we1win Privacy
Policy & Data Protection

1. Introduction

This Privacy Policy ("Policy") issued by we1win ("we", "us", "our", "the Platform") and applies to all personal data collected from individuals ("you", "your", "User "Player") who access, register upon, or otherwise interact with the we1win website atwe1win.buzz and any related subdomains, mobile interfaces, or affiliated services.

we1win is committed to protecting the privacy of all users, with particular care for our registered players across Malaysia — including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities and states nationwide. We recognise that Malaysian players trust us with sensitive personal and financial information, and we take that responsibility seriously.

This Policy describes what personal data we collect, why we collect it, how it is used, who it may be shared with, how long it is retained, and what rights you hold in relation to your data. It should be read in conjunction with our Terms & Conditions, which are incorporated by reference.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — we1win, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of we1win under a data processing agreement, such as a payment processor or identity verification provider.
• "KYC" — Know Your Customer: the process of verifying a player's identity, age, and residence in compliance with anti-money laundering regulations.
• "Cookies" — small text files stored on your device by your browser when you visit the Platform, used to maintain session state, preferences, and analytics data.
• "Sensitive Personal Data" — a subset of personal data requiring heightened protection, such as national identification numbers, financial account details, and biometric identifiers where applicable.

3. Data We Collect

we1win collects personal data across several categories, as set out in the table below. We collect only what is necessary for the purposes described in Section 5.

4. How We Collect Your Data

We collect personal data through the following channels:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account profile, you provide data to us directly.
• Automated technical collection: When you access the Platform, our servers automatically receive and log technical data such as your IP address, browser type, device specifications, and session timestamps. This data is collected via server logs and, where applicable, cookies and similar technologies.
• Third-party sources: Where permitted by law, we may receive identity verification data from licensed KYC service providers to confirm the accuracy of information you have submitted. We may also receive fraud-risk signals from payment processors in relation to transactions made on your account.
• Payment processors: When you deposit or withdraw funds using Malaysian payment methods such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong Bank, those providers share transaction confirmation data with us to reconcile your account balance.

5. Purposes of Data Processing

we1win processes personal data for the following defined purposes only. We do not use your data for purposes that are incompatible with those stated below:

1. Account creation and management: To register, authenticate, and maintain your player account, including applying account settings, managing VIP tier status, and communicating account-related updates.
2. Identity verification (KYC): To verify your age (minimum 21 years), identity, and residential address in compliance with anti-money laundering (AML) and counter-terrorism financing obligations.
3. Payment processing: To process deposits, withdrawals, and refunds in Malaysian Ringgit (MYR/RM) through your chosen payment method, and to maintain accurate financial records of all transactions.
4. Service delivery: To provide access to games, sports betting markets (including Liga Super Malaysia, EPL, UFC), live casino, and all other Platform features and Services.
5. Customer support: To investigate and respond to support queries, account disputes, technical issues, and complaints submitted via live chat or email.
6. Security and fraud prevention: To detect, investigate, and prevent fraud, account takeover, money laundering, bonus abuse, and other prohibited activities that could harm Players or the Platform.
7. Legal and regulatory compliance: To comply with applicable laws, regulatory obligations, and responses to lawful requests from governmental or regulatory authorities.
8. Platform improvement: To analyse anonymised usage patterns, diagnose technical issues, test new features, and improve the overall player experience on the Platform.
9. Marketing communications (opt-in only): To send promotional emails, bonus notifications, and relevant gaming updates to Players who have explicitly consented to receive such communications. You may withdraw this consent at any time through your account settings or by contacting our support team.

6. Legal Basis for Processing

For each category of data processing carried out by we1win, we rely on one or more of the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to upon registration — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws, including KYC/AML obligations, data retention requirements imposed by regulatory authorities, and responses to lawful court orders or regulatory notices.
• Legitimate interests: Processing carried out for our legitimate business interests where these are not overridden by your rights — including fraud prevention, security monitoring, and platform performance analysis. We conduct a balancing assessment before relying on this basis.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Data Sharing & Third-Party Disclosure

we1win does not sell, rent, or commercially transfer your personal data to third parties for their own marketing purposes. We share personal data only in the following limited circumstances, and only to the extent necessary:

• Payment service providers: To process financial transactions, we share necessary payment data with licensed Malaysian payment processors and banking partners, including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and major local banks.
• Identity verification providers: We engage third-party KYC verification specialists to assist in confirming the identity and age of players as required by our compliance obligations. These providers act as data processors under binding data processing agreements.
• Technology and infrastructure providers: Hosting, cloud infrastructure, cybersecurity, and platform development partners may have access to data stored on the Platform's systems, subject to strict contractual confidentiality and security requirements.
• Regulatory and law enforcement authorities: We will disclose personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by law, court order, or regulatory direction, or where we believe disclosure is necessary to prevent serious harm or illegal activity.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or substantially all of the Platform's assets, personal data may be transferred to the acquiring entity, subject to the same protections described in this Policy.

8. International Data Transfers

The we1win platform operates with infrastructure that may involve processing personal data in jurisdictions outside of Malaysia. Where personal data is transferred internationally, we ensure that adequate protections are in place, including:

• Transfer to jurisdictions with data protection laws deemed adequate by relevant authorities;
• Use of contractual mechanisms such as Standard Contractual Clauses or equivalent data transfer agreements;
• Binding contractual obligations on the recipient entity to maintain data protection standards equivalent to those in this Policy.

By using the Platform and providing your personal data, you acknowledge and consent to potential international transfers of your data under the safeguards described above.

9. Data Retention

we1win retains personal data for no longer than is necessary for the purposes for which it was collected or as required by applicable law. Our general retention approach is as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or rendered permanently anonymous in a manner that prevents reconstruction of the original data.

10. Cookies & Tracking Technologies

The we1win Platform uses cookies and similar tracking technologies (including local storage and session tokens) to ensure proper functionality, maintain your login session, and analyse aggregate Platform performance.

Types of cookies used by we1win:

• Essential cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without impacting core functionality.
• Functional cookies: Remember your preferences such as language settings and game display options to personalise your experience.
• Analytics cookies: Collect anonymised data on how users interact with the Platform — pages visited, session duration, error events — to help us improve performance. No individual user is identifiable from this data.

What we do not use: we1win does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the Platform. We do not participate in cross-site behavioural advertising networks.

You can manage or delete cookies through your browser settings. Note that disabling essential cookies will impair your ability to log in and use core Platform features. For instructions on managing cookies in common browsers, refer to your browser's built-in help documentation.

11. Your Data Rights

Subject to applicable law and any overiding legal obligations (such as AML retention requirements), you hold the following rights in relation to your personal data held by we1win:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. You can update most account details directly through your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict processing of your personal data in certain circumstances, such as where you contest its accuracy or object to processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request your data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests at any time. We will cease processing unless we can demonstrate compelling grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by updating your marketing preferences in your account settings or by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us using the details in Section 16. We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) calendar days, subject to identity verification requirements.

12. Data Security

we1win implements a layered approach to data security, combining technical, organisational, and procedural measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in transit: All communications between your browser or device and the Platform are secured using TLS 1.2 or higher with256-bit encryption.
• Encryption at rest: Sensitive data stored in our databases is encrypted using AES-256 encryption with hardware security module (HSM) key management.
• Access controls: Access to player personal data is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Multi-factor authentication: Administrative access to systems containing personal data requires multi-factor authentication.
• Regular security assessments: We conduct periodic vulnerability assessments and penetration testing to identify and remediate security weaknesses.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant authorities in accordance with applicable legal requirements and within mandatory notification timeframes.

While we implement robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the security of your account credentials and must notify us immediately if you suspect unauthorised access to your account.

13. Children & Minors

The we1win Platform is strictly intended for adults aged21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of our registration and KYC process.

If we become aware that personal data has been collected from an individual who is under the age of 21, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered on the Platform, please contact us using the details in Section 16.

14. Third-Party Links

The we1win Platform does not contain links to external third-party websites for advertising or commercial purposes. To the extent that any operational links to third-party services appear on the Platform (such as payment provider portals), this Privacy Policy applies only to data collected and processed by we1win directly.

Third-party services accessed via the Platform (such as your bank's FPX portal, or your Touch 'n Go eWallet interface) are governed by those providers' own privacy policies. we1win is not responsible for the privacy practices of any third-party service provider that you choose to use in connection with your account.

15. Policy Amendments

we1win reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform functionality. The "Last Updated" date at the top of this document indicates the date of the most recent revision.

Material changes — those that significantly affect your rights or our data processing obligations — will be communicated to registered players via Platform notification or by email to the address on file, with at least fourteen (14) days' notice where practicable.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement and acceptance of the updated Policy. If you do not agree to the revised Policy, you should cease using the Platform and may request account closure in accordance with ourTerms & Conditions.

16. Contact Us & Data Protection Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — please mark your email "Privacy Request" or "Data Enquiry"
• Live Chat: Available 24/7 through the Platform — select "Account & Privacy" as the subject
• FAQ: Visit our FAQ page for commonly asked questions about your account and data

We aim to acknowledge all privacy-related enquiries within five (5) business days and to provide a full response within thirty (30) calendar days. For complex requests requiring extended investigation, we will inform you of any delay and the expected resolution timeline.