Topmatch Privacy Policy: Processing of Player Data 2026
This document explains what information the operator collects, why it is used and what rights the user holds. The privacy policy Topmatch applies describes personal data processing in plain language — without references to statutes or legal constructions.
Last updated: August 2026
What This Document Covers
The Topmatch privacy policy explains what information the operator collects, why it is needed and what a player may do with it. The document avoids legal constructions wherever plain wording conveys the same meaning.
Personal data processing at Topmatch begins at registration and continues throughout use of the service. Some information is collected automatically when visiting the site.
The operator holds a Curacao licence. There is no permit from the Ukrainian regulator, so processing follows the rules of the licence jurisdiction rather than Ukrainian law.
Important to know: registration constitutes acceptance of this document. If the processing terms are unacceptable, an account should not be created — consent can only be withdrawn together with account closure.
Categories of Information Collected
Personal data arrives in two ways: the user provides it during registration and verification, or it is recorded automatically while using the site.
| Category | What it includes | How it arrives |
|---|---|---|
| Identification | Name, date of birth, citizenship | From the user at registration |
| Contact | Email address, phone number | From the user |
| Verification | Document copies, age confirmation | From the user during KYC |
| Financial | Deposit and payout history, transaction details | Generated during transactions |
| Gaming | Bets, slips, sessions, bonus status | Recorded by the system |
| Technical | IP address, device type, browser, visit times | Collected automatically |
The operator does not store full payment card numbers — this is handled by the payment provider on its own side. Only details needed to identify a transaction remain in the system.
Note: the volume of data collected depends on the stage. Before verification the system holds only contacts and technical information; document copies appear when a withdrawal request is submitted.
What the Data Is Used For
Each category is processed for a specific purpose. Use of data beyond the purposes listed is not provided for under these terms.
- User identification. Account creation, login, access recovery
- Transaction processing. Balance top-ups, payout requests, slip settlement
- Meeting licence requirements. Age verification, financial monitoring procedures
- Account protection. Detecting suspicious activity, duplicate profiles, access attempts
- Support operation. Handling requests, reconstructing the timeline of a dispute
- Notification. Updates on transaction status and changes to the service
Processing for marketing mailings is handled separately and requires consent. Opting out of marketing messages does not affect account operation — service notifications continue to arrive.
Important to know: processing required to meet licence obligations cannot be refused. Age verification and financial monitoring are mandatory procedures.
The Legal Basis for Processing
The legal basis determines whether the operator may process particular information and whether the user can refuse. There are four grounds.
| Basis | What it covers | Can it be refused |
|---|---|---|
| User consent | Marketing mailings, optional cookies | Yes, at any time |
| Contract performance | Account operation, bets, transactions | Only by closing the account |
| Licence requirements | Verification, age control, monitoring | No |
| Legitimate interest | Fraud prevention, platform security | No, unless user rights prevail |
The difference between the first and third grounds is practical. Consent is withdrawn in settings, while processing under licence requirements continues regardless of the player's wishes.
Note: withdrawing marketing consent does not delete data entirely. It remains in the system on other grounds — contract performance and licence requirements continue to apply.
Who Gains Access to the Information
Third parties receive data only to the extent needed for a specific task. Selling information to advertisers or other parties is not provided for under these terms.
- Payment providers. Processing deposits and payouts, confirming instrument ownership
- Gaming software suppliers. Technical session data for a specific game to run
- Document checking services. Identity and age verification
- Licensing authority. Providing information upon official request
- Technical contractors. Hosting, analytics, support services
Each recipient is bound by confidentiality terms and may use the information solely for the agreed purpose. Transfers beyond this list are possible only at the demand of authorised bodies.
Important to know: when contacting support through a messenger, correspondence passes through that provider's service. Personal data and payment details should not be sent through such channels — secure forms in the account exist for that.
Retention Periods
Data retention is tied to the life of the account and to requirements that apply after closure. Different categories are deleted at different times.
| Category | Retention period |
|---|---|
| Active account data | The whole period of service use |
| Verification documents | As required by the licensing authority |
| Transaction history | The period set by financial monitoring rules |
| Technical logs | A limited period necessary for security |
| Marketing preferences | Until consent is withdrawn |
After an account is closed some information is retained — financial monitoring procedures and licensing rules require it. Deleting it on request is not possible until the set period expires.
Note: specific periods for each category are published by the operator in the data protection section of the site. They depend on the requirements of the licensing authority.
What a Player May Request
User rights over their own data are close to European regulatory standards. GDPR-style rights apply regardless of where the operator is registered.
| Right | What it means in practice |
|---|---|
| Access | Request the list of information the operator holds |
| Rectification | Update inaccurate or outdated profile data |
| Erasure | Demand deletion of information not subject to mandatory retention |
| Restriction of processing | Suspend use of data while a dispute is ongoing |
| Withdrawal of consent | Opt out of marketing and optional cookies |
| Objection | Challenge processing based on legitimate interest |
A request is submitted through support, stating which right is being exercised. The operator may ask for identity confirmation — protection against requests from third parties.
Important to know: the right to erasure is limited by mandatory retention. Verification documents and transaction history remain in the system until the period set by licence requirements expires.
How the Information Is Protected
Data security operates on two levels: the platform's technical measures and the user's own actions. Full protection is possible only when both work.
On the Operator's Side
- Encryption of the channel between device and server
- Staff access to personal data limited to operational necessity
- Two-factor authentication at account login
- Monitoring of suspicious account activity
On the User's Side
- A unique password not reused from other services
- Two-factor authentication enabled
- Avoiding login from shared or public devices
- Checking the site address before entering data
Important to know: no system offers absolute assurance. The operator takes reasonable protective measures, but transmitting data over the internet always carries residual risk — this applies to any online service.
Cookies: A Brief Summary
Cookies are small files a site writes to the browser. Some are essential for the service to work, others are enabled with the user's consent.
- Essential. Login, session storage, bet slip — the site does not work without them
- Functional. Interface language, odds format, display settings
- Analytical. Statistics on visits and page behaviour
- Marketing. Personalisation of offers and advertising materials
The first category cannot be disabled: without it account login is impossible. The rest are managed through browser settings or the consent banner on a first visit.
Note: a detailed description of each category, file retention periods and the withdrawal procedure are set out in a separate document — the Cookie Policy.
Data of Persons Under 21
The service is intended solely for adult users. Gambling in Ukraine is permitted from the age of 21, and the operator does not create accounts for anyone younger.
Age is checked during verification against an identity document. Until the procedure is complete the account operates with restrictions and withdrawals are unavailable.
If an underage user is identified, the account is closed. Collected data is deleted, except information the operator must retain for reporting purposes.
Important to know: responsibility for a minor's access to a device rests with its owner. If a child has gained access to your account, contact support — the operator will suspend transactions.
Updating the Document
The policy is reviewed when legislation, licensing authority requirements or platform operation change. The current version is always on this page.
The date of the last update appears at the top of the document. Use it to check whether processing terms have changed since your last visit.
Material changes — such as a new category of collected data or a new recipient — are accompanied by a notice to the email in the profile.
Note: continued use of the service after a new version is published constitutes acceptance of the updated terms. If they are unacceptable, the account may be closed as described in the terms of use.
Data-Related Requests
Requests concerning personal data go to support through the personal account or the contact channels listed on the site. No separate address is provided for such requests.
To have a request handled without further clarification, include specifics:
- Which right you are exercising — access, rectification, erasure, withdrawal of consent
- The email or account number the profile is registered to
- The period, if the request concerns a specific stretch of history
- How you wish to receive the response
Note: the operator may request identity confirmation before acting. This guards against a situation where account information is sought by an outside party.
Privacy Questions
Can an account be deleted along with all data?
The account is closed on request, but some information is retained. Verification documents and transaction history remain in the system for the period set by the licensing authority.
Does the operator pass data to third parties unnecessarily?
No, transfers are limited to the list of recipients and to specific tasks. Selling information to advertisers is not provided for under these terms.
How are payment details protected?
The operator does not store full card numbers — the payment provider handles this. Only data identifying the transaction remains in the system.
What happens to data after account closure?
Information not subject to mandatory retention is deleted. The rest is kept until the period required by financial monitoring expires.
Can processing be refused?
Marketing mailings — yes, at any time. Processing needed for age verification and financial monitoring cannot be refused.
How can I find out what the operator holds?
Through a support request stating that you are exercising the right of access. The operator may ask for identity confirmation before replying.
Is site activity tracked?
Yes, technical data — IP address, device, visit times — is collected automatically. This is necessary for account security and detecting suspicious activity.
Does Ukrainian law apply to processing?
No, the operator holds a Curacao licence and no permit from the Ukrainian regulator. Processing follows the rules of the licence jurisdiction.
Prepared by the editorial team: topmatch-win.in.ua editorial team
Published: · Updated:
The review draws on open sources, hands-on checks of the site and a review of the brand's legal status as of the update date. Licence details should be verified on the operator's official site.