Privacy Policy we1win — Our Commitment to Protecting Your Data

We1win is an online entertainment platform operating in Malaysia, offering a wide range of digital games to registered members. We understand that your trust is our most valuable asset, and a large part of that trust depends on how responsibly we manage your personal information.

This Privacy Policy applies to all services offered through the we1win.plus website, our mobile app, and any official communication channels we operate. This document outlines the types of personal data we collect, the purposes for which it is used, how long it is retained, and the rights you hold as the data owner.

We1win acts as the data controller for all personal information you provide to us. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international standards for personal data protection. In the event of any conflict between the Bahasa Malaysia version and other translations of this document, the Bahasa Malaysia version shall prevail.

We1win only collects data that is genuinely necessary to deliver quality and secure services to you. Below are the categories of data we collect and their purposes:

We do not collect sensitive data such as health information, religious beliefs, political views, or biometric data unless specifically required for legal compliance purposes mandated by Malaysian authorities. In such cases, you will be informed in advance.

The personal data we collect is used responsibly and limited strictly to legitimate purposes. We do not use your data for any purpose not stated in this document without first obtaining your renewed consent.

• Account Management: Creating, verifying, and maintaining your member account so you can seamlessly access all platform features.
• Transaction Processing: Processing deposits, withdrawals, and all other financial transactions securely and accurately through your chosen payment method.
• Legal Compliance: Meeting legal compliance obligations including anti-money laundering (AML) requirements and KYC procedures as mandated by Malaysian law.
• Platform Security: Detecting and preventing fraud, unauthorised access, system abuse, and other activities that could compromise the security of the platform or other members.
• Service Communications: Sending account-related notifications, service updates, transaction alerts, and other important information relevant to your use of the platform.
• Personalised Experience: Providing game recommendations, relevant promotions, and tailored content based on your usage habits — all to enhance your gaming experience.
• Responsible Gambling: Monitoring gameplay patterns to identify early signs of problem gambling and offering appropriate support or control tools to members who need them.
• Service Improvement: Analysing usage data in aggregate and anonymised form to understand member needs and continuously improve our platform features.

The legal bases we rely on to process your data include the performance of a contract (member agreement), legal obligations, our legitimate interests as a platform operator, and in certain cases, your explicit consent.

We1win does not sell or trade your personal data to any third party for profit or marketing purposes. However, in the course of operating our platform, there are limited situations where necessary data sharing may occur:

• Payment Service Providers: Transaction information is shared with registered payment processors such as FPX gateway, DuitNow, and digital wallet providers to enable your transactions to be processed securely.
• Game Providers: Third-party game providers operating on our platform may receive the minimum technical data required to deliver the gaming experience to you.
• Statutory Authority: we1win will disclose personal data to authorities such as Bank Negara Malaysia, the police, or courts when required by law or a valid court order.
• Group Companies: Within the we1win group of companies, data may be shared for internal administrative purposes and the delivery of integrated services to members.
• Professional Advisors: Lawyers, auditors, and security consultants bound by professional confidentiality obligations may access certain data within the scope of their assignments.

All third parties we work with are required to comply with data protection standards equivalent to or stricter than our own. Binding data processing agreements are signed with all critical service providers.

Protecting your personal data from unauthorised access, loss, or misuse is we1win's top priority. We continuously invest in the latest security infrastructure to ensure your data remains protected at all times.

The technical security measures we implement include:

• Data-in-Transit Encryption: All communications between your browser and our servers are secured by TLS 1.3 protocol with 256-bit encryption.
• Data-at-Rest Encryption: Sensitive data stored in our databases, including financial and identity information, is encrypted using AES-256 algorithms.
• Two-Factor Authentication (2FA): We offer and encourage the use of two-factor authentication for all member accounts to add an extra layer of security.
• Continuous Security Monitoring: Our SIEM (Security Information and Event Management) system monitors platform activity 24 hours a day, 7 days a week to detect real-time threats.
• Regular Penetration Testing: We conduct regular security testing by independent security experts to identify and patch system vulnerabilities before they can be exploited.
• Role-Based Access Control: Internal staff may only access data relevant to their job responsibilities, and all access is logged for audit purposes.

While we take all reasonable steps to protect your data, it should be acknowledged that no digital security system is entirely perfect. You also play an important role in your account's security by using a strong password and not sharing your login credentials with anyone.

We1win uses cookies and similar tracking technologies to enhance the user experience, ensure platform security, and understand how our members interact with our website.

• Essential Cookies: Required for core platform functions such as login authentication and session management. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use our platform to help us improve website performance and speed.
• Functional Cookies: Remembering your preferences such as language, display settings, and game choices to personalise your experience.
• Analytics Cookies: Helping us understand platform usage patterns in aggregate and anonymised form for product improvement purposes.

You can manage your cookie preferences through your web browser settings. However, disabling essential cookies may affect platform functionality. We do not use cookies to track your activity outside of the we1win platform.

Under Malaysia's PDPA 2010, you have the following rights regarding the personal data we hold. we1win is committed to respecting and facilitating the exercise of these rights:

We1win retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by applicable Malaysian law.

• Active Account Data: Retained for the duration your account remains active, plus any legally mandated period following account closure.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's tax legislation and financial compliance requirements.
• KYC Records: Retained for 5 years after account closure as required by anti-money laundering regulations.
• Security Logs: Retained for 12 months for security incident investigation purposes if required.
• Support Communication Records: Retained for 3 years for reference and dispute resolution purposes.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered. In cases where immediate deletion is not technically feasible, the data will be isolated and protected from any further processing until it can be fully deleted.

The we1win platform may contain links or integrations with third-party services such as game providers and payment processors. This Privacy Policy applies only to data we collect and process directly.

Once you leave the we1win platform and access third-party sites or services, their own privacy policies will apply and we have no control over their data practices. We encourage you to read the privacy policy of each third-party service you use before providing them with any personal information.

The presence of third-party links or integrations on our platform does not mean we endorse or are responsible for their privacy practices or content. If you encounter any privacy issues related to third-party services integrated with our platform, please contact us so we can investigate the matter.

We1win reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to our platform services.

For any significant changes that materially affect your rights or how we process your data, we will provide adequate notice via:

• In-platform notifications when you log in to your account.
• Email sent to the address registered to your account.
• Updates the "Last Updated" date displayed at the top of this page.

Continued use of the we1win platform after the effective date of any policy update is considered your acceptance of the updated terms. If you do not agree with the changes, you have the right to close your account and stop using our platform.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the we1win Data Protection Officer (DPO) team is here to help.

You can reach us through the following channels:

We are committed to addressing every inquiry and complaint seriously and within the stipulated timeframe. If you are not satisfied with our response, you have the right to file a complaint with the Department of Personal Data Protection Malaysia (JPDP).