How Personal Data Is Handled

Personal data is any information that identifies a user or can be linked to a user. Midnight Wins may collect information needed to operate online services, meet legal duties and protect accounts.

Data may include:

• identity and contact details, such as name, date of birth, residential address, email address and telephone number;
• account details, such as username, login records, preferences and account status;
• verification details, such as address evidence, document images and age checks;
• payment and transaction information, such as deposit records, withdrawal records and payment references;
• technical data, such as IP address, device type, browser type, operating system and website activity;
• communications with support or compliance staff.

The collection is limited to information needed for lawful purposes, including account administration, safer gambling controls, prevention of money laundering, fraud prevention, dispute handling and regulatory compliance.

Technical and organisational measures may include:

• encryption for data in transit and stored records;
• restricted staff access based on job duties;
• password controls and account monitoring;
• supplier checks before personal information is shared;
• audit logs for security and compliance activity;
• retention controls so records are kept only for the required period.

United Kingdom users have rights under the UK GDPR, the Data Protection Act 2018 and related privacy rules. These rights include:

• access to personal data held about the user;
• correction of inaccurate or incomplete information;
• deletion where legal retention no longer applies;
• restriction of processing in certain cases;
• objection to certain uses of personal data;
• data portability where the law applies;
• complaint to the Information Commissioner’s Office.

The platform uses collected information only for defined purposes explained in this document or at the point of collection. Data processing must be lawful, fair and transparent under the UK GDPR.

Personal information may be used for:

• account registration, login and account management;
• deposits, withdrawals, refunds and payment reconciliation;
• identity, age, source of funds and security checks;
• prevention of fraud, money laundering, misuse of services and unauthorised account access;
• customer support, complaints and dispute resolution;
• personalisation of website settings and account preferences;
• analytics, service testing and website improvement;
• optional marketing where consent exists or another lawful basis applies;
• compliance with court orders, regulator requests, gambling law, tax rules and data protection duties.

Marketing choices can be changed in account settings or through the relevant message options. Analytics data is used to assess website performance, detect errors and improve online services without unnecessary intrusion into user privacy.

Users can request access to personal data, ask for inaccurate information to be corrected, or ask for deletion where the law allows. Requests may require identity verification so that account information is not disclosed to the wrong person.

A request normally involves these steps:

1. Submit the request through the account contact channel or privacy contact channel shown on the website.
2. State the type of request, such as access, correction, deletion, restriction or objection.
3. Supply any information needed to confirm identity and locate the relevant account record.
4. Receive a response within the period required by United Kingdom data protection law.

Deletion may be limited where records must be kept for gambling regulation, prevention of money laundering, tax, payment, legal claim or security reasons. If deletion cannot be completed, the reason should be explained in plain language.

By using the services, a user consents to security checks and to payment data processing by authorised payment providers where such processing is necessary for account protection, deposits, withdrawals, refunds or chargeback handling. Payment providers process card, bank, wallet or similar information under their own security duties and applicable financial rules.

Midnight Wins is available only to users aged 18 or over. The website is not intended for children or any person below the legal gambling age in the United Kingdom.

The operator cannot verify a person’s age without reliable documents, approved electronic checks or other lawful evidence. For that reason, age and identity verification may be required before account use, withdrawals or access to certain services.

If a parent or guardian believes that a minor has supplied personal data, a deletion request may be submitted through the privacy contact channel shown on the website. Once the request is verified, the relevant personal information will be deleted unless a legal duty requires limited retention. Any related account may also be closed or restricted.

Personal data may be processed outside the United Kingdom where service providers, payment processors, game suppliers, sportsbook technology suppliers, hosting providers, analytics suppliers or customer support providers operate.

Use of the services confirms consent to necessary cross border processing where the platform’s partners operate. Transfers are handled with confidentiality and security controls appropriate to the type of information involved.

Confidentiality is required of all authorised partners through contracts, access limits and data protection obligations. Safeguards may include adequacy regulations, the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to EU standard contractual clauses, supplier security reviews and access controls.

Legal disclaimers on the website may affect how policy rules apply, including scope, exclusions, interpretation and practical effect. They apply once a user accepts the relevant document by electronic acceptance, written signature, account registration, account use or accession to the applicable terms.

A disclaimer cannot remove statutory rights under United Kingdom data protection law or gambling law. If a disclaimer conflicts with mandatory legal protections, the mandatory legal protection prevails.

Cookies are small text files stored on a device when a user visits a website. They help the website recognise a browser, remember settings and understand how services are used.

Cookie data supports:

• site statistics and performance measurement;
• behaviour analysis to understand page use and navigation patterns;
• personalisation of preferences, language settings and account settings;
• security, session management and error detection;
• improvements to website content, layout and online services.

Cookie information is retained for 1 year unless a shorter period is stated in the cookie notice or a longer period is required for security or legal reasons. Users can manage cookies through browser settings and any cookie controls available on the website.

Use of Midnight Wins confirms full acceptance of this Privacy Policy and its rules for data collection, use, disclosure, storage and deletion. The version published on the website at the relevant time prevails over earlier versions.

If updates are made, the current version applies to continued use of the services. Policy acceptance does not replace separate consent required for optional marketing, optional cookies or any other activity requiring consent under law.

Personal data may be shared with authorised third parties where this is needed by law, for dispute resolution, or under contracts that support the services.

These parties may include:

• payment providers and banking partners;
• identity and age verification suppliers;
• game and sportsbook technology suppliers;
• hosting, analytics, security and technical support providers;
• advisers, auditors, insurers and professional service providers;
• regulators, courts, police and other public authorities where required by law.

Where the website lists specific third parties, users can review those details on the relevant policy or information page. If a party is unnamed, the relevant notice should explain the purpose and scope of the disclosure.

When a user submits personal data for an account or transaction, the user consents to the disclosure needed for that stated purpose, subject to legal rights and required safeguards.

The website may contain links to external websites, including payment services, game suppliers, identity verification services, social media pages or information resources. External website operators control their own privacy policies, cookie notices and data practices.

Midnight Wins does not control external data collection, processing, storage or disclosure. Users should take care when visiting any third party website and should read the privacy notice that applies there. Any personal information entered on an external website is governed by that website’s own privacy policy.