Privacy Policy — Winnbox

This Privacy Policy (hereinafter "Policy") sets out the basis on which Winnbox (hereinafter "Winnbox", "we", "us", or "our") collects, processes, stores, and discloses personal data obtained from individuals (hereinafter "you", "the Player", or "the User") who access or use the Winnbox platform at winnbox.cam, including all associated subdomains, mobile interfaces, and gaming services (collectively, the "Platform").

Winnbox is committed to protecting your privacy and maintaining the confidentiality and integrity of your personal information. This Policy has been prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, and reflects our obligations as a data processor operating within and serving the Malaysian market.

By registering an account on the Platform, making a deposit, or otherwise using any service offered by Winnbox, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. Where your consent is required and you do not wish to provide it, you should refrain from using the Platform and contact us to close your account.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• Personal Data — Any information that directly or indirectly identifies a living individual, including name, identification number, contact details, financial data, and online identifiers such as IP address and device ID.
• Processing — Any operation performed on personal data, whether automated or manual, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• Data Subject — The natural person to whom the personal data relates — in most cases, the registered Player on the Winnbox Platform.
• Data Controller — Winnbox, as the entity that determines the purposes and means of processing personal data collected via the Platform.
• KYC Data — Identity and age verification documents submitted by Players, including copies of the Malaysian MyKad, passport, selfie photographs, and proof of address.
• Consent — A freely given, specific, informed, and unambiguous indication by the Data Subject that they agree to the processing of their personal data for defined purposes.
• Third Party — Any natural or legal person other than the Data Subject, Winnbox, or persons who process data under the direct authority of Winnbox.
• PDPA — The Personal Data Protection Act 2010 of Malaysia, as amended or replaced from time to time.

Winnbox collects personal data from Players across several categories, depending on the nature of the interaction and the services being used. The following table sets out the categories of data we collect and typical examples of each:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data beyond what is strictly necessary for age and identity verification under our KYC obligations.

Winnbox collects personal data through the following channels:

4.1 Direct Collection

You provide data directly when you complete the registration form, submit KYC documents, make a deposit via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, or cryptocurrency, contact our support team, or update your account settings.

4.2 Automated Collection

When you access the Platform, our servers automatically log technical data including your IP address, browser user-agent, device identifiers, and session behaviour. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 7.

4.3 Third-Party Sources

We may receive data about you from identity verification service providers (for KYC purposes), payment processors (for transaction confirmation), fraud detection partners, and analytics providers. All such third parties are contractually bound to handle your data in accordance with applicable privacy law.

Winnbox processes your personal data strictly for the following defined and lawful purposes:

1. Account Management: To create, maintain, and administer your registered account on the Platform, including processing login authentication and account preference settings.
2. Identity and Age Verification (KYC): To verify that you are a natural person aged 21 or above and to confirm the accuracy of the identity information provided, as required under our operating obligations.
3. Payment Processing: To process deposits received from Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB Bank, Public Bank, Hong Leong Bank, RHB Bank, DuitNow, FPX, and cryptocurrency) and to execute withdrawal payments to verified accounts.
4. Gaming Services: To deliver the casino games, live dealer tables, sports betting markets, and other gaming products available on the Platform.
5. Responsible Gambling: To monitor gaming patterns and account activity for indicators of problem gambling, and to administer deposit limits, self-exclusion orders, and cooling-off periods at the Player's request or at our discretion.
6. Anti-Fraud and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account compromise, and violations of our Terms and Conditions.
7. Customer Support: To respond to enquiries, resolve disputes, process complaints, and provide technical assistance via live chat and email.
8. Legal and Regulatory Compliance: To satisfy our obligations under applicable laws and regulations, including the PDPA, anti-money laundering requirements, and any lawful requests from competent authorities.
9. Service Improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, game offerings, and user experience — without linking such data back to any individual.
10. Promotional Communications: To send you information about promotions, bonuses, and platform updates where you have consented to receive such communications. You may withdraw this consent at any time via your account notification settings.

Winnbox relies on the following legal bases for processing your personal data, in accordance with the PDPA 2010:

• Contractual Necessity: Processing necessary to perform our obligations under the contract formed when you accept our Terms and Conditions — including account creation, payment processing, and gaming service delivery.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML requirements, regulatory reporting, and responses to lawful orders from Malaysian authorities.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, and service improvement — provided such interests do not override your fundamental privacy rights.
• Consent: Where we rely on your consent (e.g., for marketing communications), you retain the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

The Winnbox Platform uses cookies and similar tracking technologies (including web beacons and local storage) to operate core platform functionality, remember your preferences, and analyse aggregate usage patterns. Cookies do not contain personally identifiable information in isolation; however, in some cases they may be associated with your account or device.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function, including session management, login authentication, and security tokens. These cannot be disabled without breaking core functionality.
• Performance & Analytics Cookies: Collect anonymised data about how Players use the Platform — pages visited, session duration, error rates — to help us improve the service. No individual is identified by this data.
• Functional Cookies: Remember your preferences such as language settings, responsible gambling limit configurations, and last-visited sections of the Platform.
• Security Cookies: Used to detect and prevent fraudulent logins, identify unusual session behaviour, and enforce device-level security controls.

7.2 Managing Cookies

You may adjust your browser settings to refuse or delete cookies. Please be aware that disabling strictly necessary cookies will impair or prevent access to core Platform features, including account login and gameplay. For instructions on managing cookies in your specific browser, refer to your browser's help documentation. Our Platform does not currently respond to "Do Not Track" signals from browsers.

Winnbox does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your data only in the following limited circumstances:

8.1 Service Providers

We engage trusted third-party service providers to assist in operating the Platform, including payment processors (for handling transactions via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, and cryptocurrency networks), identity verification providers, fraud detection specialists, cloud hosting providers, and customer support infrastructure providers. All such providers are subject to data processing agreements that prohibit them from using your data for any purpose other than delivering the specified service to Winnbox.

8.2 Legal and Regulatory Authorities

We may disclose personal data to competent Malaysian authorities, regulatory bodies, law enforcement agencies, or courts where we are legally required or compelled to do so, or where disclosure is necessary to protect the legal rights of Winnbox or to prevent serious harm.

8.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Winnbox, personal data held by us may be transferred to the relevant successor entity, subject to equivalent privacy protections being maintained. We will notify affected Players of any such transfer via the email address registered to their account.

Winnbox retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the lifetime of your account and for a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of last transaction, or as required by applicable regulations.
• Transaction Records: Financial records including deposit and withdrawal history are retained for a minimum of seven (7) years for accounting and regulatory compliance purposes.
• Gaming Activity Data: Retained for up to three (3) years from the date of each session for fraud investigation and responsible gambling monitoring purposes.
• Support Communications: Live chat logs and email correspondence are retained for up to two (2) years from the date of the interaction.
• Technical and Log Data: Server logs and session data are retained for up to twelve (12) months for security monitoring purposes, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

Winnbox implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit AES encryption for data in transit (via TLS/SSL) and data at rest on our servers
• Role-based access controls limiting data access to personnel with a documented operational need
• Two-factor authentication enforced for all administrative access to production systems
• Regular third-party penetration testing and vulnerability assessments of the Platform infrastructure
• Intrusion detection systems and 24/7 security operations monitoring
• Regular security awareness training for all staff with access to personal data
• Incident response procedures including breach notification protocols in accordance with PDPA obligations

While we take every reasonable precaution, no method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, Winnbox will notify affected individuals and the relevant authority as required under the PDPA.

As a Data Subject under the PDPA 2010, you have the following rights with respect to your personal data held by Winnbox. To exercise any of these rights, please contact our support team at the details provided in Section 15.

Requests to exercise your data rights will be acknowledged within 14 calendar days and resolved within 30 calendar days, or such shorter period as required by applicable law. Winnbox will not charge a fee for processing data rights requests unless they are manifestly unfounded or excessive.

The Winnbox Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the KYC process for all withdrawing accounts.

If Winnbox discovers that personal data has been collected from a person under the age of 21, we will immediately close the associated account, delete all related personal data, and refund any deposits (net of winnings, which shall be forfeited in accordance with our Terms and Conditions). If you believe that a minor may have accessed the Platform using falsified information, please contact us immediately at the details provided in Section 15 so that we may take prompt action.

Where the operation of the Platform requires personal data to be transferred to or accessed from locations outside of Malaysia — for example, by cloud infrastructure or technology service providers operating internationally — Winnbox ensures that such transfers are made only to entities that provide an adequate level of data protection equivalent to, or exceeding, the standards required under the PDPA 2010.

Such protections are implemented through binding contractual clauses in our agreements with third-party processors, mandatory confidentiality obligations, and ongoing compliance assessments. We do not transfer personal data to any jurisdiction where we cannot ensure adequate protections are in place.

Winnbox reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. Where amendments are material, we will provide advance notice to registered Players via the email address on file and/or a prominent notice on the Platform prior to the changes taking effect.

Non-material clarifications or corrections may be made without specific notification. The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with the amendments, you must discontinue use of the Platform and contact us to close your account.

We encourage all Players to review this page periodically to stay informed of how Winnbox is protecting their personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact the Winnbox Data Protection team through the following channels. We are committed to resolving all privacy-related enquiries promptly and in good faith.

When submitting a data rights request, please include your registered account username, the nature of your request, and any relevant documentation to help us verify your identity and process your request efficiently. For complaints relating to our responsible gambling practices, please visit our Responsible Gambling page.