Win17 Privacy Policy – Data Protection for Malaysian Users

Win17 collects personal data from various sources as you interact with our platform. Below are the categories of data we collect and the purposes for which they are collected:

Win17 also collects data you provide voluntarily, such as your game preferences, feedback on our services, and information shared when contacting our support team. All of this data is used solely to improve your experience on the Win17 platform.

Win17 uses the personal data we collect solely for legitimate and necessary purposes in operating our platform responsibly. These purposes are:

• Account Management: Creating, verifying, and maintaining your win17 account, including identity verification (KYC) to ensure that only eligible users — aged 18 and above and meeting other qualifying criteria — are able to use the platform.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX; and processing withdrawal of winnings to the account registered in your name.
• Legal & Regulatory Compliance: Meeting legal obligations under Malaysia's PDPA 2010, anti-money laundering (AML) requirements, and any reporting obligations that may be required by relevant authorities.
• Platform Security: Detecting and preventing fraudulent activity, money laundering, system manipulation, or the use of multiple accounts by the same individual.
• Responsible Gaming: Identifying gaming patterns that may indicate problem gambling and taking appropriate supportive action in line with win17's responsible gaming policy.
• Customer Support: Processing and responding to enquiries, complaints, or requests for assistance submitted via live chat, email, or WhatsApp.
• Service Improvement: Analysing usage patterns in aggregate (without identifying individuals) to improve platform functionality, user experience, and the range of games available.
• Service Communications: Sending you transaction notifications, account updates, security alerts, and important changes to our terms via email or message.

Win17 does not sell, rent, or trade users' personal data to any third party for marketing or other commercial purposes. This is our absolute commitment to all Malaysian users.

However, win17 may share your personal data with the following parties in limited circumstances and for legitimate purposes:

• Licensed Game Providers: Game providers such as Evolution Gaming, Pragmatic Play, PG Soft, Microgaming, and NetEnt may receive data necessary to operate the games you play, particularly for Live Casino and other technical requirements. All such providers are bound by strict confidentiality agreements.
• Payment Processors: Payment service providers that process your deposit and withdrawal transactions – including e-wallet providers and banks handling DuitNow and FPX – receive the transaction information necessary to process your payments. They operate under strict Malaysian financial regulations.
• Relevant Authorities: Win17 will disclose personal data to government authorities, law enforcement, or regulatory bodies where required by Malaysian law, court order, or legitimate legal compliance obligations.
• Technical Service Providers: Companies providing infrastructure, data hosting, cybersecurity, or analytics services to win17 may have limited access to data solely to carry out their technical functions, under binding data processing agreements.

In all of the above data-sharing instances, win17 ensures that parties receiving your personal data are bound by confidentiality and data protection obligations that are equivalent to or higher than win17's own standards.

Win17 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures we have in place include:

• 256-bit SSL Encryption: All data transmitted between your browser and win17's servers is encrypted using the latest SSL/TLS protocols. This means your information remains secure in transit, even when using public Wi-Fi networks.
• Stored Data Encryption: Sensitive personal data stored in Win17's databases is encrypted using industry-standard encryption algorithms.
• Internal Access Controls: Only win17 staff who require access to your personal data in the course of their duties are permitted to do so, based on the principle of least privilege.
• 24/7 Security Monitoring: win17's systems are continuously monitored to detect any suspicious activity, intrusion attempts, or anomalies that may indicate a security breach.
• Two-Factor Authentication (2FA): win17 offers two-factor authentication for user accounts as an additional layer of protection.
• Regular Security Audits: win17 conducts regular security assessments and audits to identify and address potential vulnerabilities in our infrastructure.

Win17 retains your personal data only for as long as it is needed for the purposes stated in this Policy, or as required by Malaysian law. The following are general data retention guidelines:

• Active Account Data: For as long as your account remains active and you continue to use the Win17 platform.
• Financial Transaction Data: A minimum of 7 years from the transaction date, in accordance with Malaysian accounting and anti-money laundering legal requirements.
• KYC (Identity Verification) Records: Minimum 5 years after account closure, in accordance with applicable legal requirements.
• Platform Activity Logs: Up to 2 years for security and dispute resolution purposes.
• Customer Support Records: Up to 3 years from the date of last interaction.
• Inactive Account Data: Accounts inactive for 12 months will be notified by email. Data may be deleted or anonymised after the designated period if no further activity occurs.

Once the relevant retention period has expired, Win17 will either securely delete your personal data or anonymise it so that it can no longer be linked to you personally. Anonymised data may be retained for aggregate analytics purposes.

Win17 uses cookies and similar tracking technologies to enhance platform functionality and the overall user experience. The following are the types of cookies we use:

• Essential Cookies (Required): These cookies are essential for the Win17 platform to function properly. They manage your login session, maintain security, and enable core platform features. Disabling them will directly impact platform functionality.
• Preference Cookies: These cookies save your preferences — such as display language, display settings, and game choices — so you don't have to reconfigure them each time you visit.
• Analytics Cookies: Win17 uses analytics tools to understand how users interact with our platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is collected in aggregate form and does not identify individuals.
• Security Cookies: These cookies help Win17 detect and prevent fraudulent activity, suspicious logins, and other security threats.

You can manage your cookie settings through your web browser. However, disabling certain cookies may affect the functionality of the Win17 platform. Please refer to your browser's documentation for guidance on how to manage cookies.

As a Win17 user based in Malaysia, you have certain rights over your personal data under the Personal Data Protection Act 2010 (PDPA). Win17 respects and supports the exercise of these rights:

Win17 is an adults-only platform for users aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18.

At the point of registration, Win17 performs age verification based on the information provided by the user. We also reserve the right to request age verification documents such as a copy of your MyKad at any time, particularly before processing withdrawals or when there is reason to suspect a user may not meet the minimum age requirement.

If Win17 discovers that personal data has been inadvertently collected from individuals under the age of 18, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered a Win17 account are urged to contact us immediately at support@win17.xyz.

Win17 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, relevant legal developments, or changes to the services we offer.

When this Privacy Policy is updated with significant changes, win17 will:

• Updating the "Updated" date at the top of this page.
• Displaying a clear notice on the platform regarding such changes.
• Sending a notification email to all registered Win17 members at least 7 days before changes take effect, except where immediate changes are required for security or legal reasons.

Your continued use of the Win17 platform after the effective date of any Policy changes will be considered your acceptance of the updated Policy. It is your responsibility to review this Privacy Policy periodically. If you do not agree with the changes made, you should stop using the Win17 platform and contact us to close your account.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how Win17 handles your personal data, please reach out to us through the following channels:

• Email: support@win17.xyz – Please include "Data Privacy Enquiry" in the subject line to help us prioritise your request. We aim to respond within 2 business days.
• Live Chat: Available 24/7 in Bahasa Malaysia – log in to your Win17 account and click the chat icon at the bottom corner of the screen.
• WhatsApp: Malaysian-language support available 24/7, including Malaysian public holidays.

For formal privacy-related complaints, please use the email channel and include your win17 account number, a detailed description of your complaint, and any identification information required to verify your identity. win17 is committed to resolving all privacy complaints within 14 business days.

If you are not satisfied with how win17 has handled your privacy complaint, you have the right to lodge a complaint with the relevant data protection authority in Malaysia in accordance with the provisions of PDPA 2010.