winmy18 Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy") is issued by winmy18 (hereinafter referred to as "winmy18", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://winmy18.cam (the "Platform"). This Policy governs the collection, use, storage, disclosure, and protection of personal data belonging to registered users, visitors, and prospective users (collectively "you" or "the Data Subject") of the Platform.

winmy18 is committed to processing personal data responsibly, transparently, and in full compliance with applicable data protection legislation. By registering an account, accessing the Platform, or otherwise submitting personal information to winmy18, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference and form part of your overall agreement with winmy18.

For the purposes of this Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, online identifiers, and behavioural data.
• "Processing" — Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — winmy18, in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — Any third-party service provider that processes personal data on behalf of winmy18 under a data processing agreement, acting on our instructions.
• "Consent" — Any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their personal data for one or more specific purposes.
• "Cookie" — A small text file placed on your device by the Platform for the purposes of session management, analytics, functionality, or targeted communications.
• "KYC" — Know Your Customer; the identity and age verification process conducted by winmy18 to comply with anti-money laundering obligations and to verify that users meet the 21+ age requirement.

winmy18 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

winmy18 collects personal data through the following means:

• Direct Submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, participating in promotions, or completing any other form or interaction on the Platform.
• Automated Technical Collection: Data collected automatically as you interact with the Platform, including IP addresses, device identifiers, browser characteristics, session logs, clickstream data, and page interaction records, collected via server logs, cookies, and similar tracking technologies.
• Payment Processors: Transaction confirmation data received from payment service providers including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB Bank, Public Bank, and cryptocurrency networks, to enable deposit and withdrawal processing.
• Identity Verification Providers: Verification outcomes and flags returned by our KYC and age-verification service providers based on the documents you submit.
• Fraud Prevention Services: Risk signals and flagging data received from third-party fraud detection and anti-money-laundering screening services based on your account activity patterns.
• Publicly Available Sources: In limited circumstances, where required for compliance purposes, winmy18 may verify information against publicly available records or sanctions databases.

winmy18 processes personal data only where a valid lawful basis exists. The lawful bases we rely upon are as follows:

• Performance of a Contract: Processing that is necessary to register your account, verify your identity, process deposits and withdrawals, settle bets, manage promotions, and provide all other services that form the subject matter of our agreement with you under the Terms & Conditions.
• Legal Obligation: Processing that is required to comply with our legal obligations, including anti-money laundering (AML) checks, counter-terrorism financing (CTF) screening, age verification (21+ enforcement), record-keeping obligations, and cooperation with law enforcement authorities where lawfully required.
• Legitimate Interests: Processing that is necessary for winmy18's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud detection, platform security monitoring, service improvement analytics, and responsible gambling monitoring. We conduct a proportionality assessment before relying on this basis.
• Consent: Processing for which you have provided explicit, freely given consent — primarily the sending of marketing communications, personalised promotions, and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

winmy18 uses your personal data for the following specific purposes:

• Account Management: Creating, maintaining, and administering your player account, including authentication, security, and account preference settings.
• Identity & Age Verification: Verifying that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that you are not subject to self-exclusion or any other regulatory restriction.
• Transaction Processing: Facilitating deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and supported cryptocurrency channels; processing withdrawal requests; and maintaining accurate financial records in Malaysian Ringgit (MYR).
• Service Delivery: Providing access to casino games, live dealer tables, sports betting markets (including EPL, Liga Super Malaysia, UFC, and other events), slots, and all other Platform features.
• Compliance & Fraud Prevention: Monitoring transactions for signs of money laundering, fraud, bonus abuse, or other prohibited conduct; screening against sanctions and watchlists; and filing regulatory reports where required.
• Responsible Gambling: Monitoring account behaviour for indicators of problem gambling; applying deposit limits, self-exclusion decisions, and responsible gambling interventions; verifying that self-excluded users do not re-register.
• Customer Support: Responding to queries, complaints, disputes, and technical support requests; maintaining records of communications for quality assurance and dispute resolution.
• Marketing Communications: Sending promotional emails, SMS messages, or in-platform notifications about bonuses, new games, sports promotions, and loyalty rewards — only where you have provided consent or where permitted by applicable law.
• Analytics & Improvement: Analysing aggregated and pseudonymised usage data to understand how players interact with the Platform and to improve user experience, game selection, and feature design.
• Legal Proceedings: Preserving and disclosing personal data where required by a valid court order, regulatory investigation, or other lawful legal process.

winmy18 does not sell, rent, or trade your personal data. We share data only where necessary, with the following categories of recipients, each bound by strict contractual data protection obligations or statutory requirements:

All third-party data processors engaged by winmy18 are required to implement appropriate technical and organisational security measures and to process data only on our documented instructions. We conduct due diligence on all processors before engagement and review their security posture on a periodic basis.

winmy18 uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session integrity, and gather analytical insights. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential to the functioning of the Platform. These enable session authentication, security token validation, and load balancing. They cannot be disabled without disrupting core Platform functionality. No consent is required for these cookies.
• Functional Cookies: Remember your account preferences, language settings, currency display (MYR), and region-specific configurations to deliver a personalised experience on return visits.
• Analytics Cookies: Collect pseudonymised data about how users interact with Platform pages, which features are most used, and where navigation difficulties arise. This data is used in aggregate to improve Platform design and performance. These cookies require your consent.
• Marketing & Communications Cookies: Track engagement with promotional communications to allow us to measure the effectiveness of bonus offers and campaigns. These cookies are only deployed where you have consented to receiving marketing communications from winmy18.

You may manage your cookie preferences at any time through your browser settings. Disabling cookies may affect the performance or availability of certain Platform features. Strictly necessary cookies cannot be blocked through this mechanism as they are integral to Platform security and authentication.

winmy18 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with winmy18, plus a minimum of five (5) years following permanent account closure, in accordance with AML record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification completion or account closure, whichever is later, as required by anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial record-keeping requirements.
• Gaming and Betting History: Retained for the duration of the account relationship plus five (5) years post-closure, for dispute resolution and regulatory audit purposes.
• Customer Support Records: Retained for three (3) years from the date of the final interaction, unless the records are relevant to an ongoing dispute or regulatory matter.
• Marketing Consent Records: Retained for the duration of the consent period plus three (3) years, to demonstrate compliance with consent obligations.
• Technical Log Data: Typically retained for a rolling period of twelve (12) months, unless required for longer retention due to an active security investigation.

Upon expiry of the applicable retention period, personal data is securely destroyed using industry-standard data deletion protocols. Where technically infeasible to delete (e.g., backup tapes), data is isolated and protected until such time as secure deletion becomes possible.

winmy18 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following controls:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all account interactions, payment transactions, and support communications.
• Encryption at Rest: Sensitive personal data stored on our servers — including identity documents, financial records, and account credentials — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo background checks and are bound by confidentiality obligations. Role-based access controls are enforced across all internal systems.
• Two-Factor Authentication: All staff accounts with access to user data are protected by mandatory two-factor authentication (2FA). Players are strongly encouraged to enable 2FA on their own accounts.
• Continuous Monitoring: Our security operations team monitors Platform infrastructure 24/7 for anomalous activity, intrusion attempts, and data access anomalies.
• Vulnerability Management: Regular penetration testing, vulnerability scanning, and security audits are conducted by qualified third-party security professionals.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, winmy18 will notify affected users without undue delay and will take immediate remediation steps.

Whilst winmy18 takes all reasonable precautions to protect your data, no online system is entirely immune from security risk. You play an important role in your own account security — never share your password with anyone, use a strong and unique password, and enable two-factor authentication where available.

As a Data Subject, you hold the following rights with respect to your personal data held by winmy18. You may exercise any of these rights by contacting us at [email protected] or through the live chat function. We will respond to all valid requests within thirty (30) calendar days.

The winmy18 Platform is strictly intended for adults aged 21 years and above. winmy18 does not knowingly collect, process, or store personal data relating to individuals under the age of 21. Registration on the Platform by any person under 21 is strictly prohibited.

If winmy18 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all associated data will be deleted to the extent not required for compliance purposes, and any funds deposited will be returned to the source payment method following verification. Parents or guardians who believe that a minor may have registered on the Platform are urged to contact us immediately at [email protected] so that we can take prompt action.

winmy18 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform functionality. The updated Policy will be published on this page with a revised "Last Updated" date.

Where changes are material — for example, where we introduce a new category of data processing or a new third-party sharing arrangement — we will notify registered users by email and/or through a prominent in-Platform notification prior to the changes taking effect. Your continued use of the Platform following publication of the revised Policy constitutes acceptance of the updated terms. If you do not agree to any amendment, you should cease using the Platform and may request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which winmy18 processes your personal data, please contact us through any of the following channels:

• Data Protection Enquiries (Email): [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" to ensure prompt routing to the appropriate team.
• Live Chat: Available 24 hours a day, 7 days a week, directly through the Platform. Our support agents are equipped to handle privacy-related queries and to escalate data rights requests to the relevant team.
• Response Timeframe: We commit to acknowledging all privacy-related contacts within 48 hours and to providing a substantive response or data rights decision within 30 calendar days of receipt.

winmy18 serves players across Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and Ipoh — and our team is available in English to assist with all privacy-related matters.