Privacy Policy – Nexus US

WINR Nexus – U.S. Privacy Policy

Last updated: October 2026

If you are not located in the United States, please refer to the link below for information on how your personal data is processed.

1. Introduction

WINR Data Pty Ltd (trading as “WINR Nexus”), referred to in this policy as “WINR Nexus”, “we”, “our” or “us” is a global leader in identity verification, identity assurance and fraud prevention and is registered in Australia with business number 73 653 357 450.

Our registered office is located at 56 Berry Street, North Sydney, 2060, New South Wales, Australia.

This Policy is designed to comply with U.S. privacy laws, including the California Consumer Privacy Act (CCPA) and similar laws in other states (e.g., Colorado, Oregon, Texas, Vermont, and Virginia). It explains how we collect, share, sell and protect personal information of U.S. residents and outlines their rights under applicable U.S. laws.

2. Scope of Privacy Policy

This Policy applies to the personal information collected, used, shared and sold by WINR Nexus, including its affiliates and subsidiaries, in connection with its services. This includes personal information obtained from websites, applications, and interactions with our business partners.

3. Definitions

Personal Information: Information that identifies, relates to, describes, or could reasonably be linked to an individual.

Data Sale & Sharing: Sharing of personal information for monetary or other valuable consideration, as defined under U.S. privacy laws.

Fraud Prevention & Identity Assurance: The use of personal information to help verify identity, age or eligibility, prevent or detect fraud, financial crime and other unlawful activity, support compliance with legal and regulatory obligations, reduce the risk of misuse of personal information, and assist with related identity assurance activities, including anti-money laundering, sanctions screening, debt collection, asset recovery and reuniting individuals with unclaimed assets.

Your personal information is used by us and our global partners and clients for the following purposes:

Fraud Prevention & Identity Assurance – Preventing others from misusing your personal information by verifying identity and ensuring data accuracy. This may involve identity, age and eligibility checks for purposes such as verification, fraud, crime and money laundering prevention, debt collection, asset recovery, and reuniting individuals with unclaimed assets. These efforts help protect individuals and organisations from fraudulent activities.

Legal Obligations – when we are required to process your data to comply with applicable laws and regulations, and to establish, exercise, or defend against legal claims.

We DO NOT use your personal information for the purpose of direct marketing including email marketing, telephone marketing, SMS marketing, or postal marketing.

We DO NOT use automated decision-making or profiling to make decisions that produce legal or similarly significant effects concerning you.

5. Categories of Personal Information Collected, Shared, or Sold

We source personal data from our data partners from online competitions, sales promotions, prize draws, surveys, coupon and sample websites. We also source personal data from publicly available sources, including but not limited to public directories and other officially published records, where permitted. We may supplement this information with reputable sources, such as change-of-address providers, to maintain accuracy and relevance (collectively “Public Data”).

Without limiting the description of the information we collect, we collect the categories of personal information about U.S. consumers identified in the chart below. Below is a breakdown of personal information we collect, share, or sell, along with the purposes and recipients:

Category of Personal Information	Collected by WINR Nexus	Shared With	Purpose for Collection	Shared or Sold
Identifiers (e.g., name, email, address, phone number, IP address)	Yes	Organisations providing identity verification services	Fraud Prevention & Identity Assurance – Supporting age assurance, anti-fraud, anti-money laundering, anti-crime, asset recovery, and debt collection	Yes
Customer Records Information (e.g., contact details)	No		N/A	No
Protected Classifications (e.g., gender, age)	Yes	Organisations providing identity verification services	Fraud Prevention & Identity Assurance	Yes
Commercial Information (e.g., purchase history, transaction details)	No		N/A	No
Biometric Information (e.g., fingerprints, faceprints)	No		N/A	No
Internet Activity (e.g., browsing history, ad interactions)	No		N/A	No
Geolocation Data (e.g., approximate location from IP address)	No		N/A	No
Sensory Data (e.g., voice recordings)	No		N/A	No
Professional or Employment-Related Information (e.g., job history)	No		N/A	No
Education Information (e.g., school records)	No		N/A	No
Inferences (e.g., profiles based on preferences)	No		N/A	No

Public Data is restricted to the Identifiers category.

Personal Information We Do Not Collect, Share or Sell

WINR Nexus collects, shares and sells personal information in limited categories to support identity verification, identity assurance and fraud prevention. WINR Nexus does not collect, share or sell personal information in the following categories:

Personal information of individuals under the age of 18 years old.

Sensitive personal information, including:

Biometric data.
Health-related information.
Financial account information (beyond basic identifiers, where applicable).
Religious or philosophical beliefs.
Sexual orientation or practices.

For more details on your rights, including the right to opt-out of selling your personal information, please refer to Section 7.

6. Disclosure of Personal Information

We may share your personal information with:

Service providers for operational purposes, including providing technology, hosting, operational support and other data processing services.
Business partners for legitimate business use.
Legal authorities as required by law.

We do not process, share or sell personal information relating to individuals under the age of 18 or sensitive personal information of any kind.

We may also collect personal information directly through our website in the following instances:

Employment Inquiries: If you submit an employment application or a general inquiry regarding career opportunities, we may collect personal information such as your name, contact details, resume, and any additional details you choose to provide.
Product or Service Inquiries: If you request information about WINR Nexus’s products or services, we may collect your name, company name, email address, phone number, and details about your inquiry to respond effectively.

Personal information collected for these purposes will only be used to fulfil your specific request and will not be shared or sold for unrelated purposes.

7. Your Privacy Rights

U.S. individuals have the following rights under applicable U.S. laws:

Right to Know: Access details of personal information collected about you.

Right to Correct: Correct inaccuracies in your personal information.

Right to Delete: Request deletion of your personal information, subject to exceptions.

Right to Data Portability: Receive your personal information in a portable format.

Right to Opt-Out: Opt-out of the sale or sharing of your personal information.

Right to Non-Discrimination: WINR Nexus does not discriminate against you if you exercise any of your privacy rights under applicable U.S. laws. As a business-to-business (B2B) organization, WINR Nexus does not sell goods or services directly to U.S. consumers, and your exercise of privacy rights will not impact any data-related interactions or services provided by our clients.

Right to Appeal: If you believe that WINR Nexus has not adequately addressed your privacy rights request or if your request has been denied, you have the right to appeal our decision. For details, refer to Section 17: Right to Appeal.

8. Exercising Your Privacy Rights

To exercise your privacy rights, contact us at Privacy@winrdata.com, or use our privacy rights webform.

If you make a privacy rights request as set out in this Policy, we will confirm your request within 10 business days and make a good faith attempt to fulfill your request within 45 days unless applicable U.S. law requires us to do otherwise.

Verification Process for Consumer Requests

To protect your personal information, we verify the identity of individuals making requests. The steps include:

Initial Verification:

We send an email to the address provided, requesting you confirm control by clicking on a verification link.

Secondary Verification:

If needed, further information may be requested from you to complete the process.

Authorized Agents:

Requests from authorized agents must include proof of authorization (e.g., a signed letter) and may also require direct verification from you.

Request Denials:

If verification fails, we may deny the request and provide an explanation.

These steps ensure we process requests securely and in compliance with applicable U.S. laws.

9. Authorized Agents

You may designate an authorized agent to act on your behalf. Proof of authorization and identity verification will be required.

10. Data Retention

We ensure that your personal information is retained only for as long as necessary to fulfil the specific purposes for which it was collected and processed while respecting your privacy rights and regulatory requirements.

We determine the appropriate retention period of personal information for each processing activity based on the following criteria:

Whether the personal data remains necessary to operate or provide our services and solutions.
Whether we are required to retain the personal data to comply with a legal obligation, and for how long.
Whether our contractual requirements with global partners oblige us to retain the personal data.
Whether we have a legitimate commercial interest or legal purpose for retaining the personal data, such as fraud prevention, record-keeping, promoting safety, security and integrity, or enforcing our legal rights.

Category of personal data	Retention period
Data actively used to deliver our core services and solutions	Retained for as long as the relevant service remains active. Reviewed at least annually, and deleted or anonymised once no longer required.
Data in transit through our processing pipelines and temporary working files	Up to 90 days.
Processed data retained for audit, reprocessing, or recovery purposes, and related system deployment records	Up to 180 days.
System and operational logs	Up to 90 days.

11. Security Measures

We maintain robust technical, organisational, and administrative security measures to protect personal information from unauthorized access, alteration, disclosure, destruction, loss, or misuse. We are certified under ISO/IEC 27001, the internationally recognised standard for information security management. This certification demonstrates our commitment to maintaining a secure environment for personal information.

Our secure infrastructure is hosted by Amazon Web Services (AWS), which is designed to minimize risks and protect your personal information. Among other practices, we use encryption and hashing standards when processing, sharing and selling personal information to ensure its confidentiality and integrity.

If you wish to obtain a copy of our security measures and certifications, you can email us at Privacy@winrdata.com.

12. Children’s Privacy

We do not process, share or sell personal information of individuals under 18 years old. Our services are not directed to children under 18 years of age, and we do not knowingly collect personal information from them.

13. Registration as a Data Broker

WINR Nexus is registered as a data broker, where required, including in California, Oregon, Texas, and Vermont. For further details, contact us using the information provided below.

14. Our Website Privacy Practices

We collect identifiable personal data from this website when you choose to provide it to us. For example, you may choose to send information about yourself in an email, or by completing a form on the website. We use this information only to contact you to respond to your inquiry. Once collected, we will store such information for a reasonable time for record keeping purposes.

We also automatically collect pseudonymous personal data from visitors to this website, including your IP host address, pages viewed, browser type, Internet Service Provider, domain name, the time/date of your visit to this website, the referring URL and your computer’s operating system.

Personal information from your interactions with us is never added to our products.

15. Cookies and Opt-Out Mechanisms

WINR Nexus uses cookies and similar technologies to analyse trends, administer this website, and deliver a better user experience. Cookies may also be used to collect data for analytics or advertising purposes. Users can control the use of cookies at the individual browser level. For more information, please visit our Cookie Policy page or learn more about cookies at http://www.allaboutcookies.org/cookies/.

WINR Nexus does not directly collect personal information for product usage and hence browser-based opt-out preference signals, such as the Global Privacy Control (GPC), have no impact. You can exercise your privacy rights, including opting-out of the sale of your personal information via our Privacy Portal.

16. Changes to This Policy

This Policy may be updated periodically. Material changes will be communicated through our website or other appropriate channels. The effective date of changes will be noted.

17. Contact Information

For questions or concerns about this Policy, please contact us:

Email: Privacy@winrdata.com

Address: WINR Nexus, 56 Berry Street, North Sydney, 2060, New South Wales, Australia.

Privacy Portal: https://privacy.winrcorp.com/

18. Right to Appeal

If you believe that we have not adequately addressed your privacy rights request or if your request has been denied, you have the right to appeal our decision. You may submit an appeal directly to us by contacting Privacy@winrdata.com. If you are not satisfied with the outcome of your appeal, you may file a complaint with the relevant state authority. Below are state-specific resources where you can escalate your appeal:

California: California Attorney General’s Office

Colorado: Colorado Attorney General’s Office

Connecticut: Connecticut Department of Consumer Protection

Delaware: Delaware Department of Justice (DPDPA)

Florida: Florida Office of the Attorney General (FDBR)

Iowa: Iowa Office of the Attorney General (ICDPA)

Indiana: Indiana Office of the Attorney General (Consumer Protection Division)

Kentucky: Kentucky Office of the Attorney General

Maryland: Maryland Attorney General’s Consumer Protection Division

Montana: Montana Office of the Attorney General (MCDPA)

Nebraska: Nebraska Attorney General’s Office

New Hampshire: New Hampshire Attorney General’s Office