Privacy Policy Bomberwin –
Your Data Is Safe and Always Protected

Bomberwin only collects data that is strictly necessary to operate our services safely and effectively. We do not collect excessive data unrelated to that purpose. The following are the categories of data we collect:

Every piece of data we collect is used for specific, accountable purposes. We do not use data in ways that conflict with our members' interests:

• Account operations: Creating, verifying, and securely managing member accounts.
• Transaction processing: Processing deposits, withdrawals, and all other financial transactions accurately and on time.
• Identity verification (KYC): Ensuring every account is owned by a real individual who meets the age and legal requirements.
• Fraud prevention: Detecting and preventing suspicious activity, multi-accounting, bonus abuse, and other illegal actions.
• Service improvement: Analyzing usage patterns (in anonymous and aggregated form) to improve platform performance and develop new features.
• Communication: Sending account-related information, transaction confirmations, security updates, and relevant promotions to members who have given their consent.
• Legal compliance: Meeting the reporting and audit requirements mandated by licensing authorities and applicable regulations.

Bomberwin does not use member personal data for third-party advertising, profile selling, or any commercial purpose unrelated to our services.

Member data security is the foundation of the trust we build. bomberwin applies a multi-layered security standard covering technical, operational, and administrative aspects:

• Encryption in transit: All data transmitted between your device and bomberwin servers is encrypted using TLS 1.3 — the same standard used by world-class digital banking.
• Encryption at rest: Sensitive data stored in our databases is encrypted using AES-256, making it unreadable even in the event of a database breach.
• Layered access control: Only bomberwin personnel with special authorization can access certain member data, and every access is recorded in an immutable audit log.
• Certified infrastructure: bomberwin servers are hosted in data centers certified to ISO 27001 and compliant with international security standards.
• 24/7 monitoring: Our security systems monitor for potential threats in real time and respond to security incidents within minutes.
• Regular penetration testing: We periodically engage independent third parties to test system security and patch any vulnerabilities found.

Bomberwin does not sell, rent, or trade members' personal data to anyone. Data may only be shared under very limited circumstances:

• Operational service providers: Technology partners such as payment gateways, cloud service providers, and anti-fraud systems that require limited data access to perform their specific functions. All such partners are bound by strict confidentiality agreements.
• Legal obligation: If required by court order, regulation, or a formal request from a legitimate competent authority. In such cases, bomberwin will only provide the minimum data requested.
• Platform rights protection: In situations where it is necessary to prevent fraud, protect Bomberwin's assets, or defend our legal rights.
• Explicit member consent: If you have actively and knowingly given consent for a specific purpose not listed above.

All third parties with access to member data are required to comply with data protection standards equivalent to or stricter than our own.

The bomberwin website and app use cookies and similar technologies to enhance the user experience and maintain session security. The cookies we use fall into several categories:

• Essential cookies: Required for the platform to function properly — such as keeping your login session active and remembering your language preferences. These cookies cannot be disabled.
• Functional cookies: Storing preferences such as display settings and notifications to deliver a more personalized experience. You can choose to disable these from your browser settings.
• Analytics cookies: Collecting data on how users interact with the platform in anonymous and aggregated form — to help us understand what is working well and what needs improvement.
• Security cookies: Helping our system detect suspicious activity, prevent CSRF attacks, and protect login sessions from hijacking.

As a bomberwin member, you have full rights over the personal data we manage. We respect and uphold these rights:

Bomberwin retains members' personal data for as long as necessary to fulfill the purpose for which it was collected, and no longer. Our general data retention guidelines are as follows:

• Active account data: Retained for as long as the account remains active, plus any additional period required by financial regulations.
• Financial transaction data: Retained for a minimum of 5 years in accordance with industry standards and applicable audit requirements.
• KYC documents: Retained for the duration the account is active and for up to 5 years after account closure, in accordance with applicable anti-money laundering regulations.
• Access and security logs: Retained for 12 months for security investigation and fraud prevention purposes.
• Closed account data: After an account is closed, personal data no longer required for regulatory purposes will be deleted or anonymized within 90 days.
• Marketing data (where consent is given): Retained until you withdraw consent or request deletion.

Bomberwin strictly prohibits individuals under the age of 18 from using our services. This platform is designed exclusively for adults, and we take active steps to prevent access by minors.

We do not knowingly collect personal data from minors. If we discover that data from an individual under 18 has been collected — whether through identity falsification or any other means — that data will be immediately deleted and the associated account permanently closed.

To deliver reliable and secure services, bomberwin uses technology infrastructure that may include servers in various geographic locations. This means your data may be processed outside your country of residence.

In such situations, Bomberwin ensures that all cross-border data transfers are protected by data processing agreements that meet international standards, including standard contractual clauses that provide protection equivalent to that of the data's originating jurisdiction.

All infrastructure partners we work with are selected based on their security capabilities and compliance with relevant international data protection standards.

Bomberwin may update this Privacy Policy from time to time to reflect changes in our data management practices, technology updates, or applicable regulatory changes.

For significant changes — particularly those that materially affect member rights — we will provide clear advance notice via in-platform notifications or email to the registered address, at least 14 days before the changes take effect.

Continued use of the service after the effective date of any changes constitutes acceptance of the updated Privacy Policy. We recommend you review this page periodically.

Previous versions of this Privacy Policy are kept in our archives and can be requested by members who wish to review the changes made.

If you have questions, concerns, or wish to exercise the privacy rights described above, there are several ways to contact us:

• Live chat: The fastest way is through the live chat feature available 24 hours a day on the Bomberwin website and app.
• Support email: Send a message to our official email address at [email protected] with the subject line "Privacy Request".
• FAQ Page: Many common questions about privacy and security have been answered in FAQ page ours.

We are committed to responding to all privacy-related requests within 5 business days for general inquiries, and within 30 business days for formal rights requests that require a more in-depth process.