Privacy Policy – winway

1. Introduction

winway ("winway", "we", "us", "our") operates the online gaming platform accessible at winway.lat (the "Platform"). In providing our services to registered users ("you", "your"), winway necessarily collects and processes personal data. We take that responsibility seriously. This Privacy Policy sets out, in plain terms, what personal data winway collects, the purposes for which it is processed, the conditions under which it may be shared with third parties, and the rights available to you as a data subject.

This Policy applies to all Users of the winway Platform, including registered account holders and visitors who browse the Platform without registering. It should be read alongside our Terms & Conditions and Responsible Gaming Policy.

By creating a winway account or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, you should discontinue your use of the winway Platform.

2. Personal Data We Collect

winway collects the following categories of personal data in connection with the provision of its services:

2.1 Identity & Contact Data

• Full legal name as it appears on government-issued identification
• Date of birth and age verification documentation
• Residential address (current and, where required for KYC, historical)
• Email address and mobile phone number
• Copies of identity documents (e.g. MyKad, passport) submitted for KYC verification

2.2 Financial Data

• Payment method identifiers (e.g. registered mobile number for Touch n Go eWallet or Boost, bank account number for Maybank, CIMB, Public Bank, Hong Leong Bank, or RHB)
• Transaction history, including deposit amounts, withdrawal requests, and processing timestamps
• Source of funds documentation where required by regulatory obligations

2.3 Platform Activity Data

• Betting history: markets accessed, stakes placed, outcomes, and winnings
• Casino and slots session data: games played, session durations, bet values, and results
• Responsible gaming tool usage: deposit limits set, cool-off periods activated, self-exclusion requests
• Communication records: live chat transcripts, email correspondence, and support ticket history

2.4 Technical & Usage Data

• IP address and approximate geolocation data derived therefrom
• Device identifiers, browser type and version, and operating system
• Pages visited, features accessed, and navigation patterns on the Platform
• Login timestamps and session duration data

3. How We Collect Your Data

winway collects personal data through the following means:

4. Purpose and Legal Basis for Processing

winway processes your personal data for the following purposes, each supported by a lawful basis as described:

• Account creation and management — Processing is necessary for the performance of our contract with you. Without this data, winway cannot provide its services.
• Identity verification (KYC) — Processing is necessary to comply with our legal obligations under applicable anti-money laundering and gaming regulations.
• Payment processing — Processing is necessary for the performance of our contract with you, specifically to facilitate deposits and withdrawals.
• Fraud prevention and security — Processing is necessary for winway's legitimate interests in protecting the Platform and its users from fraudulent activity and unauthorised access.
• Responsible gaming compliance — Processing is necessary to comply with our legal obligations and to protect the vital interests of Users who may be at risk of gambling-related harm.
• Platform improvement and analytics — Processing is based on winway's legitimate interest in understanding how the Platform is used in order to improve service quality and user experience.
• Marketing communications — Where you have provided explicit consent, winway may use your contact details to send promotional offers and platform updates. You may withdraw consent at any time by contacting support.
• Regulatory reporting — Processing is necessary to comply with our obligations to relevant regulatory and licensing authorities.

5. Data Sharing and Disclosure

winway does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment processors and e-wallet providers — Including Touch n Go eWallet, Boost, and partner banks, to the extent necessary to execute your requested transactions.
• Identity verification and KYC service providers — Third-party agencies engaged to verify the identity documents you submit during the registration or KYC process.
• Game content providers — Third-party casino and slot game providers may receive anonymised session data required for game performance, fairness certification, and dispute resolution purposes.
• Fraud detection and cybersecurity vendors — Service providers engaged to monitor platform activity for suspicious behaviour, unauthorised access attempts, and potential money laundering indicators.
• Regulatory and law enforcement authorities — winway may be required by law to disclose certain personal data to relevant regulatory bodies, licensing authorities, law enforcement agencies, or courts of competent jurisdiction. Such disclosures will be made only to the extent required by applicable law.
• Professional advisers — Lawyers, accountants, and auditors, subject to professional obligations of confidentiality, where disclosure is necessary for the conduct of winway's business.

All third-party recipients are contractually required to process your personal data solely for the specified purpose and in accordance with applicable data protection standards.

6. International Data Transfers

The winway Platform is operated from servers that may be located outside Malaysia. Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to Malaysia's Personal Data Protection Act 2010 (PDPA), winway will implement appropriate safeguards to ensure that your data remains protected. These safeguards may include standard contractual clauses, data processing agreements that impose equivalent protections, or transfers to recipients who are certified under recognised international data protection frameworks. If you wish to obtain further information about the safeguards applicable to any specific international transfer of your data, please contact winway's support team.

7. Data Retention

winway retains your personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy, and in any event for the minimum periods required by applicable law and our regulatory obligations. The following general retention periods apply:

• Account and KYC data — Retained for a minimum of five (5) years following account closure, in compliance with applicable anti-money laundering regulations.
• Transaction records — Retained for a minimum of five (5) years from the date of each transaction.
• Responsible gaming records — Retained for the duration of any self-exclusion period plus five (5) years thereafter.
• Technical and usage data — Generally retained for a maximum of twenty-four (24) months, unless a longer period is required for fraud investigation purposes.
• Marketing consent records — Retained until consent is withdrawn and for a period sufficient to demonstrate that the applicable communications were sent with valid consent.

Upon expiry of the applicable retention period, winway will securely delete or anonymise your personal data in accordance with its data destruction procedures.

8. Cookies and Tracking Technologies

winway uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device when you access a website. winway uses the following categories of cookies:

• Strictly necessary cookies — Required for the Platform to function. These include session authentication cookies that keep you logged in to your winway account. These cannot be disabled.
• Functional cookies — Used to remember your preferences, such as preferred language, display settings, and the "Remember Me" login option.
• Analytics cookies — Used to collect aggregated, anonymised data about how Users interact with the Platform, enabling winway to identify and address usability issues and improve the overall experience.
• Security cookies — Used to detect and prevent fraudulent activity, including cookies that support multi-device login detection and session integrity verification.

You may manage non-essential cookies through your browser settings. Note that disabling certain cookies may impair the functionality of the winway Platform. winway does not use third-party advertising cookies or engage in cross-site behavioural tracking for advertising purposes.

9. Security Measures

winway implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the winway Platform
• Bcrypt hashing for stored passwords — winway never stores passwords in plain text
• Two-factor authentication (2FA) available to all registered Users
• Automated login anomaly detection and geographic location alerts
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Regular security audits and penetration testing of Platform infrastructure
• Secure session token management with automatic expiry after periods of inactivity

While winway takes all reasonable steps to protect your personal data, no system of transmission or storage over the internet can be guaranteed to be entirely secure. You are responsible for maintaining the security of your own winway account credentials.

10. Your Data Rights

Subject to applicable law, you have the following rights in respect of your personal data held by winway:

• Right of access — You may request a copy of the personal data winway holds about you.
• Right to rectification — You may request that inaccurate or incomplete personal data held by winway be corrected. For account-level information, you may update many details directly through your winway account settings.
• Right to erasure — Subject to our legal and regulatory retention obligations, you may request the deletion of your personal data. Note that certain data must be retained for mandatory minimum periods and cannot be erased on request.
• Right to restriction of processing — You may request that winway restricts the processing of your data in certain circumstances, for example while a dispute about data accuracy is pending resolution.
• Right to data portability — Where processing is carried out on the basis of your consent or for the performance of a contract, you may request a copy of your data in a structured, machine-readable format.
• Right to withdraw consent — Where processing is based on your consent (e.g. marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to object — You may object to processing carried out on the basis of winway's legitimate interests. winway will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, please contact winway's support team. We will respond to all valid requests within thirty (30) days. We may need to verify your identity before processing your request.

11. Children's Privacy

The winway Platform is strictly intended for individuals aged 21 and above. winway does not knowingly collect personal data from individuals under the age of 21. If winway becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, such data will be deleted and the associated account will be immediately closed. If you believe that a minor has registered on the winway Platform, please notify us immediately at [email protected].

12. Changes to This Privacy Policy

winway reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where material changes are made, winway will notify registered Users by email to the address on file or through a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date at the top of this Policy will be revised accordingly. Your continued use of the winway Platform following notification of material changes constitutes acceptance of the revised Policy. We encourage you to review this page periodically to stay informed of how winway handles your personal data.

13. Contact Us & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or winway's handling of your personal data, please contact our support team. We are available 24/7 via live chat on the winway Platform, or by email at: [email protected]

Please include your registered username and a description of your query to allow us to respond efficiently. winway aims to resolve all data-related queries within 30 days of receipt.

If you are not satisfied with winway's response to your complaint, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In Malaysia, the regulatory body responsible for overseeing compliance with the Personal Data Protection Act 2010 is the Department of Personal Data Protection (JPDP), accessible via official government channels.