w2win Privacy Policy

1. Who We Are

This Privacy Policy applies to w2win ("the Company", "we", "us", "our") and governs the collection and use of personal data through the w2win website at w2win.app and all associated services, games, and features (collectively, the "Platform"). w2win is an online gaming platform serving Malaysian players, operating under internationally recognised gaming regulatory frameworks.

By registering an account on w2win, making use of any Platform service, or simply browsing the Platform as a visitor, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Privacy Policy, you should not use the Platform.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which form part of the agreement between you and w2win.

2. Personal Data We Collect

w2win collects personal data that is necessary for the provision of its services, fulfilment of legal and regulatory obligations, and improvement of the Platform experience. The categories of personal data we may collect include:

2.1 Identity & Contact Data

• Full legal name as per government-issued identification;
• Date of birth (used for mandatory age verification — w2win is strictly 21+);
• Email address (primary communication channel and account identifier);
• Username selected at registration;
• Mobile phone number (used for account security notifications where provided);
• Residential address (required for identity verification and compliance).

2.2 Identity Verification Documents

• Malaysian Identity Card (MyKad) number and/or scanned copy;
• Passport details where MyKad is unavailable;
• Proof of address documents (e.g., utility bills, bank statements issued in Malaysia);
• Selfie or liveness verification image where required for KYC compliance.

2.3 Financial & Transaction Data

• Payment method details used for deposits (e.g., registered e-wallet phone number, bank account details for FPX, USDT wallet address for cryptocurrency);
• Transaction history including deposit amounts, withdrawal requests, dates, and processing status;
• Account balance and wagering history for regulatory record-keeping purposes.

2.4 Technical & Usage Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system, browser type and version;
• Session duration, pages visited, games played, and click-path data;
• Login timestamps and authentication method used.

2.5 Communication Data

• Contents of live chat support conversations;
• Email correspondence with w2win support or compliance teams;
• Survey or feedback responses provided voluntarily.

3. How We Collect Your Data

w2win collects personal data through the following means:

• Direct collection: Information you provide at account registration, during identity verification, when making deposits or withdrawal requests, or when contacting our support team;
• Automated collection: Technical data collected automatically through cookies, server logs, and analytics tools as you interact with the Platform;
• Third-party sources: Where required for identity and fraud verification, w2win may receive data from payment processors, identity verification providers, or fraud prevention databases. Data received from third parties is handled with the same standards as directly collected data.

4. How We Use Your Personal Data

w2win uses the personal data collected for the following purposes:

Purpose	Data Used
Account registration and identity verification	Identity data, KYC documents
Processing deposits, withdrawals and financial transactions	Financial data, identity data
Providing and improving Platform services	Usage data, technical data
Fraud prevention and anti-money laundering compliance	Identity, financial and technical data
Responsible gaming monitoring and intervention	Wagering history, account activity data
Customer support and dispute resolution	Communication data, account data
Regulatory reporting obligations	Identity, financial, and transaction data
Marketing communications (where consented)	Email address, communication preferences
Security monitoring and system integrity	Technical and login data

w2win does not use automated decision-making that produces legal or similarly significant effects on Players, except for automated fraud detection systems which flag accounts for human review. Players may request human review of any automated flag affecting their account.

5. Legal Basis for Processing

w2win processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between w2win and the Player, including account management, game provision, and payment processing;
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and other applicable legal obligations;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and service improvement — where these interests are not overridden by your privacy rights;
• Consent: For marketing communications and optional data uses not covered by the above bases. Consent may be withdrawn at any time by contacting support or adjusting communication preferences in account settings.

6. Sharing Your Personal Data

w2win does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your personal data with the following categories of recipient, strictly for the purposes described:

• Payment processors and e-wallet providers (e.g., Touch 'n Go, DuitNow, FPX network banks) — to process your transactions. These providers operate under their own privacy policies and are contractually obligated to handle your data securely;
• Identity and KYC verification providers — to verify age, identity, and compliance with anti-money laundering obligations;
• Fraud prevention and security services — to detect and prevent fraudulent activity and protect the integrity of the Platform;
• Game content providers — limited technical data may be shared with licensed game providers (e.g., Pragmatic Play, PG Soft) for the purpose of game delivery and fairness auditing. No financial personal data is shared with game providers;
• Regulatory and law enforcement authorities — where w2win is legally required to disclose data by a competent authority or court order. w2win will, where legally permitted, notify affected Players of such disclosures;
• Professional advisers — legal, accounting, and compliance advisers who are bound by confidentiality obligations.

All third parties with whom w2win shares data are contractually required to implement appropriate technical and organisational security measures and to use the data solely for the specified purpose.

7. Data Retention

w2win retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. As a general guide:

• Account data and KYC records: Retained for a minimum of 5 years following account closure, in accordance with standard anti-money laundering record-keeping requirements;
• Transaction records: Retained for a minimum of 7 years for financial compliance purposes;
• Support communications: Retained for up to 3 years following the resolution of the relevant matter;
• Technical and usage logs: Retained for up to 12 months for security and fraud analysis purposes.

On expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Cookies and Tracking Technologies

w2win uses cookies and similar technologies on the Platform for the following purposes:

• Essential cookies: Required for Platform functionality, including maintaining login sessions and security state. These cannot be disabled without affecting Platform usability;
• Analytics cookies: Used to understand aggregate player behaviour, most visited pages, and session characteristics — to improve Platform design and navigation. Data collected is anonymised at the aggregate level;
• Preference cookies: Store your language and display preferences to improve your experience across sessions.

w2win does not use third-party advertising or cross-site tracking cookies. You may manage cookie preferences through your browser settings. Disabling essential cookies may prevent certain Platform features from functioning correctly.

9. Security of Your Personal Data

w2win implements technical and organisational security measures appropriate to the nature of the personal data held. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and w2win's servers;
• Encrypted storage of sensitive account and financial data at rest;
• Role-based access controls ensuring that internal staff access personal data only to the extent required for their specific function;
• Regular security audits and penetration testing of Platform infrastructure;
• Two-factor authentication available for all Player accounts, strongly recommended for additional protection.

While w2win applies rigorous security standards, no system is entirely immune from unauthorised access. Players are strongly encouraged to use a strong, unique password for their w2win account and to enable two-factor authentication. In the event of a data breach affecting Players' rights, w2win will notify affected individuals as required by applicable data protection obligations.

10. Your Data Rights

Subject to applicable law, you have the following rights in relation to the personal data w2win holds about you:

• Right of access: You may request a copy of the personal data w2win holds about you. w2win will respond within 30 days of a verified request;
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Minor corrections (e.g., email address updates) can be made directly in account settings;
• Right to erasure: Subject to legal retention obligations, you may request deletion of your personal data following account closure. Note that data subject to AML or regulatory retention requirements cannot be deleted before mandatory retention periods expire;
• Right to restrict processing: In specified circumstances, you may request that w2win limit the use of your personal data while a dispute or verification request is pending;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal;
• Right to complain: You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe w2win has mishandled your personal data.

To exercise any of the above rights, contact w2win's support team via live chat or email at [email protected]. Identity verification will be required before any request is actioned.

11. Minors

The w2win Platform is strictly for individuals aged 21 years and older. w2win does not knowingly collect personal data from individuals under 21. If you believe that a minor has registered an account or provided personal data to w2win, please contact us immediately at [email protected]. Upon confirmation, we will take prompt steps to close the account and delete any associated personal data in accordance with our data retention policy.

12. Changes to This Privacy Policy

w2win reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform services. Material changes will be communicated to registered Players by email to the address registered on their account, or by prominent notice on the Platform, with at least 7 days' notice before the revised policy takes effect. The date of the most recent revision is always displayed at the top of this page. Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Privacy Policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or w2win's handling of your personal data, please contact our support team:

• Live Chat: Available 24/7 via the chat widget on the Platform. Recommended for time-sensitive data requests — average response under 5 minutes;
• Email: [email protected] — for formal data subject requests and detailed enquiries. Please allow up to 3 business days for initial response and up to 30 days for full completion of access or erasure requests.