Privacy Policy WIN28 — We Protect Your Data the Same Way We Protect Your Money

Win28 only collects information that is strictly necessary to provide our services to you. We do not collect data excessively or without a clear purpose. Below are the categories of information we collect:

Information you provide directly:

• Registration Information: Your full name, mobile number, username, and password set during WIN28 account registration.
• Identity Verification (KYC) Information: Copies of your identity card (MyKad), IC number, and other supporting documents required to verify your identity for anti-money laundering (AML) compliance purposes.
• Financial Information: Bank account number, bank name, and eWallet details (Touch 'n Go, GrabPay) registered for deposit and withdrawal purposes.
• Communications: Records of your conversations with the win28 support team via live chat or email, including complaints, enquiries, and feedback.

Information collected automatically:

• Technical Data: IP address, device type, operating system, web browser type and version, screen resolution, and time zone.
• Usage Data: Pages visited within the WIN28 platform, time spent, games played, total wagering, and general usage patterns.
• Transaction Data: A complete record of all deposits, withdrawals, wagering, wins, and other financial activity in your win28 account.
• Location Data: Approximate location based on your IP address, used solely for security and verification purposes.

Win28 uses your personal data responsibly and only for legitimate purposes. Below is the full list of data use purposes:

Win28 will not use your data for any purpose outside the list above without obtaining your consent first. If you no longer wish to receive marketing communications from win28, you may withdraw that consent at any time by contacting our support team.

Win28 does not sell your personal data. However, in certain limited situations, win28 may need to share your information with carefully selected third parties:

• Payment Service Providers: Required transaction details are shared with partner banks and eWallet providers solely to securely process your deposits and withdrawals.
• Game Software Providers: Required game session data is shared with gaming platform providers (such as slots and Live Casino providers) to ensure smooth and fair gameplay.
• KYC Service Providers: Identity verification documents may be processed through an authorised third-party verification platform to expedite your KYC process.
• Legal Authority: win28 will disclose required information to government authorities or law enforcement when mandated by law or a valid court order.
• Auditors & Legal Advisors: Within the limited scope required for compliance audit or legal advisory purposes, subject to strict confidentiality obligations.

All third parties that win28 works with are required to meet data protection standards equal to or higher than win28's own. win28 conducts due diligence on all data partners before any data sharing takes place.

Win28 invests seriously in security infrastructure to ensure your personal data is protected at every stage — whether in transit, during processing, or at rest. Below are the security layers we employ:

• 256-bit SSL/TLS Encryption: All communications between your browser and the win28 platform are protected by bank-grade encryption. You can verify this by looking for the padlock icon and "https://" in your browser's address bar.
• Multi-Layer Firewall: WIN28 servers are protected by a multi-layered firewall system that blocks unauthorized access from both external and internal networks.
• Two-Factor Authentication (2FA): win28 supports two-factor authentication for player accounts as an additional layer of security beyond passwords.
• 24/7 Monitoring: WIN28's cybersecurity team monitors systems around the clock to detect and respond to any security threats promptly.
• Internal Access Controls: The "least privilege" access principle is enforced — each win28 staff member can only access data required for their specific role.
• Regular Data Backups: Data is regularly backed up to a separate, secure location to ensure service continuity in the event of any technical incident.
• Penetration Testing: win28 conducts periodic independent third-party security testing to identify and patch any vulnerabilities before they can be exploited.

Win28 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device by your web browser when you visit the win28 website.

Types of cookies WIN28 uses:

• Essential Cookies: Required for core WIN28 platform functionality, including login authentication and session management. These cookies cannot be disabled as they affect essential platform functions.
• Performance Cookies: Collecting information on how you use WIN28 — most visited pages, response times, and any errors encountered — to help us improve the platform.
• Functionality Cookies: Remembering your preferences such as language, display settings, and login details (if you choose to stay logged in) to provide a more personalized experience.
• Analytics Cookies: Used to understand aggregated and anonymised platform usage patterns for WIN28 product and service improvement purposes.

You can manage or block cookies through your web browser settings. However, blocking essential cookies may affect the functionality of the WIN28 platform and your gaming experience. For more information on managing cookies, refer to your web browser's help documentation.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data WIN28 holds. We respect and facilitate the exercise of these rights:

• Right of Access: You have the right to request and obtain a copy of the personal data WIN28 holds about you. WIN28 will provide this information within 21 business days from the date of your request.
• Right to Rectification: If any personal data held by WIN28 is inaccurate or outdated, you have the right to request immediate correction. You may also update most of your profile information directly through your WIN28 account settings.
• Right to Withdraw Marketing Consent: You may withdraw your consent to receive marketing communications from WIN28 at any time without affecting your core services.
• Right to Complain: If you believe that win28 has violated your privacy rights, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant enforcement authority.
• Right to Erasure (Limited): Under certain circumstances — particularly when data is no longer needed for the purpose it was originally collected and there is no legal obligation to retain it — you may request deletion of your personal data.

To exercise any of the above rights, please contact the win28 support team via 24/7 live chat or our support email. Please include your win28 account number and a clear description of your request to help expedite the process.

Win28 retains your personal data only for as long as necessary to fulfil the original purpose of collection, or as required by applicable law.

• Active Account Data: Retained for the duration your WIN28 account remains active, plus the period required to resolve any outstanding claims or disputes.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of transaction, in line with Malaysia's AML and tax legal requirements.
• KYC Documents: Retained for a minimum of 5 years after the business relationship with win28 ends, in line with legal compliance requirements.
• Support Communication Logs: Retained for 2 years from the date of communication, for reference and complaint resolution purposes.
• Technical Access Log Data: Retained for 90 days for security purposes and incident detection.
• Account Closed: Following account closure, your personal data not subject to any legal retention obligation will be anonymised or deleted within 90 days.

Upon expiry of the applicable retention period, win28 will securely delete or anonymise your personal data in accordance with industry standards.

Win28 is an online betting platform restricted to individuals aged 18 years and above only. WIN28 does not knowingly collect or process personal data from individuals under the age of 18.

Should win28 discover that personal data of a child has been collected without the knowledge or consent of a parent or legal guardian, we will take immediate action to:

• Closing the account in question immediately.
• Deleting all personal data associated with that individual from our systems.
• Returning any deposited funds, subject to a verification process.

If you are a parent or guardian concerned that your child has registered a WIN28 account, please contact our support team immediately via 24/7 live chat.

The win28 platform may contain links or integrations with third-party services such as game providers, payment platforms, and support service providers. win28's Privacy Policy applies solely to the win28 platform.

Win28 is not responsible for the privacy practices or content of those third-party websites and services. We encourage you to read and understand the privacy policy of each third-party service you use in connection with your win28 account, in particular:

• Payment Providers: Local banks, FPX, Touch 'n Go eWallet, and GrabPay have their own privacy policies governing the processing of your transaction data on their end.
• Game Providers: Third-party game studios providing slots, live casino, and other games may process game session data under their own privacy policies.
• Analytics Services: win28 uses web analytics tools to understand platform usage patterns. Data collected by these tools is processed in aggregate and anonymised form.

Win28 carefully selects third-party partners and only works with companies that have a strong reputation and commitment to data protection. However, we cannot guarantee the privacy practices of those parties and encourage you to exercise caution.

Win28 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our business practices, new legal requirements, or improvements in how we protect your data.

When WIN28 makes material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date displayed at the top of this page.
• Displaying in-platform notifications on WIN28 to inform active players of important changes.
• For changes that are highly material and significantly affect your privacy rights, win28 will send a direct notification to you via email or an in-account message.

Your continued use of the win28 platform after the effective date of any amendment will be considered your acceptance of the updated Privacy Policy. We encourage you to review this page periodically to stay informed about how win28 protects your privacy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how WIN28 handles your personal data, our team is ready to assist you through the following channels:

• 24/7 Live Chat: The fastest way to get an immediate response — available directly within the WIN28 platform at all times.
• Privacy Email: [email protected] — please set your email subject to "Privacy Inquiry" to ensure it is routed to the right team.
• Response Time: Live chat enquiries are typically answered in under 2 minutes. Email enquiries will be responded to within 24 business hours.

For formal requests relating to personal data rights (such as data access or deletion requests), please include in your email:

• Your full name and WIN28 account number.
• The type of request being made (access, correction, deletion, etc.).
• A clear description of the information or action you are requesting.

Win28 is committed to responding to every privacy inquiry seriously and within a reasonable timeframe. Your satisfaction and trust are our top priority.