Privacy Policy

1. Introduction

mywinbox ("mywinbox", "We", "Us", "Our") is committed to protecting the privacy and personal data of all individuals who interact with the mywinbox platform, accessible at mywinbox.co and any associated subdomains (collectively, the "Platform").

This Privacy Policy ("Policy") explains what personal data mywinbox collects from players and visitors, the purposes for which that data is used, the legal bases on which we rely to process it, and the rights available to individuals with respect to their personal data.

By registering for a mywinbox account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the mywinbox Platform.

This Policy should be read alongside the mywinbox Terms & Conditions and Responsible Gaming Policy, which together govern your use of the Platform.

2. Data Controller

mywinbox is the data controller responsible for the personal data collected through the Platform. As data controller, mywinbox determines the purposes and means of processing your personal data. Where mywinbox engages third-party processors to handle personal data on its behalf, such processors are bound by contractual data processing agreements that require them to maintain appropriate security standards and process data only in accordance with mywinbox's documented instructions.

For all data protection enquiries, please contact us at [email protected].

3. Personal Data We Collect

mywinbox collects personal data through several channels, including account registration, account use, communications with support, and automated collection through the Platform's technical infrastructure. The categories of personal data we collect include:

mywinbox does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data except where expressly required by applicable regulatory obligations.

4. How We Use Your Personal Data

mywinbox uses personal data collected from players and visitors for the following purposes:

• Account Management: To create, verify, maintain, and administer your mywinbox account, including processing deposits, withdrawals, and bet settlement;
• Identity Verification and AML Compliance: To verify your identity, confirm your age eligibility (21+), conduct Know Your Customer (KYC) checks, and fulfil anti-money laundering (AML) obligations as required by applicable regulations;
• Platform Operation: To deliver the mywinbox gaming services you have requested, including sportsbook, live casino, and slots functionality;
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance;
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited activities on the Platform;
• Responsible Gaming: To monitor player activity for signs of problem gambling behaviour and to administer responsible gaming tools such as deposit limits and self-exclusion requests;
• Legal and Regulatory Compliance: To comply with applicable laws, regulatory requirements, court orders, and the requirements of competent authorities;
• Platform Improvement: To analyse usage patterns, troubleshoot technical issues, and improve the performance and functionality of the mywinbox Platform;
• Communications: To send you account-related notifications, security alerts, and, where you have provided consent, promotional communications about mywinbox offers and new features.

5. Legal Bases for Processing

mywinbox relies on the following legal bases to process your personal data:

• Contractual Necessity: Processing required to perform the contract between you and mywinbox — i.e., to operate your account and deliver the gaming services you have registered for;
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/KYC requirements and regulatory reporting obligations;
• Legitimate Interests: Processing necessary for mywinbox's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where those interests are not overridden by your data protection rights;
• Consent: Where mywinbox relies on consent as a legal basis — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing and Third-Party Disclosure

mywinbox does not sell, rent, or trade personal data to third parties for their own commercial purposes. mywinbox may share personal data with the following categories of third parties where necessary and lawful:

• Payment Service Providers: Including Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and other payment processors, to process deposits and withdrawals on your behalf;
• Game Software Providers: Licensed third-party game studios whose titles are available on the mywinbox Platform, where data sharing is necessary to operate specific games or resolve disputes;
• Identity Verification Providers: Third-party KYC and AML service providers engaged to assist with identity verification and compliance;
• IT and Infrastructure Providers: Cloud hosting, data storage, and security service providers operating under strict data processing agreements;
• Regulatory Authorities: Competent regulatory authorities, law enforcement agencies, and courts where mywinbox is required by law to disclose personal data;
• Professional Advisors: Legal, audit, and compliance advisors where disclosure is necessary for mywinbox to obtain professional services.

All third-party processors engaged by mywinbox are required to implement and maintain security measures consistent with the standards applied by mywinbox and to process personal data only in accordance with documented instructions.

7. Cookies and Tracking Technologies

mywinbox uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Necessary for the Platform to function correctly — including session management, login state persistence, and security verification. These cookies cannot be disabled without impairing Platform functionality;
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform, allowing mywinbox to identify technical issues and optimise the user experience;
• Preference Cookies: Used to remember your account settings and preferences, such as language and display preferences.

You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies may prevent you from accessing certain features of the mywinbox Platform.

8. Data Security

mywinbox implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the mywinbox Platform;
• AES-256 encryption for sensitive data at rest in mywinbox's data storage systems;
• Multi-factor authentication requirements for administrative access to systems containing personal data;
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security specialists;
• Role-based access controls limiting personal data access to mywinbox personnel with a documented need to process such data;
• Incident response procedures for the detection, investigation, and notification of data security incidents.

Notwithstanding the security measures described above, no system is completely immune to security threats. mywinbox encourages all players to use strong, unique passwords for their mywinbox account and to enable two-factor authentication.

9. Data Retention

mywinbox retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable minimum retention requirements imposed by law or regulation. As a general guide:

• Account Data: Retained for the duration of your active mywinbox account and for a minimum period of five (5) years following account closure, in compliance with AML record-keeping requirements;
• Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, consistent with financial record-keeping obligations;
• KYC and Verification Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later;
• Communications Data: Retained for a minimum of two (2) years from the date of the communication;
• Technical and Usage Data: Retained for a rolling period of up to twenty-four (24) months for security monitoring and platform improvement purposes.

Upon expiry of the applicable retention period, mywinbox will securely delete or anonymise personal data in accordance with its data destruction procedures.

10. Your Data Rights

Subject to applicable law, you have the following rights with respect to the personal data mywinbox holds about you:

• Right of Access: The right to request a copy of the personal data mywinbox holds about you;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure: The right to request deletion of your personal data, subject to mywinbox's legal and regulatory retention obligations;
• Right to Restrict Processing: The right to request that mywinbox restricts its processing of your personal data in certain circumstances;
• Right to Data Portability: The right to receive personal data you have provided to mywinbox in a structured, commonly used, machine-readable format;
• Right to Object: The right to object to mywinbox processing your personal data on the basis of legitimate interests;
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting prior lawful processing.

To exercise any of the above rights, please contact mywinbox at [email protected]. mywinbox will respond to all verifiable data rights requests within thirty (30) days. In complex cases, this period may be extended by a further sixty (60) days, with notification provided within the initial thirty-day period.

11. International Data Transfers

The mywinbox Platform and its associated data processing infrastructure may involve the transfer of personal data to locations outside of Malaysia. Where such transfers occur, mywinbox ensures that appropriate safeguards are in place to protect the transferred data, including the use of standard contractual clauses, binding corporate rules, or reliance on adequacy decisions where applicable.

By using the mywinbox Platform, you consent to the transfer of your personal data to jurisdictions outside of Malaysia as described in this Policy, subject to the safeguards described above.

12. Children's Privacy

The mywinbox Platform is strictly intended for individuals aged 21 years and older. mywinbox does not knowingly collect personal data from individuals below the minimum age requirement. If mywinbox becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, such data will be deleted promptly and the associated account will be closed.

If you believe that mywinbox may have inadvertently collected personal data from an individual who does not meet the minimum age requirement, please contact us immediately at [email protected].

13. Changes to This Privacy Policy

mywinbox reserves the right to update or amend this Privacy Policy at any time. Revised versions of this Policy will be published on the Platform with an updated "Last Updated" date. Where mywinbox considers changes to be material, reasonable notice will be provided to registered players via the contact details held on their mywinbox account.

Your continued use of the mywinbox Platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree to a revised Policy, you must cease using the Platform and may request account closure by contacting customer support.

14. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the mywinbox data protection team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 from within your mywinbox account dashboard

mywinbox aims to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within the timeframes specified in Section 10 above.