Winner33 Privacy Policy – Malaysian Member Data Protection

1Introduction & Policy Scope

Winner33 is an online entertainment and betting platform operating under a valid international licence, serving users in Malaysia through the winner33.asia website and the Winner33 mobile app. In the course of operating the platform, Winner33 needs to collect and process certain personal information from our members and users.

This Privacy Policy explains:

• The types of personal data we collect from you;
• How and why we collect that data;
• The purposes for which we use your data;
• The parties we may share your data with (and under what circumstances);
• The steps we take to protect your data;
• Your rights regarding your personal data and how to exercise them.

2Types of Personal Data We Collect

Winner33 collects various types of personal data depending on the nature of your interaction with our platform. The table below outlines the categories of data collected along with specific examples:

3How Personal Data Is Collected

Winner33 collects members' personal data through several key channels:

• Account registration: When you register a new account with Winner33, you directly provide us with your basic identity and contact information. This information is required to establish a valid and secure account;
• Platform usage: When you log in and use the platform — making deposits via DuitNow or Touch 'n Go eWallet, playing slots, betting on EPL or Malaysian Super League football matches, or playing Live Casino blackjack or baccarat — our systems automatically record your activity and related technical data;
• Identity verification process (KYC): For first-time withdrawals or withdrawals exceeding a certain threshold, Winner33 may request identity verification documents such as a copy of your MyKad. These documents are processed solely for verification purposes and stored securely;
• Communications with support: When you contact the Winner33 support team via live chat or email, the content of that communication is recorded for complaint resolution and service quality improvement purposes;
• Cookies and web technologies: Your web browser automatically sends technical information to Winner33's servers as you browse our site. Cookies and similar technologies are also used to remember your preferences and analyse platform usage;
• Third-party sources: In certain cases, Winner33 may receive additional information about you from payment service providers (such as transaction verification details from DuitNow or FPX) or from recognised identity verification databases.

4How We Use Your Personal Data

Winner33 uses the personal data we collect for legitimate and specific purposes. We do not process your data for any other purpose without a lawful basis or your consent. The primary purposes are as follows:

• Account operations: Creating, verifying, and managing your member account, processing logins, and ensuring that only you have access to your account;
• Transaction processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX; processing withdrawals to your Malaysian bank account; and recording transaction history for your reference;
• Service delivery: Providing access to all Winner33 games — virtual sports, e-sports, badminton, blackjack, slots, lottery — and ensuring a smooth, fair gaming experience;
• Security and fraud prevention: Detecting and preventing fraudulent activity, money laundering, multi-account use, and any other breach of our terms that could compromise the security of the platform or other members;
• Legal compliance: Fulfilling applicable legal and regulatory obligations, including KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements;
• Service communications: Sending important account notifications such as deposit confirmations, withdrawal alerts, security updates, and changes to our terms;
• Promotions and marketing: Sending information about relevant Winner33 promotions, bonuses, and campaigns — only if you have opted in to receive marketing communications;
• Platform improvements: Analysing aggregated usage patterns to understand how members use the platform and to drive continuous improvements to the interface, performance, and overall user experience;
• Customer support: Handling member enquiries, complaints, and requests effectively by using past interaction records as context.

5Data Sharing with Third Parties

Winner33 does not sell or trade members' personal data to any third party. However, in the course of operating the platform, there are limited situations where Winner33 needs to share data with certain parties:

• Payment gateway providers: Required transaction information is shared with payment service providers such as DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay processors to facilitate transaction completion. These providers are subject to their own privacy policies and security standards;
• Game software providers: The minimum technical details required to deliver the gaming experience may be processed by third-party software providers that supply live casino, slots, and virtual sports content to Winner33. All such providers are bound by strict data processing agreements;
• Regulatory and enforcement authorities: Winner33 will disclose member data to the relevant authorities when required by law or a valid court order, or where there is reasonable cause to prevent or investigate criminal activity;
• IT and security service providers: Third-party companies that assist Winner33 with technical operations, security audits, and infrastructure maintenance may have limited access to personal data within the scope of their work, and are bound by strict confidentiality agreements.

6Personal Data Security

Winner33 continually invests in cybersecurity infrastructure to ensure members' personal data remains protected at all times. The key security measures we have in place include:

• Transit encryption: All communications between your device and Winner33's servers are encrypted using TLS 1.3 with 256-bit SSL certificates. This ensures that data in transit — including login credentials and transaction details — cannot be intercepted during transmission;
• Encryption at rest: Sensitive data stored in Winner33's databases, including personal information and financial records, is encrypted at rest using AES-256 standards;
• Role-based access control: Only staff with a legitimate operational need are granted access to member data, and that access is restricted to their specific role. No single staff member has full access to the entire member records database;
• Two-factor authentication (2FA): Winner33 offers 2FA for all member accounts to add an extra layer of protection against unauthorised access, particularly for sensitive actions such as withdrawals;
• 24/7 threat monitoring: Winner33's cybersecurity team continuously monitors the platform for suspicious activity using automated threat detection systems and manual reviews;
• Periodic audits: Winner33 undergoes independent security audits on a regular basis to identify and address potential vulnerabilities before they can be exploited;
• Staff training: All Winner33 staff with access to member data undergo regular data protection and information security training.

Although Winner33 takes all reasonable steps to protect your data, no security system is 100% impenetrable. We encourage members to also take their own protective measures, including using a strong and unique password for their Winner33 account, enabling 2FA, and never sharing their login credentials with anyone.

7Data Retention Period

Winner33 retains members' personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or to comply with legal requirements. The following is a general guide to retention periods:

• Active account data: For as long as your account is active and you continue to use the Winner33 platform, your data will be retained to support ongoing use and customer service;
• Data after account closure: Upon account closure, Winner33 will retain basic transaction and identity records for the minimum period required by applicable legal and regulatory obligations (typically 5–7 years) for audit, dispute resolution, and compliance purposes;
• Technical log data: Server logs and technical data are typically retained for 90 days before being automatically deleted or anonymised;
• Communication records: Customer support communication records are retained for 2 years following case resolution, for reference in the event of any subsequent disputes;
• Marketing data: Information used for marketing communications will be deleted within 30 days of you withdrawing your consent to receive marketing communications.

8Cookies & Tracking Technologies

Winner33 uses cookies and similar web technologies to enhance your experience on our platform. Below is an explanation of the types of cookies we use:

• Required session cookies: These cookies are essential for the platform's core functions — including maintaining your login session, remembering form details during a session, and ensuring session security. They cannot be disabled without affecting platform functionality;
• Preference cookies: These cookies store your preferences such as selected language, display settings, and game preferences, so you don't have to reconfigure them each time you log in;
• Analytics cookies: Winner33 uses analytics cookies to understand aggregate platform usage patterns — which pages are visited most, how long members spend on the platform, and where technical issues may arise. This data is used to improve the platform and does not identify individuals specifically;
• Security cookies: These cookies help Winner33 detect suspicious activity, such as login attempts from unusual locations or abnormal usage patterns that may indicate a compromised account.

You can manage your cookie preferences through your web browser settings. Please note, however, that disabling certain cookies may affect the functionality of the Winner33 platform. Winner33 does not use third-party advertising cookies that track your activity across other websites.

9Your Personal Data Rights

As a Winner33 member and Malaysian citizen, you have the following rights regarding your personal data held by Winner33:

To exercise any of the above rights, you may submit a request through your Winner33 account settings or contact our support team via live chat. Winner33 will process your request within 14 business days and provide a written response detailing the action taken. In complex cases, this period may be extended to 30 days, with prior notification to you.

10Cross-Border Data Transfers

As a platform operating under an international licence, parts of Winner33's technical infrastructure may be located outside Malaysia. This means your personal data may be transferred, stored, or processed in countries other than Malaysia as part of the platform's technical operations.

Winner33 ensures that all cross-border data transfers are carried out with adequate safeguards in place, including:

• Transferring data only to countries or organisations that offer equivalent or higher levels of data protection;
• Binding all data recipients with data processing agreements that include adequate technical and organisational safeguards;
• Using recognised data transfer mechanisms such as standard contractual clauses where applicable;
• Ensuring that all transferred data is encrypted in transit using robust security protocols.

11Children's & Minors' Privacy

The Winner33 platform is intended for users aged 18 and above only, in line with applicable betting regulations and child protection laws. Winner33 does not knowingly collect or process personal data from individuals under the age of 18.

Measures Winner33 takes to prevent underage access include:

• Requiring age verification during new account registration;
• Conducting additional age verification checks for financial transactions that exceed certain thresholds;
• Using pattern-based detection tools to identify potentially underage users;
• Immediately suspending and deleting accounts suspected of belonging to underage individuals.

If Winner33 discovers that personal data of a minor has been collected unintentionally, we will take immediate action to delete that data and close the associated account. Parents or guardians who believe their child may have registered a Winner33 account are encouraged to contact us immediately at support@winner33.asia.

12Contact Us & Policy Amendments

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by Winner33, please contact us through the following channels:

• Email: support@winner33.asia
• Live chat: Available 24/7 via the Winner33 platform
• Response time: Data privacy enquiries will be responded to within 3 business days

Winner33 reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or platform operations. When material changes are made, we will notify members via in-account notifications and update the "Last Updated" date at the top of this document.

Your continued use of the Winner33 platform after any Privacy Policy changes have been communicated will be taken as acceptance of the updated version. If you do not agree with the changes, you have the right to close your account and request deletion of your data in accordance with the rights set out in Section 9.