winmy20 Privacy Policy

1. Introduction

winmy20 ("we", "us", "our") operates the online casino and sports betting platform accessible at winmy20.co (the "Platform"). This Privacy Policy describes how winmy20 collects, uses, stores, shares, and protects the personal data of Members and visitors who access the Platform from Malaysia and other jurisdictions.

By registering an account or using the winmy20 Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform immediately.

This Policy should be read alongside the winmy20 Terms & Conditions, which govern the overall relationship between winmy20 and its Members.

2. Data Controller

winmy20 is the data controller responsible for personal data processed in connection with the Platform. For all privacy-related enquiries, Members may contact winmy20 at the contact details set out in Section 15 of this Policy.

Where winmy20 engages third-party service providers who process personal data on our behalf, those parties act as data processors and are bound by data processing agreements that require them to handle personal data only as directed by winmy20 and in accordance with applicable data protection law.

3. Data We Collect

winmy20 collects the following categories of personal data from Members and Platform visitors:

• Identity Data: Full legal name, date of birth, nationality, government-issued identification number (e.g., MyKad number for Malaysian nationals), and copies of identity documents submitted during KYC verification.
• Contact Data: Email address, mobile phone number, and residential address (including postcode and state for Malaysian members in locations such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Kota Kinabalu).
• Account Data: Username, encrypted password hash, account registration date, account status, and communication preferences.
• Financial Data: Payment method details (e.g., Touch n Go eWallet account reference, Boost wallet reference, bank account details for Maybank, CIMB, Public Bank, or GrabPay), deposit and withdrawal transaction records, MYR balance history, and bonus transaction logs.
• Gaming Data: Game session records, wager history, win/loss records, responsible gaming tool settings (deposit limits, session alerts, self-exclusion status), and account activity timestamps.
• Technical Data: IP address, device type and operating system, browser type and version, session duration, page interaction data, and approximate geolocation derived from IP address.
• Communications Data: Records of communications between you and winmy20 support, including live chat transcripts, email correspondence, and support ticket history.

4. How We Collect Data

winmy20 collects personal data through the following means:

• Direct submission: Data you provide during account registration, KYC verification, payment method setup, or when contacting winmy20 support.
• Automated collection: Data collected automatically during your use of the Platform, including through cookies, server logs, and analytics tools (see Section 10).
• Third-party sources: Identity and fraud-screening data from KYC verification service providers; payment status confirmations from payment processors including Touch n Go, Boost, GrabPay, Maybank, and CIMB.

5. How We Use Your Data

winmy20 uses your personal data for the following purposes:

• To create, verify, and manage your winmy20 Member account;
• To process MYR deposits, withdrawals, and bonus credits in compliance with financial controls;
• To conduct identity verification and KYC checks as required by international gaming authority licensing conditions;
• To detect, investigate, and prevent fraud, money laundering, collusion, and other prohibited activities;
• To enforce the winmy20 Terms & Conditions and responsible gaming policies, including age verification and self-exclusion processing;
• To personalise your Platform experience and deliver relevant promotional content where you have consented to receive marketing communications;
• To conduct anonymised analytics that inform Platform improvements and game library decisions;
• To comply with applicable regulatory and legal obligations.

6. Legal Bases for Processing

winmy20 processes personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the Platform services under the Member agreement (e.g., account management, payment processing).
• Legal obligation: Processing required to comply with KYC, AML, and licensing obligations under the international gaming authority framework applicable to winmy20's operating licence.
• Legitimate interests: Processing for fraud prevention, platform security, and product analytics, where those interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where your specific consent has been obtained and can be withdrawn at any time.

7. Data Sharing

winmy20 does not sell, rent, or trade your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary:

• KYC and identity verification providers: Third-party services engaged to verify government-issued identity documents and screen against AML watchlists as required by our licensing conditions.
• Payment processors: Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, and other payment infrastructure partners who process deposit and withdrawal transactions on our behalf.
• Game technology providers: Casino game studios and sportsbook platform providers who operate the games and markets available on winmy20, to the extent necessary to record and settle game transactions.
• Regulatory authorities: International gaming authority regulators and law enforcement bodies where disclosure is required by applicable law or our licensing obligations.
• IT and security service providers: Cloud infrastructure, cybersecurity, and fraud detection service providers who process data on our behalf under data processing agreements.

8. International Data Transfers

Some of the third-party service providers engaged by winmy20 operate outside Malaysia. Where personal data is transferred internationally, winmy20 ensures that appropriate safeguards are in place — including contractual clauses that require recipient parties to protect your personal data to standards equivalent to those applied by winmy20 — before any such transfer takes place.

9. Data Retention

winmy20 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or our international gaming authority licensing obligations. In general:

• Active Member account data is retained for the duration of the Member relationship and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction and gaming activity records are retained for a minimum of five (5) years following each transaction, as required under our licensing framework.
• Communication records are retained for a minimum of three (3) years following the relevant communication.
• Technical log data is retained for periods consistent with fraud detection and security purposes, typically not exceeding two (2) years.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with winmy20's data disposal procedures.

10. Cookies & Tracking Technologies

winmy20 uses the following categories of cookies and tracking technologies on the Platform:

• Strictly necessary cookies: Required for the Platform to function — including session management, login state, and security tokens. These cannot be disabled.
• Functional cookies: Used to remember your preferences, language settings, and responsible gaming configurations between sessions.
• Analytics cookies: Used to collect aggregated, anonymised data about how Members use the Platform — such as most-visited sections and session duration — to inform product improvements. No individual Member is identified in analytics reports.
• Fraud-prevention cookies: Used to detect and prevent fraudulent activity, automated access, and account takeover attempts.

winmy20 does not use third-party advertising cookies or retargeting pixels. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may prevent certain Platform features from functioning correctly.

11. Your Data Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by winmy20:

• Right of access: To request a copy of the personal data winmy20 holds about you.
• Right of rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure: To request deletion of your personal data, subject to retention obligations under our licensing framework.
• Right to restrict processing: To request that we limit how we use your personal data in certain circumstances.
• Right to data portability: To receive your personal data in a structured, machine-readable format where processing is based on your consent or a contract.
• Right to object: To object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: To withdraw any consent you have previously given at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact winmy20 at the details in Section 15. We will respond to valid requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two (2) months, with notification provided.

12. Children and Minors

winmy20 is strictly for adults aged 21 and above. We do not knowingly collect personal data from persons under 21 years of age. If we become aware that personal data has been collected from an underage individual, that data will be deleted immediately, the associated account will be closed, and any deposited funds will be returned to the originating payment method following verification. If you believe a person under 21 has registered on winmy20, please contact our support team immediately.

13. Security Measures

winmy20 implements technical and organisational security measures commensurate with the sensitivity of the personal data we process. These include 256-bit SSL encryption for all data in transit, encryption at rest for sensitive financial and identity data, role-based access controls limiting staff access to personal data on a need-to-know basis, regular security audits and penetration testing of Platform infrastructure, and incident response procedures for managing potential data breaches. In the event of a data breach that poses a risk to Members' rights and freedoms, winmy20 will notify affected Members and relevant authorities within the timeframes required by applicable law.

14. Changes to This Policy

winmy20 reserves the right to update this Privacy Policy at any time. Updated versions will be published on the Platform with a revised Effective Date. For material changes that significantly affect how we use your personal data, we will provide advance notice via your registered email address where technically practicable. Continued use of the Platform following the publication of an updated Privacy Policy constitutes acceptance of those changes.

15. Contact Us

For all privacy-related enquiries, data subject access requests, or complaints, please contact winmy20 at:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through the winmy20 Platform after login

winmy20 will acknowledge privacy-related correspondence within five (5) business days and provide a substantive response within the timeframes specified in Section 11 above.