11Winner Privacy Policy

Information categories

11Winner processes the following categories of information:

• Account identifiers: name, date of birth, registered mobile number, email address, username, and password hashes; preferences such as language and communication settings.
• KYC details: PAN, Aadhaar, proof of address, and liveness checks (photos/selfies) necessary for identity and age verification.
• Financial and transaction data: UPI VPA, wallet handles, bank details (e.g., account number and IFSC), deposit/withdrawal references, amounts, timestamps, and status messages from payment intermediaries. Full payment card data, where applicable, is handled by PCI DSS–compliant gateways and is not stored in full by 11Winner.
• Gameplay and wagering data: bet slips, tickets, game rounds, outcomes, odds viewed, bonuses used, and limit settings.
• Device and technical telemetry: device model, OS/app version, SDK (Software Development Kit) identifiers, IP address, network type (Wi-Fi/mobile), crash logs, performance metrics, and security signals.
• Usage analytics: pages and features accessed, session duration, clickstream, and referral sources.
• Support communications: live-chat and email transcripts, attachments, and ticket metadata.
• Responsible-play preferences: deposit limits, time reminders, cooling-off/self-exclusion selections, and related timestamps.

Sources of data

Data reaches 11Winner through:

• Direct submission by users (registration, KYC, payments, support).
• Automated collection via cookies, local storage, pixels, and mobile SDKs.
• Third parties such as verification vendors, payment processors, analytics providers, anti-fraud services, and game studios supplying live and RNG (Random Number Generator) content.

Purposes of processing

11Winner processes personal data for the following purposes:

• Service delivery: enabling account creation, authentication, access to sportsbook and casino content, display of balances, and participation in promotions.
• Identity and age checks: performing KYC and AML controls to meet legal and licensing obligations.
• Payments: processing deposits and withdrawals, reconciling transactions, and handling disputes or chargebacks.
• Security and integrity: preventing fraud, bonus abuse, multi-accounting, and unauthorized access; maintaining audit trails and incident response records.
• Responsible play: implementing player-controlled limits, reminders, cooling-off, and self-exclusion measures.
• Customer support: responding to queries, reviewing logs, and providing status updates through tickets.
• Service improvement and personalization: measuring performance, testing features, improving streaming quality, and tailoring recommendations where permitted.
• Legal compliance: retaining records, responding to lawful requests from authorities, and meeting tax and bookkeeping requirements.
• Communications: sending transactional notices (KYC status, payout updates, policy changes) and marketing messages by push, SMS, or in-app notifications.

Cookies, SDKs, and local storage

Cookies and comparable technologies are used to maintain sessions, remember preferences, secure authentication, measure performance, attribute campaigns, and deliver relevant content. Mobile apps may embed SDKs for analytics, crash reporting, and push notifications. Disabling certain categories can impair functionality (for example, frequent re-authentication or limited personalization).

Data sharing and disclosures

11Winner does not sell personal data. Disclosures occur under contract and with appropriate safeguards:

• Service providers and processors: cloud hosting, CDNs, KYC vendors, payment gateways and banks, analytics, customer-support platforms, and anti-fraud tools.
• Game studios and content suppliers: to deliver games, resolve disputes, validate outcomes, and conduct audits.
• Professional advisers and authorities: auditors, legal counsel, regulators, and law-enforcement where disclosure is legally required or necessary to protect rights and safety.
• Corporate transactions: in mergers, acquisitions, or reorganizations, data may transfer to a successor entity subject to this Policy or a policy that offers materially similar protection.

International data transfers

Personal data may be processed outside India due to the location of vendors or infrastructure. 11Winner applies contractual and technical safeguards — such as encryption in transit and at rest, access controls, and audit logging — to maintain protection standards across borders, subject to applicable law.

Retention

11Winner retains personal data only as long as necessary for the purposes described and to satisfy legal, accounting, and regulatory requirements. Retention periods vary: KYC and transaction records are preserved for statutory periods under AML/CFT and tax rules; support tickets are retained for audit and quality; analytics are kept for shorter cycles. On expiry, data is securely deleted or irreversibly anonymized.

User rights and choices

Subject to law, users can exercise the following rights with 11Winner:

• Access: obtain confirmation and a copy of personal data undergoing processing.
• Correction: rectify inaccurate or incomplete data.
• Erasure: request deletion in defined circumstances (for example, where data is no longer necessary or where consent is withdrawn and no other legal basis applies).
• Consent withdrawal: opt out of optional processing such as marketing or certain analytics.
• Portability: receive certain data in a structured, machine-readable format where technically feasible.
• Nomination (DPDP): designate a nominee to exercise rights in case of death or incapacity.

Identity verification is required before fulfilling requests. Some requests may be limited or refused where necessary to comply with law or protect the rights of others.

Security practices

11Winner implements layered security measures designed to protect confidentiality, integrity, and availability:

• Encryption: TLS for data in transit; encryption and role-based access at rest.
• Infrastructure hardening: network segmentation, firewalls, intrusion detection/prevention, rate limiting, and DDoS mitigation.
• Account protections: strong-password rules, device binding, session timeouts, optional MFA checks.
• Vendor governance: due diligence, contractual processing terms, and periodic reviews for processors.
• Monitoring and response: logging of sensitive operations, continuous monitoring, and incident response playbooks.

Although no system is perfectly secure, 11Winner commits to notifying users and/or authorities of data incidents when required by law and to taking appropriate remedial actions.

Changes to this Privacy Policy

11Winner may update this Policy to reflect changes in law, technology, or business operations. Material updates are communicated through in-app notices or other appropriate means. Continued use of the Services after the effective date of changes signifies acceptance of the revised terms.