The Codex of Your Digital Sovereignty

Your choice to use 1Win Kenya is based on trust. This document outlines our unwavering commitment to protecting your personal information. We provide clear details on the types of data collected and the valid, lawful grounds for processing it, ensuring strict compliance with the Data Protection Act, 2019 and mandatory Anti-Money Laundering (AML) regulations in Kenya. By continuing to access our services, you confirm your acceptance of these protocols, which are designed to safeguard the entire betting community.

What Information is Collected by 1Win Kenya?

We practice data minimization, gathering only the information strictly required for service delivery, security, and legal obligations.

Identity Verification Records 

This data is crucial for confirming your legal identity and eligibility:

• Identification Core: Your full legal name, date of birth, nationality, and the official number from your Kenyan National ID or Passport.
• Communication Details: Your primary mobile number (necessary for secure M-Pesa/Airtel Money transactions), current email address, and physical residential address (for compliance purposes).

Financial and Transactional History (For Account Audit)

We track this information solely for payment execution, account auditing, and adherence to tax requirements:

• Betting Ledger: Comprehensive history of all account activity, including deposits, withdrawals, specific bets, payouts received, and the automatic 20% Withholding Tax (WHT) deductions.
• Funding Source: Details identifying the mobile or bank account used for all transactional interactions with your 1Win account.

Technical Usage Information (For Optimisation)

This data is utilized to enhance the user experience, troubleshoot issues, and protect against security threats:

• Device Characteristics: Your IP address, device type, operating system details, and a unique internal identifier for the specific mobile device used (relevant for the 1Win app).
• Usage Patterns: Logs detailing time spent on the site, pages navigated, feature usage frequency, and data related to technical performance.

The Legal Basis for Data Processing

Every processing action is justified by a clear operational or legal requirement:

• Contract Execution (Service Delivery): We process your Identity, Contact, and Transaction data to fulfill our agreement with you—i.e., operating your betting account and executing payouts.
• Statutory Compliance (AML, KRA, BCLB): Processing your Identity, Financial, and Technical data is a legal mandate under Kenyan law to meet AML directives and KRA tax reporting obligations.
• Business Protection (Security & Fair Play): We rely on our legitimate interest to use Technical, Usage, and Identity data to proactively detect and mitigate fraud, technical abuse, and syndicate betting.
• Opt-in Consent (Promotional Offers): We use Contact and Usage data for marketing only when we have obtained your clear, affirmative, and revocable consent.
• Defence of Claims (Resolution): Transaction History and Correspondence records may be used as evidence to resolve internal disputes or defend against external legal action.

Regulatory Requirement: Strict compliance with Kenyan financial and gambling legislation requires us to verify every customer's ID and maintain detailed transaction records for legally mandated periods.

Third-Party Data Disclosures

We solemnly confirm that we will never sell your personal information. Disclosure only occurs under strict, legally controlled circumstances:

• Regulatory Compliance: Essential data is shared with government bodies, including the BCLB (Betting Control and Licensing Board), KRA (Kenya Revenue Authority) for tax deductions, and the FRC (Financial Reporting Centre) for anti-money laundering checks.
• Payment Facilitation: We share only necessary transaction data with our mobile money partners (M-Pesa, Airtel Money) and banks to complete your deposits and withdrawals.
• Security Partners: We use specialized third-party services for secure identity screening and fraud prevention against external databases.
• Legal Obligation: We will disclose data if compelled by a formal, legally enforceable court order or directive from an authorized Kenyan government authority.

Data Security: Our Protective Measures

The safeguarding of your data is a paramount priority, achieved through state-of-the-art measures:

• Encryption: All data transmission is secured using robust SSL/TLS protocol, ensuring your data is scrambled during transit.
• Internal Controls: Access to sensitive data is rigorously controlled, granted only to employees whose specific duties absolutely require it ("need-to-know" basis).
• System Monitoring: We employ advanced firewalls and continuous system monitoring to swiftly identify and counteract any potential security breaches.

Data Retention Policy

Legal requirements prevent us from deleting your records immediately upon request:

• Statutory Retention: Core records must be retained for a minimum of seven (7) years following the closure of your account, mandated by Kenyan anti-money laundering and tax laws.
• Marketing Withdrawal: Your information is purged from all active marketing lists the moment you revoke your consent.

Your Rights Under Kenya's Data Protection Act

As a user, you possess fundamental rights concerning your personal information:

• The Right of Transparency: We must clearly and accurately inform you about our data collection practices (as performed in this policy).
• The Right to Receive Data: You have the right to request a copy of the personal information we hold about you, which we will provide within the statutory 30-day period.
• The Right to Correct Data: You may request the prompt correction of any inaccurate or outdated personal details held in your account file.
• The Right to Withdraw Consent: You may object to or withdraw your consent for direct marketing processing at any time.
• The Right to Request Deletion: While you can request account closure, we are legally compelled to maintain your core transaction data for the obligatory 7-year retention period.
• The Right to Appeal: You can lodge a formal complaint with the Office of the Data Protection Commissioner in Kenya if you believe we have failed to protect your rights.

FAQ