Privacy Policy — win28 Online Casino & Sportsbook

1. Data Controller

1.1 win28 ("the Platform", "we", "us", "our") acts as the data controller in respect of personal data collected from players and visitors who interact with the win28 platform at win28.club. win28 operates under international gaming authority licensing and is subject to the data protection requirements of its licensing jurisdiction.

1.2 For all privacy-related correspondence, including data subject access requests, correction requests, and deletion requests, players may contact win28 via the support ticket system. The contact email address for data privacy matters is [email protected] (plain text — not a clickable link).

1.3 This Privacy Policy applies to all personal data collected through the win28 website, any mobile-optimised interface, and all associated support and communication channels operated by win28.

2. Personal Data We Collect

win28 collects the following categories of personal data in the course of providing its services:

win28 does not collect sensitive personal data such as racial or ethnic origin, political opinions, health data, or biometric data, except where expressly required by applicable licensing authority KYC mandates.

3. How We Collect Your Data

3.1 Directly from You. win28 collects personal data directly from you when you: register a win28 account; complete the KYC identity verification process; make a deposit or withdrawal; contact win28 customer support; or participate in promotions or surveys.

3.2 Automatically. When you access the win28 platform, technical and usage data is collected automatically through cookies, server logs, and platform analytics. This includes your IP address, device information, pages visited, games accessed, and session activity. This data is collected regardless of whether you are logged in to your win28 account.

3.3 From Third Parties. win28 may receive data about you from third-party sources including: identity verification service providers used for KYC processing; payment processors handling your Touch n Go, Boost, or bank transaction; fraud detection and AML screening services; and gaming regulatory authorities as required under licensing compliance obligations.

4. Purposes of Processing

win28 processes your personal data for the following purposes:

• Account Registration & Management: To create and maintain your win28 account, verify your identity, and administer your account settings and preferences.
• Service Delivery: To provide access to win28's gaming services, process wagers, credit winnings, and deliver the full range of casino, slots, and sportsbook functionality.
• Financial Transactions: To process deposits and withdrawals in MYR via approved Malaysian payment methods, verify payment instrument ownership, and maintain transaction records.
• Legal & Regulatory Compliance: To fulfil win28's obligations under its international gaming authority licensing, including KYC identity verification, AML transaction monitoring, responsible gaming age verification, and regulatory reporting.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and prohibited conduct as defined in win28's Terms & Conditions.
• Responsible Gaming: To administer player protection tools including deposit limits, self-exclusion periods, and problem gambling detection systems in compliance with licensing authority requirements.
• Customer Support: To manage and respond to support requests, complaints, and dispute resolutions submitted by win28 players.
• Platform Improvement: To analyse aggregated usage data and identify opportunities to improve platform performance, game selection, and user experience.
• Marketing Communications: To send promotional offers and platform updates to players who have opted in to marketing communications. Players may opt out at any time via account settings or by contacting support.

5. Legal Basis for Processing

win28 processes your personal data on the following legal bases:

• Contract Performance: Processing necessary to perform the contract between win28 and the Player, including account operation, game access, and payment processing.
• Legal Obligation: Processing required to comply with win28's obligations under applicable gaming licensing requirements, including KYC, AML, responsible gaming mandates, and regulatory reporting.
• Legitimate Interests: Processing for win28's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by the Player's rights and interests.
• Consent: Processing for purposes such as marketing communications, where win28 relies on the Player's explicit opt-in consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Third-Party Disclosure

6.1 win28 does not sell your personal data to third parties. win28 may share your data with the following categories of recipient, strictly for the purposes described in this Policy:

• Identity Verification Providers: Third-party KYC services used to verify Player identity documents in compliance with licensing obligations.
• Payment Processors: Financial service providers facilitating MYR transactions via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and USDT channels.
• Fraud & AML Service Providers: Screening services used to detect and prevent money laundering, match-fixing, and other prohibited financial activity.
• Game Content Providers: Licensed game studios may receive anonymised session and technical data to facilitate game delivery and audit compliance. Personal identifiers are not shared with game studios.
• Regulatory Authorities: Win28 will disclose personal data to its licensing authority or competent law enforcement bodies where required to do so by law, court order, or regulatory direction.
• Cloud & Infrastructure Providers: Third-party hosting and infrastructure providers who process data on win28's behalf under data processing agreements that bind them to equivalent data protection standards.

6.2 All third parties with whom win28 shares personal data are contractually obligated to process such data only for the specified purpose and to apply appropriate technical and organisational security measures.

7. Data Retention

7.1 win28 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and licensing obligations.

7.2 Account and transaction records, including KYC documents and financial data, are retained for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements under win28's licensing framework.

7.3 Marketing communications data is retained until a Player withdraws their marketing consent, after which it is deleted or anonymised within thirty (30) days.

7.4 Technical and usage data collected via server logs and platform analytics is retained in identifiable form for up to twelve (12) months and thereafter retained in aggregated, anonymised form for statistical purposes without retention limits.

7.5 Following the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data sanitisation methods.

8. Cookies & Tracking Technologies

8.1 win28 uses cookies and similar tracking technologies to provide, maintain, and improve its platform services. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for core platform functionality including session authentication, login state persistence, and security features. These cookies cannot be disabled without impairing platform functionality.
• Performance Cookies: Collect anonymised data about how players interact with the win28 platform, including pages visited, game categories accessed, and session duration. Used to identify performance issues and improve platform responsiveness.
• Functional Cookies: Remember Player preferences such as display language, currency settings, and previously played game categories to improve the personalisation of the win28 experience.
• Analytics Cookies: Used to compile aggregate statistical information about platform usage. Data is anonymised before analysis and not linked to individual Player accounts.

8.2 Players may manage cookie preferences through their browser settings. Disabling strictly necessary cookies will impair login functionality and access to the win28 platform. Disabling other cookie categories will not prevent platform access but may degrade personalisation features.

9. Your Data Protection Rights

Subject to applicable law and win28's licensing obligations, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data win28 holds about you. win28 will respond to access requests within thirty (30) days of receipt.
• Right of Rectification: You may request correction of inaccurate or incomplete personal data. Identity data corrections require supporting documentation consistent with KYC requirements.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the original processing purpose, subject to win28's legal retention obligations. Data subject to mandatory licensing retention periods cannot be deleted prior to expiry of those periods.
• Right to Restriction: You may request that win28 restrict processing of your personal data in certain circumstances, such as where the accuracy of the data is contested.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to win28, where processing is based on contract or consent.
• Right to Object: You may object to processing of your personal data where win28 relies on legitimate interests as the legal basis, and to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time via account settings or by contacting support. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, contact win28 via the support ticket system with your registered email address and a description of your request. win28 may request identity verification before processing data subject rights requests.

10. Security Measures

10.1 win28 implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction, including:

• 256-bit TLS/SSL encryption for all data in transit between client devices and win28 servers;
• Encryption at rest for sensitive data fields including identity documents and payment identifiers;
• Salted cryptographic hashing of account passwords — win28 staff have no access to plaintext passwords;
• Role-based access controls limiting staff access to personal data to the minimum necessary for their specific function;
• Regular third-party security audits and penetration testing as required under win28's licensing framework;
• Intrusion detection systems and real-time monitoring of platform access logs for anomalous activity.

10.2 Notwithstanding the above, no internet transmission or electronic storage method is completely secure. win28 cannot guarantee absolute security of data transmitted over the internet. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their win28 account.

11. Children's Privacy

11.1 win28 strictly enforces a minimum age requirement of 21 years. The win28 platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21.

11.2 Where win28 discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21, the associated account will be immediately closed, funds returned where practicable, and the relevant personal data deleted in accordance with applicable licensing requirements.

11.3 If you believe that a minor has registered a win28 account, please contact win28 customer support immediately with the relevant account details.

12. Policy Updates

12.1 win28 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, licensing requirements, or data processing practices. Material changes will be communicated to registered Players via their registered email address at least fourteen (14) days before the revised Policy takes effect.

12.2 The current version of this Privacy Policy, with its effective date, is always available at win28.club/privacy-policy. Continued use of the win28 platform following the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.

This Privacy Policy was last reviewed and updated in June 2026. For privacy enquiries, contact win28 at [email protected] (plain text — not a clickable link). See also the Terms & Conditions and Responsible Gaming pages.