Privacy Policy Winbax – Your Data Security Our Priority

1Introduction — Why Your Privacy Matters to winbax

Winbax takes its members' privacy very seriously. As an online gaming platform operating in Malaysia, we are subject to and fully comply with the Malaysia Personal Data Protection Act 2010 (PDPA).

This Privacy Policy clearly and transparently explains how Winbax collects, uses, stores, protects, and in certain circumstances shares your personal data. By using the Winbax platform, you consent to the practices described in this document. If you do not agree, please stop using the platform and contact us to delete your account.

The term "personal data" in this context refers to any information that can identify you directly or indirectly — including your name, identification number, email address, financial information, and platform usage data.

2What Information Does Winbax Collect?

Winbax collects your personal data through several different means, depending on your interaction with the platform. The following are the categories of information collected:

Account Registration Information:

• Full name as it appears on your official identification document
• Date of birth for age verification
• Active email address for account communications
• Mobile number for two-factor authentication
• Current residential address
• Username and password (stored as an irreversible hash)

Identity Verification Information (KYC):

• Copy of MyKad, passport, or other valid identity document
• Selfie photo for facial verification
• Proof of payment method (bank statement, e-wallet account screenshot)

Financial Information:

• Bank account or e-wallet number for deposit and withdrawal purposes
• Deposit and withdrawal transaction history
• Betting records and gaming activity

Technical & Usage Data:

• IP address and device information used
• Browser type, operating system, and screen resolution
• Access time logs and platform usage patterns
• Cookie data and related tracking technology (see Section 6)

3How Does Winbax Use Your Data?

Every piece of data collected by winbax has a clear and lawful purpose. We do not collect more data than is necessary for the following purposes:

• Account Management: Creating, verifying, and maintaining your member account on the winbax platform.
• Transaction Processing: Managing deposits, withdrawals, and all financial transactions securely and accurately.
• KYC Verification: Meeting legal obligations related to identity verification and anti-money laundering.
• Platform Security: Detecting and preventing fraud, unauthorized access, and account misuse.
• Customer Support: Handling inquiries and complaints, and providing the assistance needed.
• Service Communications: Sending important notifications about your account, transactions, and policy changes.
• Platform Improvement: Analyzing aggregate usage patterns to improve the overall user experience.
• Responsible Gaming: Monitoring gameplay patterns to identify players who may need support.

4Sharing Information with Third Parties

Winbax does not sell your personal data. However, in the course of platform operations, there are situations where we may need to share certain information with trusted parties:

• winbax does not share your personal data with third-party advertisers or marketing companies.
• winbax does not sell or transfer your personal data for commercial gain to any party.
• Any sharing with third parties is subject to strict confidentiality agreements.

5How Does Winbax Protect Your Data?

Winbax continuously invests in security infrastructure to ensure your personal data is protected to the highest standards available in the industry:

• 256-bit SSL Encryption: All data transmitted between your device and winbax servers is encrypted using 256-bit SSL — the same standard used by major banks in Malaysia.
• Secure Password Storage: Your password is stored as a cryptographic hash that cannot be reversed — never in plain text.
• Two-Factor Authentication (2FA): winbax offers an additional layer of security through two-factor authentication to protect your account from unauthorised access.
• Regular Security Audits: The winbax platform undergoes regular penetration testing and security audits conducted by accredited independent parties.
• 24/7 Threat Monitoring: Automated monitoring systems operate around the clock to detect and respond to any suspicious activity.
• Internal Access Controls: Access to members' sensitive data is restricted to staff who require it for their specific duties only.

6Cookies and Tracking Technologies

Winbax uses cookies and related tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you visit our website.

• Essential Cookies: Required for core platform functions such as login verification and session security. Cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how you use the platform to help us improve it. This data is collected in aggregate and does not identify you individually.
• Functional Cookies: Saving your preferences such as language, theme, and display settings for a smoother platform experience.
• Analytics Cookies: Helping us understand overall traffic patterns and platform usage for continuous improvement.

You can manage your cookie settings through your web browser. Please note that disabling certain cookies may affect specific features of the Winbax platform.

7Your Rights Over Your Personal Data

Under Malaysia's PDPA and Winbax's commitment to privacy, you have several important rights regarding your personal data:

8Data Retention Period

Winbax retains your personal data for as long as necessary to fulfil the purposes stated in this policy, or as required by applicable law:

• KYC records and identity verification – minimum 5 years after account closure, in line with AMLA requirements.
• Financial transaction records – minimum 7 years for audit and tax compliance purposes.
• Customer support communication logs — retained for 3 years from the date of last interaction.
• Technical data and access logs – 12 months for security and analytics purposes.
• Active account information — retained for the duration your account remains active and for a set period after closure.

Upon expiry of the specified retention period, data will be securely deleted or anonymised so that it can no longer be linked to your identity.

9Child Protection

The winbax platform is exclusively for individuals aged 18 and above. winbax does not knowingly collect personal data from individuals under the age of 18.

Should winbax discover that personal data of an individual under the age of 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the relevant account. Parents or guardians who believe their child may have registered an account with winbax should contact us immediately.

10Amendments to This Privacy Policy

Winbax reserves the right to update this Privacy Policy from time to time to reflect changes in data practices, legal requirements, or service improvements. When material changes are made, we will notify you via in-app notification or email to the address registered to your account.

The "Updated" date at the top of this document indicates when this Privacy Policy was last reviewed. Your continued use of the winbax platform after any amendments take effect will be considered your acceptance of the revised terms.

11Contact Us About Privacy

If you have any questions, concerns, or wish to exercise your privacy rights, please contact the Winbax Data Protection Officer through the following channels:

• Live Chat 24/7: Stay within the winbax platform — the fastest way to get a response.
• Privacy Email: [email protected] – for specific enquiries relating to personal data and privacy.
• General Support Email: [email protected] – for general enquiries about your account and services.

Winbax is committed to responding to all privacy-related enquiries within 5 business days, and formal data rights requests within 30 business days, in accordance with Malaysia's PDPA provisions.