Privacy Policy —
Winbox2025 Platform

Introduction

This Privacy Policy ("Policy") is issued by Winbox2025 ("Company", "we", "us", "our") and governs the collection, use, storage, sharing, and protection of personal data provided by or collected from users ("User", "you", "your") of the Winbox2025 platform accessible at https://winbox2025.cam and all associated services (collectively, the "Platform").

Winbox2025 is an English-language online casino and sports betting platform built for Malaysian players. As a company that handles financial transactions, identity verification data, and behavioural usage information, we treat data privacy as a fundamental operational responsibility — not merely a legal formality.

By registering an Account, accessing the Platform, or using any of our Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to this Policy, you must refrain from using the Platform.

Definitions

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, email address, phone number, IP address, financial information, and behavioural data generated through use of the Platform.
• "Processing" — Any operation or set of operations performed on Personal Data, including collection, recording, storage, use, analysis, disclosure, or erasure.
• "Data Controller" — Winbox2025, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — Any third party engaged by Winbox2025 to process Personal Data on behalf of the Company under contractual instruction.
• "KYC Data" — Identity verification documentation submitted by Users, including government-issued identification, proof of address, and facial verification images, collected for regulatory compliance and fraud prevention purposes.
• "Cookie" — A small data file placed on a User's device by the Platform, used to store session information, preferences, and anonymised analytical data.
• "Consent" — A freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their Personal Data for a specified purpose.

Data We Collect

Winbox2025 collects Personal Data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party service providers where necessary for operational or compliance purposes. The following table outlines the categories of data we collect and their source:

We do not collect sensitive categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where voluntarily disclosed by you in the context of a responsible gambling concern or support request, in which case such data is handled with the highest level of confidentiality.

How We Use Your Data

Winbox2025 processes your Personal Data for the following specific purposes. We do not use your data for any purpose beyond what is necessary for the functions described below unless we have your explicit consent to do so.

4.1 Account Management & Service Delivery

• Creating, maintaining, and operating your registered Account on the Platform.
• Processing deposits and withdrawals in Malaysian Ringgit (MYR) via your selected payment method (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, GrabPay, Boost, and others).
• Providing access to casino games, live dealer tables, sports betting markets, and other Platform features.
• Verifying your identity through KYC procedures before processing withdrawals.
• Communicating with you about your Account, transactions, and support requests.

4.2 Legal Compliance & Fraud Prevention

• Verifying that Users meet the minimum age requirement of 21 years.
• Complying with applicable anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Detecting, investigating, and preventing fraud, money laundering, account abuse, and other prohibited conduct.
• Responding to lawful requests from regulatory authorities or law enforcement agencies where legally required.

4.3 Responsible Gambling & Player Safety

• Administering deposit limits, session limits, cooling-off periods, and self-exclusion requests made by Users.
• Monitoring account activity for behavioural patterns that may indicate problematic gambling, in accordance with our duty of care obligations.
• Sending responsible gambling communications, including reality check notifications and limit reminder alerts.

4.4 Platform Improvement & Analytics

• Analysing anonymised and aggregated usage data to identify areas for Platform improvement.
• Conducting internal research into game performance, payment channel efficiency, and user experience quality.
• Running A/B tests on Platform features to optimise design and functionality.

4.5 Marketing Communications

Where you have provided explicit consent to receive marketing communications, we may contact you with information about promotions, bonuses, new game releases, and platform updates relevant to Malaysian players. You may withdraw your consent to receive marketing communications at any time by updating your notification preferences within your Account settings or by contacting our support team.

Legal Basis for Processing

Winbox2025 processes your Personal Data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Terms and Conditions — including operating your Account, processing transactions, and delivering Platform services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC, AML, and CTF requirements.
• Legitimate Interests: Processing undertaken to pursue Winbox2025's legitimate business interests, including fraud prevention, Platform security, and responsible gambling monitoring, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for non-essential purposes — specifically, direct marketing communications — which is undertaken only where you have provided clear, affirmative consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

Winbox2025 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: We share transaction-relevant data with payment service providers including Malaysian e-wallet operators (Touch 'n Go, Boost, GrabPay), banking partners (Maybank, CIMB, Public Bank, Hong Leong), DuitNow/FPX infrastructure providers, and cryptocurrency processors, solely for the purpose of executing deposits and withdrawals.
• Identity Verification Partners: We engage third-party KYC and identity verification service providers to validate identification documents submitted by Users. These providers process KYC Data exclusively for verification purposes and are contractually bound by strict data protection obligations.
• Fraud Prevention & AML Services: We may share anonymised or pseudonymised transactional and behavioural data with third-party fraud detection and AML screening services to fulfil our compliance obligations.
• Game Content Providers: Third-party game providers integrated into the Platform may receive anonymised session and game play data necessary to deliver game functionality. These providers do not receive personally identifiable information beyond what is technically required.
• Legal & Regulatory Authorities: We will disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so by applicable law or valid legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business assets, User Personal Data may be transferred to the relevant successor entity, subject to equivalent privacy protections being maintained.

Data Retention

Winbox2025 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your Account's active status on the Platform, including all transaction history, KYC documentation, and communication records.
• Post-Account Closure: Following Account closure, Winbox2025 retains transaction records, KYC documentation, and audit logs for a minimum period of five (5) years to comply with AML, CTF, and financial record-keeping obligations.
• Self-Exclusion Records: Where a permanent self-exclusion has been applied, associated records are retained indefinitely to prevent re-registration by excluded individuals.
• Marketing Consent Records: Records of consent to marketing communications are retained for the duration of the consent and for a period thereafter sufficient to demonstrate compliance.
• Cookie and Analytics Data: Anonymised analytics data is retained for up to 26 months from the date of collection, in accordance with standard analytical data practices.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

Cookies & Tracking Technologies

Winbox2025 uses cookies and similar tracking technologies to operate and improve the Platform. By accessing the Platform, you consent to the use of cookies in accordance with this section. The following categories of cookies are used on the Platform:

• Strictly Necessary Cookies: These cookies are essential to the operation of the Platform and cannot be disabled. They enable core functions including session management, login persistence, and security controls. No consent is required for strictly necessary cookies.
• Functional Cookies: These cookies store your preferences, such as language settings, display preferences, and notification configurations, to provide a personalised experience across sessions.
• Analytical Cookies: These cookies collect anonymised data about how Users interact with the Platform — including pages visited, session duration, and navigation paths — to help us improve our services. Data collected through analytical cookies is aggregated and does not identify individual Users.
• Performance Cookies: These cookies assist in monitoring Platform performance, load times, and error rates, enabling our technical team to identify and resolve issues proactively.

You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform and your ability to access some features. Instructions for managing cookies are available through your browser's built-in help documentation.

Data Security

Winbox2025 implements a comprehensive range of technical, physical, and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Transport Encryption: All data transmitted between your device and the Winbox2025 Platform is encrypted using industry-standard 256-bit TLS/SSL protocols, preventing interception during transmission.
• Data Encryption at Rest: Sensitive Personal Data, including KYC documents and financial records, is encrypted in storage using AES-256 encryption standards.
• Access Controls: Access to Personal Data within Winbox2025's internal systems is restricted on a strict need-to-know basis and governed by role-based access control policies. All internal access is logged and subject to regular audit.
• Two-Factor Authentication: Winbox2025 offers two-factor authentication (2FA) for User Accounts to provide an additional layer of protection against unauthorised access.
• Incident Response: Winbox2025 maintains a documented data breach response protocol. In the event of a confirmed breach affecting Users' Personal Data, we will notify affected users and relevant authorities in accordance with applicable legal requirements.

While we implement robust security controls, no digital system can guarantee absolute security. You are also responsible for maintaining the security of your own Account credentials. If you suspect any unauthorised activity on your Account, please contact us immediately via live chat or at [email protected].

Your Rights

As a User of the Winbox2025 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please submit a written request to [email protected] with sufficient information to verify your identity. We will respond to all valid requests within thirty (30) calendar days of receipt.

• Right of Access: You have the right to request a copy of all Personal Data that Winbox2025 holds about you, along with information about the purposes for which it is processed and the categories of third parties with whom it has been shared.
• Right to Rectification: You have the right to request correction of any Personal Data that is inaccurate or incomplete. Minor corrections (such as updating your email address or phone number) can be made directly within your Account settings.
• Right to Erasure: You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent (where consent was the legal basis for processing). Please note that this right is subject to overriding legal retention obligations, including AML record-keeping requirements.
• Right to Restriction: You have the right to request that we restrict processing of your Personal Data in certain circumstances, such as while you contest the accuracy of the data or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Object to Marketing: You have the right to object at any time to processing of your Personal Data for direct marketing purposes. This includes profiling to the extent it relates to direct marketing.

Minors & Age Policy

The Winbox2025 Platform is strictly intended for users who are twenty-one (21) years of age or older. We do not knowingly collect Personal Data from any individual under the age of 21 and we do not permit minors to register for or use our Services under any circumstances.

If we become aware, through age verification processes, user reports, or any other means, that a User is under the age of 21, we will take immediate action to:

• Suspend and permanently close the relevant Account.
• Void all gameplay and transactions associated with the underage Account.
• Delete the Personal Data associated with the Account to the extent permitted by our legal obligations.
• Withhold any account balance pending investigation, as no contractual relationship is legally enforceable with a minor.

If you have reason to believe that a minor has registered on or accessed the Winbox2025 Platform, please report this to us immediately at [email protected] so that we can investigate and act accordingly.

Third-Party Services

The Winbox2025 Platform integrates with a number of third-party services to deliver its full functionality. These may include game content providers, payment processing infrastructure, KYC verification tools, and internal analytics platforms. While we exercise due diligence in selecting partners who maintain appropriate data protection standards, Winbox2025 is not responsible for the privacy practices of independent third parties.

The Platform does not contain links to external third-party websites for general browsing purposes. All content and services are delivered within the Winbox2025 environment. Any third-party integrations used within the Platform for operational purposes are governed by their own privacy policies, and we recommend reviewing those policies if you have specific concerns about how those parties handle your data.

Policy Amendments

Winbox2025 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform functionality. Where material changes are made, we will notify Users via a prominent notice on the Platform or via email to your registered address, and we will update the effective date at the top of this document.

Your continued use of the Platform following the posting of an updated Privacy Policy constitutes your acknowledgement of the changes and your consent to the updated terms where consent is the applicable legal basis. If you do not accept the revised Policy, you must discontinue use of the Platform and close your Account.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by Winbox2025, please contact us through the following channels:

• Email: [email protected] — for all data subject access requests, erasure requests, and privacy-related enquiries.
• Live Chat: Available 24 hours a day, 7 days a week via the live chat button on the Platform, for general privacy questions and urgent data security concerns.
• Response Timeframe: We will acknowledge all written privacy requests within 5 business days and aim to provide a full substantive response within 30 calendar days of receipt.

Where a data subject access request or erasure request is complex or involves a high volume of data, we may extend our response period by a further 60 days. In such cases, we will notify you of the extension and the reason for it within the initial 30-day period.