win66bet Privacy Policy

1. Who We Are

This Privacy Policy applies to the win66bet Platform, operated at win66bet.co (the "Platform"). win66bet is an online gaming and sports betting operator serving Malaysian players. For the purposes of this Policy, win66bet is the data controller in respect of personal data collected from users of the Platform ("you", "your").

If you have any questions about how win66bet handles your personal data, you may contact the Data Privacy team at any time using the details set out in Section 13 of this Policy.

2. Personal Data We Collect

win66bet collects the following categories of personal data in connection with the operation of the Platform:

win66bet does not intentionally collect special category personal data (such as health data, religious beliefs, or biometric data) except where biometric authentication is voluntarily enabled by the user on their own device — in which case such data is stored locally on the device and is not transmitted to win66bet's servers.

3. How We Collect Your Data

win66bet collects personal data through the following means:

• Direct submission: Data you provide when registering a win66bet account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your account profile.
• Automated collection: Technical and usage data collected automatically through your interaction with the Platform via cookies, server logs, and analytics tools. See Section 8 for details of cookie use.
• Third-party sources: Data received from payment processors (for transaction verification), identity verification service providers (for KYC), fraud detection partners, and — where applicable — responsible gaming databases such as self-exclusion registers.
• Public sources: Publicly available information used for fraud screening or sanctions compliance checks (e.g. published sanctions lists).

4. Purpose and Legal Basis for Processing

win66bet processes your personal data on one or more of the following legal bases, depending on the purpose of processing:

• Contract performance: Processing necessary to register your account, process deposits and withdrawals, settle bets, provide customer support, and operate the Platform as contracted.
• Legal obligation: Processing required to comply with anti-money laundering (AML) legislation, know-your-customer (KYC) regulatory requirements, international sanctions obligations, and gaming licence conditions — including mandatory age verification and responsible gaming obligations.
• Legitimate interests: Processing conducted in win66bet's legitimate interests and not overridden by your rights — including fraud prevention, platform security monitoring, responsible gambling analytics, and improving the Platform's functionality and performance.
• Consent: Processing of your data for direct marketing communications (including promotional emails and SMS regarding win66bet bonuses and new features), where you have provided explicit opt-in consent. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting support.

5. Data Sharing and Disclosure

win66bet does not sell your personal data to third parties. We share personal data with third parties only in the following circumstances:

• Payment processors and e-wallet providers: Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, and FPX infrastructure providers receive the minimum data necessary to process your transactions.
• KYC and identity verification partners: Third-party verification service providers receive identity document data to fulfil win66bet's regulatory KYC obligations. These providers operate under strict data processing agreements with win66bet.
• Game content providers: Licensed game studios and live casino operators may receive a pseudonymous player identifier and session data to deliver game content and calculate outcomes. They do not receive your full identity or financial data.
• Fraud and risk management partners: Technical data and behavioural signals may be shared with fraud detection service providers to identify and prevent unauthorised account access, bonus abuse, and money laundering activity.
• Regulatory and law enforcement authorities: win66bet will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law or under a valid legal order.
• Corporate transactions: In the event of a merger, acquisition, or sale of the Platform or its assets, personal data held by win66bet may be transferred to the successor entity subject to equivalent privacy protections.

6. International Data Transfers

win66bet operates internationally and some of the third-party service providers described in Section 5 may be based outside Malaysia. Where personal data is transferred outside Malaysia, win66bet ensures that appropriate safeguards are in place — including contractual clauses that impose data protection obligations on the receiving party equivalent to those applicable in Malaysia — before any transfer takes place.

If you would like further information about the safeguards applicable to a specific international transfer, please contact the win66bet Data Privacy team using the details in Section 13.

7. Data Retention

win66bet retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting requirements. The following general retention principles apply:

• Account and identity data is retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulatory requirements applicable to gaming operators.
• Transaction and betting records are retained for a minimum of five (5) years from the date of each transaction.
• Customer support communication logs are retained for three (3) years from the date of the interaction.
• KYC documentation is retained for a minimum of five (5) years following the conclusion of the account relationship.
• Marketing preference data is retained until you withdraw consent or close your account, whichever occurs first.

Following the expiry of the applicable retention period, win66bet will securely delete or anonymise personal data in a manner that prevents recovery.

8. Cookies and Tracking Technologies

win66bet uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Remember your preferences such as language, display settings, and responsible gaming tool configurations between sessions.
• Analytics cookies: Collect aggregate, anonymised data on how users navigate the Platform — including which pages are visited most frequently and how long sessions last — to allow win66bet to improve Platform performance and user experience.
• Marketing cookies: Used only where you have consented to receiving personalised marketing. These help win66bet understand which promotions are relevant to your playing activity.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use the core Platform features.

9. Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by win66bet:

• Right of access: You may request a copy of the personal data win66bet holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some data, such as your registered name and date of birth, can only be amended following identity re-verification.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to win66bet's overriding legal retention obligations under AML and gaming licence requirements.
• Right to restrict processing: You may request that win66bet temporarily restricts processing of your data in certain circumstances, for example while the accuracy of data is disputed.
• Right to data portability: You may request a machine-readable copy of the personal data you provided to win66bet directly, where processing is based on consent or contract performance.
• Right to object: You may object to processing carried out on the basis of win66bet's legitimate interests at any time. You may also withdraw consent to marketing communications at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact win66bet's Data Privacy team as described in Section 13. win66bet will respond to verified requests within 30 calendar days. We may request proof of identity before processing a data subject request.

10. Security Measures

win66bet implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and win66bet's servers.
• Salted cryptographic hashing of account passwords — win66bet staff cannot access your password in plain text under any circumstances.
• Two-factor authentication (2FA) available to all account holders, providing an additional authentication layer tied to your registered Malaysian mobile number.
• Role-based access controls on win66bet's internal systems ensuring that staff access to personal data is limited to what is required for their specific role.
• Regular internal security audits and vulnerability assessments.
• Incident response procedures that include mandatory breach notification to affected users and relevant authorities within the timeframes required by applicable law.

Despite these measures, no data transmission over the internet is completely secure. win66bet cannot guarantee the absolute security of data transmitted to the Platform, and such transmission is at your own risk. Once your data has been received, win66bet will use strict procedures and security features to prevent unauthorised access.

11. Minors

The win66bet Platform is strictly intended for users aged 21 and above. win66bet does not knowingly collect personal data from any person under the age of 21. Account registration requires entry of date of birth, and win66bet verifies age as part of its mandatory KYC process.

If win66bet becomes aware that personal data has been collected from a person under the minimum age, the relevant account will be immediately closed, all data will be deleted in accordance with our retention policies, and any deposited funds will be returned to the source payment method subject to verification.

If you believe a person under the age of 21 has registered a win66bet account, please contact the support team immediately via live chat or email.

12. Changes to This Privacy Policy

win66bet may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform functionality. The current version of this Policy is always available at win66bet.co/privacy-policy. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

Material changes to this Policy will be communicated to registered users via their registered email address or via a notice displayed on the Platform upon login. Continued use of the Platform following notification of material changes constitutes your acceptance of the updated Policy.

13. Contact Us & Complaints

If you have questions about this Privacy Policy, wish to exercise your data rights, or wish to lodge a complaint about win66bet's data handling practices, please contact the win66bet Data Privacy team through any of the following channels:

• Live Chat: Available 24/7 via the Platform — reference "Data Privacy" in your opening message to be routed to the correct team.
• Email: [email protected] — include "Privacy Request" in the subject line.
• WhatsApp: Available 24/7 — contact details displayed after win66bet login.

win66bet will acknowledge data privacy requests within 5 business days and issue a substantive response within 30 calendar days. If you are not satisfied with win66bet's response to a data privacy complaint, you have the right to escalate your complaint to the relevant national data protection supervisory authority in your jurisdiction.