their account, or by a prominent notice on the platform, before the changes take effect. Your continued use of the dmwin platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you should stop using the platform and contact dmwin support to arrange account closure.

12Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or dmwin's handling of your personal data, please contact the dmwin privacy team at [email protected]. Please include "Privacy Enquiry" in the subject line of your email and provide your registered mobile number so that dmwin can locate your account and respond to your query as quickly as possible. All privacy-related communications are handled confidentially by the dmwin compliance team.

Support is available 24 hours a day, 7 days a week. dmwin aims to acknowledge all privacy-related enquiries within 2 business days and to provide a full response within 30 calendar days. For formal data rights requests (access, erasure, rectification), please use the subject line "Data Rights Request" to ensure your query is routed to the correct team without delay.