Pickwin Offers Data Deletion Only Where the Law Provides It and Keeps Transaction Records at Least Five Years

The policy is issued by NALATE SRL, registered in Costa Rica under number 3-102-918278, which operates pickwin.com under the PickWin brand, and it was last updated on 8 August 2026. It covers the casino and the sportsbook, and it names no data-protection law. Every right it lists depends on applicable law, and the policy leaves each player to work out which law that is.

• Identity checks reach the face and the source of wealth. The policy lists: "Verification data: identification documents, proof of address, photographs, selfies, liveness or facial-verification checks, occupation, source-of-funds or source-of-wealth information, and KYC, sanctions or politically exposed person screening results." The check can go past a player's documents to their face and the origin of their money.
• Devices are fingerprinted. Technical data covers IP address, location where necessary, device and browser details, device identifiers or fingerprints, login activity, authentication attempts and security logs. A player can be recognised by the device as well as by the account.
• Five years is the floor, from the last activity. "Customer transaction information is generally retained for at least five (5) years from the player’s last activity under applicable record-keeping requirements." KYC and due-diligence records may be kept for at least five years after the business relationship ends, or longer where required by law, an investigation, self-exclusion, complaint, chargeback or proceeding. Every new session moves the start of the five years forward, and the policy sets no maximum period.
• Deletion depends on a law the policy does not name. Access, correction, an explanation of how data was used and withdrawal of consent are listed for every player, subject to applicable law, identity verification and lawful exceptions. "Where applicable law provides, you may also request deletion, restriction or portability, or object to certain processing." The policy then adds: "We may refuse or limit a request where information must or may lawfully be retained, including for AML/CFT, regulatory, tax, security, fraud, self-exclusion, dispute or third-party rights purposes." The refusal reaches data the law merely allows Pickwin to keep, not only data it must keep.
• No sale, a long list of recipients. "We do not sell or rent personal information." Data may be disclosed, where reasonably necessary, to affiliates and partners, game and platform providers, payment processors and crypto services, KYC and fraud-prevention providers, the Tobique Gaming Commission, an authorised Direct Licensee, tax and law-enforcement bodies, and buyers or investors in a merger or asset sale. The regulator is named, and the licensee that may also receive the data is not.
• Transfers abroad, safeguards where the law requires them. Data may be stored or processed outside the player's country of residence, Canada or the European Economic Area, where different rules may apply. Contractual, organisational and technical safeguards are used where required by law. Where no law requires them, the policy promises none.
• Publicity needs a lawful basis, and consent only where required. "We will not publicly use your name, image, username, location or winnings for advertising without an appropriate lawful basis and, where required, your specific consent." Separate publicity rules may be set in contest terms before entry. A winner's name can appear in an advertisement on a lawful basis other than the winner's consent.
• Marketing can be stopped, account messages cannot. Offers by email, SMS or notification follow the player's choices, and unsubscribing works through the message, account settings or support@pickwin.com. Withdrawing marketing consent does not stop account, security, payment, responsible-gaming or legal communications. The player controls the promotions, not the service messages.
• One inbox for every request, and notice of material changes. Questions, rights requests and complaints about personal data all go to support@pickwin.com, and no Data Protection Officer is named. Unresolved complaints about account administration or gaming go through the complaint link in the Tobique Gaming Commission seal. For a material change to the policy, Pickwin will give appropriate notice and obtain renewed consent where required by law. A privacy request reaches the same queue as a question about a bonus.

The policy is short and lists what it collects and why. What it leaves open is the law behind the rights: deletion, objection and portability exist where some applicable law provides them, and a request can be refused for data Pickwin may lawfully keep.