mywinbox Privacy Policy

This Privacy Policy sets out the data processing practices of mywinbox in connection with the operation of the online entertainment platform available at mywinbox.cam. It applies to all personal data collected from users who register, browse or otherwise interact with the Platform, including visitors who have not completed registration.

mywinbox is operated as an English-language entertainment platform targeting adult users in Malaysia, including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other regions. Our services are intended solely for individuals aged 21 years and above.

This Policy is intended to satisfy the transparency obligations applicable to online platforms under relevant data protection frameworks. If you have any questions about how your data is handled, contact details are provided in Section 13 of this document.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or can reasonably identify a living individual, directly or in combination with other data.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, erasure or destruction.
• "Data Subject" — The individual to whom personal data relates; in this context, a registered or browsing mywinbox user.
• "Controller" — The entity that determines the purposes and means of processing personal data; in this context, mywinbox.
• "Processor" — A third-party entity that processes personal data on behalf of the Controller under a contractual arrangement.
• "KYC" — Know Your Customer; the identity and age verification process required to activate full account functionality.
• "Consent" — A freely given, specific, informed and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "Cookie" — A small text file placed on a user's device by a website to store session information, preferences or tracking identifiers.

mywinbox collects personal data through several channels depending on how you interact with the Platform. The categories below describe the principal data types collected:

3.1 Registration Data

When you create a mywinbox account we collect: full legal name, date of birth, residential address, email address, mobile phone number and your chosen login credentials. This data is required to establish and maintain your account.

3.2 Identity Verification (KYC) Data

To comply with applicable age and identity verification requirements, we may collect copies of government-issued identity documents (such as a Malaysian MyKad or passport), proof of residential address and documentation relating to your registered payment methods. This data is processed solely for KYC and anti-money laundering purposes.

3.3 Financial & Transaction Data

mywinbox records transaction information including deposit and withdrawal amounts in MYR, payment method identifiers (e.g., masked bank account references for Maybank, CIMB, Public Bank, FPX; eWallet transaction references for Touch 'n Go eWallet, Boost or GrabPay), timestamps and transaction status. Full payment instrument numbers are not stored by mywinbox directly.

3.4 Platform Usage Data

Automatically collected data includes: IP address, device type, operating system, browser version, pages visited, session duration, game interactions, clickstream data and referral source. This data is used for security monitoring, performance improvement and responsible gambling analysis.

3.5 Communications Data

Records of correspondence with mywinbox support, including chat transcripts, email exchanges and support ticket content, are retained for quality assurance, compliance and dispute resolution purposes.

mywinbox processes personal data for the following purposes. Each purpose is matched to a legal basis described in Section 5:

• Account creation and management — Establishing, maintaining and operating your registered account, including authentication and account recovery.
• Identity and age verification (KYC) — Confirming that users are aged 21 and above and that account details match verified identity documents.
• Payment processing — Facilitating deposits and withdrawals in MYR through supported Malaysian payment channels including FPX, DuitNow and eligible eWallets.
• Security and fraud prevention — Detecting, investigating and preventing fraudulent activity, money laundering, account takeovers and terms violations.
• Responsible gambling monitoring — Analysing account activity patterns to identify potential problem gambling behaviour and to apply account controls where appropriate.
• Customer support — Processing enquiries, complaints and account assistance requests submitted through available support channels.
• Legal and regulatory compliance — Meeting applicable record-keeping, reporting and verification obligations.
• Platform improvement — Analysing aggregated, anonymised usage data to improve Platform performance, navigation and game selection.
• Communications — Sending transactional messages (account alerts, withdrawal confirmations, security notices) and, where consent has been obtained, promotional communications.

mywinbox relies on the following legal bases for the processing activities described in this Policy:

• Contractual necessity — Processing required to perform the agreement between you and mywinbox, including account management, payment processing and KYC verification. Without this processing, we cannot provide you with the services.
• Legal obligation — Processing necessary to comply with applicable laws and regulations, including anti-money laundering requirements, age verification mandates and financial record-keeping rules.
• Legitimate interests — Processing necessary for the legitimate interests of mywinbox, including security monitoring, fraud prevention, platform improvement and responsible gambling analysis, where those interests are not overridden by your privacy rights.
• Consent — Where we rely on consent — primarily for optional marketing communications — you may withdraw that consent at any time by contacting us or using the unsubscribe mechanism in any promotional message.

mywinbox does not sell personal data to third parties for their own commercial use. We may share personal data with the following categories of recipients where necessary and under appropriate contractual protections:

• Payment service providers — To process deposits and withdrawals through supported channels including Malaysian bank payment gateways (FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong) and eWallet operators (Touch 'n Go eWallet, Boost, GrabPay). Sharing is limited to transaction data required to complete the specific payment.
• Identity verification services — Third-party KYC and anti-money laundering providers engaged to assist in confirming user identity and age in accordance with applicable requirements.
• Technology and platform infrastructure providers — Hosting, cloud storage, security monitoring and analytics service providers operating under data processing agreements that restrict their use of your data to agreed purposes.
• Game content studios — Generic session data may be shared with licensed content providers to facilitate gameplay. No identifiable personal data beyond session identifiers is ordinarily shared for this purpose.
• Legal and regulatory authorities — Where required by law, court order or regulatory request, mywinbox will disclose personal data to the relevant authority. We will, where legally permitted, notify affected users of such requests.
• Business successors — In the event of a merger, acquisition or asset transfer, personal data may be transferred to the relevant successor entity subject to equivalent privacy protections.

mywinbox retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. The following general principles apply:

• Active accounts — Account and transaction data is retained for the duration of the account relationship and for a further period following closure to meet legal and regulatory obligations.
• KYC documentation — Identity verification records are retained for the minimum period required by applicable anti-money laundering regulations, which typically extends beyond the period of active account use.
• Financial transaction records — MYR transaction records are retained for a minimum period required by applicable financial record-keeping rules.
• Support communications — Customer support interactions are typically retained for a defined period following the resolution of the relevant enquiry for quality assurance and potential dispute reference.
• Marketing data — Where consent-based marketing data is held, it is deleted or anonymised promptly following withdrawal of consent or upon your request.

When personal data is no longer required, mywinbox will either delete it securely or anonymise it so that it can no longer identify you.

mywinbox uses cookies and similar technologies to support Platform functionality, security and user experience. The principal categories are:

• Strictly necessary cookies — Required for core Platform functionality such as session management, login state and security token handling. These cannot be disabled without impairing basic functionality.
• Functional cookies — Store preferences such as language settings, display options and previously visited game categories to improve your experience across sessions.
• Analytical cookies — Collect aggregated, anonymised data about how users interact with the Platform to help us understand performance and improve navigation. Where individual-level analysis is required, it is conducted using pseudonymised identifiers.
• Security cookies — Support fraud detection, bot prevention and account protection mechanisms.

You may manage cookie preferences through your browser settings. Disabling certain categories of cookies may limit Platform functionality. mywinbox does not use third-party advertising cookies to serve targeted advertisements through the Platform.

Subject to applicable law and our legal retention obligations, you hold the following rights in relation to your personal data held by mywinbox:

To exercise any of these rights, contact mywinbox using the email address displayed in the footer of this page. We will respond within a reasonable period and, in any event, no later than the timeframe required by applicable law. We may need to verify your identity before processing a data rights request.

mywinbox implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures are reviewed and updated as the threat landscape and platform architecture evolve.

While mywinbox takes reasonable steps to protect personal data, no online platform can guarantee absolute security. You play an important role in keeping your account secure by using a strong, unique password, not sharing login credentials and logging out of shared devices promptly. Contact us immediately if you suspect unauthorised access to your account.

mywinbox services are strictly intended for adults aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and accounts that cannot satisfy the age requirement will be closed.

If mywinbox becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you have reason to believe a minor has registered on the Platform, please contact us immediately using the details in Section 13.

mywinbox may update this Privacy Policy from time to time to reflect changes in processing activities, applicable law or Platform operations. When material changes are made, the "Last updated" date at the top of this page will be revised and, where the changes are significant, we may communicate them directly to registered users through their registered contact details or through a Platform notice.

Your continued use of the mywinbox Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you disagree with any changes, you should discontinue use and may request account closure by contacting our support team.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by mywinbox, please contact us using the email address shown in the footer of every page on this site. Please include your registered username and a clear description of your query or request so we can assist you efficiently.

For data rights requests in particular — including access, rectification or erasure — please state clearly which right you wish to exercise and provide sufficient information to allow us to verify your identity before processing the request.

We endeavour to acknowledge all privacy-related enquiries promptly and to respond in full within the timeframe required by applicable data protection law.