uwin33myr Privacy Policy — How Your Data Is Protected

Definitions

In this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person. "Processing" includes collection, storage, retrieval, use, disclosure and deletion of personal data. "Controller" refers to uwin33myr in its capacity as the entity determining purposes and means of data processing. "Processor" means a third party processing data on uwin33myr's behalf under a written instruction. "User", "you" and "your" refer to an individual accessing or registering on uwin33myr.

Personal Data We Collect

uwin33myr may collect and process the following categories of personal data depending on your level of engagement with the platform:

We do not collect special-category personal data such as health records, religious beliefs or biometric identifiers unless specifically required and authorised for a defined compliance purpose.

How Personal Data Is Collected

uwin33myr collects personal data through the following means:

• Direct submission — information you provide when registering an account, completing KYC verification, submitting payment details or contacting customer support.
• Automated collection — technical and behavioural data gathered through cookies, server logs, session tracking and analytics tools when you interact with the uwin33myr platform.
• Third-party sources — identity, age or fraud-screening data received from payment processors, identity-verification services or financial institutions such as Maybank, CIMB or Public Bank where permitted and necessary.

Legal Basis for Processing

uwin33myr processes personal data under one or more of the following lawful bases, depending on the specific processing activity:

• Contractual necessity — processing required to register an account, verify age, process deposits and withdrawals, or settle transactions.
• Legal obligation — processing required to comply with anti-money-laundering, fraud prevention, identity verification or applicable statutory requirements.
• Legitimate interest — processing used to protect uwin33myr security, improve platform features, detect prohibited conduct and manage risk, where those interests are not overridden by user rights.
• Consent — where uwin33myr has obtained your clear agreement for a specific processing purpose such as certain marketing or optional analytics.

Data Processing Purposes

Personal data held by uwin33myr is processed for the following purposes:

• creating, verifying and maintaining user accounts;
• processing MYR deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank or supported digital assets;
• conducting age, identity and source-of-funds checks;
• administering promotions, bonuses and VIP reward programmes;
• applying responsible-gambling controls, deposit limits and self-exclusion requests;
• detecting and preventing fraud, collusion, money laundering and prohibited conduct;
• responding to support enquiries and resolving disputes;
• complying with legal, regulatory and audit obligations; and
• improving platform performance, security and user experience.

Data is not used to profile users for unrelated commercial purposes or sold to advertisers for third-party targeting campaigns.

Payments and Financial Data

When you make a deposit or request a withdrawal through uwin33myr, financial data such as payment method type, transaction reference, amount and payment provider name is recorded. Full card numbers and e-wallet account credentials are not stored on uwin33myr systems. Payment data is transmitted through secure protocols to the applicable processor.

Transaction records are retained for the period required to satisfy anti-money-laundering obligations, dispute resolution and audit needs. Payment data may be reviewed if there is a reasonable suspicion of fraud or if a chargeback or reversal is raised by your bank, Touch 'n Go eWallet, Boost or another payment provider.

Third-Party Sharing and Processors

uwin33myr does not sell personal data. Data may be shared with the following categories of third party only when necessary and under appropriate contractual safeguards:

• Payment processors and financial institutions — to execute and verify MYR transactions through supported Malaysian payment channels.
• Identity and KYC verification providers — to confirm age and identity for account eligibility checks.
• Technology and infrastructure providers — hosting, analytics and security vendors processing data on uwin33myr's instruction.
• Legal and regulatory authorities — where disclosure is required by applicable law, court order or legitimate regulatory request.

Third-party processors are required to maintain appropriate security standards and may not use uwin33myr user data for their own independent commercial purposes.

Cookies and Technical Tracking

uwin33myr uses cookies and similar tracking technologies to manage user sessions, apply security controls, remember preferences and collect aggregated analytics about platform usage. Cookies do not contain your password or full payment details.

The following categories of cookie may be active on uwin33myr:

• Strictly necessary cookies — required for authentication, session management and security.
• Functional cookies — used to remember language, display or preference settings.
• Analytical cookies — used to measure page visits, bounce rates and navigation patterns in aggregated form.

Most browsers allow you to control cookie storage. Disabling strictly necessary cookies may prevent some uwin33myr features from operating correctly. Continued use of the platform without adjusting browser cookie settings implies acceptance of cookies in use.

Data Retention

uwin33myr retains personal data only for as long as necessary to fulfil the purpose for which it was collected or to satisfy applicable legal and regulatory obligations. General retention guidelines are as follows:

• Account records — for the duration of the account relationship and a reasonable period thereafter for dispute resolution and legal obligation.
• Financial transaction records — as required by applicable financial compliance obligations.
• Communication and support records — for the period needed to resolve the relevant matter and for reasonable audit purposes.
• Security and fraud logs — for the period required to investigate, report or resolve the relevant concern.

Following the retention period, personal data is securely deleted or anonymised unless a specific legal obligation requires continued storage.

User Rights

Subject to applicable law and legitimate operational constraints, Malaysian users of uwin33myr may exercise the following rights regarding their personal data:

Rights requests should be submitted to the contact details in Section 12. uwin33myr may ask for reasonable identification before processing a rights request. Some rights may be limited where fulfilling them would interfere with fraud prevention, legal obligations or the rights of other users.

Security Measures

uwin33myr implements technical and organisational measures proportionate to the sensitivity of the data involved. These include encrypted data transmission, access controls limiting internal data access to authorised personnel, secure credential storage and periodic security reviews.

No security measure eliminates all risk. Users are responsible for protecting their own credentials, including passwords, OTP codes and device access. If you become aware of unauthorised access to your uwin33myr account, stop activity on that account and notify our support team immediately using the email address in Section 12 below.

Policy Changes, Contact and Complaints

This Privacy Policy may be updated to reflect changes in uwin33myr services, legal obligations, payment arrangements or data-processing practices. Material updates will be posted with a revised effective date. Continued use of uwin33myr after that date constitutes acceptance of the updated policy.

To exercise a data right, raise a privacy concern or submit a complaint, contact uwin33myr using the details below. Include your account identifier and a clear description of your request. Do not include your password, OTP or full card number.