Winph Privacy Policy – Personal Data Protection for Malaysian Users

This Privacy Policy outlines Winph's commitment to protecting the privacy and security of your personal data as a user of our digital entertainment platform. It applies to all information collected through the Winph website, mobile app, customer support services and any other communication channels between you and Winph.

Winph takes the privacy of Malaysian users seriously. We operate in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010) and adhere to the data protection principles set out in that Act. This means every action we take regarding the collection, processing, and storage of your data is grounded in clear legal requirements and legitimate interests.

In this document, "personal data" refers to any information that can identify you directly or indirectly — including your name, phone number, email address, financial information, and platform usage data. "Processing" refers to any operation performed on that data, from collection through to storage and deletion.

Winph only collects information that is strictly necessary to deliver our digital entertainment platform services safely and efficiently. We do not collect excessive or irrelevant data beyond the scope of our services. The following are the categories of information we collect:

Winph collects information through several different channels, depending on the context of your interaction with our platform:

• During Account Registration: When you register a Winph account, you provide identity and contact information directly through the registration form. This information is stored securely and used for identity verification, legal compliance, and account-related communications.
• During Deposits & Withdrawals: When you make a deposit via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, or FPX (Maybank2u / CIMB Clicks), a transaction record is automatically generated. Winph receives transaction confirmation details only — not your account information or PIN.
• While Using the Platform: Game activity data — including slots played, Malaysia Super League or EPL Sports Betting wagers, MPL Malaysia e-sports bets, and live baccarat sessions — is automatically recorded as part of Winph's platform operations.
• Through Cookies & Tracking Technologies: Winph uses session cookies and persistent cookies to maintain your login session, save your gaming preferences, and analyse platform usage patterns on an aggregate (not individual) basis.
• Via Support Communications: When you contact the Winph support team via live chat, email at support@winph.ws, or WhatsApp, those communications are recorded for quality control and issue resolution purposes.
• Through the Responsible Gaming Programme: If you use Winph's responsible gambling tools — such as deposit limits or self-exclusion — the relevant information is stored to ensure the limits you set are fully enforced by the system.

Winph only uses your personal data for purposes that are lawful, necessary, and directly related to the provision of our digital entertainment platform services. We do not use your data for any other purpose without first obtaining your explicit consent.

The primary purposes for which Winph uses your data are as follows:

• Identity Verification & Eligibility: To verify that you meet the minimum age requirement of 18 and other eligibility criteria before using the Winph platform. This is a legal obligation that Winph cannot waive.
• Platform Service Delivery: Processing deposits, withdrawals, bets, and winnings on the Winph platform. Without this basic information, Winph cannot provide the services you request.
• Financial Transaction Verification: Verifying deposits made via TNG, DuitNow, GrabPay, and other methods, as well as processing withdrawals to the same payment methods. This includes compliance with Anti-Money Laundering (AMLA) requirements.
• Customer Support: Resolving queries, complaints, and technical issues that you submit to the Winph team. Keeping communication records allows us to deliver more consistent and effective support.
• Platform Security: Detecting and preventing fraudulent activity, account abuse, multiple account ownership, and any security threats to the platform or other Winph users.
• Platform Improvements: Analysing usage data in aggregate (not at an individual level) to understand usage patterns and improve the overall Winph user experience.
• Service Communications: Sending important account notifications, updates to our Terms or Privacy Policy, transaction confirmations, and security information via email or SMS.
• Legal Compliance: Complying with applicable Malaysian legal requirements, including PDPA 2010 and financial regulations applicable to the Winph platform's operations.

Winph does not sell, rent or trade your personal data to any third party for their own commercial purposes. This is a core principle of Winph's Privacy Policy and one we have never compromised on.

However, in order to provide the services you request, Winph may need to share certain information with the following parties, strictly within limited and specific purposes only:

• Licensed Game Providers: To ensure that slots, live baccarat, table games, and other games function correctly on the Winph platform, game providers such as Pragmatic Play and PG Soft may receive the session identifiers and credit balances required for gameplay. These providers are bound by strict data confidentiality agreements with Winph.
• Payment Processors: Payment gateways processing Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX transactions receive only the information necessary to complete those transactions. All payment processors maintain recognised data security standards.
• Legal Authorities: Winph will disclose the required information if mandated by Malaysian law, a valid court order, or as part of a legitimate financial crime investigation. In such circumstances, Winph will notify you unless prohibited from doing so by law.
• Technical Service Providers: Third-party companies providing technical infrastructure services (such as server hosting, platform analytics and cybersecurity services) may process some of your data as part of their services to Winph. All such providers are bound by data processing agreements that prohibit them from using your data for any other purpose.

Winph invests seriously in data security infrastructure to ensure your personal and financial information is protected at all times. The key security measures we have in place are:

• 256-bit SSL Encryption: All communications between your browser or app and Winph's servers are encrypted using TLS with 256-bit encryption strength. This means every piece of information transmitted — including logins, account details and transaction data — cannot be read by any third party that may intercept the communication.
• Data Encryption at Rest: Personal data stored in Winph's databases is also encrypted at rest. Even if someone were to gain physical access to the servers, the data cannot be read without the correct encryption key.
• Strict Access Controls: Only Winph employees with a legitimate work requirement are permitted to access user personal data. Every access is automatically logged and periodically audited. Access is revoked immediately once the work requirement no longer exists.
• Two-Factor Authentication (2FA): Winph's internal systems that store user data are protected by two-factor authentication for all staff who require access. This adds an extra layer of security beyond standard passwords.
• 24/7 Security Monitoring: The Winph platform is continuously monitored for suspicious activity, intrusion attempts, or anomalies that may indicate a data breach. Automated alert systems trigger an immediate response if any threat is detected.
• Regular Security Audits: Winph undergoes regular independent security testing and audits to identify and address any vulnerabilities in our systems before they can be exploited.

While Winph takes all reasonable precautions to protect your data, no digital system can be guaranteed 100% secure against every threat. You are also responsible for keeping your Winph account password secure and not sharing it with anyone.

The Winph platform uses cookies and similar tracking technologies to enhance the user experience, maintain your login session, and understand how our platform is used overall. Below is an overview of the types of cookies Winph uses:

Essential cookies are required for the core functions of the Winph platform and cannot be disabled without affecting your ability to use the platform properly. Optional cookies can be managed through the cookie settings within the Winph platform or via your web browser settings. Disabling optional cookies will not affect the platform's core functionality.

Winph retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable Malaysian law. Our principle is simple: keep what is needed, delete what is not.

• Active Account Data: For as long as your Winph account is active, your personal data is retained to allow you full use of the platform. This includes identity information, contact details and account history.
• Financial Transaction Records: All deposit, withdrawal, and financial activity records are retained for a minimum of 7 years in accordance with Malaysian financial compliance and legal requirements. This is a legal obligation, not a choice made by Winph.
• Game Logs: Detailed game history is retained for 90 days for dispute resolution purposes. After this period, data is aggregated and individual identifying information is removed.
• Communication Records: Customer support logs are retained for 12 months for quality control and service improvement purposes. After that, they are deleted unless still relevant to an unresolved dispute.
• Closed Account Data: When your Winph account is closed voluntarily or for any other reason, your personal data will be deleted or anonymised within 30 days, unless Winph has a legal obligation to retain it for longer.
• Self-Exclusion Data: If you choose to self-exclude from the Winph platform, the self-exclusion record is retained for a minimum of 5 years to ensure you cannot access the platform for the duration you have specified.

As a Winph user based in Malaysia, you have certain rights regarding your personal data under the Personal Data Protection Act 2010 (PDPA 2010). Winph fully respects these rights and makes it straightforward for you to exercise them:

Winph strictly prohibits the use of its platform by individuals under the age of 18. This platform is designed exclusively for adults, and we do not knowingly collect or process personal data from children or minors.

The Winph registration process includes an age verification step requiring applicants to confirm they are 18 years of age or older. Each new account is also subject to a risk assessment process, which may require additional age verification documents at any time.

If Winph determines that personal data has been collected from a person under the age of 18, we will immediately delete that data and close the account in question. Any deposits made will be refunded upon completion of the identity verification process.

Winph reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data protection practices, updates to Malaysian legislation, or improvements in how we deliver our platform services.

When we make material changes to this Privacy Policy, we will notify you via a prominent notice within the Winph platform and/or by email to your registered address at least 14 days before the changes take effect. For minor changes that do not affect your fundamental rights, updating the date at the top of this page is sufficient notice.

Continued use of the Winph platform after the stated effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to close your Winph account and request the deletion of your data.

Winph welcomes any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data. You can reach Winph's data privacy team through the following channels:

• Privacy Email: support@winph.ws (enter "Privacy Enquiry" in the email subject line)
• Live Chat: Available 24/7 within the Winph platform – request to speak with the data privacy team
• WhatsApp: The number listed in the support section of the Winph platform

Winph is committed to responding to all privacy enquiries within 2 hours via live chat and within 24 hours by email. Formal requests such as data access, correction or deletion will be processed within 14 working days.

For formal complaints that cannot be resolved through Winph's customer support, you may contact the Department of Personal Data Protection Malaysia (JPDP), the supervisory authority responsible for enforcing PDPA 2010 in Malaysia.