winway Privacy Policy

1. Introduction

winway ("winway", "we", "us", "our") is committed to protecting the privacy and personal data of all players who access the winway gaming platform at winway.vu. This Privacy Policy describes the types of personal data we collect, the purposes for which we use it, the parties with whom we may share it, and the rights available to you in respect of your personal data.

This Privacy Policy applies to all personal data processed by winway in connection with your registration and use of the winway platform, including the sportsbook, live casino, slots, lottery, World Cup betting, and all associated account management services. By registering a winway account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Data Controller

For the purposes of applicable data protection legislation, winway is the data controller in respect of personal data collected and processed through the winway platform. winway is responsible for determining the purposes and means of processing your personal data.

Where winway engages third-party processors to process personal data on its behalf — such as payment processors, identity verification providers, and cloud infrastructure providers — those parties act strictly as data processors under written contractual terms that require them to process data only on winway's instructions and to maintain appropriate security standards.

3. Personal Data We Collect

winway collects the following categories of personal data in connection with the registration and use of the winway platform:

• Identity Data: Full name, date of birth, nationality, and government-issued identity document details (such as MyKad or passport details where required for age and identity verification).
• Contact Data: Email address, mobile phone number, and residential address.
• Account Data: Username, password (stored in hashed form), account settings, responsible gaming preferences, and self-exclusion records.
• Financial Data: Payment method details, deposit and withdrawal transaction history, and account balance information denominated in MYR. winway does not store full payment card numbers; card processing is handled by PCI-DSS compliant third-party payment processors.
• Transaction Data: Records of all bets placed, games played, bonuses claimed, and gaming session data.
• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone settings, and pages visited on the winway platform.
• Usage Data: Information about how you navigate and use the winway platform, including betting and gaming behaviour patterns.
• Communications Data: Records of your correspondence with winway customer support, including live chat transcripts and email exchanges.

4. How We Collect Data

winway collects personal data through the following means:

• Direct interaction: Data you provide when registering a winway account, completing identity verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Technical and usage data collected automatically as you interact with the winway platform, including through cookies, server logs, and similar tracking technologies as described in Section 8.
• Third parties: Identity verification agencies and fraud prevention services may provide winway with verification data; payment processors provide transaction confirmation data; and analytics providers may provide aggregated usage insights.

5. How We Use Your Data

winway uses your personal data for the following purposes:

• To create, verify, and maintain your winway account, including age verification to enforce the 21+ eligibility requirement.
• To process deposits, withdrawals, and all financial transactions on your account in MYR.
• To provide and improve the winway gaming services, including the sportsbook, live casino, slots, and lottery products.
• To detect and prevent fraud, money laundering, cheating, multi-accounting, and other prohibited conduct as described in our Terms & Conditions.
• To comply with legal and regulatory obligations, including anti-money laundering (AML) requirements, know-your-customer (KYC) obligations, and reporting obligations to gaming authorities.
• To administer responsible gaming features, including deposit limits, session reminders, loss caps, and self-exclusion records.
• To communicate with you about your account, transactions, platform updates, and — where you have opted in — promotional offers and bonuses.
• To analyse platform usage in aggregate in order to improve the winway product and gaming experience.
• To resolve disputes, enforce our Terms & Conditions, and protect the rights, property, and safety of winway and its players.

6. Legal Bases for Processing

winway processes personal data on the following legal bases as applicable:

• Performance of a contract: Processing necessary to provide you with the winway services pursuant to the account agreement formed when you register a winway account.
• Legal obligation: Processing necessary to comply with AML, KYC, and regulatory reporting obligations applicable to a licensed gaming operator.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and product improvement, where those interests are not overridden by your data protection rights.
• Consent: Processing of personal data for direct marketing communications, where you have given us your express consent. You may withdraw consent for marketing at any time via your account settings.

7. Sharing Your Data

winway does not sell your personal data to third parties. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, FPX, Visa, and Mastercard processing partners require certain data to process transactions on your winway account.
• Identity and age verification providers: Third-party KYC and document verification services used to confirm your identity and verify that you meet the 21+ eligibility requirement.
• Gaming software providers: Where game providers operate their own servers for live casino or slot games, session data is transmitted to them as required to deliver the game. These providers act as data processors under contractual terms with winway.
• Fraud and AML service providers: Third-party fraud detection and anti-money laundering screening services used to protect the integrity of the winway platform.
• Regulatory and law enforcement authorities: Where winway is required by law, regulation, or court order to disclose personal data to a governmental or regulatory authority.
• Professional advisers: Legal, accounting, and audit professionals where disclosure is necessary for their professional services and is subject to professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or asset sale involving winway, your personal data may be transferred to the relevant acquiring entity, subject to equivalent privacy protections.

8. Cookies & Tracking Technologies

winway uses cookies and similar tracking technologies on the winway platform. Cookies are small data files placed on your device that help winway deliver a functional, personalised, and secure gaming experience. The categories of cookies used by winway include:

• Essential cookies: Required for the platform to function. They maintain your login session, remember your language preferences, and enable security features. These cannot be disabled without affecting platform functionality.
• Analytics cookies: Used to collect aggregated data about how players interact with the winway platform, enabling winway to identify and improve areas of the user experience. Data collected through analytics cookies does not identify you individually.
• Functional cookies: Remember your account preferences such as saved bet slips, preferred sports markets, and display settings.
• Fraud prevention cookies: Used to identify and block suspicious behaviour, protect your account, and maintain the integrity of the winway platform.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to log in and use the winway platform.

9. Data Retention

winway retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations. Specific retention periods include:

• Account and identity data is retained for a minimum of five years following account closure, as required under AML and gaming regulatory obligations.
• Financial transaction records are retained for a minimum of seven years following each transaction date.
• Customer support communications are retained for three years following the date of the interaction.
• Marketing consent records are retained for the duration of the consent plus three years following any withdrawal of consent.

Following the applicable retention period, personal data is securely deleted or anonymised in accordance with winway's data destruction procedures.

10. Data Security

winway implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption of all data transmitted between your device and the winway platform.
• Secure, encrypted storage of account passwords using industry-standard hashing algorithms.
• Two-factor authentication available to all winway account holders.
• Access controls limiting internal access to personal data to staff with a legitimate business need.
• Regular security assessments and penetration testing of the winway platform.
• Incident response procedures for the detection, escalation, and notification of personal data breaches where required by applicable law.

While winway takes these measures seriously, no method of electronic transmission or storage is completely secure, and winway cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials as described in our Terms & Conditions.

11. Your Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by winway:

• Right of access: You may request a copy of the personal data winway holds about you.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data. You can update most account details directly from your winway account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to winway's regulatory retention obligations.
• Right to restriction: You may request that winway restricts processing of your personal data in certain circumstances, for example while a rectification request is under review.
• Right to object: You may object to processing of your personal data for direct marketing purposes at any time with immediate effect. You may also object to processing based on legitimate interests.
• Right to data portability: You may request that winway provide your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract.

To exercise any of the above rights, please contact winway at [email protected]. winway will respond to verified requests within 30 days. We may need to verify your identity before processing your request.

12. Marketing Communications

winway may send you promotional communications — including bonus offers, free spins, cashback promotions, and product news — by email or SMS where you have given your express consent at the time of registration or through your account settings. Each marketing communication includes an unsubscribe mechanism. You may also withdraw marketing consent at any time by updating your communication preferences in your winway account settings. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal, and does not affect winway's ability to send you service communications related to your account.

13. Children's Privacy

The winway platform is strictly restricted to individuals aged 21 and above. winway does not knowingly collect or process personal data from any person below the age of 21. Age verification is conducted as part of the registration and KYC process. Where winway becomes aware that personal data has been collected from a person under 21, that account will be suspended immediately, any funds returned, and the personal data deleted. winway encourages parents and guardians to supervise the online activities of persons under their care and to prevent access to the winway platform by minors.

14. International Data Transfers

winway may transfer your personal data to third-party service providers located outside of Malaysia, including in jurisdictions where data protection laws may differ from those applicable in Malaysia. Where such transfers occur, winway ensures that appropriate safeguards are in place, including standard contractual clauses or equivalent transfer mechanisms, to provide a level of data protection equivalent to that required under applicable law. winway will not transfer your personal data to a jurisdiction that does not provide adequate data protection without appropriate safeguards.

15. Changes to This Policy

winway may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where amendments are material, winway will notify registered players via the email address associated with their winway account or by prominent notice on the platform prior to the changes taking effect. The "Last updated" date at the top of this page reflects the date of the most recent revision. Continued use of the winway platform following publication of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not accept the revised Privacy Policy, you should cease using the platform and contact winway to close your account.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by winway, please contact our data protection team:

Email: [email protected]

winway aims to respond to all privacy-related enquiries within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days and will notify you accordingly. If you are unsatisfied with winway's response, you may have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.