Privacy Policy winmy25 – Personal Data Protection for Malaysian Members

This Privacy Policy ("Policy") describes how winmy25 ("Company", "we", "us") collects, uses, discloses, stores and protects your personal information when you use the winmy25 platform accessible at winmy25.net ("Platform").

Winmy25 operates in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) — the primary legislation governing the handling of personal data in Malaysia. We take this obligation seriously and have made it an integral part of how we conduct our business every day.

By registering for or using the winmy25 Platform, you consent to the collection and use of your personal data as described in this Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact us for assistance with closing your account.

This Privacy Policy should be read together with winmy25 Terms & Conditions which forms part of the overall agreement between you and winmy25.

Winmy25 collects only the data genuinely needed to deliver quality services to our members. The following are the categories of data we may collect:

Winmy25 does not collect sensitive personal data such as health information, religious beliefs or political views unless specifically required by law or with your explicit consent.

Winmy25 collects your personal data through several different means, depending on how you interact with our Platform:

• During Account Registration: When you create a new account at winmy25, you are required to provide basic information such as your name, phone number, email address and password. This information is needed to set up and manage your account.
• During the KYC Verification Process: When you submit identity documents such as your MyKad or bank statement for verification purposes, we securely retain copies of those documents to comply with anti-money laundering legal requirements.
• During Financial Transactions: Information relating to your payment method — whether Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX, Maybank2u or CIMB Clicks — is recorded for transaction processing and fraud detection purposes.
• During Platform Use: winmy25's systems automatically record game activity, logins, in-platform actions and technical data for security and service improvement purposes.
• Through Communications with Us: When you contact the winmy25 support team via live chat, WhatsApp or email, records of those communications are retained for reference and service quality improvement purposes.

Winmy25 uses the personal data collected solely for the following legitimate and clearly stated purposes:

• Account Management: To create, manage and maintain your winmy25 account, including processing deposits, withdrawals, bonuses and VIP rewards.
• Identity Verification (KYC): To meet anti-money laundering legal obligations and ensure that only eligible individuals use the winmy25 Platform.
• Payment Processing: To securely and accurately process your deposit and withdrawal transactions through your chosen Malaysian payment method.
• Platform Security: To detect, investigate and prevent fraudulent activity, unauthorised account access, money laundering and other security threats.
• Customer Support: To provide effective assistance when you contact the winmy25 support team and to resolve any issues you may encounter.
• Service Improvement: To understand how members use the Platform and make meaningful improvements to the user experience, games offered and relevant promotions.
• Service Communications: To send you important notifications relating to your account, security updates, and changes to our Terms & Conditions and Privacy Policy.
• Legal Compliance: To comply with any laws, regulations or court orders applicable to winmy25's operations in Malaysia.

Winmy25 does not sell, rent, or transfer your personal data to third parties for marketing or commercial purposes. However, in the course of operating the Platform, winmy25 may need to share your personal data with the following limited categories of third parties:

• Payment Processors: Payment service providers such as Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX, Maybank2u and CIMB Clicks require certain transaction information to process your deposits and withdrawals. They are bound by strict confidentiality terms.
• Game Service Providers: Game software providers such as Evolution Gaming, Pragmatic Play, and others may receive certain data required to operate and audit the games you play.
• Technology Service Providers: Companies that provide technical infrastructure, cloud services or analytics tools for the operation of the winmy25 Platform. All such parties are subject to strict data processing agreements.
• Legal Authorities: winmy25 is required by Malaysian law to disclose information to competent authorities when mandated by a court order, criminal investigation, or other legal obligation.

Winmy25 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, alteration, disclosure or destruction:

• 256-bit SSL Encryption: All communications between your device and winmy25 servers are encrypted using the latest TLS/SSL protocols.
• Layered Access Controls: Only authorised staff who require access to carry out their specific duties may access member personal data. All access is audited and logged.
• 24/7 Security Monitoring: winmy25 systems are monitored around the clock to detect any unusual activity or intrusion attempts that could compromise the security of members' data.
• Regular Security Testing: winmy25 conducts regular penetration testing and security audits to identify and address any vulnerabilities in our systems.
• Hashed Password: Your account password is never stored in plain text — it is hashed using a strong hashing algorithm before being saved, meaning no one, including winmy25 staff, can read your original password.

While winmy25 takes all reasonable steps to protect your data, no security system in the world can guarantee 100% protection. We encourage you to do your part by using a strong password and never sharing your login credentials with anyone.

Winmy25 uses cookies and similar tracking technologies to enhance your experience on our Platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies winmy25 uses:

• Essential Cookies: Required for core Platform functions such as maintaining your login session and keeping your account secure. These cookies cannot be disabled without affecting Platform functionality.
• Functional Cookies: Allows the Platform to remember your preferences and settings — such as your preferred language and display preferences — to deliver a more personalised experience.
• Analytics Cookies: Helps winmy25 understand how members use the Platform – which pages are visited most, how long is spent on them, and where technical issues occur – so we can make meaningful improvements.
• Security Cookies: Used to detect fraudulent activity and ensure the security of your session while using the winmy25 Platform.

You can manage and disable cookies through your web browser settings. However, disabling certain cookies may affect the functionality of some areas of the winmy25 Platform. Continued use of the Platform constitutes your consent to the use of cookies as described above.

Winmy25 does not retain your personal data for longer than is necessary for the purposes stated in this Policy or as required by Malaysian law. Our data retention policy is as follows:

• Active Account Data: Retained for as long as your account remains active and updated periodically to ensure accuracy.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysia's Anti-Money Laundering and Anti-Terrorism Financing Act 2001.
• KYC Documents: Retained for a minimum of 5 years after account closure or after the business relationship ends, in accordance with applicable legal requirements.
• Inactive Account Data: Inactive accounts of 12 months or more will receive a notice. Data will be deleted once the minimum statutory retention period has lapsed and there are no open cases requiring those records.
• Customer Support Records: Retained for 3 years from the date of last communication for reference and service quality purposes.

When personal data is no longer required, winmy25 will securely delete or destroy it using methods that ensure the data cannot be recovered.

To exercise any privacy rights you hold under Malaysia's PDPA 2010 in relation to your data at winmy25, you may submit a request through the following methods:

• Email: Send your request to support@winmy25.net with the subject line "Data Privacy Request" and specify the type of request (access, rectification, deletion, etc.).
• Live Chat: Contact the winmy25 support team via live chat on the Platform and ask to be connected with the privacy team.
• Account Dashboard: Basic personal information can be updated directly through the "My Profile" section in your account dashboard.

Winmy25 will process your privacy request within 14 business days from the date of receipt. In complex cases, this period may be extended to 30 business days, and you will be notified in advance.

Winmy25 may send you communications related to our services via email, SMS or in-Platform notifications. There are two categories of communication:

• Service Communications (Mandatory): Important account-related notifications such as transaction confirmations, security alerts, Terms & Conditions or Privacy Policy updates, and other critical information relating to your account. These communications cannot be unsubscribed from as they form part of winmy25's core service.
• Marketing Communications (Optional): Information about winmy25 promotions, new bonuses, latest games and special offers. You may opt out of marketing communications at any time through your account settings or by clicking the "Unsubscribe" link in any marketing email we send.

Winmy25 will not send you unsolicited communications (spam). Any marketing communication you receive is based on consent you provided at registration or subsequently through your account settings.

Winmy25 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, new legal requirements, or changes to the services we offer.

When significant changes are made to this Policy, winmy25 will:

• Updates the "Last Updated" date at the top of this document.
• Sending notifications to all active members via email or in-platform notifications at least 7 days before the changes take effect.
• Retains previous versions of the Privacy Policy for reference by members who require them.

Your continued use of the winmy25 Platform after any changes to this Privacy Policy take effect will be considered your acceptance of those changes. If you do not agree with the changes made, you have the right to close your account and request data deletion in accordance with the procedure outlined in Section 9 above.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way winmy25 handles your personal data, please contact us through the following channels:

• Privacy Email: support@winmy25.net (include "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24/7 within the winmy25 Platform

The winmy25 team will respond to all privacy enquiries within 3 business days. For more complex matters, you may be contacted by a privacy representative who is specially trained to handle such issues.

If you are not satisfied with winmy25's response to your privacy complaint, you have the right to escalate the matter to the Department of Personal Data Protection (JPDP) Malaysia as the competent regulatory authority.