Privacy Policy

This Privacy Policy (hereinafter referred to as "this Policy" or "the Policy") sets out how WinMY ("WinMY", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", or "the Player") who access or use the WinMY website at https://winmy.cam and its associated platform, products, and services (collectively, "the Platform").

WinMY operates an online casino and sports betting platform serving the Malaysian market. In doing so, we collect and process personal data as a necessary part of providing our services, fulfilling our licensing obligations, complying with anti-money laundering (AML) requirements, and maintaining the security and integrity of our Platform.

This Policy should be read alongside our Terms and Conditions, which govern your use of the Platform as a whole. In the event of any conflict between this Policy and the Terms and Conditions on matters of data privacy, this Policy shall take precedence.

For the purposes of this Policy, the following defined terms apply:

WinMY is the Data Controller in respect of all Personal Data processed through the Platform. WinMY operates under an international gaming licence and maintains data protection practices in accordance with the requirements of that licence and applicable international data protection standards.

WinMY does not fall within the direct territorial scope of the Malaysian Personal Data Protection Act 2010 (PDPA 2010), as it does not process personal data in the course of commercial transactions taking place wholly within Malaysia. However, WinMY voluntarily adopts principles consistent with the PDPA 2010 and international best practice standards as a matter of operating policy, given that the majority of our players are Malaysian residents.

WinMY collects the following categories of Personal Data in the course of operating the Platform:

WinMY does not intentionally collect special categories of Sensitive Data (such as health data or biometric data) unless specifically required to do so by a legal obligation or with your explicit consent. If such collection becomes necessary, you will be notified prior to collection.

WinMY collects Personal Data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, setting responsible gambling limits, or contacting our support team.
• Automated collection: Technical and usage data collected automatically when you access the Platform, via server logs, cookies, and similar tracking technologies.
• Third-party sources: Identity verification data received from our KYC service providers; fraud screening data from our anti-fraud partners; payment confirmation data from our payment processing partners (including DuitNow, FPX, Touch 'n Go eWallet, and bank gateway providers).
• Referral programmes: If you were referred to WinMY by an existing player, we receive the referrer's account identifier to process the referral bonus. We do not receive any personal data about you from the referring player beyond your registration on our Platform.

WinMY processes your Personal Data on the following lawful bases, in accordance with applicable data protection principles:

WinMY uses your Personal Data for the following specific purposes:

• To create and manage your WinMY Account and provide you with access to the Platform's products and services.
• To process deposits and withdrawals, and to maintain accurate financial records in MYR.
• To verify your identity and age in accordance with our KYC obligations under our operating licence.
• To conduct AML screening and monitor for patterns of activity consistent with money laundering, fraud, or other financial crime.
• To monitor your gaming behaviour for responsible gambling purposes, including identifying indicators of problem gambling and applying appropriate interventions.
• To administer promotional bonuses, loyalty rewards, birthday bonuses, and referral programmes in accordance with their applicable terms.
• To communicate with you about your Account, transactions, policy updates, and support matters.
• To send marketing communications where you have provided consent, including information about new games, promotions, and platform features.
• To analyse Platform usage patterns and improve the user experience for Malaysian players.
• To enforce our Terms and Conditions and protect the integrity and security of the Platform.
• To comply with applicable legal and regulatory obligations under our international gaming licence.

WinMY does not use automated decision-making processes — including profiling — that produce legal or similarly significant effects on Players, except where explicitly required by our AML and fraud prevention obligations under our licensing conditions. Where such automated processes apply, you have the right to request human review.

WinMY does not sell your Personal Data to third parties. We may share your Personal Data with the following categories of recipients in the circumstances described:

• Payment processing partners: Including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, Visa, Mastercard, and cryptocurrency gateway providers. These partners receive only the data necessary to process your specific transaction.
• Identity verification and KYC service providers: Third-party services engaged by WinMY to verify player identity and age documents as a condition of our operating licence.
• AML and fraud screening services: Third-party providers engaged to screen transactions and player activity against sanctions lists and fraud databases.
• Platform technology providers: Cloud hosting, data infrastructure, and platform development services operating under data processing agreements with WinMY.
• Game studios and content providers: Limited technical data (such as session tokens and wager amounts) may be passed to licensed game studios to facilitate gameplay. No personal identity information is passed to game studios beyond what is technically required.
• Regulatory and legal authorities: Where we are required to disclose data by a court order, regulatory direction, law enforcement request, or other mandatory legal process under applicable law.
• Corporate successors: In the event of a merger, acquisition, or asset sale, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

WinMY is an internationally operated platform. Your Personal Data may be processed and stored in countries outside Malaysia. Where such international transfers occur, WinMY ensures that appropriate safeguards are in place to protect your data, including:

• Transfers to countries that provide an adequate level of data protection as determined by applicable international standards.
• Data processing agreements with our service providers that incorporate appropriate contractual protections for Personal Data.
• Technical and organisational security measures applied consistently across all jurisdictions in which we operate.

By using the WinMY Platform, you acknowledge that your Personal Data may be transferred internationally as described in this clause. Where you have concerns about specific transfers, please contact us at [email protected].

WinMY retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Active Account Data: Retained for the duration of your account relationship with WinMY plus a post-closure retention period of not less than 5 years, to satisfy AML record-keeping obligations under our licensing conditions.
• KYC Documentation: Retained for a minimum of 5 years from the date of last account activity, as required by our international gaming licence AML provisions.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, for AML compliance and potential dispute resolution purposes.
• Support Communications: Retained for up to 3 years from the date of the communication, unless a longer period is required for ongoing dispute resolution.
• Marketing Consent Records: Retained for the duration of the consent plus 3 years, to demonstrate compliance with consent obligations.
• Technical and Usage Data (Logs): Retained for up to 12 months for security, fraud prevention, and platform optimisation purposes.

Following the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

WinMY uses cookies and similar tracking technologies on the Platform to ensure proper functionality, enhance user experience, and collect usage analytics. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security tokens. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Store your preferences (such as language and display settings) to personalise your experience across sessions.
• Analytics Cookies: Collect aggregated data about how players interact with the Platform — such as most-visited pages and navigation flows — to help us improve the user experience. This data does not identify individual players.
• Security Cookies: Used to detect and prevent fraudulent access attempts, session hijacking, and other malicious activity.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform, though some features may function differently. Strictly necessary cookies cannot be disabled without impeding Platform access.

Subject to applicable data protection law, you hold the following rights in respect of your Personal Data processed by WinMY:

To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. Complex requests may require up to 60 days; we will notify you if an extension is necessary.

WinMY implements technical and organisational measures designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the WinMY Platform.
• Encryption of sensitive data at rest, including payment details and KYC documentation.
• Role-based access controls limiting staff access to Personal Data to those with a legitimate operational need.
• Comprehensive audit logging of all access to Personal Data systems.
• Regular security assessments, penetration testing, and vulnerability scans of Platform infrastructure.
• Two-factor authentication (2FA) available to all registered players to secure account access.
• Incident response procedures for detecting, reporting, and managing potential Personal Data breaches.

While WinMY takes all reasonable precautions to secure your Personal Data, no method of internet transmission or electronic storage is entirely risk-free. We encourage all players to use strong, unique passwords, enable 2FA on their WinMY account, and report any suspected unauthorised access to [email protected] immediately.

In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, WinMY will notify affected players and, where required, the relevant supervisory authority, without undue delay.

The WinMY Platform is strictly intended for individuals aged 21 years and above. WinMY does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory step in our KYC process, and accounts found to be registered by individuals under 21 will be immediately closed and any funds returned in accordance with our Terms and Conditions.

If you have reason to believe that a person under the age of 21 has registered an account on WinMY, please notify us immediately at [email protected]. We will investigate and take appropriate action promptly.

The WinMY Platform may contain references to third-party services — such as payment gateways or game studios — in the course of providing our services. WinMY is not responsible for the privacy practices of any third-party service. Each third-party service operates under its own privacy policy, which you should review before providing that service with any personal information.

WinMY does not permit third-party advertising networks to embed trackers or links on the Platform for independent commercial profiling of our players. Any third-party data sharing is limited to the operational purposes described in Clause 8 of this Policy.

WinMY reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal or regulatory requirements, or platform operations. Where a material change is made, we will provide reasonable notice by posting the updated Policy on the Platform and updating the "Last updated" date at the top of this document.

Where a change materially affects how we process your Personal Data in a way that requires fresh consent, we will request that consent separately at the appropriate time. For non-material updates, your continued use of the Platform following the effective date of the revised Policy constitutes your acknowledgement of the changes.

We encourage all players to review this Policy periodically to stay informed about how WinMY protects and handles their data.

For any questions, concerns, or requests relating to this Privacy Policy, your Personal Data, or your data rights, please contact the WinMY support and compliance team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Data Rights Request" or "Privacy Enquiry"
• Live Chat: Available in-platform 24 hours a day, 7 days a week
• Support Hours: Daily, 9:00 AM – 12:00 AM (GMT+8)

We aim to acknowledge all privacy-related enquiries within 2 business days and provide a substantive response within 30 calendar days. For formal data rights requests as described in Clause 12, the 30-day response window begins from the date on which we have verified your identity.