winmy21 Privacy Policy

1Data Controller

winmy21 is the data controller in respect of personal data processed under this Policy. As data controller, winmy21 determines the purposes and means of processing your personal data. winmy21 operates under an international online gaming licence and is subject to the data protection obligations imposed by that licensing framework.

All enquiries regarding this Policy, including requests to exercise data subject rights, should be directed to the winmy21 Data Protection team via the contact details set out in Section 13 of this Policy.

2Personal Data We Collect

winmy21 collects personal data in the following categories, depending on the nature of your interaction with the platform:

2.1 Registration Data

When you create a winmy21 account, we collect: full legal name, date of birth, email address, Malaysian mobile number, preferred username, and account password (stored in irreversibly hashed form).

2.2 Identity Verification (KYC) Data

To comply with our licensing obligations and applicable anti-money laundering (AML) requirements, we collect: copies of government-issued identification documents (such as MyKad, passport, or equivalent), proof of address documents, and — where required — source-of-funds documentation. KYC data is processed by authorised verification service providers operating under confidentiality obligations.

2.3 Financial Data

We collect data necessary to process deposits and withdrawals, including: payment method type, masked payment instrument identifiers (e.g., last four digits of bank account), transaction amounts, timestamps, and currency. Full financial account credentials (e.g., full bank account numbers or card numbers) are not stored by winmy21 — they are handled directly by the payment service provider.

2.4 Gaming Activity Data

We collect a record of all gaming activity on your winmy21 account, including: games played, wager amounts, outcomes, session start and end times, bonus participation, and responsible gaming tool usage. This data is used for account integrity, bonus administration, responsible gaming monitoring, and regulatory reporting.

2.5 Technical & Device Data

We automatically collect technical data when you access the winmy21 platform, including: IP address, device type and identifier, operating system, browser type and version, session duration, pages visited, and referring URL. This data is collected via cookies and server logs as described in Section 6.

2.6 Communications Data

Records of communications between you and winmy21 support — including live chat transcripts, email correspondence, and feedback submissions — are retained for quality assurance, training, and dispute resolution purposes.

3How winmy21 Uses Your Personal Data

winmy21 processes your personal data for the following purposes:

• Account management: Creating, verifying, operating, and closing your winmy21 account, including authentication and account security functions.
• Service delivery: Enabling access to all gaming services on the winmy21 platform — including live casino, slots, sportsbook, and Toto 4D — and processing associated wagers and payouts.
• Payment processing: Facilitating deposits and withdrawal requests, including communication with payment service providers and verification of payment instrument ownership.
• Regulatory compliance: Meeting obligations under winmy21's international gaming licence, including KYC verification, AML screening, and reporting to licensing authorities as required by law.
• Fraud prevention and security: Detecting and investigating suspicious account activity, unauthorised access, payment fraud, and multi-accounting.
• Responsible gaming: Monitoring gaming behaviour patterns to identify potential problem gambling indicators and administering responsible gaming tools in accordance with the winmy21 Responsible Gaming Policy.
• Bonus and promotion administration: Verifying eligibility, tracking wagering progress, and awarding promotional credits.
• Customer support: Responding to enquiries, resolving disputes, and improving service quality.
• Marketing communications: Sending promotional offers, platform updates, and personalised recommendations — subject to your communication preferences and applicable consent requirements. You may opt out of marketing communications at any time.
• Platform improvement: Analysing aggregated and anonymised usage data to improve winmy21's products, interfaces, and user experience.

4Legal Basis for Processing

winmy21 processes personal data under the following legal bases, consistent with applicable data protection legislation:

• Contractual necessity: Processing required to perform the Member agreement — including account operation, game provision, and payment processing.
• Legal obligation: Processing required to comply with applicable laws, licensing requirements, AML obligations, and regulatory reporting duties.
• Legitimate interests: Processing carried out in furtherance of winmy21's legitimate business interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by the data subject's rights and interests.
• Consent: Where winmy21 relies on consent as the legal basis for processing (primarily for direct marketing communications), that consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5Sharing of Personal Data

winmy21 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared with third parties only in the following circumstances and subject to appropriate safeguards:

• Payment service providers: Data shared with licensed payment processors (including e-wallet operators such as Touch 'n Go and Boost, and Malaysian banking institutions) solely for the purpose of processing deposits and withdrawals.
• KYC and AML verification providers: Identity and document data shared with certified third-party verification service providers operating under binding data processing agreements and confidentiality obligations.
• Game software providers: Anonymised gaming session data shared with certified game studios for game integrity monitoring and RTP auditing purposes. Personally identifiable information is not shared with game providers.
• Licensing and regulatory authorities: Personal and gaming data disclosed to winmy21's licensing authority and relevant regulatory bodies where required under applicable law or as directed by the licensing authority.
• Law enforcement agencies: Personal data disclosed to law enforcement or governmental authorities in response to a lawful request, court order, or where winmy21 reasonably believes disclosure is required to prevent fraud, money laundering, or other criminal activity.
• Professional advisors: Disclosure to legal, accounting, and audit professionals where necessary for the conduct of winmy21's business, subject to professional confidentiality obligations.

6Cookies & Tracking Technologies

winmy21 uses cookies and similar tracking technologies on the platform. Cookies are small data files placed on your device that enable certain platform functionality and analytics. The following categories of cookies are used:

• Strictly necessary cookies: Essential for platform operation — session management, authentication tokens, and security functions. These cookies cannot be disabled without impairing core platform functionality.
• Functional cookies: Enabling enhanced functionality such as remembering your language and display preferences, maintaining your logged-in state across sessions, and storing responsible gaming settings.
• Analytics cookies: Collecting anonymised and aggregated data about how Members use the winmy21 platform — pages visited, session duration, navigation paths — to inform platform improvements.
• Security cookies: Supporting fraud detection and prevention functions, including identifying anomalous access patterns that may indicate unauthorised account access.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent access to the winmy21 platform but may affect the quality of certain personalised features. winmy21 does not use cookies to serve third-party advertising.

7Data Retention

winmy21 retains personal data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable law or our licensing obligations. The retention periods applicable to each data category are set out in the table in Section 2 above.

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised, such that it can no longer be attributed to any identified or identifiable individual. Transaction and identity records may be retained for longer periods where required by anti-money laundering legislation or pursuant to a regulatory direction.

8Your Data Subject Rights

Subject to applicable law and any overriding legal obligations, you have the following rights in respect of personal data held by winmy21:

• Right of access: You may request confirmation of whether winmy21 processes your personal data and, if so, a copy of the data held.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some data corrections may require re-submission of KYC documentation.
• Right to erasure: In certain circumstances, you may request deletion of your personal data. This right does not apply where retention is required by applicable law, licensing obligations, or for the establishment, exercise, or defence of legal claims.
• Right to restriction: You may request that processing of your personal data be restricted in defined circumstances, for example whilst a rectification request is being considered.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request that personal data you have provided be transferred to you in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. winmy21 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact the winmy21 Data Protection team as described in Section 13. winmy21 will respond to data subject requests within thirty (30) calendar days of receipt, subject to identity verification.

9Data Security

winmy21 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between the Member's device and the winmy21 platform.
• Encryption of sensitive data fields at rest, including identity document data and payment instrument references.
• Irreversible hashing of account passwords using industry-standard algorithms.
• Role-based access controls limiting internal access to personal data to staff with a legitimate operational need.
• Periodic penetration testing and vulnerability assessments by independent security professionals.
• Incident response procedures to detect, assess, and notify affected Members and relevant authorities in the event of a data breach meeting the applicable notification threshold.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. winmy21 encourages Members to use strong, unique passwords for their winmy21 account and to enable two-factor authentication as an additional protective layer.

10Children and Minors

The winmy21 platform is strictly intended for individuals aged 21 years and above. winmy21 does not knowingly collect or process personal data relating to persons under the age of 21. If winmy21 discovers or has reasonable grounds to believe that personal data belonging to an underage individual has been submitted, the associated account will be immediately suspended, all data pertaining to the underage registration will be securely deleted (except where retention is required for regulatory reporting), and any deposited funds will be returned net of gaming losses incurred.

Persons who are aware of an underage individual having registered on the winmy21 platform are encouraged to contact winmy21 support immediately.

11International Data Transfers

winmy21 operates as an international online gaming platform, and certain service providers — including game studios and technology infrastructure partners — may be located in jurisdictions outside Malaysia. Where personal data is transferred to recipients in countries that do not provide an equivalent standard of data protection, winmy21 ensures that appropriate safeguards are in place, including standard contractual clauses or equivalent data transfer mechanisms, to protect the rights of data subjects.

By accepting this Policy, you acknowledge that your personal data may be transferred to and processed in countries outside your country of residence, subject to the safeguards described above.

12Amendments to This Policy

winmy21 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, licensing requirements, or our data processing practices. Where amendments are material, winmy21 will notify Members via the registered email address or via a prominent notice on the platform at least seven (7) calendar days prior to the revised Policy taking effect.

Continued use of the winmy21 platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. The version number and effective date at the top of this document indicate the currently operative version.

13Contact & Data Protection Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or winmy21's processing of your personal data — including requests to exercise data subject rights — please contact the winmy21 Data Protection team:

You may also contact the winmy21 support team via live chat available on the platform at any time to initiate a data subject request or to obtain further information about our data practices.