Wewin Privacy Policy – Malaysian Player Data Security & Privacy

This Privacy Policy is issued by wewin ("Company", "we", "Platform") and applies to all users who register, access, or use any services provided through the wewin website and wewin mobile app. We are committed to protecting the privacy and security of every player's personal data.

At wewin, we understand that entrusting personal information to any online platform requires genuine confidence. That is why we have written this Privacy Policy in plain language – so you know exactly what happens to your data, rather than having to wade through confusing legal text.

This Privacy Policy complies with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and international online gaming industry best practices. By registering a wewin account, you consent to the collection and use of your personal data as described in this document.

Wewin only collects data that is genuinely necessary to provide a safe and quality service to our players. We never collect excessive or irrelevant data. The following are the categories of data we collect:

We do not collect sensitive information such as biometric data (except for limited KYC requirements), medical records, political views, or religious beliefs. All financial data is processed through PCI DSS-certified payment gateways – your full bank card number is never stored in the wewin system.

Every piece of data we collect has a specific and legitimate purpose. wewin operates on the principle of data minimisation — we only use data for the stated purposes and will not use it for any other purpose without obtaining your consent again.

• Account Management: Creating and maintaining your wewin account, processing deposits and withdrawals, and ensuring continuity of service
• Identity Verification (KYC): Verifying your identity to comply with legal requirements related to anti-money laundering and prevention of illegal financing
• Platform Security: Detecting and preventing fraud, suspicious account activity, and cybersecurity threats that may affect your account
• Service Communications: Sending important notifications about your account such as deposit confirmations, processed withdrawals, and security alerts
• Platform Improvements: Analysing usage patterns in aggregate (not individually) to understand how players use wewin and improve the overall experience
• Legal Compliance: Complying with any legal requirements, court orders, or requests from legitimate authorities
• Marketing Communications: Sending information about new promotions and bonuses — you can unsubscribe at any time via account settings

Wewin does not sell, rent, or trade your personal data to any third party for commercial purposes. This is our absolute commitment. However, in the day-to-day operation of the platform, there are certain instances where data needs to be shared with trusted parties:

• Payment Gateway Providers: Financial data required to process deposits and withdrawals is shared with payment service providers that hold PCI DSS certification. They are bound by strict confidentiality agreements with wewin.
• Game Providers: Minimal game session information is shared with game providers for technical purposes such as saving game progress and resolving technical disputes.
• Third-Party KYC Services: Identity verification documents may be processed through an accredited KYC verification platform. All such providers are held to the same security standards as wewin.
• Legal Authorities: wewin will disclose required data to the police, courts, or other regulatory bodies where mandated by applicable law or a valid court order.

Wewin continuously invests in security infrastructure to ensure your personal data is always protected. We apply a layered approach to data security — meaning that if one line of defence fails, additional layers remain in place to protect your data.

The following are the technical and organisational security measures we have implemented:

• Transmission Encryption: All communications between your device and wewin's servers are protected with TLS 1.3 and 256-bit SSL encryption. This ensures that data transmitted cannot be intercepted by third parties.
• Storage Encryption: Sensitive data stored in the wewin database uses AES-256 encryption. This means that even if our database were accessed without authorisation, the data cannot be read without the encryption key.
• Two-Factor Authentication (2FA): wewin supports and encourages the use of two-factor authentication for all accounts. This adds an extra layer of protection in the event your password is compromised.
• 24/7 Security Monitoring: wewin's cybersecurity team monitors our systems around the clock to detect and respond to any suspicious activity in real time.
• Regular Security Audits: wewin conducts regular independent security audits to identify and address any vulnerabilities before they can be exploited.

Wewin uses cookies and similar tracking technologies to enhance the user experience on our platform. Cookies are small files stored on your device that help the platform remember your preferences and deliver a smoother experience.

Types of cookies we use:

• Essential Cookies: These cookies are required for the platform to function properly. Without them, you will not be able to log in or use wewin services. They cannot be disabled.
• Performance Cookies: Helps us understand how players use the platform — which pages are visited most, how long is spent on them, and where players encounter issues. This information is used in aggregate form only.
• Functional Cookies: Remembering your preferences such as selected language, display settings, and login details (if you choose to save them).
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser. Used to maintain your login session while using the platform.

You can manage cookie settings through your web browser at any time. However, disabling essential cookies may affect your ability to fully use wewin services.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and wewin's internal policies, you have the following rights regarding your personal data. wewin is committed to fulfilling all valid requests relating to these rights within 14 business days.

Wewin adheres to the principle of data storage minimisation — we do not retain your personal data longer than necessary for legitimate purposes. Retention periods vary depending on the type of data and applicable legal requirements:

• Active Account Data: Retained for the duration of your active account and up to 7 years after account closure for financial regulatory compliance purposes
• Transaction Records: Retained for a minimum of 7 years based on accounting and anti-money laundering legal requirements
• KYC Documents: Retained for the duration of the active account and 5 years after account closure
• Technical Logs: Deleted after 90 days unless required for an ongoing security investigation
• Customer Support Communications: Retained for 2 years for service quality purposes and reference if needed

Once the retention period expires, data is securely deleted using industry-standard data deletion procedures. Deleted data cannot be recovered.

Wewin strictly prohibits anyone under the age of 18 from registering or using our platform in any capacity. This is not only a platform policy, but also our legal and moral responsibility.

If wewin discovers that personal data of an individual under the age of 18 has been collected without our knowledge, we will immediately take the following steps:

• Immediately closing the account in question
• Deleting all associated personal data
• Returning any remaining account balance
• Reporting the incident to the relevant authorities if required

If you have any questions, concerns, or complaints regarding how wewin handles your personal data, we strongly encourage you to reach out to us. The wewin Data Protection Officer (DPO) team is ready to assist you.

How to contact the wewin privacy team:

• Live Chat Platform: The fastest way – open the wewin platform and click the support icon. Our team will respond within minutes, 24 hours a day, 7 days a week.
• Privacy Email: Send an email to our privacy address. We are committed to responding to all privacy enquiries within 72 business hours.
• Via Account Settings: The "Privacy & Data" section in your account settings provides direct access to all data-related requests.

For formal complaints that cannot be resolved directly with wewin, you have the right to submit a complaint to the Department of Personal Data Protection under Malaysia's Ministry of Communications and Digital.