Winmy25 Privacy Policy – Personal Data Protection for Malaysian Members

This Privacy Policy is published by winmy25 and applies to all personal information collected, stored, used, and disclosed through the winmy25 platform — including the winmy25.com website, mobile applications, and all related services.

Winmy25 is the data controller for all personal information collected from members in Malaysia. As data controller, we are fully responsible for ensuring your data is handled securely, responsibly, and in compliance with applicable law — in particular, Malaysia's Personal Data Protection Act 2010 (PDPA).

This Privacy Policy governs all interactions between winmy25 and its members, including the account registration process, deposits and withdrawals via Malaysian eWallets (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) and FPX (Maybank2u, CIMB Clicks), gaming activities such as slots, Live Casino, football Sports Betting, badminton, poker, virtual sports, and all communications related to winmy25 services.

Winmy25 collects various categories of personal data from members and prospective members for legitimate purposes. Below is a detailed breakdown of the data we collect:

Winmy25 collects only the data genuinely necessary to provide a safe, fair, and responsible service to Malaysian members. We do not collect excessive or irrelevant data beyond what is required for legitimate purposes.

Every use of member personal data by winmy25 has a lawful basis and a clear purpose. We use your data for the following:

• Account Management: Creating, verifying, managing, and updating your winmy25 account, including the mandatory identity verification (KYC) process.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u and CIMB Clicks, as well as withdrawals of winnings to your Malaysian eWallet or bank account.
• Gaming Service Provision: Gives you access to all games on winmy25 — slots, Live Casino, EPL and Malaysia Super League Sports Betting, badminton, cricket, poker, lottery, jackpots, and Virtual Sports.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account hacking, and misuse of the winmy25 platform.
• Regulatory Compliance: To fulfil legal obligations under Malaysia's PDPA, anti-money laundering (AML) laws, and other applicable regulatory requirements.
• Service Improvement: Analysing aggregated usage data to understand platform usage patterns and improve the overall winmy25 member experience.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance to winmy25 members via live chat, email, and other support channels.
• Service Communications: Sending important notifications regarding your account, changes to terms or policies, and critical security information.
• Marketing (with consent): Sending promotional information, bonus offers, and winmy25 marketing content only where you have given your consent to receive them.

Winmy25 will not use your personal data for any purpose beyond those stated above without first notifying you and, where required, obtaining your explicit consent.

Winmy25 does not sell, rent, or trade member personal data to any third party for their own marketing purposes. Data sharing occurs only in limited situations and for legitimate purposes:

• Payment Service Providers: Required transaction information is shared with Malaysian eWallet providers and banks (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX) solely for the purpose of processing your deposits and withdrawals. These providers are subject to their own financial security standards.
• Game Service Providers: In certain cases, minimal session data is shared with the game providers that power games on the winmy25 platform, strictly for technical delivery purposes.
• Technical Service Providers: winmy25 works with trusted third-party service providers for cloud computing infrastructure, platform analytics, and technical support. All such providers are bound by strict confidentiality agreements with winmy25.
• Legal Obligations: winmy25 will disclose member personal data to Malaysian authorities where required by court order, regulatory directive, or applicable law — including investigations related to fraud or financial crime.
• Business Transfers: In the event of a merger, acquisition, or sale of winmy25 business assets, member data may be transferred as part of those assets, subject to equivalent privacy protections.

Winmy25 implements multiple layers of technical and organisational security controls to protect members' personal data from unauthorised access, disclosure, alteration, or loss:

• 256-bit SSL Encryption: All communications between your device and winmy25 servers are protected by 256-bit SSL encryption — the same standard used by Malaysia's major banking institutions.
• Two-Factor Authentication (2FA): winmy25 provides and strongly encourages the use of 2FA on all member accounts as an additional layer of protection against unauthorized access.
• Internal Access Controls: Access to member personal data in winmy25's internal systems is restricted to staff with a legitimate business need only, in accordance with the principle of minimum privilege.
• 24/7 Monitoring: winmy25's cybersecurity systems monitor the platform around the clock to detect any intrusion attempts, suspicious activity, or security anomalies in real time.
• Regular Security Audits: winmy25 conducts regular penetration testing and security audits to identify and address potential vulnerabilities.
• Secure Data Storage: All members' personal data is stored on servers protected by strict physical and logical access controls, with encrypted backups.

While winmy25 takes all reasonable steps to protect your data, no security system can be guaranteed 100% impenetrable. In the event of a data breach affecting your information, winmy25 is committed to notifying you and the relevant authorities in accordance with PDPA legal requirements within the stipulated timeframe.

Winmy25 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform performs at its best. Below is an explanation of the types of cookies we use:

• Essential Cookies: Required for core winmy25 platform functions such as maintaining your login session, saving language preferences, and securing transactions. These cookies cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies: Helps winmy25 understand how members use the platform — the most frequently visited pages, time spent, and navigation patterns. This data is collected in aggregate and does not identify any individual specifically.
• Functional Cookies: winmy25 remembers your preferences — such as display settings, favourite games, and payment options — to make your experience smoother on every subsequent visit.
• Marketing Cookies: Used to display relevant winmy25 promotions and offers based on your activity on the platform. You can control or disable these cookies through your browser settings.

You can manage your cookie settings through your browser. Please note that disabling certain cookies may affect the functionality of some parts of the winmy25 platform. For more information on how to manage cookies in your browser, please refer to your browser's help documentation.

Winmy25 retains member personal data only for as long as necessary to fulfill the purposes stated in this Privacy Policy, or as required by applicable Malaysian law:

• Active Account Data: For the duration of your active winmy25 account, plus the minimum legally mandated retention period following account closure.
• Financial Transaction Records: A minimum of 7 years from the date of transaction, in accordance with Malaysian financial and AML legal requirements — including deposit and withdrawal records via eWallet and Malaysian banks.
• KYC Data (Identity Verification): A minimum of 5 years after account closure or the date of the last transaction, whichever is later, subject to applicable legal requirements.
• Support Communication Data: Up to 3 years from the date of communication, to allow winmy25 to resolve any subsequent disputes or complaints that may arise.
• Technical Log Data: Between 90 days and 1 year depending on the log type, primarily for security and incident investigation purposes.

Once the retention period has ended and there is no legal requirement to retain the data any longer, winmy25 will delete or anonymize it in a secure and irreversible manner.

As a winmy25 member and data subject under Malaysia's PDPA, you have the following rights regarding your personal data:

• Right of Access: You have the right to obtain a copy of the personal data winmy25 holds about you, including account information, transaction history, and other relevant data.
• Right to Correction: If any personal data winmy25 holds about you is inaccurate or incomplete, you have the right to request a correction within a reasonable timeframe.
• Right to Restriction of Processing: In certain circumstances, you may request that winmy25 restrict the processing of your data while a dispute is being resolved.
• Right to Object to Direct Marketing: You may object to the processing of your data for direct marketing purposes at any time, and winmy25 will cease such use immediately.
• Right to Erasure (under certain circumstances): You may request winmy25 to delete your personal data when it is no longer needed for its original purpose, or when you withdraw previously given consent — subject to any data retention requirements imposed by law.

To exercise any of the above rights, please contact the winmy25 team via email support@winmy25.com by stating the right you wish to exercise along with your account details. winmy25 is committed to responding to all requests within 30 calendar days. For complex cases, this period may be extended to 60 days with appropriate notice.

Winmy25 sends members a range of communications — from important account notifications to promotional offers and bonuses. We distinguish between necessary communications and marketing communications:

• Service Communications (Mandatory): Notifications relating to account security, transaction verification, changes to winmy25's terms or policies, and other important service-related information. These communications are sent without additional consent as they form part of the service you signed up for.
• Marketing Communications (Optional): Bonus offers, seasonal promotions, poker tournament updates, jackpot offers, EPL Sports Betting promotions, and other marketing materials are only sent if you have consented to receive them at registration or subsequently through your winmy25 account settings.

You can manage your marketing communication preferences at any time through your winmy25 account settings or by contacting our support team. Requests to unsubscribe from marketing communications will be processed within 5 business days.

Please note that opting out of marketing communications will not affect your receipt of important service communications related to your winmy25 account and transactions.

Winmy25 is a platform strictly for adults aged 18 and above. We do not knowingly collect any personal information from individuals under the age of 18.

If winmy25 becomes aware or suspects that information has been collected from an individual under the age of 18 without proper age verification, we will take immediate steps to:

• Suspending access to the relevant account immediately while an investigation is carried out.
• Deleting all personal data relating to that individual from winmy25's systems.
• Returning any remaining account balance in accordance with the appropriate procedures.

If you believe your child or ward has registered an account with winmy25, please contact our support team immediately at support@winmy25.com so that immediate action can be taken.

Winmy25 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, new legal requirements, or new platform features. Whenever a material amendment is made, we will:

• Updating the "Last Updated" date at the top of this page.
• Display an in-platform notification or send an email notification to all active members when a significant change is made.
• Providing a reasonable period — at least 14 days — for members to review changes before they take effect.

Your continued use of the winmy25 platform after an amended Privacy Policy takes effect will be considered your acceptance of the new terms. We encourage you to review this page periodically to stay informed of how winmy25 protects your privacy.

This Privacy Policy is governed by and interpreted in accordance with the laws of Malaysia, in particular the Personal Data Protection Act 2010 (PDPA). Any disputes relating to this Privacy Policy shall be resolved under the jurisdiction of the relevant Malaysian courts.

Winmy25 has appointed a Data Protection Officer (DPO) responsible for ensuring ongoing compliance with Malaysia's PDPA and this Privacy Policy. If you have any questions, concerns, or wish to exercise your data rights, you may contact us via:

• Email: support@winmy25.com — for all privacy and data protection enquiries
• Live Chat: Available 24/7 within the winmy25 platform for general enquiries
• Email Subject: Use the subject line "Data Privacy Enquiry — [Your Account Number]" to help our team respond to you faster

The winmy25 team is committed to responding to all privacy-related enquiries within 5 business days, and to resolving more complex requests within 30 calendar days. If you are not satisfied with the response provided, you have the right to lodge a complaint with the Malaysian Communications and Multimedia Commission (MCMC) or the relevant Ministry of Communications Malaysia.