Privacy Policy

1 Introduction

MyWinn ("MyWinn", "we", "us", "our") operates the online gaming and sports betting platform accessible at mywinn.cam ("Platform"). This Privacy Policy ("Policy") describes how MyWinn collects, processes, stores, and protects the personal data of individuals ("User", "Player", "you") who access or use the Platform, including through any associated mobile-optimised interfaces or services.

By registering an account, making a deposit, or otherwise accessing the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must cease all use of the Platform immediately.

This Policy should be read in conjunction with our Terms and Conditions, which govern your use of the Platform generally.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and behavioural data generated through use of the Platform.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means MyWinn, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of MyWinn pursuant to a written data processing agreement.
• "Cookies" means small text files placed on a User's device by the Platform for the purpose of session management, analytics, and personalisation.
• "KYC" means Know Your Customer verification procedures conducted for the purpose of identity verification, age verification, and anti-money laundering compliance.

3 Personal Data We Collect

MyWinn collects the following categories of personal data in the course of providing the Platform and associated services:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for mandatory age verification — MyWinn is strictly for persons aged 21 and above).
• Gender (where provided voluntarily).
• National identification number — Malaysian IC (NRIC / MyKad number), passport number, or driver's licence number, as applicable.
• Username and encrypted account password.

3.2 Contact Data

• Email address (primary account contact).
• Mobile telephone number.
• Residential address, including city, postcode, and state — covering players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other Malaysian locations.

3.3 Financial & Transaction Data

• Payment method details, including bank account numbers (partial, as required for FPX and direct bank transfers), e-wallet account identifiers (Touch 'n Go eWallet, Boost, GrabPay), and bank names (Maybank, CIMB, Public Bank, Hong Leong).
• Deposit and withdrawal transaction records, including amounts in Malaysian Ringgit (MYR), dates, and payment method references.
• Account balance history and bonus credit records.

3.4 KYC & Verification Documents

• Copies or images of government-issued identity documents submitted for KYC verification (MyKad, passport, or driver's licence).
• Proof of address documents (utility bills, bank statements, or official correspondence dated within three months).
• Selfie photographs submitted in connection with enhanced identity verification where required.

3.5 Gaming & Behavioural Data

• Game session records, including games played, wager amounts, win/loss outcomes, and session durations.
• Sports betting history, including markets selected, stake amounts, and settlement outcomes.
• Bonus and promotional activity records.
• Responsible gambling tool usage, including deposit limits set, self-exclusion requests, and reality check settings.

3.6 Technical & Device Data

• IP address and geolocation data (at country and city level).
• Device type, operating system, and browser type and version.
• Login timestamps and session activity logs.
• Cookie identifiers and analytics data as described in Section 10 (Cookies & Tracking).

4 How We Collect Personal Data

MyWinn collects personal data through the following channels:

• Direct Submission: Data you provide voluntarily during account registration, KYC verification, payment transactions, support enquiries, and when using Platform features.
• Automated Collection: Technical data collected automatically when you access the Platform, including via cookies, server logs, and analytics tools.
• Third-Party Sources: Identity verification data from KYC service providers; fraud screening data from payment processors; and, where applicable, data from responsible gambling self-exclusion registers.

5 Data Processing & Use

MyWinn processes your personal data for the following purposes:

6 Legal Basis for Processing

MyWinn processes personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between MyWinn and the Player, including account operation, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC/AML obligations, age verification, and regulatory reporting.
• Legitimate Interests: Processing conducted for MyWinn's legitimate business interests, including fraud prevention, platform security, abuse detection, and Platform improvement — where such interests are not overridden by the Player's rights.
• Consent: Processing based on the Player's freely given, specific, and informed consent, including for the sending of promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

MyWinn does not sell, rent, or disclose personal data to third parties for commercial marketing purposes. Personal data may be shared in the following limited circumstances:

• Payment Processors: Financial transaction data is shared with payment processors and banking partners — including FPX operators, DuitNow, e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), and Malaysian banking institutions (Maybank, CIMB, Public Bank, Hong Leong) — solely to facilitate deposit and withdrawal processing.
• Identity Verification Providers: KYC document data is shared with contracted third-party identity verification services for the purpose of age and identity verification.
• Fraud Prevention & AML: Data may be shared with fraud screening services and financial intelligence bodies as required by applicable anti-money laundering legislation.
• Regulatory Authorities: Personal data may be disclosed to regulators, law enforcement agencies, or courts where legally required or in response to a valid lawful demand.
• Technology & Infrastructure Partners: Technical data may be processed by contracted cloud infrastructure and analytics service providers under strict data processing agreements that prohibit independent use of such data.
• Responsible Gambling Organisations: Where a Player registers for self-exclusion, relevant data may be shared with applicable responsible gambling schemes or exclusion registers to give effect to that request.

8 Data Retention

MyWinn retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, in line with standard AML record-keeping obligations.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification completion, or longer if required by applicable regulatory obligations.
• Financial Transaction Records: Retained for a minimum of seven (7) years to comply with financial record-keeping requirements.
• Support & Communication Records: Retained for three (3) years from the date of the last communication, unless a longer retention period is required for dispute resolution purposes.
• Technical & Device Logs: Typically retained for ninety (90) days to one (1) year, depending on the nature and security relevance of the data.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the anonymised dataset no longer constitutes personal data and is not subject to this Policy.

9 Data Security

MyWinn implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using Transport Layer Security (TLS) with a minimum of 256-bit encryption. The Platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data, including identity documents and financial account details, is encrypted at rest in our database infrastructure.
• Access Controls: Internal access to personal data is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to audit.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts as an additional layer of access security.
• Regular Security Assessments: MyWinn conducts periodic security reviews and vulnerability assessments of its Platform infrastructure.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be one hundred percent secure. In the event of a personal data breach that poses a risk to your rights, MyWinn will notify affected Players and, where required, relevant regulatory authorities in accordance with applicable breach notification obligations.

10 Cookies & Tracking Technologies

MyWinn uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for core Platform functionality, including session management, account authentication, and security features. These cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how Players interact with the Platform, enabling MyWinn to identify areas for improvement, measure game popularity, and optimise the user experience.
• Functional Cookies: Used to remember Player preferences, such as language settings and responsible gambling tool configurations, to provide a more personalised experience.
• Session Cookies: Temporary cookies deleted when you close your browser, used to maintain session state across page navigations during a single visit.

You may manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may impair the functionality or performance of the Platform. MyWinn does not use cookies to collect personally identifiable information beyond what is described in this Policy.

11 Minors & Age Verification

MyWinn is strictly intended for persons aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals below the age of 21. Age verification is a mandatory step in the account registration and KYC process — all Players are required to submit documentary proof of age before withdrawal access is enabled.

If MyWinn becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated Account. If you have reason to believe that a minor has registered an Account on the Platform, please notify our support team immediately.

12 Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by MyWinn. To exercise any of these rights, please contact our support team using the details provided in Section 15.

• Right of Access: You have the right to request a copy of the personal data MyWinn holds about you, together with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations.
• Right to Restrict Processing: You have the right to request that MyWinn restricts the processing of your personal data in certain circumstances, for example while a rectification request is being considered.
• Right to Data Portability: You have the right to receive personal data you have provided to MyWinn in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, and to withdraw consent where processing is consent-based, including withdrawal of consent to receive promotional communications.

MyWinn will respond to all valid data rights requests within thirty (30) calendar days. Where a request is complex or involves a large volume of data, this period may be extended by up to a further sixty (60) days, with prior notification provided.

13 International Data Transfers

In the course of providing the Platform, personal data may be transferred to, and processed in, jurisdictions outside Malaysia by contracted service providers, including cloud infrastructure providers and identity verification vendors. Where such transfers occur, MyWinn ensures that appropriate safeguards are in place to protect personal data to a standard equivalent to that applicable in Malaysia, including through contractual data protection clauses binding the recipient.

MyWinn does not transfer personal data to jurisdictions that do not offer an adequate level of data protection without first implementing appropriate contractual or technical safeguards.

14 Amendments to This Policy

MyWinn reserves the right to update or revise this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational circumstances. Where material changes are made, MyWinn will provide reasonable notice via the Platform and/or by email to the address associated with your Account.

Continued use of the Platform following notification of any amendment constitutes acceptance of the revised Policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision. Players are encouraged to review this Policy periodically.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, via the Platform. Recommended for urgent account security matters.
• Email (plain text, non-clickable): [email protected]

When submitting a data rights request, please include your full registered name, Account username, and a clear description of the right you wish to exercise. We may request additional identity verification before processing your request to ensure we are acting on behalf of the correct Account holder.

For responsible gambling concerns, please visit our Responsible Gambling page for information on self-exclusion and support resources.