winvox Privacy Policy

winvox ("we", "us", "our") is committed to protecting the privacy and personal data of all users ("you", "your") who access, register for, or otherwise interact with the winvox Platform accessible at winvox.app. This Privacy Policy has been prepared in accordance with applicable data protection principles and the obligations imposed by winvox's international gaming authority compliance framework.

By creating an Account with winvox, making a deposit, placing a bet, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use and processing of your personal data as described herein. If you do not agree with this policy, please do not use the winvox Platform.

This Privacy Policy should be read alongside the winvox Terms & Conditions. In the event of any conflict, these specific privacy provisions prevail in relation to matters of data processing.

winvox is the data controller in respect of the personal data processed through the winvox Platform. For the purposes of this policy, "data controller" means the entity that determines the purposes and means of processing personal data.

For all privacy-related enquiries, data access requests or complaints, you may contact the winvox Data Protection team at: [email protected]

winvox collects the following categories of personal data from or about you:

winvox does not collect or store full payment card numbers. Payment processing involving card networks is handled by certified third-party payment processors who operate under their own PCI-DSS compliance obligations.

winvox collects personal data through the following means:

1. Direct provision by you: when you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey or communicate with winvox by any means.
2. Automated technologies: as you interact with the winvox Platform, we collect Technical Data and Usage Data automatically via cookies, web beacons, server logs and similar tracking technologies.
3. Third parties: winvox may receive data from identity verification service providers (who process your KYC documents), payment processors (who confirm transaction status), fraud prevention services, and analytics providers.
4. Publicly available sources: winvox may, in limited circumstances related to fraud prevention or compliance investigations, cross-reference data from publicly available sources.

winvox uses the personal data we collect for the following purposes:

• To create, maintain and manage your winvox Account;
• To verify your identity and age (21+) in compliance with our international gaming authority obligations;
• To process deposits, withdrawals and gaming transactions;
• To detect and prevent fraud, money laundering, and other prohibited conduct;
• To provide customer support and respond to enquiries and complaints;
• To comply with applicable legal and regulatory obligations, including reporting requirements under our gaming authority licence;
• To send transactional communications (account activity confirmations, withdrawal notifications, security alerts);
• To send promotional communications where you have consented or where winvox has a legitimate interest in marketing its services to existing customers — you may opt out at any time;
• To operate and improve the winvox Platform, including analysing usage patterns and testing new features;
• To enforce the winvox Terms & Conditions and manage responsible gaming obligations;
• To monitor gaming activity for responsible gaming purposes, including identifying patterns indicative of problem gambling.

winvox processes your personal data on the following legal bases:

1. Performance of a contract: processing necessary to operate your winvox Account, process transactions and provide gaming services as described in our Terms & Conditions;
2. Compliance with a legal obligation: KYC identity verification, AML (anti-money laundering) checks, age verification and regulatory reporting required under our gaming authority licence;
3. Legitimate interests: fraud prevention, platform security, product improvement, analytics and direct marketing to existing customers (subject to your right to object);
4. Consent: for optional marketing communications and non-essential cookies — you may withdraw consent at any time without affecting the lawfulness of prior processing.

winvox does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Gaming providers: game studios and platform providers who supply the Games available on winvox, to the extent necessary to deliver gaming services;
• Payment processors: Touch n Go eWallet, Boost, FPX banking networks, USDT processors and other payment service providers, for the purpose of processing deposits and withdrawals;
• KYC and identity verification providers: third-party services that process identity documents to verify your identity and age;
• Fraud and AML screening providers: services that screen transactions and accounts for fraud, money laundering and sanctions compliance;
• Customer support platforms: live chat and support ticketing system providers who process support communications on our behalf;
• Regulatory and gaming authorities: where disclosure is required by law, court order or our gaming authority licence obligations;
• Analytics providers: anonymised or pseudonymised usage data shared with analytics services for Platform improvement purposes.

All third-party service providers acting on behalf of winvox are required to process personal data in accordance with winvox's instructions and applicable data protection standards, as formalised in data processing agreements.

winvox uses cookies and similar tracking technologies on the Platform for the following purposes:

1. Strictly necessary cookies: session management, authentication tokens, fraud prevention signals and security functions. These cannot be disabled without affecting Platform functionality.
2. Functional cookies: remembering your preferences (e.g., language settings, "Remember me" login state), and providing a personalised experience.
3. Analytics cookies: collecting anonymised or pseudonymised data about how users interact with the Platform, to improve design and performance. winvox uses industry-standard analytics tools for this purpose.
4. Marketing cookies: where you have consented, tracking Platform visits to deliver relevant promotional content. You may withdraw this consent via your browser settings or by contacting support.

You can manage cookie preferences via your browser settings. Note that disabling strictly necessary cookies will impair or prevent use of the winvox Platform.

winvox retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of your Account relationship and thereafter as required by regulatory obligations.

Specifically:

• Account and KYC data is retained for a minimum of 5 years following Account closure, as required by anti-money laundering and gaming authority regulations;
• Transaction records are retained for a minimum of 5 years from the date of the transaction;
• Support correspondence is retained for 3 years from the date of the last interaction;
• Marketing consent records are retained for the duration of the consent plus 3 years;
• Technical and usage data (server logs) is retained for up to 12 months in standard operational systems, and may be retained for longer in aggregated or anonymised form.

When data is no longer required, winvox will securely delete or anonymise it in accordance with our data destruction procedures.

winvox implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and the winvox Platform;
• Encryption at rest for sensitive personal data including KYC documents and payment references;
• Access controls limiting data access to authorised personnel on a need-to-know basis;
• Regular independent security audits and penetration testing as part of our gaming authority compliance obligations;
• Secure data centre infrastructure with redundancy and disaster recovery capabilities;
• Staff data protection training and internal data handling policies.

While winvox takes all reasonable measures to secure your data, no security system is entirely impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, winvox will notify affected users and relevant authorities in accordance with applicable notification obligations.

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by winvox:

1. Right of access: you may request a copy of the personal data winvox holds about you;
2. Right to rectification: you may request correction of inaccurate or incomplete personal data;
3. Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
4. Right to restriction: you may request that winvox restricts processing of your data in certain circumstances;
5. Right to data portability: you may request a machine-readable copy of data you have provided to winvox, for transfer to another service provider;
6. Right to object: you may object to processing based on legitimate interests, including direct marketing — such objections to marketing will be actioned immediately;
7. Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact the winvox Data Protection team at [email protected]. winvox will respond to valid requests within 30 days. We may require identity verification before processing a data access or deletion request.

Please note that certain rights are subject to exceptions under applicable law — for example, winvox cannot delete data that we are legally required to retain for AML or gaming regulatory compliance purposes.

The winvox Platform does not contain links to third-party websites as part of its standard navigational structure. Where winvox promotional materials or communications reference third-party services (such as payment provider platforms), please be aware that those third parties operate under their own privacy policies, which winvox does not control. We encourage you to review the privacy practices of any third-party service you use in connection with your winvox account.

The winvox Platform is strictly for adults aged 21 and above. winvox does not knowingly collect personal data from individuals under the age of 21. If winvox becomes aware that an Account has been registered by a person under 21, the Account will be immediately suspended, the data reviewed in accordance with our regulatory obligations, and — where appropriate — deleted.

If you are a parent or guardian and believe that a minor has registered on the winvox Platform, please contact us immediately at [email protected].

winvox may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations or business operations. The updated policy will be published on this page with a revised "Last Updated" date. For material changes, winvox will provide notification to registered users via email or on-Platform notice where practicable.

Your continued use of the winvox Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically.

For privacy-related enquiries, data subject rights requests, or to raise a concern about how winvox handles your personal data, please contact us via:

Email: [email protected]
Response time: Within 2 business hours for general enquiries; data subject requests acknowledged within 5 business days and fulfilled within 30 days
Live Chat: Available 24/7 on the winvox Platform
Coverage: We serve users across Malaysia including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Kota Kinabalu and all other regions

If you are not satisfied with winvox's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority or the dispute resolution body designated under winvox's international gaming authority licensing framework.