Privacy Policy winmy —
Your Information Security Is Our Priority

1. Introduction & Our Commitment

At winmy, we understand that your trust in us depends not only on the quality of the games we offer, but also on how we handle your personal information. Privacy is not just a word to us — it is the foundation of every operational decision we have made since this platform first launched.

This Privacy Policy is designed to give you full clarity on how winmy manages your personal data. This document applies to all users who register an account, use gaming services, make deposits or withdrawals, or simply browse our website. We are fully compliant with Malaysia's Personal Data Protection Act 2010 (PDPA) in all aspects of data management.

We have never and will never sell your personal information to any third party for commercial purposes. The data you provide us is used solely for the purposes stated in this policy, and you have the right to know, access, and request corrections to that information at any time.

2. Information We Collect

2.1 Information You Provide Directly

When you register an account at winmy, we collect information you voluntarily provide. This includes:

• Full name as stated on official identification documents
• National Identity Card number (MyKAD) or passport for foreign nationals
• Active email address for communication and account verification purposes
• Mobile phone number registered in Malaysia
• Date of birth for age verification (you must be 18 years of age or older)
• Bank account or digital wallet details for processing deposits and withdrawals
• Account passwords stored in encrypted form that cannot be read by any of our staff

2.2 Automatically Collected Information

While you are using the platform winmy, our systems automatically record certain technical information to ensure a smooth and secure gaming experience:

• IP address and estimated geographic location
• Device type, operating system, and web browser version used
• Login session data including time, date, and duration of activity
• Betting records, game history, and financial transactions
• Cookies and session identifiers to enhance the user experience
• App performance data for users who download the WinMY mobile app

2.3 Information from the KYC Process

As part of the mandatory Know Your Customer (KYC) process required for platform security and legal compliance, we may request additional documents such as a copy of your identification card, proof of current address, and source of income information. All documents are stored in a secured environment and are accessible only by authorised personnel.

3. How We Use Your Data

winmy uses the information collected for the following legally permissible purposes:

We will not use your data for any purposes beyond those listed above without first obtaining your renewed consent. Whenever we wish to use your data for a new purpose, you will be notified and given the choice to agree or decline.

4. Sharing Data with Third Parties

winmy does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, in the course of operating the platform, we may share certain information with the following parties under limited and controlled circumstances:

• Payment service providers: To process deposits and withdrawals via FPX, Touch 'n Go eWallet, GrabPay, Boost, and other supported payment methods
• Technology service providers: Parties providing the technical infrastructure and identity verification systems we use
• Game software providers: Game development companies that supply game content to our platform, strictly on a need-to-know basis
• Relevant authorities: When required by law, court order, or a lawful request from a Malaysian enforcement agency
• Professional advisors: Lawyers, accountants, or auditors bound by strict confidentiality obligations

All third parties working with us are required to sign data protection agreements that mandate security standards equivalent to or higher than those we apply ourselves.

5. Data Security & Encryption

Your data security is a responsibility we take seriously. winmy implements multiple layers of technical and organisational protection to ensure your personal information remains secure at all times:

• Data encryption in transit using TLS 1.3 protocol and 256-bit SSL certificates
• Data encryption at rest using AES-256 for all sensitive records
• Role-based access control — only authorised staff may access personal data
• 24/7 security monitoring using advanced intrusion detection systems (IDS)
• Periodic security audits by independent third parties to identify and patch vulnerabilities
• Two-factor authentication (2FA) available for player accounts as an additional layer of protection
• Server infrastructure equipped with DDoS protection and enterprise-grade firewalls

6. Data Retention Period

winmy retains your personal data only for as long as it is needed for the purposes stated in this policy, or as required by applicable law. The following are general guidelines for our data retention periods:

• Active account data: Throughout the period your account is active and for a defined period after account closure
• Financial transaction records: Minimum 7 years in line with Malaysia's accounting statutory requirements
• KYC Record: Minimum 5 years after termination of the business relationship
• Security logs: 90 days to 1 year depending on log type
• Customer support communications: 3 years from the date of last communication

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised so that it can no longer be linked to your identity.

7. Your Rights as a Data Subject

Under Malaysia's PDPA and our commitment to privacy, you have the following rights regarding the personal data we hold:

• Right of Access You have the right to request a copy of the personal data we hold about you. We will process your request within 21 business days.
• Right to Rectification If your data is inaccurate or outdated, you may request a correction or update at any time through your account portal or by contacting customer support.
• Right to Object to Processing You may object to the processing of your data for direct marketing purposes at any time, and we will comply with that request promptly.
• Right to Data Portability In certain circumstances, you have the right to request your data in a machine-readable format for transfer to another service provider.
• Right to Withdraw Consent For processing that relies on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.

To exercise any of the above rights, please contact our data protection team via live chat or support email. We will process your request promptly and reach out to verify your identity before disclosing or modifying any data.

8. Use of Cookies & Tracking Technologies

Platform winmy uses cookies and similar tracking technologies to enhance user experience and ensure the platform functions correctly. The cookies we use can be categorised as follows:

• Essential Cookies: Required for core platform functions such as login sessions and security. These cookies cannot be disabled.
• Preference Cookies: Saving your preferences such as language, theme, and display settings for a smoother experience.
• Analytics Cookies: Help us understand how users interact with the platform for continuous improvement purposes.
• Performance Cookies: Monitor the platform's technical performance and identify issues requiring improvement.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect the functionality of certain platform features.

9. Cross-Border Data Transfers

In operating a platform across multiple regions, your data may in certain circumstances be processed or stored outside Malaysia. When this occurs, winmy ensures that such data transfers are safeguarded by adequate protection mechanisms, including data transfer agreements that comply with Malaysia's PDPA standards and recognised international data protection guidelines.

We only transfer data to countries or regions with an equivalent or higher level of data protection, or where adequate contractual safeguards have been put in place to protect your rights.

10. Children's Privacy

Platform winmy is strictly for individuals aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. Should we discover that personal data of an individual under 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question.

Parents or guardians who have reason to believe their child has registered an account at winmy are advised to contact our support team immediately.

11. Changes to This Privacy Policy

winmy reserves the right to update or modify this Privacy Policy from time to time in response to changes in law, technology, or our business practices. Any material changes will be communicated to you via your registered email or through an in-platform notification at least 14 days before the changes take effect.

The "Updated" date at the top of this page reflects the date of the latest version of this policy. We encourage you to review this page periodically to stay informed about how we manage your personal data. Continued use of our platform after any changes take effect will be considered your acceptance of the updated terms.