WINR Alchemist – Privacy Policy

Last updated: September 2026

If you are located in the United States, please refer to the link below for information on how your personal data is processed.

If you wish to read this Notice in your native language, you can access Google Translate in your browser or contact us using the details below.

1. Introduction

WINR Alchemist Pty Ltd (“WINR Alchemist”, “we”, “our, “us”) is a global leader in identity resolution and digital advertising and is registered in Australia with business number 57 697 222 129.

Our registered offices is located at 56 Berry Street, North Sydney, 2060, New South Wales, Australia.

As a controller and third-party data company, we source personal data from our data partners from online competitions, sales promotions, prize draws, surveys, coupon and sample websites (collectively “Promotional Websites”).  We also source personal data from publicly available sources, including but not limited to public directories and other officially published records, where permitted (collectively “Public Data”). We provide multinational AdTech companies with data driven identity resolution services and solutions.

2. Who this policy applies to?

This Privacy Policy applies globally to all individuals whose personal data is processed by WINR Alchemist except for residents of the United States, who should refer to our U.S. Privacy Policy.

As a global business, WINR Alchemist processes personal data relating to individuals in multiple jurisdictions. We are committed to complying with the privacy laws that apply to our processing activities. Depending on where you are located and the applicable law, this may include, for example:

• the EU General Data Protection Regulation (GDPR);
• the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018;
• Australia’s Privacy Act 1988, including the Australian Privacy Principles;
• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA);
• Brazil’s Lei Geral de Proteção de Dados (LGPD);
• New Zealand’s Privacy Act 2020
• Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and
• other applicable privacy and data protection laws in jurisdictions where WINR Alchemist operates.

This Privacy Policy describes our global approach to privacy and data protection. Where applicable law provides you with specific privacy rights, we will honour those rights and respond to your privacy rights request within the timeframes required by the applicable law.

3. What categories of personal data do we process and share?

Personal data means any information used to identify directly or indirectly a specific individual. We collect different types of your personal data through our data partners who operate the Promotional Websites.

These types can be summarised into the following categories:

• Identity – This relates to information including full name, date of birth, and gender.
• Contact – This relates to information including residential address, email address, and telephone number.
• Technical – This relates to information including data source, and IP address.
• Website and device usage, and similar information collected by automated means – This relates to information including cookies and similar technologies.

Public Data is restricted to Identity and Contact categories. 

We do not process or share personal data of individuals under the age of 18 years old, special category or sensitive data, or personal data relating to criminal convictions and offences.

4. What are the purposes for processing and sharing your personal data?

Your personal data is used by us and our global partners and customers for the following purposes:

Digital Advertising – providing personalised advertising and content that is relevant to you. This may involve identity resolution for data analysis, matching and linkage.

Legal Obligations – when we are required to process your data to comply with applicable laws and regulations, and to establish, exercise, or defend against legal claims.

You can ask us to stop processing or sharing your details at any time at: privacy rights webform.

We DO NOT use your personal data for the purpose of direct marketing including email marketing, telephone marketing, SMS marketing, or postal marketing.

We DO NOT use automated decision-making or profiling to make decisions that produce legal or similarly significant effects concerning you. 

5. What legal basis do we use for processing and sharing your personal data?

Your personal data must be processed by us and shared to third parties based on one or more valid legal basis. This processing is carried out in accordance with applicable data protection laws, either under legitimate interest (as permitted under Article 6(1)(f) of the GDPR and equivalent frameworks) or under fair and reasonable practices for maintaining data accuracy, integrity, and security.

We rely on the legal basis of legitimate interests for the purpose of digital advertising relating to individuals located in the following jurisdictions:

• European Economic Area (EEA)
• United Kingdom (UK)
• Switzerland
• Brazil
• Indonesia
• Philippines
• Singapore
• South Africa
• Thailand

Where required, we rely on the legal basis of consent for the purpose of digital advertising relating to individuals located in the following jurisdictions:

• Australia
• Argentina
• New Zealand
• Canada
• Colombia
• Malaysia
• Mexico
• Taiwan

In the event of an investigation by a court or regulatory body, we will rely on the legal basis of compliance with legal obligations.

Legitimate Interest grounds

We process and share your personal data with our global partners for the following legitimate commercial interests:

• To develop and enhance our identity resolution services and solutions for the benefit of customers through data analysis, matching and linkage.
• To help make online communication more personalised and relevant.
• To determine the effectiveness of our global partners’ advertising campaigns.

For all data processing activities, we conduct legitimate interest assessments. These are detailed evaluations to ensure we have balanced the need of processing against your rights and interests for minimal privacy impact.

Consent

Where required, with your consent we process, use, and disclose your personal data to our global partners for the purpose of digital advertising.

You can withdraw your consent for these purposes at any time at: privacy rights webform.

Compliance with legal obligations

If we are asked to share your personal data with a court or regulatory body for an investigation following a complaint, request, or otherwise, we will do so to comply with legal obligations, and to establish, exercise, or defend against legal claims.

6. Who do we share your personal data with?

We may share your personal data with the following categories of recipients:

• Advertising personalisation and technology
• Insurance
• Lifestyle
• Media/publishing
• Professional advisors and consultants
• Processors acting on our behalf, including WINR Services Pty Ltd, which provides technology, hosting, operational support and other data processing services on our behalf
• Other entities as required under applicable law or in the event of a sale or transfer of our business.

Our global partners

We may share your personal data with the following partners listed below.

The below list of our global partners may change from time to time, so please regularly review this Notice for updates.

• Audience Acuity LLC
• Dentsu UK Limited
• Epsilon Data Management LLC
• Eyeota (a Dun & Bradstreet Company)
• Equifax Australia Holdings Pty Ltd
• Equifax New Zealand Information Services and Solutions Limited
• Experian Australia Pty Ltd
• Hightouch (Carry Technologies, Inc)
• Liveramp
• Livewire
• ManageYourID Inc
• Yahoo
• Zeta Global Corp

7. International data transfers

We may transfer your personal data to recipients in countries located outside your home country. When we transfer your personal data cross border, we ensure compliance with applicable laws and privacy practices outlined in this Notice and our policies.

In cases where the data protection laws in recipient countries differ from those in your home country, we take all necessary steps to ensure your personal data receives adequate protection and safeguards to meet the requirements of applicable laws.

If we transfer your personal data cross border, we rely on the following safeguards:

Adequacy Decisions – adopted by European Commission based on Article 45 of General Data Protection Regulation (“GDPR”) 2016/679 of European Union. For more information, and to access the full list of countries deemed adequate to date, please visit: EU adequate countries;

UK Secretary of State – based on Article 45 of the UK GDPR and Section 17A of the Data Protection Act 2018. For more information, and to access the full list of countries deemed adequate to date, please visit: ICO adequate countries; or

The European Commission’s Standard Contractual Clauses (“SCCs”) and the UK Information Commissioner’s Office International Data Transfer Addendum (“IDTA”), as applicable, supplemented by additional security measures as recommended by the European Data Protection Board. The European Commission’s and the UK’s Information Commissioner’s Office have determined that the SCCs and IDTA may provide sufficient safeguards to protect personal data transferred outside the EEA and the UK. For more information, please visit: standard contractual clauses.

As a matter of best practice, we apply a consistent global approach to international data transfers, even where the GDPR or UK GDPR does not apply or local laws impose less stringent requirements. This includes implementing appropriate contractual, technical and organisational safeguards designed to protect personal data throughout the transfer and subsequent processing, while also complying with any additional requirements imposed by applicable local laws.

Where required, we perform transfer impact assessments and regularly monitor such transfers to ensure that the safeguards implemented continue to provide an appropriate level of protection in accordance with applicable laws.

If you wish to obtain a copy of the safeguards we use to transfer personal data outside of your jurisdiction, you can email us at: Privacy@winrdata.com or write to us at:

56 Berry Street
North Sydney, 2060
New South Wales, Australia

8. Security

We maintain appropriate technical, organisational, and administrative security measures, underpinned by an ISO/IEC 27001:2022-certified information security management system, to protect any personal data we store from accidental, unlawful, or unauthorised access, alteration, destruction, disclosure, loss, or misuse. This includes access controls, encryption, regular risk assessments, and staff training to ensure these protections are applied consistently across our operations.

We have secure infrastructure hosted by Amazon Web Services, designed to minimise risk and protect your personal data. Among other practices, we use encryption and hashing standards when we process and share your personal data.

If you wish to obtain a copy of our security measures and certifications, you can email us at: Privacy@winrdata.com or write to us at:

56 Berry Street
North Sydney, 2060
New South Wales, Australia

9. How long do we store your personal data?

We ensure that your personal data is retained only for as long as necessary to fulfil the specific purposes for which it was collected and processed while respecting your privacy rights and regulatory requirements.

We determine the appropriate retention period of personal data for each processing activity based on the following criteria:

• Whether the personal data remains necessary to operate or provide our services and solutions. 
• Whether we are required to retain the personal data to comply with a legal obligation, and for how long. 
• Whether our contractual requirements with global partners oblige us to retain the personal data. 
• Whether we have a legitimate commercial interest or legal purpose for retaining the personal data, such as fraud prevention, record-keeping, promoting safety, security and integrity, or enforcing our legal rights. 

Category of personal data	Retention period
Data actively used to deliver our core services and solutions	Retained for as long as the relevant service remains active. Reviewed at least annually, and deleted or anonymised once no longer required.
Data in transit through our processing pipelines and temporary working files	Up to 90 days.
Processed data retained for audit, reprocessing, or recovery purposes, and related system deployment records	Up to 180 days.
System and operational logs	Up to 90 days.

10. How can you exercise your privacy rights?

Depending on your country and applicable law, you may have the right to:

• Opt out of sharing your personal data with third parties.
• Access a copy of your personal data.
• Rectify or update your personal data.
• Restrict or object to processing of your personal data.
• Request deletion of your personal data.
• Receive the personal data you provided to us to transmit it to another company.
• Withdraw any consent provided.
• Review an automated decision where it produces legal effects concerning you or significantly affects you.

You, or your authorised representative, can submit a request to exercise your privacy rights at: privacy rights webform.

You, or your authorised representative, can request a copy of our Data Subjects Rights Policy or contact our Data Protection Officer at any time by email to: Privacy@winrdata.com or by letter to our office at:

56 Berry Street
North Sydney, 2060
New South Wales, Australia

We remind you of your right to lodge a complaint with your supervisory authority or regulator should you feel unsatisfied with our treatment of your personal data.

11. Our Website Privacy Practices

We collect identifiable personal data from this website when you choose to provide it to us. For example, you may choose to send information about yourself in an email, or by completing a form on the website. We use this information only to contact you to respond to your inquiry. Once collected, we will store such information for a reasonable time for record keeping purposes.

We also automatically collect pseudonymous personal data from visitors to this website, including your IP host address, pages viewed, browser type, Internet Service Provider, domain name, the time/date of your visit to this website, the referring URL and your computer’s operating system.

Cookies

WINR Alchemist uses cookies or similar technologies to analyse trends and administer the website. Users can control the use of cookies at the individual browser level. Please visit our Cookie Policy page for more information. For more general information about cookies, please visit: http://www.allaboutcookies.org/cookies/.

12. Changes to this Notice

We are constantly improving our website and services, so we may change this Notice from time to time. We will review this Notice on a quarterly basis. You can see when this Notice was last updated by reviewing the date at the bottom of this page. You are responsible for periodically reviewing this Notice for any changes. We will alert you about material changes by placing a notice on our website.

13. Contact Details

You, or your authorised representative, may contact our Data Protection Officer at any time by email to Privacy@winrdata.com  or by letter to our offices at:

56 Berry Street
North Sydney, 2060
New South Wales, Australia

EU Representative: We have appointed VeraSafe Ireland Limited as our representative in the EU for data protection matters. To contact VeraSafe, please use this contact form: https://verasafe.com/public-resources/contact-data-protection-representative, or via telephone at: +420 228 881 031, Address: Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland.

UK Representative: We have appointed VeraSafe United Kingdom Limited as our representative in the UK for data protection matters. To contact VeraSafe, please use this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003, Address: 37 Albert Embankment, London, SE1 7TL, United Kingdom.

In accordance with registration requirements, we are registered to the UK ICO under number ZC160017.

Should you wish to exercise any of your privacy rights by email or letter, your personal data will be uploaded to our secure privacy rights platform for the management of your requests.