W2win Privacy Policy – How We Protect the Personal Data of Malaysian Members

W2win collects personal data from members through several means — directly when you register and use the platform, automatically through the technologies built into our platform, and in certain cases, from legitimate third-party sources. Below are the categories of data we collect and their respective purposes.

Information you provide directly:

• Identity Information — your full legal name as shown on your MyKad or passport, MyKad or passport number, date of birth, gender, and images of identity documents where required for KYC verification.
• Contact Information — your active email address, Malaysian mobile number, and current residential address in Malaysia.
• Financial Information — details of the payment methods you use, including your Touch 'n Go, GrabPay, Boost, ShopeePay, or DuitNow e-wallet numbers, or bank account details for FPX via Maybank2u or CIMB Clicks. We do not store credit or debit card numbers directly — card payments are processed by licensed third-party payment processors.
• Account Information — your username, encrypted password, and any preferences or account settings you have saved within the w2win platform.

Automatically collected data:

• Log & Technical Data — IP address, browser type and version, device operating system, screen resolution, and other technical information automatically transmitted by your device when you access our platform.
• Usage Data — pages visited, time spent on each page, matches viewed, bets placed (including time, type, and amount), games played, and general platform usage patterns.
• Cookie Data — information stored in cookies and similar tracking technologies on your device. Further details are explained in Section 5 below.

Every piece of data we collect is used for a specific, legitimate purpose. w2win does not use your data for anything outside the scope described here without first obtaining your consent.

Primary Purposes of Data Use:

• Account Management & Services — to create and maintain your account, process your registration, verify your identity, and grant you access to all w2win platform features you have subscribed to.
• Financial Transaction Processing — to process deposits, process withdrawal of winnings, verify the source of funds, and maintain accurate transaction records for every member.
• Security & Fraud Prevention — to detect suspicious activity, prevent money laundering, verify member identity during withdrawals, and protect the platform's user community from abuse.
• Service Communications — to send you account-related notifications such as transaction confirmations, security alerts, policy updates, and promotional information you have agreed to receive.
• Customer Support — to help resolve enquiries, complaints, and technical issues you report to our support team, including retaining conversation records for training and service quality improvement purposes.
• Legal Compliance — to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) and know your customer (KYC) obligations.
• Platform Improvement — to analyze usage patterns in aggregate (not individually) in order to understand which features are most valuable to members and make better product development decisions.

We do not use your personal data for fully automated decision-making that has a material impact on you without human review — except for immediate security purposes such as temporary account suspension when our systems detect suspicious activity, which will be reviewed by our team within 24 hours.

This is the section most members want specific clarity on — and we will be completely transparent. w2win does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Full stop.

However, there are limited circumstances in which we need to share data with other parties for legitimate platform operational purposes:

• Payment Service Providers — payment processors responsible for handling your deposit and withdrawal transactions, including local e-wallet providers and the FPX payment gateway. Data shared is limited to the minimum necessary to process each transaction.
• Game Software Providers — in the context of slots and Live Casino games, software providers may receive the session data required to deliver the game. They do not receive your full identity information.
• Identity Verification Services — third-party KYC service providers we engage to verify identity documents during registration or certain withdrawal processes. They operate under strict confidentiality agreements with w2win.
• Statutory Authorities — where required by law, court order, or a valid request from a Malaysian law enforcement agency, we may be required to disclose certain information. We will notify you of any such request unless prohibited from doing so by law.
• Aggregate Analytics Services — we use analytics tools to understand user behaviour collectively. This data is aggregated and anonymised — no individually identifiable information is shared with analytics providers.

Protecting members' personal data is our highest technical and operational priority at w2win. We continually invest in security infrastructure and best practices to ensure your data remains safe at all times.

Technical Security Measures We Have Implemented:

• 256-bit SSL/TLS Encryption — all communications between your device and w2win's servers are encrypted using SSL/TLS protocol with a 256-bit key length. This means that even if your data is intercepted in transit, it cannot be read without the encryption key.
• Encrypted Password Storage — your password is never stored in plain text. We use modern cryptographic hashing algorithms with a unique salt for each account, ensuring that passwords cannot be recovered — even by w2win staff.
• Environment Segregation — our production data and development/testing data are kept entirely separate. No real user data is used in our testing environment.
• 24/7 Threat Monitoring & Detection — our automated monitoring system detects and alerts on any abnormal activity within the platform in real time, enabling our security team to respond swiftly.
• Strict Internal Access Controls — only w2win staff who require access to specific data to perform their duties are granted that access, based on the principle of least privilege. All internal access to sensitive member data is logged and audited on a regular basis.
• Regular Security Testing — we conduct regular penetration testing and security audits by independent experts to identify and address vulnerabilities before they can be exploited.

While we take every reasonable step to protect your data, it is important to understand that no security system is entirely foolproof. In the unlikely event of a security breach affecting member data, we are committed to responding swiftly, transparently, and responsibly.

The w2win platform uses cookies and similar technologies to enhance the user experience, ensure account security, and understand how members use our platform. Below is an overview of the types of cookies we use.

• Session Cookies — a temporary cookie that exists only while your login session is active. It is used to keep you logged in, store your current account balance, and ensure that bets and transactions are linked to the correct account. This cookie is automatically deleted when you log out or close your browser.
• Preference Cookies — saves your preferences such as display language, preferred odds format, and other display settings so you do not have to reconfigure them every time you log in.
• Security Cookies — used to detect and prevent unauthorised activity such as unauthorised login attempts and cross-site request forgery (CSRF) attacks. These cookies are mandatory for the security of your account.
• Analytics Cookies — helps us understand how members use our platform — which pages are most visited, how much time is spent, and where users encounter difficulties. This information is used to improve the platform. Analytics data is collected in aggregate and does not identify individual users.

W2win does not use cross-site tracking technology to monitor your online activity outside of our platform. Once you leave the w2win website, we do not track your activity on other websites.

W2win retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulations. The following are general guidelines on retention periods for key data categories.

• Active Account Data — retained for the lifetime of your w2win account. You may request account deletion at any time, provided there are no pending transactions or ongoing investigations.
• Financial Transaction Records — retained for a minimum of 7 years from the transaction date, in line with financial compliance and anti-money laundering requirements set out under Malaysian law.
• Identity Verification Records (KYC) — identity documents and verification records are retained for a minimum of 5 years after account closure, or longer if required by applicable law.
• Support Communication Logs — records of conversations with our support team are retained for 3 years for training, quality audit, and reference purposes in the event of a complaint or dispute.
• Log and Activity Data — platform technical logs are retained for 12 months for security and technical troubleshooting purposes.
• Data After Account Closure — when you close your w2win account, we will delete or anonymise data that is no longer required for legal purposes within 90 days. Data that must be retained by law will be kept in a separate system with stricter access controls.

If you would like more specific information about the retention periods for particular data categories relating to your account, please contact our support team and we will provide details based on your account's circumstances.

As a w2win member, you have clearly defined rights over your personal data. We respect these rights and make it straightforward for you to exercise them.

The w2win platform is strictly for individuals aged 18 and above. We take the protection of minors extremely seriously and maintain a zero-tolerance policy against underage use of the platform.

• W2win does not knowingly collect any personal data from individuals under the age of 18.
• Our registration process includes age verification steps specifically designed to prevent sign-ups by underage individuals.
• If we discover that personal data belonging to an individual under the age of 18 has been collected inadvertently, we will delete that data immediately and close the account in question.
• If you are a parent or guardian who has discovered that your underage child has registered a w2win account, please contact us immediately at support@w2win.best so that we can take the appropriate action.

The technology industry and data protection laws continue to evolve, and w2win may need to update this privacy policy from time to time to reflect changes in our practices, the technologies we use, or applicable legal requirements.

• Any material changes to this privacy policy — including changes to how we collect, use, or share your personal data — will be communicated to all active members via their registered email address at least 14 days before the changes take effect.
• Minor changes that are corrective, clarifying, or involve updated contact information may be implemented without a formal email notice, but the updated date at the top of this document will be revised to reflect those changes.
• Continued use of the w2win platform after any privacy policy changes take effect will be considered as acceptance of those changes. If you do not agree with any changes, you have the right to close your account before they come into effect.
• Previous versions of our privacy policy will be retained for reference and can be requested through our support team.

If you have any questions, concerns, or requests relating to this privacy policy or the way we handle your personal data, please get in touch with our team. We are committed to providing an informed response within a reasonable timeframe.

How to Reach the w2win Privacy Team:

• Privacy-Specific Email: support@w2win.best — please mark your email subject as "Privacy Inquiry" for faster handling.
• 24/7 Live Chat: Use the live chat button within the platform for enquiries that require a faster response. Our team is fully able to communicate in Bahasa Melayu.
• Data Access Request: To request a copy of the personal data we hold about you, or to request a correction or deletion of that data, please email us with the subject line "Data Access Request" along with proof of your identity. We will process your request within 30 days.

We welcome feedback from members regarding our Privacy Policy. If you have suggestions on how we can strengthen privacy protection or make this policy easier to understand, we would love to hear from you. Your trust is the foundation of our relationship as a platform provider and you as a member — and we are committed to maintaining that trust through transparency and consistent action.