Privacy Policy.

Volcano Technology Advertising Limited — Big Win Bingo & Solitaire Bucks

Issuing Entity: Volcano Technology Advertising Limited
US Operating Entity: Source Codes Entertainment Inc
Effective Date: January 9, 2026
Last Updated: August 11, 2026

1. Introduction

Volcano Technology Advertising Limited (Incorporated in Hong Kong, China (Company Registration No.: 3243064)) ("Company", "we", "us", or "our") operates Big Win Bingo and Solitaire Bucks (each a "Service", together the "Services"). In the United States, the Services are operated by Source Codes Entertainment Inc, a wholly-owned US subsidiary of Volcano Technology Advertising Limited. This Privacy Policy describes how we collect, use, disclose, and protect your personal information. By using either Service, you agree to this Policy.

For privacy inquiries, please contact us at the applicable privacy contact email listed in Section 10.

2. Information We Collect

2.1 Identity and Verification Information

• Government-issued ID document (passport, driver's license, national ID).
• Facial biometric data (face image and liveness detection via Sumsub).
• Full legal name, date of birth, residential address.
• Email address and mobile phone number.

2.2 Location and Device Information

• Precise GPS location (verified at registration and during real-money gameplay).
• IP address (for geolocation verification and fraud prevention via IPInfo + TrustDecision).
• Device fingerprint, device identifiers (IDFA, device model, OS version).

2.3 Financial Information

• Payment method details — processed by third-party processors; full card numbers are not stored by us.
• Transaction history (deposits, withdrawals, game results).

2.4 Gameplay and Behavioral Data

• In-game activity, scores, session duration, and gameplay patterns.
• Device behavior patterns (used for fraud detection via TrustDecision and Forter).

3. How We Use Your Information

• Service Provision: To create and manage your account, process payments, enable gameplay, and deliver customer support.
• Identity Verification (KYC): To verify your age (18+), identity, and eligibility, as required by our compliance obligations.
• Geolocation Compliance: To verify you are physically located in an authorized jurisdiction before enabling real-money gameplay.
• Fraud Prevention and AML Compliance: To detect and prevent fraud, money laundering, and illegal activity, including screening against OFAC, UN, EU, and UK sanctions lists and PEP databases via Sumsub.
• Transaction Monitoring: Real-time monitoring via Forter and TrustDecision.
• Legal Compliance: To comply with applicable laws including the U.S. Bank Secrecy Act, FinCEN regulations, and equivalent UK regulations.
• Communications and Service Improvement: Account notifications, policy updates, and (with consent) promotional offers.

4. Information Sharing

We do not sell your personal information. We share it only as follows:

4.1 Third-Party Service Providers

4.2 Legal and Regulatory Disclosures

We may disclose your information when required by law, court order, or regulatory authority, including FinCEN (BSA/AML obligations), OFAC (sanctions compliance), and equivalent UK regulatory bodies. This includes filing Suspicious Activity Reports (SARs) where required.

5. Data Security

• Encryption of data in transit (TLS) and at rest.
• PCI DSS-compliant payment card data handling (assessed by atsec Corporation).
• Access controls limiting data access to authorized personnel only.
• Regular security audits and anomaly detection.
• Biometric data processed by Sumsub and deleted upon completion of verification.

6. Data Retention

• KYC and identity verification records: minimum 5 years after account closure (BSA/FinCEN requirement).
• Transaction records: minimum 5 years.
• Gameplay data: retained while account is active, plus 2 years.
• Biometric data: deleted by Sumsub upon completion of verification.

7. Children's Privacy

The Services are strictly for users aged 18 and above. We do not knowingly collect information from individuals under 18. If we become aware a minor has registered, we will delete their information and terminate the account. Contact the applicable privacy contact email in Section 10 immediately if you believe a minor has used either Service.

8. Your Rights

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion, subject to legal retention requirements.
• Opt-Out of Marketing: Unsubscribe via email link or by contacting us.

To exercise these rights, please contact the applicable privacy contact email in Section 10. We will respond within 30 days.

9. International Data Transfers

Your information may be processed in the United States, United Kingdom, and Singapore. All international transfers are protected by appropriate safeguards including standard contractual clauses approved by relevant data protection authorities.

10. Contact Information

The following constitutes the Company's privacy and data protection contact details as required by card scheme rules.

Issuing Entity: Volcano Technology Advertising Limited
HK Address: Flat 2401-16, 24/F, Wing Shing Industrial Building, 26 Ng Fong Street, San Po Kong, Kowloon, Hong Kong
US Operating Entity: Source Codes Entertainment Inc
US Address: 1800 Gaylord Street, Denver, CO 80206, United States
Governing Jurisdiction: State of Colorado, United States

Privacy Contact Emails (by Service):

This Privacy Policy is effective as of January 9, 2026. Material changes will be communicated via in-app notification or email. Continued use after notification constitutes acceptance.