Politique de confidentialité

As part of its activity and for the purpose of providing its Services, Winalia collects and processes personal data relating to the users of its platform (hereinafter the "Users" or "you").

This Privacy Policy (the "Policy"), implemented by Avenis SAS (publisher of winalia.gg), is intended to provide Users with clear, comprehensive and concise information on how Winalia processes their personal data in connection with:

• •Access to and use of the Winalia website and platform (the "Platform");
• •Participation in Ranked mode, Tournaments and WinaMatch;
• •Use of W-Coins and associated deposits and withdrawals;
• •Linking of third-party gaming accounts, such as an Epic Games account;
• •Security, moderation, anti-fraud and anti-cheat systems;
• •Identity verification (KYC) and anti-money-laundering / counter-terrorist-financing checks (AML/CFT).

Winalia attaches particular importance to the protection of your privacy and the confidentiality of your personal data, and is committed to processing such data in strict compliance with applicable laws and regulations, in particular:

• •French Data Protection Act – Law n° 78-17 of 6 January 1978 on information technology, files and civil liberties;
• •Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR").

Winalia implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of your personal data, including in relation to fraud prevention, competitive integrity, identity verification and financial compliance.

The data controller responsible for the processing of your personal data described in this Policy is: Avenis SAS – Winalia, 60 Rue François Ier, 75008 Paris, France (RCS Paris 942 368 895).

When this Policy refers to "Winalia", "we", "us" or "our", it refers to Avenis SAS acting as data controller within the meaning of the GDPR.

This Policy applies to all processing of personal data carried out by Winalia in its capacity as data controller, in particular for:

• •Players / Users of the Platform (accounts, Ranked, Tournaments, WinaMatch, W-Coins, support, moderation);
• •Visitors to the website winalia.gg (browsing, cookies, contact forms);
• •Prospective Users who interact with Winalia (e.g. newsletter subscribers).

When you connect an external service to your Winalia account (for example an Epic Games account, Google or Discord), this Policy describes only what Winalia does with the data it receives through that connection.

Winalia only collects and processes personal data that is relevant, adequate and limited to what is necessary for the purposes described below.

4.1 Categories of personal data we process

1. Account & profile data

• •Email address
• •Username / display name
• •Password (hashed, never stored in clear text)
• •Date of birth (asked before your first deposit, to confirm you are 18 or older)
• •Preferred language and interface preferences

2. Gameplay & competition data

• •Game platform identifiers (e.g. Epic Games display name)
• •Match histories and statistics (Ranked, Tournaments, WinaMatch)
• •Rankings and leaderboards
• •Sanctions and disciplinary measures
• •Evidence submitted in case of dispute (screenshots, links, videos)
• •Reports filed and arbitration outcomes

3. Currency, payments & withdrawals

• •Winalia balances and earnings
• •Balance, earning and spending history
• •Deposit and withdrawal requests and their statuses
• •Transaction references
• •Payment method identifiers as handled by our payment providers (we never store full card numbers)
• •Identity documents and supporting documents where required for KYC/AML (e.g. ID, proof of address, proof of payment means)

4. Security & anti-fraud data

• •IP address and approximate location
• •Device and browser information (user-agent, operating system)
• •Session identifiers and connection logs
• •Technical and behavioural signals used to detect multi-accounting, unusual patterns, cheating or fraud

5. Support & moderation

• •Contents of support requests and complaints
• •Attachments you send us
• •Timestamps and processing history of tickets
• •Internal notes and moderation / arbitration decisions

6. Browsing & cookies

• •Cookies and similar trackers strictly necessary for the operation of the site
• •Analytics, functional and marketing trackers (only if you consent), as described in our Cookie Policy

7. Linked third-party accounts (optional)

• •Identifiers required to link your account with a third-party service (e.g. Epic Games, Google, Discord)
• •Public profile information made available by that service with your permission
• •Section 4.3 below explains in detail how data received from Epic Games is handled.

4.2 Purposes, legal bases and retention periods

a) Operation of the Platform and Services

Purpose:

• •Creating and managing your account
• •Allowing you to access and participate in Ranked mode, Tournaments and WinaMatch
• •Displaying rankings and leaderboards
• •Managing Winalia balances, W-Coins and rewards

Data:

• •Account & profile data
• •Gameplay & competition data
• •Currency & earnings data

Legal basis:

• •Performance of a contract (Terms of Service)

Retention:

• •Duration of the contractual relationship, then generally 3 years from account closure for evidence and limitation periods.

b) Payments, withdrawals and accounting

Purpose:

• •Processing deposits and withdrawals
• •Maintaining accounting and financial records
• •Complying with financial and tax obligations

Data:

• •Currency & earnings data
• •Payment and withdrawal data
• •Identity documents and payment proofs when required

Legal basis:

• •Performance of a contract
• •Legal obligation (accounting, AML/CFT, tax law)

Retention:

• •Up to 10 years for accounting records, in line with applicable law.

c) KYC / AML / CFT and financial security

Purpose:

• •Identity verification (KYC) prior to certain withdrawals or from specific earnings thresholds
• •Monitoring and preventing money laundering and terrorist financing
• •Detecting suspicious or atypical transactions and reporting to competent authorities where required

Data:

• •Identity documents, proof of address, proof of payment means
• •Transaction history and W-Coins movements
• •Security and anti-fraud data

Legal basis:

• •Legal obligation (AML/CFT regulations)

Retention:

• •KYC data: up to 5 years after the end of the relationship
• •Transaction and AML logs: up to 10 years, in accordance with AML law.

d) Security, fraud prevention, anti-cheat and moderation

Purpose:

• •Maintaining the integrity of competitive play
• •Detecting cheating, collusion, multi-accounting and rule violations
• •Ensuring the security of accounts and infrastructure
• •Handling reports, disputes and sanctions

Data:

• •Gameplay & competition data
• •Security & anti-fraud data
• •Support & moderation data

Legal basis:

• •Legitimate interests of Winalia to protect the Platform, other Users and its business

Retention:

• •Security logs: up to 12 months (longer if an incident or investigation requires it)
• •Moderation data: duration of the sanction + limitation period for potential disputes.

e) Customer support and communication

Purpose:

• •Responding to your requests (support, claims, dispute resolution, information)
• •Informing you about Service changes, incidents and mandatory notifications (e.g. withdrawal status)

Data:

• •Account & profile data
• •Support & moderation data

Legal basis:

• •Performance of a contract (if related to your account / use of the Platform)
• •Legitimate interests (to respond to general enquiries and maintain the service)

Retention:

• •Support tickets: generally 3 years after closure.

f) Analytics, product improvement and statistics

Purpose:

• •Understanding how the Platform is used
• •Improving features, balancing Ranked and WinaMatch, and developing new services
• •Producing aggregated, non-identifying statistics

Data:

• •Gameplay & competition data
• •Browsing & cookies data (analytics cookies only if consented)

Legal basis:

• •Legitimate interests (service improvement) for aggregated / strictly necessary analytics
• •Consent for optional analytics cookies

Retention:

• •As long as necessary for analysis, then anonymised or aggregated; cookies as per the Cookie Policy.

g) Marketing and newsletters

Purpose:

• •Sending you newsletters, promotional offers or product updates (e.g. new game modes, events, VIP offers)

Data:

• •Email address, username, usage indicators (if allowed)

Legal basis:

• •Consent (where required)
• •Or legitimate interests where allowed by law (with the possibility to opt out at any time)

Retention:

• •Up to 2 years from the last contact or until you withdraw consent / object.

h) Legal defence and compliance

Purpose:

• •Establishing, exercising or defending legal claims
• •Managing pre-litigation and litigation
• •Responding to lawful requests from authorities

Data:

• •Any relevant category depending on the dispute or request

Legal basis:

• •Legitimate interests (defence of Winalia’s rights)
• •Legal obligation

Retention:

• •For the duration of the dispute and the applicable statutory limitation periods under French law.

i) Match notifications on your devices (optional)

Purpose:

• •Alerting you, on the devices where you turn them on, when your match needs you: opponent found, result to check, cancel request, dispute opened

Data:

• •The push subscription of each device you turn on (an address and encryption keys created by your browser)
• •The sign-in session that turned them on, your language and the date of your consent

Legal basis:

• •Consent, given on each device when you allow notifications for Winalia in your browser, and withdrawable at any time with the "Even when Winalia is closed" switch in My notifications, by blocking notifications in your browser settings, or by signing out of the device

Retention:

• •Until you turn the switch off, block notifications on the device, sign out of it (signing out deletes it) or close your account. Deleted automatically when your browser reports the subscription as expired, or after 90 days without any delivery.

Linking an Epic Games account is optional. It lets us confirm that the Fortnite account you play matches with really belongs to you. You start the link yourself from your Winalia profile and give your permission before any data reaches Winalia. Winalia never asks for, sees or stores your Epic Games password.

What Winalia requests

Winalia requests only the basic profile permission, and uses only two items from it: your Epic account ID and your Epic display name. Winalia does not request your email address, friends list, purchases or payment information through this connection.

What we store and why

• •Your Epic display name and a "verified" flag are saved on your Winalia profile. They are used to identify you in matches, show your Epic name on your profile and match pages, check match results, and make sure one Epic account is linked to only one Winalia account (anti-fraud).
• •The Epic account ID is only used during the sign-in exchange to confirm your identity. It is not stored on your profile.
• •The access token issued by Epic Games is used once, at the moment of linking, and is not stored.
• •An entry is added to your account’s security log (link / unlink, date) and, where a welcome bonus is granted for linking, the transaction record mentions the Epic display name to prevent the same Epic account from claiming it twice.

Where it is stored

This data is stored in Winalia’s database, hosted by our infrastructure providers under the safeguards described in sections 8 and 12. It is not sold, and it is not shared with anyone except our processors acting on our instructions.

How long we keep it

• •Epic display name and verified flag: as long as the Epic account stays linked. They are removed from your profile as soon as you unlink it.
• •Security log entries and bonus transaction records: kept for the periods listed in section 4.2 (security logs up to 12 months; transaction records up to 10 years for accounting and anti-fraud purposes).
• •If you close your Winalia account, the data linked to your Epic account follows the retention periods of section 4.2 a), then is deleted or anonymised.

How to delete it

• •Unlink your Epic Games account at any time from your Winalia profile. Your Epic display name and verified flag are removed immediately.
• •To request full deletion of your data, including any remaining Epic-related records not required by law, email support@winalia.gg. We respond within one month.

Legal basis

Your consent, given when you choose to link your account, and the performance of our Terms of Service for competitive matches. Withdrawing consent (by unlinking) does not affect processing carried out before.

Winalia is not affiliated with, endorsed by or sponsored by Epic Games, Inc. Fortnite and Epic Games are trademarks of Epic Games, Inc.

You can create your Winalia account or sign in with your Google account or your Discord account instead of an email and password. This is optional: you choose it on the Winalia sign-in page and approve it on Google’s or Discord’s own screen. Winalia never sees or stores your Google or Discord password.

What we receive

• •From Google (permissions "openid", "email" and "profile" only): your Google account identifier, your email address and whether Google has verified it, your name as shown on your Google account, and the link to your Google profile picture.
• •From Discord (permissions "identify" and "email" only): your Discord user ID, username, display name, avatar and your email address and whether Discord has verified it.
• •We do not receive your contacts, emails, files, calendar, Discord messages, servers or friends list, or any other data from Google or Discord.

What we use it for

• •Your email address: to create and identify your Winalia account, to recognise an existing Winalia account opened with the same email, and to send you messages about your account and its security.
• •Your Google account identifier or Discord user ID: to recognise you the next time you sign in, and to make sure one Google or Discord account opens only one Winalia account (anti-fraud).
• •Your name or display name: only to suggest your temporary Winalia username when your account is created (first name only for Google, display name for Discord). You can change it at any time. Your last name is never shown publicly.
• •Your profile picture or avatar link is kept in your account record as provided by Google or Discord. It is not displayed on Winalia: you choose your avatar from your Winalia inventory.
• •The sign-in tokens issued by Google or Discord are checked once, at the moment you sign in, and are not stored.

Where it is stored and how long we keep it

This data is stored by Winalia’s authentication provider and in Winalia’s database, hosted by our infrastructure providers under the safeguards described in sections 8 and 12. It is not sold, not used for advertising, and not shared with anyone except our processors acting on our instructions. It is kept as long as your Winalia account exists, then deleted or anonymised under the retention periods of section 4.2.

How to revoke access or delete it

• •Google: go to your Google Account, "Security" then "Your connections to third-party apps and services", select Winalia and stop using Sign in with Google.
• •Discord: go to User Settings, "Authorised Apps", and deauthorise Winalia.
• •Revoking access stops future sign-ins with that service but does not close your Winalia account. To delete your account and data, use the account deletion option in your settings or email support@winalia.gg. We respond within one month.

Legal basis

The performance of our Terms of Service: creating, securing and giving you access to the account you asked for.

Winalia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We collect personal data from the following main sources:

1. Directly from you

• •When you create an account
• •When you participate in Ranked, Tournaments or WinaMatch
• •When you make deposits or withdrawal requests
• •When you contact support or submit evidence / reports

2. Automatically when you use the Platform

• •Through logs, cookies and similar technologies
• •Through game and match data generated during your use of the Platform

3. From third-party providers

• •Payment service providers (for transaction references and anti-fraud signals)
• •KYC/AML providers (for identity verification)
• •Anti-cheat and security tools

4. From services you choose to connect

• •If you link your account with an external service (e.g. Epic Games, Google, Discord), we receive only the minimum data needed for the integration, as described in section 4.3 for Epic Games.

Winalia only seeks to collect personal data that is relevant and necessary for the purposes described above. When using free text fields (for example in support tickets or dispute descriptions), you should only provide information that is:

• •Strictly necessary to explain your situation or request;
• •Related to the Platform, your account, your matches or your payments.

You should avoid including sensitive personal data (e.g. health data, political opinions, information about third parties) unless expressly required and requested by Winalia for a specific legal reason.

Where certain fields are marked as mandatory, failure to provide the requested data may prevent us from creating your account, processing your request or providing the relevant Service.

Winalia only shares your personal data with identified and authorised recipients, and only where necessary and justified.

7.1 Internal recipients

Within Winalia, your personal data is accessible only to the teams that need it to perform their tasks:

• •Customer support and moderation
• •Technical and security teams
• •Compliance / AML / KYC teams
• •Finance and accounting
• •Product and analytics (for aggregated, pseudonymised data)

All internal staff are subject to confidentiality obligations.

7.2 External recipients

1. Service providers (processors)

• •Hosting and infrastructure providers
• •Payment and e-wallet providers
• •KYC/AML verification providers
• •Anti-fraud and anti-cheat tools
• •Email and notification services
• •Push notification services run by your browser or device maker (for example Google, Apple, Mozilla or Microsoft), which only relay encrypted match notifications to your device
• •Ticketing and customer support tools

These providers act on our instructions and must implement appropriate security and confidentiality measures.

2. Authorities and public bodies

• •When required by law or regulation
• •In response to judicial or administrative requests
• •For AML/CFT reporting obligations (e.g. TRACFIN), where applicable

3. Corporate transactions

• •In the context of a merger, acquisition, restructuring or asset sale, your data may be transferred in compliance with the GDPR and subject to appropriate safeguards.

We do not sell your personal data.

Some of our service providers or partners may be located outside the European Economic Area (EEA), in countries that may not provide the same level of data protection. Where such transfers occur, Winalia ensures that appropriate safeguards are in place, such as:

• •An adequacy decision from the European Commission; or
• •Standard Contractual Clauses approved by the European Commission; and, where needed,
• •Additional technical and organisational measures.

You may obtain more information or a copy of the applicable safeguards by contacting us (see section 10).

In accordance with the GDPR and applicable data protection laws, you have the following rights:

• •Right of access: obtain confirmation that we process your personal data and receive a copy of it.
• •Right to rectification: request correction of inaccurate or incomplete personal data.
• •Right to erasure ("right to be forgotten"): request deletion of your personal data in certain cases. We may be required to retain some data for legal or legitimate reasons.
• •Right to restriction of processing: request that we temporarily restrict the processing of your data in certain situations.
• •Right to object: object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and at any time to processing for direct marketing.
• •Right to data portability: receive the personal data you provided to us in a structured, commonly used and machine-readable format.
• •Right to withdraw consent: where processing is based on your consent (for example linking an Epic Games account), withdraw it at any time.
• •Right to lodge a complaint: with your local supervisory authority. In France, this is the CNIL (Commission Nationale de l’Informatique et des Libertés).

To exercise your rights, see section 10 below.

For any question regarding this Policy or to exercise your rights, you can contact us at:

• •Winalia – Data Protection Service
• •Email: support@winalia.gg
• •Postal address: 60 Rue François Ier, 75008 Paris, France

We may ask you for additional information or proof of identity if necessary to verify your request. We will respond within one (1) month, extendable by two (2) additional months for complex or numerous requests.

Free features of Winalia (account, Ranked mode and free Tournaments) are open to Users aged 13 or older. Where the law of your country sets a higher age for consenting to the processing of your data online (15 in France), a User below that age may only use Winalia with the consent of a parent or legal guardian.

Deposits, WinaMatch and withdrawals are strictly reserved for Users aged 18 or older. Your date of birth is asked before your first deposit; if you are under 18, deposits stay blocked on your account.

Winalia does not knowingly collect personal data from children under 13. If we become aware that we have, or that a User under 18 has made a deposit, we will take appropriate steps to delete the data or close the account. If you believe this has happened, please contact us immediately at support@winalia.gg.

Winalia implements appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful access, accidental loss, destruction or damage, including:

• •Encrypted communications (TLS)
• •Strict access control and authentication
• •Environment segmentation and hardened infrastructure
• •Logging, monitoring and alerts
• •Encrypted backups
• •Regular security reviews
• •Data minimisation and strict internal procedures

Despite these efforts, no online service can guarantee absolute security. You also play a role in protecting your account (e.g. choosing a strong password, keeping it confidential, enabling available security options).

We use cookies and similar technologies on the Winalia website and Platform:

• •Strictly necessary cookies: essential for the operation, security and access control of the Platform.
• •Analytics cookies: help us understand how the site and Platform are used (only activated if you consent).
• •Functional cookies: improve your user experience (e.g. remembering preferences, language).
• •Marketing / partnership cookies: used to measure and optimise the performance of our campaigns (only with your consent).

On your first visit, a banner allows you to accept all, reject all or customise your choices. You can change your preferences at any time via the cookie settings link in the footer. For more details, please refer to our Cookie Policy.

Match notifications: if you turn them on for a device, your browser registers that device with its push notification service and we store the resulting subscription (see section 4.2 i). This is optional, limited to match notifications, and never used for advertising.

Winalia uses automated systems in particular for:

• •Calculating and updating Ranked leaderboards and statistics based on your gameplay performance;
• •Detecting suspicious or abnormal behaviour (anti-fraud and anti-cheat);
• •Applying anti-abuse rules (e.g. temporary restrictions), subject to human review.

No decision producing legal effects or similarly significant effects on you is taken solely on the basis of automated processing, without the possibility of human review. You may request explanations about such processing and ask for human intervention via support@winalia.gg.

The Platform may contain links to third-party websites or services (e.g. payment providers, social networks, game publishers). These third parties have their own privacy and cookie policies, which we do not control. We recommend that you review their policies before providing them with personal data.

When you choose to connect a third-party service to your Winalia account, Winalia receives only the data described in this Policy for that service. For Epic Games, see section 4.3.

We may update this Policy from time to time, in particular to reflect legal, technical or operational changes. When changes are significant, we will take appropriate steps to inform you, such as:

• •Updating the "Last updated" date at the top of this page;
• •Displaying a notice on the Platform;
• •Or, where appropriate, notifying you by email.

Your continued use of the Platform after the effective date of the updated Policy constitutes your acknowledgement of the changes.

• •"Personal data" means any information relating to an identified or identifiable natural person.
• •"Processing" means any operation performed on personal data (collection, storage, use, transmission, etc.).
• •"Controller" means the entity which determines the purposes and means of processing personal data (here, Avenis SAS – Winalia).
• •"Processor" means an entity that processes personal data on behalf of the controller.
• •"Services" or "Platform" means the winalia.gg competitive gaming platform and associated features (Ranked, WinaMatch, Tournaments, W-Coins, shop, etc.).
• •"Cookies" refers to small files or similar technologies stored on your device to collect certain information when you visit the website or use the Platform.