Privacy Policy 18win – Personal Data Protection

18win ("we", "our platform") is committed to protecting the privacy of every user who uses our services. This Privacy Policy applies to all users who register, browse, or interact with the 18win platform via our website, mobile app, or any digital channel we operate.

This document is drafted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection standards. We believe every user has the right to know exactly how their data is used — not just through difficult legal language, but clearly and simply.

If you are under 18 years of age, you are not permitted to use the 18win platform and we will not knowingly collect data from you. Should we discover that a minor's data has been collected without our knowledge, it will be deleted immediately.

We collect your personal data through several methods — either directly from you during registration, or automatically through your use of the platform. Below are the main categories of data we collect:

The data we collect is used responsibly and only for legitimate purposes. The following are the primary uses of your data on the 18win platform:

Account Operations and Services

• Creating and managing your user account, including secure registration and login processes.
• Processing fund deposits and withdrawals through your chosen payment method.
• Sending important account-related notifications such as transaction confirmations, security alerts, and policy updates.
• Providing effective customer support when you reach out to our team.

Legal Compliance and Security

• Performing KYC (Know Your Customer) checks to verify user identities in accordance with legal requirements.
• Monitoring platform activity to detect and prevent fraud, money laundering, and other illegal activities.
• Complying with lawful requests from government authorities or competent regulatory bodies.

User Experience Improvements

• Analyzing usage patterns to improve the platform's design, performance, and functionality.
• Personalizing content, promotions, and game recommendations that are more relevant to your interests.
• Conducting internal research to better understand the needs of Malaysian users and improve our services.

18win does not sell, rent, or disclose your personal data to third parties for marketing or commercial purposes without your explicit consent. However, there are limited situations where data sharing is necessary and lawful:

• Payment Processors: Transaction information is shared with payment providers such as FPX, DuitNow, Touch 'n Go, and GrabPay solely for the purpose of processing your financial transactions.
• Technical Service Providers: Server hosting providers, analytics services, and customer support tools that help us operate the platform — all bound by strict confidentiality agreements.
• Regulatory and Law Enforcement Bodies: When required by law or a valid court order, we will disclose the necessary information to the relevant authorities.
• Licensed Game Operators: The minimum data required to verify gaming eligibility is shared with licensed game providers integrated within our platform.

All third parties that receive your data are bound by strict data protection obligations and are prohibited from using that information for any purpose other than those specified in the service agreement with 18win.

The security of your personal data is a responsibility we take very seriously. 18win implements multiple layers of technical and organizational protection to keep your data safe at all times:

• 256-bit SSL Encryption used for all communications between your device and 18win's servers, ensuring that transmitted data cannot be intercepted by unauthorized parties.
• Data encryption at rest (at-rest encryption) protecting all data stored in our databases from unauthorized access.
• Two-factor authentication (2FA) available for all user accounts, and we encourage all members to enable it for added security.
• 24/7 security monitoring by our information security team to detect and respond to any threats or suspicious activity in real time.
• Penetration testing conducted periodically by independent third-party security experts to identify and address any system vulnerabilities.
• Strict internal access controls ensuring that only authorized personnel can access user data, with every access logged for audit purposes.

Under Malaysia's Personal Data Protection Act 2010 and internationally recognised data protection principles, you have the following rights regarding your personal data that we hold:

To exercise any of the rights above, contact our privacy team via email at [email protected] with the subject line "Privacy Rights Request". We will process your request within 30 business days.

The 18win platform uses cookies and similar tracking technologies to enhance your user experience and enable key platform functions to operate smoothly.

Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login authentication, session security, and language preferences. These cookies cannot be disabled.
• Performance Cookies: Collecting information about how you use the platform to help us identify issues and improve performance. All data is collected anonymously.
• Functional Cookies: Saving your preferences such as username, display settings, and preferred language to deliver a more personalized experience.
• Analytics Cookies: Used by trusted third-party analytics tools to understand traffic patterns and platform usage in aggregate, anonymised form.

We do not retain your personal data longer than necessary for the purposes stated in this privacy policy, or as required by applicable Malaysian law.

• Active account data: Retained for the duration your account is active plus 7 years after account closure, in line with financial compliance and legal requirements.
• Transaction records: Retained for 7 years in accordance with Malaysia's Anti-Money Laundering Act and financial regulations.
• Security and access logs: Retained for 90 days for security incident investigation purposes if an incident occurs.
• Marketing and communications data: Retained until you withdraw consent or request deletion.
• KYC Documents: Retained for 5 years after the business relationship ends, in accordance with anti-money laundering legal requirements.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to you.

In operating a global platform, your personal data may be processed or stored on servers located outside Malaysia. When this occurs, 18win ensures that such data transfers are protected by measures equivalent to or exceeding the protections provided under Malaysian law.

• All cross-border data transfers are conducted under data processing agreements that comply with international protection standards.
• Countries or jurisdictions that receive your data must have an adequate level of data protection or be bound by equivalent data protection contractual obligations.
• Sensitive financial data is always processed through encrypted channels and fully protected regardless of processing location.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the 18win privacy team is here to help.

You may reach us via:

• Privacy Email: [email protected] — use the subject line "Privacy Inquiry" to be prioritized.
• Live Chat: Available on the 18win platform 24 hours a day, 7 days a week.
• FAQ Page: Answers to common privacy questions can be found at our FAQ page.

We are committed to responding to all privacy-related inquiries within the stated timeframe. 5 business days. For more complex data rights requests, we will notify you within 3 business days regarding the timeframe required to fulfil the request.

This Privacy Policy may be updated from time to time to reflect changes in our privacy practices or legal requirements. Any significant changes will be communicated to you via email or in-platform notification at least 14 days before they take effect.