PRIVACY POLICY

1. Information Security Policy

WinU app implements the Information Security Management System standard ISO27001:2022, the Personal Information Management System standard ISO27701:2019, and complies with all relevant Mongolian laws including the Cyber Security Law and Personal Data Protection Law to ensure the confidentiality, integrity, and availability of personal information and information assets against all types of intentional and unintentional internal and external threats.
WinU app is legally obligated under Mongolian law not to disclose your personal information except as required by law.
WinU app implements all necessary technical and procedural security measures in accordance with applicable laws to protect customer information confidentiality.
WinU app implements the international information security standard ISO27001:2022 and best practices in its operations.
We comply with the recommendations and requirements of the SWIFT Customer Security Program in our operations.
When working with external service providers, WinU app strictly requires compliance with international information security standards and best practices.
Regardless of where customer information is transmitted, we take all necessary measures to ensure the security of personal and confidential information.

2: Personal Data Privacy Policy

We respect and strictly maintain the confidentiality of your information, and maintaining privacy is a crucial part of our work.
We are implementing the ISO27701:2019 Personal Information Management System standard, which is followed by most countries worldwide, in Mongolia.

3. Customer Consent

With your consent, we will collect personal information and store it electronically or in paper form for a period not less than that specified by relevant laws and regulations.
By agreeing, you authorize us to access the State Electronic Information Database to verify and confirm your personal information (surname, name, registration number/civil registration number, employment status, income information, residential address, etc.), and to request additional information if necessary.
Where necessary, we may process information you provide in the app or specifically authorize for identity verification, fraud/security, risk assessment, and offering suitable products and services. WinU does not copy or collect your device contact list, calendar, or browsing/search history outside the app.
If you wish to receive products or services from other organizations collaborating with our WinU app, we will share relevant information to the extent of your consent.
We may share your information with contractors and consultants working to improve and expand the WinU app.

4. Information We May Collect

Account and profile information: name, surname, username, phone number, email address, profile image, business profile, branches, addresses, registration number, and DAN verification-related information.
User-generated content: posts, reels, comments, replies, ratings, marketplace items, business/service/product content, chat/message content, photos, videos, audio, captions, and related metadata.
Location information: when you use maps, nearby businesses, branch locations, delivery, orders, or service location selection, we may use the approximate or precise location that you select or allow.
Payment, order, and transaction information: orders, transactions, payment history, receipts, saved card tokens, payout destinations, wallet/ledger records, and information required for financial audit purposes.
Device, usage, and diagnostic information: app events, feature interactions, push notification tokens, device/app identifiers, crash logs, non-fatal errors, performance data, and diagnostic information.

5. Device Permissions

Camera permission is used for actions you initiate, such as scanning QR codes, taking profile/post/product/service photos, and uploading reels or other media.
Location permission is used while you use the app to show nearby businesses, use maps, and select branch, delivery, order, or service locations. WinU does not use location permission to continuously collect background location.
Notification permission is used to send account, order/service, payment/transaction, business invitation, chat/message, security, and important update notifications. You may disable notifications in your device settings.
Microphone permission is used only when you initiate reel or video recording that includes voice or ambient audio.
Photo/media library permission is used so you can choose photos or videos from your device for profiles, posts, products, services, reels, and other content.

6. Analytics, Crash Logs, and Push Notifications

WinU may use analytics tools such as Firebase Analytics to understand and improve app performance, usage, and feature interactions.
App errors, crashes, non-fatal errors, stack traces, and device/app diagnostic information may be collected through tools such as Firebase Crashlytics for maintenance, reliability, and security purposes.
To deliver push notifications, we may use Firebase Messaging or similar services and store device tokens and notification delivery metadata.

7. Payments, Cards, and Transactions

When you use orders, services, marketplace, wallet, payout, or payment-related flows in WinU, we process information such as transaction records, payment status, receipts, settlement, refunds, and audit records.
WinU uses tokenization/payment providers and does not intend to store full bank card numbers or sensitive card data on WinU servers. Saved card tokens, provider references, and charge/refund logs are used for payment processing, fraud/security, and audit purposes.
Payment, order, tax, ebarimt, payout, ledger, and audit information may be retained for the period required by law, tax, financial reporting, dispute resolution, and audit obligations, even after account deletion.

8. User-Generated Content and Moderation

Users and business users may create and publish content in WinU, including posts, reels, comments, replies, marketplace items, business profiles, and product/service content. This content may be visible to other users.
To detect and limit objectionable, inappropriate, spam-like, or rule-violating content, we may use automated text filters, repeated-character spam checks, and admin moderation review.
Users may report comments, posts, reels, and other content/users. When a report is submitted, target content, reason, reporter, and snapshot metadata are processed for moderation review and admin notification.
The block user action is used to hide that user's content in your app experience. In the current version, the block list may be stored locally on your device.

9. Account Deletion and Data Retention

You can request deletion of your account and related personal information in the app from Profile settings > Account settings > Delete account, from the web page at https://portal.winu.mn/account/delete, or by contacting winu.support@winu.mn. A confirmation word and, where applicable, your current password are required.
When an account is deleted, WinU deactivates the account, anonymizes or clears personal fields such as name, email, phone, password, profile image, registration number, and social/profile fields, and may remove user-facing linked data such as saved card tokens, device tokens, notifications, addresses, carts, saved items, likes, shares, and comments.
For legal, tax, financial audit, payment dispute, fraud/security, and platform integrity reasons, order, payment, transaction, receipt, payout, ledger, and audit records may be retained in anonymized or de-identified form for as long as required.

10. Sharing and Your Rights

We may use your information for app functionality, customer support, analytics, diagnostics, payment processing, notification delivery, fraud/security, legal compliance, and service improvement.
Where necessary, we may share information with cloud hosting, analytics, crash reporting, push notification, payment, banking, card tokenization, identity verification, delivery/logistics, customer support, and audit/compliance service providers.
You may access or correct your information, request deletion of your account and related personal information at https://portal.winu.mn/account/delete or by emailing winu.support@winu.mn, change notification permissions, use report/block actions, or send privacy-related questions and requests through the contact information below.

Phone: 7288 8800

Email: winu.support@winu.mn

Address: Ulaanbaatar city, KHD, 3rd khoroo,

Design Central, Room 403