Privacy and Data Protection Policy

Effective Date: 24.09.2025
Website: rovadigital.co.ke
Operator: 1win Kenya
Last Updated: 24.09.2025

LEGAL DISCLAIMER: This privacy policy template requires review by qualified legal counsel familiar with Kenyan data protection laws, gambling regulations, and the Kenya Data Protection Act 2019 before implementation.

1. Regulatory Framework and Compliance

1win Kenya operates under the jurisdiction of the Republic of Kenya and maintains strict compliance with:

• The Kenya Data Protection Act, 2019
• The Betting Control and Licensing Board (BCLB) regulations
• The Central Bank of Kenya (CBK) guidelines for financial transactions
• The Communications Authority of Kenya data handling requirements

As a licensed sports betting and casino operator in Kenya, 1win is committed to transparent data handling practices that exceed regulatory minimums while protecting user privacy rights.

2. Information Collection and Processing Foundations

2.1 Personal Identification Data

When creating an account with 1win Kenya through rovadigital.co.ke, we collect essential verification information required by Kenyan gambling law:

• Identity Verification: Full legal name, date of birth, national ID or passport number
• Contact Information: Physical address in Kenya, mobile phone number, email address
• Financial Details: Bank account information, mobile money details (M-Pesa, Airtel Money)
• Employment Status: Occupation and income verification as required by anti-money laundering protocols

2.2 Gaming and Betting Activity Records

To ensure responsible gambling and regulatory compliance, 1win Kenya maintains comprehensive records of:

• Sports betting selections, odds, and stake amounts
• Casino game sessions, including time spent and wagering patterns
• Account deposit and withdrawal histories
• Bonus utilization and promotional activity
• Self-exclusion requests and responsible gambling tool usage

2.3 Technical and Behavioral Analytics

Our platform automatically captures technical data to enhance security and user experience:

• Device information, IP addresses, and location data within Kenya
• Browser specifications, operating system details
• Session duration, page navigation patterns
• Network connectivity and performance metrics

3. Lawful Processing Purposes and Legal Basis

3.1 Regulatory Compliance Processing

Under Kenyan law, 1win processes personal data for mandatory compliance purposes:

• Age Verification: Ensuring all users are 18+ as required by BCLB regulations
• Identity Authentication: Preventing fraud and maintaining gaming integrity
• Financial Crime Prevention: Anti-money laundering (AML) and know-your-customer (KYC) procedures
• Responsible Gambling: Monitoring for problem gambling indicators and providing intervention

3.2 Service Delivery and Account Management

We process your information to deliver core betting and casino services:

• Processing sports bets and casino wagers
• Managing account balances and financial transactions
• Providing customer support and dispute resolution
• Delivering promotional offers and loyalty rewards

3.3 Security and Fraud Prevention

1win employs advanced data processing for platform security:

• Detecting suspicious betting patterns or account activity
• Preventing unauthorized access and account takeovers
• Maintaining system integrity against cyber threats
• Investigating potential violations of terms and conditions

4. Data Sharing and Third-Party Disclosures

4.1 Regulatory Authorities

1win may disclose personal information to Kenyan regulatory bodies when legally required:

• Betting Control and Licensing Board: For licensing compliance and investigation purposes
• Financial Reporting Centre (FRC): For suspicious transaction reporting
• Kenya Revenue Authority: For tax compliance and withholding obligations
• Data Protection Commissioner: For data protection compliance verification

4.2 Essential Service Providers

We engage vetted third parties to support platform operations while maintaining data protection standards:

• Payment Processors: Licensed financial institutions and mobile money operators in Kenya
• Identity Verification: KYC service providers compliant with Kenyan banking regulations
• Cloud Infrastructure: Secure hosting providers with data centers meeting international security standards
• Customer Support: Specialized gambling industry support services

4.3 Marketing and Analytics Partners

With explicit consent, 1win may share anonymized data with:

• Digital marketing agencies for promotional campaign optimization
• Sports data providers for enhanced betting odds and statistics
• Analytics platforms for user experience improvement (anonymized data only)

5. Data Security and Protection Measures

5.1 Technical Safeguards

1win Kenya implements enterprise-grade security measures:

• Encryption: SSL/TLS encryption for all data transmission
• Database Security: Encrypted storage with access controls and audit trails
• Network Protection: Firewalls, intrusion detection, and DDoS protection
• Authentication: Multi-factor authentication for sensitive account operations

5.2 Organizational Controls

Our internal data governance framework includes:

• Regular security training for all staff handling personal data
• Strict access controls based on job function and necessity
• Third-party security audits and penetration testing
• Incident response procedures for potential data breaches

5.3 International Standards Compliance

1win maintains security certifications including:

• ISO 27001 information security management
• PCI DSS compliance for payment card processing
• SOC 2 Type II for service organization controls

6. User Rights Under Kenyan Data Protection Law

6.1 Access and Transparency Rights

As a data subject in Kenya, you have the right to:

• Data Access: Request copies of all personal data we hold about you
• Processing Information: Understand how and why your data is being processed
• Source Disclosure: Know the origin of your personal information
• Recipients List: Identify who has received your personal data

6.2 Control and Correction Rights

You maintain control over your personal information through:

• Data Rectification: Correct inaccurate or incomplete personal data
• Profile Updates: Modify account information and preferences
• Consent Withdrawal: Revoke consent for marketing communications
• Processing Objection: Object to certain types of data processing

6.3 Deletion and Portability Rights

Subject to regulatory requirements, you may request:

• Data Erasure: Deletion of personal data (right to be forgotten)
• Data Portability: Transfer of your data to another service provider
• Processing Restriction: Limitation of how we use your data

Note: Some rights may be limited by gambling regulations requiring record retention for compliance purposes.

7. Data Retention and Deletion Schedules

7.1 Active Account Data

While your 1win account remains active, we retain:

• Account Information: Maintained for ongoing service delivery
• Transaction Records: 7 years as required by Kenyan financial regulations
• Communication Logs: 3 years for customer service quality assurance
• Gaming Activity: 5 years for regulatory compliance and dispute resolution

7.2 Closed Account Processing

Following account closure, 1win retains data according to legal requirements:

• Identity Documents: 7 years (AML/KYC compliance)
• Financial Records: 7 years (taxation and audit requirements)
• Gambling Activity: 5 years (BCLB record-keeping requirements)
• Marketing Data: Deleted within 30 days unless consent withdrawn earlier

7.3 Automated Deletion Processes

Our systems automatically purge:

• Technical logs and analytics data after 24 months
• Temporary session data within 24 hours
• Promotional preferences for inactive accounts after 12 months

8. International Data Transfers and Cross-Border Processing

8.1 Data Localization Commitment

1win Kenya prioritizes keeping personal data within Kenya's borders through:

• Primary data processing servers located in Kenya
• Local backup and disaster recovery facilities
• Kenyan-registered payment processing partners

8.2 Limited International Transfers

Where international transfers are necessary for service delivery, we ensure:

• Adequacy Decisions: Transfers only to countries with adequate data protection
• Contractual Safeguards: Standard contractual clauses for third-party processors
• Technical Measures: Encryption and pseudonymization for transferred data
• Access Controls: Strict limitations on who can access Kenyan user data

8.3 Regulatory Approval

All international data transfers comply with:

• Data Protection Commissioner registration requirements
• BCLB approval for gambling-related data processing
• CBK authorization for financial transaction data

9. Cookies and Tracking Technologies

9.1 Essential Platform Cookies

1win uses necessary cookies for core platform functionality:

• Authentication Cookies: Maintaining secure user sessions
• Security Cookies: Fraud prevention and account protection
• Preference Cookies: Remembering user settings and language
• Load Balancing: Optimizing platform performance

9.2 Analytics and Performance Tracking

With your consent, we employ analytics tools to:

• Monitor website performance and user experience
• Identify technical issues and optimization opportunities
• Analyze popular betting markets and casino games
• Measure promotional campaign effectiveness

9.3 Marketing and Advertising Cookies

Optional marketing cookies enable:

• Personalized promotional offers based on gaming preferences
• Retargeting advertisements on external websites
• Social media integration and sharing capabilities
• Affiliate tracking for partnership programs

Cookie Management: You can control cookie preferences through your browser settings or our cookie consent manager. Disabling essential cookies may limit platform functionality.

10. Responsible Gambling and Data Protection

10.1 Problem Gambling Detection

1win uses personal data to identify potential gambling problems:

• Monitoring betting patterns and frequency
• Tracking deposit amounts and spending velocity
• Analyzing session duration and late-night activity
• Identifying requests for credit or loan products

10.2 Intervention and Support Services

When concerning patterns are detected, we may:

• Send responsible gambling reminders and resources
• Implement temporary account restrictions
• Provide contact information for Kenyan gambling support services
• Facilitate self-exclusion from our platform

10.3 Self-Exclusion Data Processing

Self-exclusion requests trigger specific data handling:

• Immediate account suspension and marketing opt-out
• Retention of exclusion records to prevent re-registration
• Sharing with industry databases to support cross-operator exclusion
• Confidential treatment of exclusion status

11. Contact Information and Data Protection Officer

11.1 Data Protection Enquiries

For privacy-related questions or to exercise your data rights, contact:

1win Kenya Data Protection Officer
Email: privacy@rovadigital.co.ke
Phone: +254 [Phone Number]
Address: [Physical Address in Kenya]
Response Time: Maximum 30 days as per Kenya Data Protection Act

11.2 Customer Support

General enquiries and account support:

Live Chat: Available 24/7 on rovadigital.co.ke
Email: support@rovadigital.co.ke
Phone: +254 [Support Number]

11.3 Regulatory Complaints

If unsatisfied with our data handling, you may lodge complaints with:

• Data Protection Commissioner: [Contact Details]
• Betting Control and Licensing Board: [Contact Details]
• Communications Authority of Kenya: [Contact Details]

12. Policy Updates and Legal Changes

12.1 Amendment Procedures

This privacy policy may be updated to reflect:

• Changes in Kenyan data protection or gambling laws
• New features or services offered by 1win Kenya
• Enhanced security measures or technical capabilities
• Feedback from regulatory authorities or users

12.2 Notification Process

Material changes to this policy will be communicated through:

• Email notification to registered account holders
• Prominent notices on rovadigital.co.ke
• SMS alerts for significant privacy changes
• In-app notifications for mobile users

12.3 Consent and Continued Use

Continued use of 1win services following policy updates constitutes acceptance of the revised terms. Users who disagree with changes may close their accounts and request data deletion subject to regulatory retention requirements.

---

Legal Notice: This privacy policy is designed for compliance with Kenyan data protection and gambling regulations. It must be reviewed by qualified legal counsel before implementation. 1win Kenya reserves the right to modify this policy in accordance with legal requirements and business needs.

Document Version: 1.0
Jurisdiction: Republic of Kenya
Governing Law: Kenya Data Protection Act 2019, BCLB Regulations
Website: rovadigital.co.ke