Privacy Policy
Owner and data controller
The Yalla Win Platform collects Personal Data from its Users
YALLA WIN L.L.C.-FZ
U.A.E. Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E, Dubai, United Arab Emirates. Tel:+971 50-756-4894
DPO Contact
U.A.E. Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E, Dubai, United Arab Emirates. Tel: 1234567
Legal information
This Privacy Statement has been prepared in accordance with applicable data protection laws, including Articles 13 and 14 of the General Data Protection Regulation (EU Regulation 2016/679).
It applies exclusively to the Yalla Win Platform, unless stated otherwise in this document.
Latest Update: 13 September 2025
Definitions and Interpretation
In this Privacy Policy:
- All capitalized words and expressions used shall have the following meanings; and
- Unless the context otherwise requires, words in the singular shall include the plural and, in the plural, shall include the singular.
| Cookies / Identifiers | Portions of code are placed on a Users device in order to identify them |
| Cookie Policy | The Yalla Win Cookie Policy, a copy of which can be found on either the Yalla Win Website or Mobile App. |
| Data Controller (or Owner) | The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including the security measures concerning the operation and use of this Platform. The Data Controller, unless otherwise specified, is the Owner of this Platform. |
| Data Processing / Processing | The methods used to collect and Process a Users Personal Data on the Platform and the processes used which govern the integrity of the Data Processing. |
| Data Processor (or Data Supervisor) | The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this Privacy Policy. |
| Data Subject | The natural or legal person to whom the Personal Data belongs to. |
| European Union (or EU) | Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area. |
| Owner | Yalla Win L.L.C.-FZ, a Limited Liability Company incorporated in the Meydan Free Zone U.A.E. |
| Personal Data (or Data) | Any information that directly, indirectly, or in connection with other information, such as a username or password that allows the identification or identifiability of a natural person. |
| Platform or Mobile App | The Yalla Win Website and Mobile App and its associated content which collects and processes a User’s Personal Data. |
| Service | The Service provided by the Platform as described in the Terms which can be found on either the Yalla Win Website or Mobile App. |
| Usage Data | Information collected automatically through this Platform (or third party services employed by this Platform), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Platform; · the URI (Uniform Resource Identifier) addresses, the time of the request; · the method utilized to submit the request to the server, the size of the file received in response; · the numerical code indicating the status of the server's,answer (successful outcome, error, etc.); · the country of origin, the features of the browser and the operating system utilized by the User; · the various time details per visit (e.g., the time spent on each page within the Application); · the details about the path followed within the Application with special reference to the sequence of pages visited; other parameters about the device operating system and/or theUser's IT environment. |
| User (You or Your) | The individual using this Platform who, unless otherwise specified, is considered the Data Subject. |
| Website | Yalla Win internet Website https://yallawin.pro (or such other address as may be advised from time to time). |
Types of data collected
Among the types of Personal Data that this Platform collects, by itself or through third parties, this can be broadly categorized as email address, Usage Data, first name, last name, telephone number, Cookies, unique device identifiers for advertising (Google Advertiser ID or IDFA, for example) and geographic position.
Complete details on each type of Personal Data collected are provided in the dedicated sections of this Privacy Policy or by specific explanation texts displayed prior to the Data collection.
Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using the Platform. Unless specified otherwise, all Data requested by the Platform is mandatory. Failure to provide this Data may make it impossible for the Platform to provide its Services. In cases where the Platform specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service. Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.
Any use of Cookies, or of any other tracking tools, by this Platform or by the owners of third-party services used by this Platform, serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy.
Users are responsible for any third-party Personal Data obtained, published, or shared through this Platform and confirm that they have the third party consent to provide the Data to the Owner.
Data Processing
Methods of Processing
The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data. Data Processing is carried out using computers and/or IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain persons involved with the operation of the Platform (such as but not limited to: administration, sales, marketing, legal, and system administration) or external parties (such as but not limited to: third party technical service providers, mail carriers, hosting providers, IT companies and communications agencies) appointed, if necessary, as Data Processors by the Owner. An updated list of these parties may be requested from the Owner at any time.
Legal Basis of Data Processing
The Owner may process Personal Data relating to Users if any one of the following applies:
- Users have given their consent for one or more specific purposes. Note: Under some legislation, the Owner may be allowed to process Personal Data until the User objects to such Data Processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply, whenever the processing of Personal Data is subject to European data protection law;
- provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
- Processing is necessary for compliance with a legal obligation to which the Owner is subject;
- Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
- Processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.
In any case, the Owner will help to clarify the specific legal basis that applies to the Data Processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Place
Data Processing is carried out at the Owners operating offices and in any other places where the parties involved in the Data Processing are located.
Depending on the Users location, data transfers may involve transferring the Users Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can refer to the section Detailed information on the Processing of Personal Data.
Users are also entitled to learn about the legal basis of Data transfers to a country outside of the European Union, or to any international organization governed by public international law or set up by two or more countries (such as the UN), and about the security measures taken by the Owner to safeguard their Personal Data.
If any such transfer takes place, Users can find out more by checking the relevant sections of this Privacy Policy or inquire with the Owner using the information provided in the contact section.
Retention time
Personal Data shall be processed and stored for as long as required by the purpose/s it has been collected for. Therefore:
- Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
- Personal Data collected for the purposes of the Owners legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.
The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such Data Processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.
Once the retention period expires, Personal Data shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification, and the right to data portability cannot be enforced after the expiration of the retention period.
The Purposes of Processing
Personal Data belonging to the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), or to detect any malicious or fraudulent activity. In addition, Personal Data may be used for purposes including but not limited to: advertising, analytics, contacting the User, displaying content from external platforms, handling payments, location-based interactions, managing contacts and sending messages, platform services and hosting, backend infrastructure, User database management, SPAM protection, and tag management.
For specific information about how the Personal Data is used for each purpose, the User may refer to the below section “Detailed information on the Processing of Personal Data”.
Advertising
This service allows User Data to be utilized for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on the Platform, possibly based on User interests. Not all Personal Data is used for this purpose. Some services may use Cookies or other Identifiers to identify Users or apply behavioral retargeting techniques. Users can opt-out through service-specific opt-out links, device settings, or the Network Advertising Initiative opt-out page.
Crimean (Crimean Holdings Limited) – Advertising service provided by Crimean Holdings Limited.
Personal Data processed: Cookies; Usage Data.
Place of Processing: United Kingdom – Privacy Policy – Opt-out.
Category of personal data collected: Internet information.
Analytics
These services enable the Owner to monitor and analyses web traffic and track User behavior.
Google Analytics (Google LLC) – Web analysis service by Google. Data collected is used to track platform usage and may be combined with other Google services.
Personal Data processed: Cookies; Usage Data.
Place of Processing: United States – Privacy Policy – Opt-out.
Category of personal data collected: Internet information.
Google Analytics Advertising Reporting Features – Collects additional data like DoubleClick cookies and advertising IDs, allowing demographic and interest-based reporting.
Personal Data processed: Cookies; unique device Identifiers (Google Advertiser ID or IDFA); various Data.
Place of Processing: United States -Privacy Policy- Opt-out.
Category of personal data collected: Internet information and Identifiers.
Telephone Contact
Users that provided their telephone number may be contacted for commercial or promotional purposes related to this Platform, as well as for support requests.
Personal Data processed: Telephone number.
Category of personal data collected: Identifiers.
Displaying Content from External Platforms
This service allows Users to view content hosted on external platforms directly from this Platform and interact with them. These services may still collect web traffic data even if Users do not interact with them.
Google Fonts – Typeface service by Google LLC.
Personal Data processed: Usage Data; various Data.
Place of Processing: United States – Privacy Policy.
Category: Internet information.
YouTube – Video content service by Google LLC.
Personal Data processed: Cookies; Usage Data.
Place of Processing: United States – Privacy Policy.
Category: Internet information.
Handling Payments
Unless otherwise specified, this Platform processes any payments by debit or credit card, bank transfer or other means via external payment made to Authorized Yalla Win Retailers and other appropriate service providers. In general and unless where otherwise stated, Users are requested to provide their payment details and personal information directly to such payment service providers. This Platform is not involved in the collection and processing of such information: instead, it will only receive a notification by the relevant payment service provider as to whether payment has been successfully completed or not.
CC Avenues Payment Solutions
Personal Data processed: Cookies, Credit Card information.
Place of Processing: United States / United Arab Emirates.
Location-Based Interactions
This Platform may collect non-continuous geolocation data to provide location-based services, with explicit User consent.
Personal Data processed: Geographic position.
Category: Geolocation data.
Managing Contacts and Sending Messages
This service manages communication with Users (email, SMS, etc.) and tracks interactions.
Airship – Personal Data processed: Email Address, Gender, Purchase information.
Category: Personal marketing information.
SPAM Protection
This service analyses the traffic of the Platform, potentially containing User's Personal Data, with the purpose of filtering it from parts of traffic, messages and content that are recognised as SPAM.
Tag Management
This service helps the Owner to manage the tags or scripts needed on this Platform in a centralized manner. This results in the User’s Data being passed through these services, potentially resulting in the retention of the User’s Data.
User Database Management
This service allows the Owner to build user profiles by starting from an email address, a personal name, or other information that the User provides to this Platform, as well as to track User activities through analytics features.
This Personal Data may also be matched with publicly available information about the User (such as social network profiles) and used to build private profiles that the Owner can display and use for improving the Platform.
Selling Goods and Services Online
Personal Data collected is used to provide the User with Services or to sell goods, including payment and possible delivery.
Personal Data which is collected to complete the payment may include the debit or credit card, the bank account used for the transfer, or any other means of payment envisaged. The kind of Data collected by this Platform depends on the payment method or system used.
The Rights of Users
Users may exercise certain rights regarding their Data being processed by the Owner. In particular, Users have the right to do the following:
• Withdraw their consent at any time.
• Object to Processing of their Data where it is carried out on a legal basis other than consent.
• Access their Data and obtain a copy of the Data undergoing Processing.
• Verify and seek rectification of inaccurate or incomplete Data.
• Restrict the Processing of their Data under certain circumstances.
• Have their Personal Data deleted or removed under certain circumstances.
• Receive their Data in a structured, commonly used, machine-readable format and transmit it to another Data Controller.
• Lodge a complaint with their competent data protection authority.
Users’ Rights to Object to Processing
Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner, or for the purposes of the legitimate interests pursued by the Owner, Users may object to such Processing by providing a ground related to their particular situation to justify the objection.
Users must know that if their Personal Data is processed for direct marketing purposes, they can object to that Processing at any time without providing any justification.
How to Exercise These Rights
Any requests to exercise User rights can be directed to the Owner through the contact details provided at the beginning of this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.
Cookie Policy
This Platform uses Cookies and other Identifiers. To learn more, the User may consult the Cookie Policy, a copy of which can be found on either the Yalla Win Website or Mobile App.
Legal Action
The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Platform or the related Services.
The User declares to be aware that the Owner may be required to reveal Personal Data upon request of public authorities.
Additional Information about User'sPersonal Data
In addition to the information contained in this Privacy Policy, this Platform may provide the User with additional and contextual information concerning particular Services or the collection and Processing of Personal Data upon request.
System Logs & Maintenance
For operation and maintenance purposes, this Platform and any third-party services may collect files that record interaction with this Platform (System logs) and use other Personal Data (such as the IP Address) for these purposes.
Information not contained in this Privacy Policy
More details concerning the collection or Processing of Personal Data may be requested from the Owner at any time. Please refer to the contact details provided at the beginning of this document.
How “Do Not Track” requests are handled
This Platform does not support “Do Not Track” requests. To determine whether any of the third-party services the Platform uses honour the “Do Not Track” requests, please read their relevant privacy policies.
Changes to this Privacy Policy
The Owner reserves the right to make changes to this Privacy Policy at any time by notifying its Users on this page and possibly within this Platform and/or (as far as technically and legally feasible) sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification stated at the beginning of this document.
Should the changes affect Processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.
Categories of Personal Information Collected, Disclosed or Sold
We have collected the following categories of personal information about You: Identifiers, internet information and geolocation data.
We will not collect additional categories of personal information without notifying You. We collect the above-mentioned categories of personal information, either directly or indirectly, from You when You use this Platform.
For example, You directly provide Your personal information when You submit requests via any forms on this Platform. You also provide personal information indirectly when You navigate this Platform, as personal information about You is automatically observed and collected. Finally, We may collect Your personal information from third parties that work with Us in connection with the Service or with the functioning of this Platform and features thereof.
Sale of Your Personal Information
For Our purposes, the word “sale” means any “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing or by electronic means, a consumer's personal information by the business to another business or a third party, for monetary or other valuable consideration”.
This means that, for example, a sale can happen whenever an application runs ads, or makes statistical analyses on the traffic or views, or simply because it uses tools such as social network plug-ins and the like.
Your right to opt out of the sale of personal information: We may use Your personal information to allow the operational functioning of this Platform and features thereof (“business purposes”). In such cases, Your personal information will be processed in a manner necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.
We may also use Your personal information for other reasons such as for commercial purposes, as well as for complying with the law and defending Our rights before the competent authorities where Our rights and interests are threatened, or We suffer an actual damage. We will not use Your personal information for different, unrelated or incompatible purposes without notifying You.
Your Privacy Rights and How to Exercise Them
The right to know and to portability
You have the right to request that We disclose to You:
• The categories and sources of the personal information that We collect about You, the purposes for which We use Your information and with whom such information is shared.
• In case of sale of personal information or disclosure for a business purpose, two separate lists where We disclose:
– For sales, the personal information categories purchased by each category of recipient.
– For disclosures for a business purpose, the personal information categories obtained by each category of recipient.
The disclosure described above will be limited to the personal information collected or used over the past 12 months. If We deliver our response electronically, the information enclosed will be portable, i.e. delivered in an easily usable format to enable You to transmit the information to another entity without hindrance, provided that this is technically feasible.
If no legal exception applies, We will delete your personal information and direct any of Our service providers to do so.
How to exercise Your rights
To exercise the rights described above, You need to submit Your verifiable request to Us by contacting Us via the contact details provided at the beginning of this document.
For Us to respond to Your request, it is necessary that We know who You are. Therefore, You can only exercise the above rights by making a verifiable request which must:
• Provide sufficient information that allows Us to reasonably verify You are the person about whom We collected personal information or an authorised representative.
• Describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it.
We will not respond to any request if We are unable to verify Your identity. If You are an adult, You can make a verifiable request on behalf of a minor under Your parental authority. You can submit a maximum of 2 requests over a 12-month period.
How and when We are expected to handle Your request
We will confirm receipt of Your verifiable request within 10 days and provide information about how We will process it. We will respond within 45 days of receipt. Should We need more time (up to 90 days), We will explain why. Our disclosures will cover the preceding 12-month period. If We deny Your request, We will explain the reasons.
We do not charge a fee unless the request is manifestly unfounded or excessive. In such cases, We may charge a reasonable fee or refuse to act, but We will communicate the reasons behind it.