Privacy Policy — winmy8

Introduction

This Privacy Policy ("Policy") is issued by winmy8 ("winmy8", "we", "us", "our") and applies to all users ("you", "your", "User", "Player") of the winmy8 website located at https://winmy8.cam and all associated services, features, and products accessible through the Platform (collectively, "the Platform").

winmy8 is committed to protecting the privacy and security of the personal data you entrust to us. This Policy sets out in full detail the categories of personal data we collect, the purposes for which we process that data, the legal bases upon which we rely, how long we retain your data, who we share it with, and the rights you hold as a data subject.

By registering an account on the Platform or by continuing to use the Platform, you acknowledge that you have read, understood, and accepted the practices described in this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact our support team to arrange account closure.

Definitions

For the purposes of this Privacy Policy, the following defined terms apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, information that can be used directly or indirectly to identify you.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. winmy8 is the Data Controller in respect of your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under a written agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your wishes, expressed by a clear affirmative action, by which you agree to the processing of your Personal Data.
• "KYC" means Know Your Customer — the identity and document verification procedures required by winmy8 for compliance and fraud prevention purposes.
• "Cookie" means a small text file placed on your device by the Platform to store session and preference information.

Data Controller

winmy8 acts as the Data Controller in respect of all Personal Data collected through the Platform. As Data Controller, winmy8 is responsible for determining the purposes and means of processing your Personal Data and for ensuring that such processing is conducted lawfully, fairly, and transparently.

All enquiries relating to the processing of your Personal Data — including requests to exercise your data subject rights — should be directed to our support team using the contact details set out in Section 15 of this Policy.

Data We Collect

4.1 Information You Provide Directly

When you register an account, use the Platform, or contact our support team, you may provide us with the following categories of Personal Data:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identification numbers (such as Malaysian MyKad or passport number).
• Contact Data: Email address, mobile telephone number, and residential address (including city — such as Kuala Lumpur, Petaling Jaya, Johor Bahru, Penang, or Shah Alam — postcode, and country).
• Financial Data: Payment method details including e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), bank account references (for Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, FPX, and DuitNow transactions), and cryptocurrency wallet addresses used for deposits or withdrawals.
• Account Data: Username, encrypted password, account preferences, communication preferences, and self-imposed responsible gambling limits.
• Communications Data: Records of your communications with our customer support team, including live chat transcripts and email correspondence.
• Verification Documents: Copies of identification documents, proof of address documents, and proof of payment method documents submitted during KYC verification.

4.2 Information Collected Automatically

When you access and use the Platform, we may automatically collect the following Technical Data:

• IP address and device identifier.
• Browser type, version, and operating system.
• Pages visited, time and date of access, session duration, and clickstream data.
• Device geolocation data (country or region level) for compliance and fraud prevention purposes.
• Cookie and tracking technology data, as described in Section 10 of this Policy.

4.3 Information from Third Parties

winmy8 may receive Personal Data about you from third-party sources including payment processors, fraud detection services, identity verification providers, and publicly available sources, where this is necessary for compliance, fraud prevention, or account security purposes.

Purposes & Legal Basis for Processing

winmy8 processes your Personal Data only where it has a lawful basis to do so. The following table sets out the principal processing purposes, the categories of data involved, and the applicable legal basis:

Where processing is based on your consent — such as for marketing communications — you have the right to withdraw that consent at any time by updating your communication preferences in your Account settings or by contacting our support team. Withdrawal of consent will not affect the lawfulness of processing that took place prior to withdrawal.

Sharing Your Personal Data

winmy8 does not sell, rent, or trade your Personal Data to third parties. We may share your Personal Data with the following categories of recipients where necessary and in accordance with this Policy:

• Payment Processors: We share necessary financial data with payment service providers — including those operating Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, and cryptocurrency networks — solely to facilitate the processing of your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and identity verification services that assist us in confirming the identity and age of our users in accordance with our legal obligations.
• Fraud Prevention and Compliance Services: Specialist providers that assist winmy8 in detecting and preventing fraud, money laundering, and other financial crimes.
• IT and Infrastructure Providers: Cloud hosting, database management, and cybersecurity service providers who process data on our behalf under binding Data Processing Agreements.
• Regulatory and Law Enforcement Authorities: Government agencies, courts, regulators, and law enforcement bodies where winmy8 is legally required or permitted to disclose information.
• Professional Advisors: Legal counsel, auditors, and insurers, subject to professional obligations of confidentiality.

International Data Transfers

As an internationally operated Platform, winmy8 may process or transfer your Personal Data to countries outside of Malaysia, including jurisdictions where data protection laws may differ from those applicable in Malaysia. Where such transfers occur, winmy8 will ensure that appropriate safeguards are in place to protect your Personal Data, which may include:

• Transferring data to countries that have been assessed as providing an adequate level of data protection by the relevant regulatory authority.
• Implementing standard contractual clauses or equivalent mechanisms approved by applicable data protection authorities.
• Ensuring that recipients are bound by binding corporate rules or equivalent data protection frameworks.

If you have questions about the specific safeguards applicable to a particular transfer of your Personal Data, please contact us using the details in Section 15.

Data Retention

winmy8 retains your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as is required by applicable law or regulatory obligation. The following retention principles apply:

• Active Account Data: Retained for the duration of your account relationship with winmy8 and for a minimum of five years following account closure, as required for anti-money laundering and gaming compliance purposes.
• Transaction Records: Financial transaction data is retained for a minimum of seven years to satisfy statutory accounting and regulatory requirements.
• KYC Verification Documents: Retained for the period required by applicable anti-money laundering legislation, typically five to seven years from the date of submission or from the date of account closure, whichever is later.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which it will be deleted or anonymised within 90 days.
• Support Communications: Live chat transcripts and email correspondence are retained for up to three years for quality assurance and dispute resolution purposes.
• Technical Data (logs): System access logs and session data are retained for up to 12 months for security and fraud prevention purposes.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

Your Data Subject Rights

Subject to applicable law and certain exceptions, you hold the following rights in relation to the Personal Data winmy8 processes about you:

• Right of Access: You may request confirmation of whether winmy8 processes Personal Data about you and, if so, a copy of that data along with information about how it is processed. Requests will be fulfilled within 30 calendar days.
• Right to Rectification: Where the Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected or completed without undue delay.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected; where you withdraw consent and there is no other legal basis for processing; or where you object to processing and there are no overriding legitimate grounds. This right is subject to legal retention obligations that may require us to retain certain data notwithstanding your request.
• Right to Restriction of Processing: You may request that winmy8 restrict the processing of your Personal Data in certain circumstances — for example, while we assess the accuracy of data you have disputed.
• Right to Data Portability: Where processing is based on your consent or on performance of a contract, and is carried out by automated means, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your Personal Data where processing is based on legitimate interests, or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions made solely by automated means that produce significant legal effects, except where such decisions are necessary for performance of a contract, required by law, or based on your explicit consent.

To exercise any of these rights, please contact our support team using the details in Section 15. We may require you to verify your identity before processing your request. There is generally no fee for exercising your rights; however, we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

Cookies & Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device and remember information about your session and preferences. winmy8 uses cookies and similar tracking technologies to operate the Platform, analyse usage, and — where you have consented — to deliver relevant content.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as account login, session management, and security. They cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Collect anonymised data about how visitors use the Platform — such as pages visited, time spent, and error messages — to help us improve performance. These are set only with your consent.
• Functionality Cookies: Remember your preferences such as language settings and display preferences to provide a personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, protect against cross-site request forgery, and maintain the integrity of your session.

10.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to view, delete, and block cookies from specific websites. Blocking strictly necessary cookies may impair your ability to use certain features of the Platform. For further information on managing cookies, refer to your browser's help documentation.

Data Security

winmy8 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and our servers.
• Encryption of sensitive data at rest, including payment information and identification documents.
• Role-based access controls limiting staff access to Personal Data to those with a legitimate need.
• Regular security audits, vulnerability assessments, and penetration testing.
• Multi-factor authentication requirements for all staff accessing production systems.
• Monitoring of systems for anomalous activity and potential data breaches.
• Incident response procedures for rapid containment and notification in the event of a data breach.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. While we strive to protect your Personal Data, we cannot guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying us promptly of any suspected unauthorised access.

Minors & Age Verification

The winmy8 Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect, process, or retain the Personal Data of individuals under the age of 21. Age verification is a mandatory component of our registration and KYC process, and we require documentary proof of age before permitting access to real-money gambling features.

If winmy8 discovers that a registered account belongs to an individual under the age of 21, we will immediately suspend the account, void any associated bets, return any deposits to the payment source, and delete the account and all associated Personal Data as promptly as possible in accordance with our legal obligations.

If you have reason to believe that a minor is using the Platform or has provided their data to us, please contact our support team immediately at [email protected].

Third-Party Links

The winmy8 Platform does not include links to third-party websites in its main content. Where any reference is made to third-party payment systems — such as Touch 'n Go eWallet, Maybank2u, DuitNow, or others — these are solely for informational purposes within the context of our payment services. winmy8 has no control over the privacy practices of these third parties and accepts no responsibility for their data handling policies.

We encourage you to review the privacy policies of any third-party services you use in connection with your winmy8 account, including your payment provider and financial institution.

Policy Amendments

winmy8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The revised Policy will be published on this page with an updated "Last Updated" date. Material changes will be communicated to registered users via email or through a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and contact us to arrange account closure and data deletion where applicable.

Contact Us

For all enquiries, requests, and complaints relating to this Privacy Policy or to the processing of your Personal Data by winmy8, please contact our dedicated data protection team using the following details:

• Email: [email protected] — please include "Privacy / Data Request" in the subject line
• Live Chat: Available 24/7 via the support icon on your account dashboard
• Supported Languages: English, Bahasa Melayu, Chinese
• Response Time: Within 30 calendar days for formal data subject requests; 3–5 minutes for live chat enquiries

We will endeavour to address all enquiries promptly and in a manner consistent with our obligations under applicable data protection law. Where you believe that winmy8 has failed to address your privacy concern adequately, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.