Privacy Policy 18win — Member Personal Data Protection

1Information We Collect

18win collects your personal information across several key categories depending on how you interact with our platform. We only collect information that is strictly necessary to deliver the best service to you.

Information you provide directly:

• Registration information: Full name, national identification number (MyKad), date of birth, mobile number, email address, and encrypted password when you open a new account.
• Identity verification information (KYC): Copies of identity documents, recent bank statements, or utility bills required to meet legal compliance obligations.
• Payment information: Bank account details and digital wallet account numbers (DuitNow, Touch 'n Go, Boost) used for deposits and withdrawals. We do not directly store credit or debit card numbers.
• Communication with customer support: Live chat records, emails, and any communications you send to the 18win support team.

Automatically collected information:

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage data: Pages you visit, games you play, session duration, buttons you click, and navigation patterns within the platform.
• Transaction data: Complete history of deposits, withdrawals, wagering, wins, and bonuses for every gaming session.
• Location data: General location information based on your IP address to ensure you are accessing the platform from a permitted region.

2How We Use Your Information

Every piece of information we collect has a clear and lawful purpose. 18win uses your personal data solely for the following purposes and for no other purpose without your consent:

• Account management: Creating, verifying, and maintaining your member account, including a secure login process and identity verification.
• Transaction processing: Processing all deposit and withdrawal requests promptly and securely through the payment methods you have registered.
• Legal Compliance: Meeting the requirements of the Personal Data Protection Act 2010 (PDPA), anti-money laundering (AML) regulations, and Know Your Customer (KYC) requirements as prescribed.
• Platform security: Detecting and preventing fraud, unauthorised access, suspicious activity, and bonus system abuse.
• Customer support: Providing effective assistance when you reach the 18win support team via live chat or email.
• Service improvement: Analysing usage patterns in aggregate to improve platform design, speed, and overall experience.
• Relevant communications: Sending important account-related notifications, selected promotions, and security updates. You may unsubscribe from marketing communications at any time.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and recommend appropriate control tools.

3Sharing Information with Third Parties

18win does not sell, rent, or trade members' personal data to any third party for commercial purposes. However, in certain situations, we may share necessary information with the following parties:

• Payment service providers: Financial institutions, payment processors, and digital wallet providers required to carry out your financial transactions. They are bound by strict confidentiality agreements.
• Game providers: Gaming technology companies (game providers) that supply slot, Live Casino, and other game content may receive technical data required for game functionality, but not your personally identifiable information.
• Legal authorities: Law enforcement agencies, regulatory bodies, or courts issuing a valid order requiring the disclosure of information. We only disclose information that is specifically ordered.
• Audit and compliance: Independent auditors and certification bodies that verify our platform's security compliance and fairness. They are subject to binding confidentiality agreements.
• Business transfers: In the event of a merger, acquisition, or sale of 18win assets, member data may be transferred as part of that transaction. You will be notified before your data becomes subject to a different privacy policy.

4Cookies and Tracking Technologies

18win uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

• Essential cookies: Required for core platform functions such as login sessions, language preferences, and security settings. These cookies cannot be disabled as they are critical to platform operations.
• Performance cookies: Collecting information on how you use the platform — most visited pages, time spent, and any error messages encountered. This data helps us improve the platform.
• Functional cookies: Saving your preferences such as username, display theme, and settings you have configured so you do not need to reconfigure them each time you log in.
• Analytics cookies: Helping us understand how users interact with the platform in aggregate and anonymised form. This data is used solely for internal product development purposes.

You can manage and delete cookies through your browser settings at any time. However, disabling essential cookies may affect certain functions of the 18win platform.

5Data Security

Protecting your personal data is 18win's highest priority. We continuously invest in security infrastructure and apply the latest industry standards to keep your data safe at all times.

• 256-bit SSL Encryption: All communications between your device and our servers are encrypted with the highest-grade TLS/SSL protocols, ensuring your data remains secure in transit.
• Encryption of data at rest: Sensitive data stored in our databases, including passwords and financial information, is encrypted using modern encryption algorithms that cannot be decrypted without the correct key.
• Regular security testing: Our security team conducts regular penetration testing and vulnerability audits to identify and address any weaknesses before they can be exploited.
• Multi-layer access control: Every internal system is protected by multi-factor authentication, comprehensive audit logs, and separation of duties, ensuring no single individual has full access to all data.
• Incident response plan: 18win has tested incident response procedures in place to address any data breaches promptly. Should an incident affecting your data occur, we will notify you within 72 hours.

6Data Storage and Transfer

18win retains your personal data for as long as your account is active or as needed to provide services to you. We also retain data for a defined period after account closure to meet legal, tax, and audit requirements.

• Active retention period: Active account data is retained for as long as you use the 18win platform and for a minimum of 5 years after account closure to meet anti-money laundering legal requirements.
• Transaction data: All financial transaction records are retained for a minimum of 7 years in accordance with Malaysia's financial regulatory requirements.
• Security logs: Access logs and security activity records are retained for 2 years for incident investigation and security audit purposes.
• Storage location: Member data is stored in data centers located in the Asia region with comprehensive physical and digital protection. Any cross-border data transfers are carried out with contractual safeguards that ensure an equivalent level of protection.

Once the retention period expires or you request data deletion (subject to legal requirements), 18win will securely delete or anonymize your data using industry-standard methods.

7Your Rights as a Member

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection principles, you have the following rights regarding your personal data at 18win:

• Right of access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to rectification: If any information we hold about you is inaccurate or incomplete, you have the right to request an immediate correction.
• Right to erasure: Under certain circumstances, you have the right to request the deletion of your personal data, subject to any active legal retention requirements.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time without providing any reason.
• Right to data portability: You may request your personal data in a machine-readable format for transfer to another party.
• Right to withdraw consent: You may withdraw your consent to certain data processing at any time, though this may affect our ability to provide the full range of services.

To exercise any of the above rights, contact the 18win customer support team via live chat, available 24/7. We will process your request within 14 business days.

8Children's Data

The 18win platform is strictly for individuals aged 18 and above. We do not intentionally collect or process personal data from minors.

• All account registrations require age verification through a valid identity document.
• Should we discover that personal data has been collected from a minor, we will immediately delete that information and close the relevant account.
• If you believe your child or a minor you know has registered on our platform, please contact our support team immediately for prompt action.

9Third-Party Links

The 18win platform may contain links or integrations with third-party services such as game providers and payment processors. This Privacy Policy applies solely to the 18win platform.

• Third-party websites or services you access through our platform have their own privacy policies that are independent of our control.
• 18win is not responsible for the privacy practices or content of any third-party websites.
• We encourage you to read and understand the privacy policy of each third-party platform you use alongside 18win services.

10Changes to This Privacy Policy

18win reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, new technologies, legal requirements, or other relevant factors.

• Change notification: Whenever significant changes are made, we will notify you via your registered email or an in-platform notification at least 7 days before the changes take effect.
• Effective date: The effective date of the latest version will always be displayed at the top of this page for your reference.
• Implied acceptance: Your continued use of the 18win platform after the effective date of any changes constitutes your acceptance of the latest version of this Privacy Policy.
• Archive of older versions: Previous versions of this Privacy Policy are available upon request from our customer support team for reference.

11Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the 18win Data Protection Officer (DPO) team is here to help.

• Live chat: Click the chat icon at the bottom corner of our platform to connect directly with the support team — available 24 hours a day, 7 days a week.
• Support email: Send your enquiry to [email protected] and we will respond within 1–2 business days.
• Response time: Requests relating to personal data rights will be processed within 14 business days from the date of receipt of a complete request.