Privacy Policy — winmy10

winmy10 ("the Company", "we", "us", "our") is committed to protecting the privacy and personal data of all users ("Players", "you") who access and use the winmy10 platform at winmy10.cam ("the Platform"). This Privacy Policy describes how we collect, store, process, use, and protect personal data in connection with the operation of our online casino, sports betting, and gaming services.

This Privacy Policy applies to all Players who register and use the winmy10 Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations in Malaysia. By registering an account or using the Platform, you acknowledge that you have read, understood, and consented to the practices described in this Privacy Policy.

We operate under an internationally recognised gaming licence, which imposes strict obligations regarding the collection, processing, and protection of Player data. Our data practices are designed to comply with those obligations, including applicable anti-money laundering (AML) and Know Your Customer (KYC) regulatory requirements.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information that identifies or could reasonably identify a natural person, directly or indirectly, including name, identification number, contact details, location data, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, modification, deletion, or transfer.
• "Data Controller" — winmy10, the entity that determines the purposes and means of processing Player personal data.
• "Data Processor" — any third party that processes personal data on behalf of winmy10 under a contractual arrangement (e.g., payment service providers, KYC verification vendors).
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer procedures, which require the verification of a Player's identity and other compliance-related information.
• "Cookie" — a small data file stored on a Player's device by a web browser to remember preferences and session information.
• "AML" — Anti-Money Laundering policies and procedures applied by winmy10 in accordance with its licensing requirements.

winmy10 collects and processes the following categories of personal data, depending on your interaction with the Platform:

We do not collect special categories of sensitive personal data (such as health data, religious beliefs, or biometric data) unless specifically required by our KYC liveness verification process, in which case such data is processed solely for identity verification and is not retained beyond the period necessary for that purpose.

winmy10 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or completing a promotional opt-in form on the Platform.
• Automated technologies: Technical and usage data collected automatically through cookies, web beacons, log files, and similar tracking technologies when you browse or interact with the Platform.
• Payment providers: Transaction confirmation and account verification data shared by payment processors including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay.
• KYC verification partners: Identity verification outcomes and fraud risk signals shared by our contracted KYC verification service providers.
• Third-party sources: Fraud prevention databases, sanctions screening lists, and publicly available regulatory sources used for AML compliance purposes.

winmy10 processes your personal data on one or more of the following legal bases:

1. Contractual necessity: Processing required to fulfil our contractual obligations to you under the Terms & Conditions — including account management, game delivery, payment processing, and withdrawal handling.
2. Legal obligation: Processing required to comply with applicable laws and regulations, including AML regulations, KYC obligations, and our gaming licence conditions.
3. Legitimate interests: Processing conducted for the purposes of fraud prevention, security monitoring, platform improvement, and responsible gambling enforcement — where such processing does not override your fundamental rights and freedoms.
4. Consent: Where we rely on your consent (e.g., for optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

We use the personal data we collect for the following purposes:

• To create, maintain, and manage your winmy10 account.
• To verify your identity and age (21+ requirement) in compliance with our KYC obligations.
• To process deposits and withdrawals via your chosen payment methods, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency.
• To detect, prevent, and investigate fraud, money laundering, and other unlawful activity on the Platform.
• To monitor gameplay for responsible gambling indicators and to apply responsible gambling tools at your request.
• To provide customer support and resolve disputes or complaints efficiently.
• To send you account notifications, transaction confirmations, and security alerts.
• To send you marketing communications about winmy10 promotions and offers — only where you have opted in to receive such communications.
• To personalise your experience on the Platform based on your preferences and usage patterns.
• To comply with our licensing obligations, including regulatory reporting to our gaming licence authority.
• To improve, test, and optimise the Platform's features and performance.

winmy10 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection agreements:

• Payment service providers: Malaysian banking partners (Maybank, CIMB, Public Bank, Hong Leong), e-wallet operators (Touch 'n Go, Boost, GrabPay), DuitNow/FPX infrastructure providers, and cryptocurrency payment processors — to facilitate deposits and withdrawals.
• KYC and identity verification vendors: Third-party services contracted to verify the authenticity of identity documents and conduct liveness checks as required under our KYC programme.
• Fraud prevention and AML screening services: Third-party databases and providers used to screen for fraud risk, sanctions, politically exposed persons (PEPs), and other AML-related indicators.
• Customer support platforms: Service providers that host and manage our live chat and ticketing systems — who process communication data on our behalf under data processing agreements.
• Regulatory and law enforcement authorities: Where required to do so by law, court order, or our gaming licence regulator. winmy10 cooperates fully with lawful data disclosure requests.
• Corporate group entities: Where winmy10 operates as part of a corporate group, data may be shared internally for consolidated compliance, fraud management, and technical operations.

All third-party Data Processors engaged by winmy10 are required to process your data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection obligations under a formal data processing agreement.

Given the international nature of the online gaming industry, some of the third-party service providers used by winmy10 may be located outside Malaysia. When personal data is transferred internationally, winmy10 ensures that appropriate safeguards are in place to protect that data, which may include:

• Contractual data transfer agreements incorporating standard contractual clauses approved by the relevant data protection authority.
• Transfers to countries that have been assessed as providing an adequate level of data protection.
• Binding corporate rules or equivalent frameworks where transfers are within a corporate group.

Players may request information about the specific safeguards applied to any international transfer of their personal data by contacting our support team.

winmy10 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our legal and regulatory obligations. The following general retention periods apply:

Where data is no longer required for its original purpose and no legal retention obligation applies, it is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

winmy10 uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage objects) to enhance your experience on the Platform, maintain session state, and gather analytics data about Platform usage.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. They cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how Players use the Platform — including pages visited, session duration, and error reports — to help us improve performance and user experience.
• Functionality Cookies: Enable the Platform to remember your preferences, such as language settings and game display options, to provide a more personalised experience.
• Marketing Cookies: Used to track the effectiveness of winmy10's marketing campaigns. These are only set where you have consented to receive marketing communications. No third-party advertising networks have access to your data through these cookies.

You can manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. For full details on how to manage cookies, refer to your browser's help documentation.

winmy10 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the winmy10 Platform.
• AES-256 encryption for personal data stored in our databases.
• Multi-factor authentication (MFA) options for Player account access.
• Role-based access controls (RBAC) ensuring that staff can only access personal data relevant to their specific job functions.
• Regular independent penetration testing and security audits of our infrastructure.
• Continuous security monitoring and intrusion detection systems.
• Formal data breach response procedures, including notification obligations to affected Players and the relevant regulatory authority where required by law.

In the event of a data breach that poses a significant risk to your rights and freedoms, winmy10 will notify affected Players without undue delay and in accordance with our applicable notification obligations.

The winmy10 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and any account found to belong to an underage individual will be immediately suspended and all associated data will be deleted.

If you believe that a person under the age of 21 has registered on or is using the winmy10 Platform, please contact our support team immediately at the details set out in Section 16. We will investigate the matter promptly and take appropriate action.

Subject to applicable law and our regulatory obligations, you hold the following rights over your personal data held by winmy10:

1. Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed. We will respond to access requests within 30 days.
2. Right to Rectification: You may request the correction of any inaccurate or incomplete personal data on your account. Minor corrections (such as updating a phone number or email address) can be made directly through your account settings.
3. Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent. Note that we may be required to retain certain data for legal or regulatory reasons notwithstanding such a request.
4. Right to Restriction of Processing: You may request that we restrict the processing of your personal data in specific circumstances — for example, while you contest the accuracy of the data or while we assess an objection you have raised.
5. Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You may object to the processing of your personal data where such processing is based on legitimate interests. You may also opt out of marketing communications at any time by contacting our support team or using the unsubscribe mechanism in marketing emails.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our support team using the details in Section 16. We may require you to verify your identity before processing a data rights request, to protect against fraudulent requests.

The winmy10 Platform may, from time to time, contain references to third-party services — including payment processors and gaming content providers. winmy10 does not control the privacy practices of these third parties and is not responsible for their privacy policies or data handling practices.

When you interact with third-party services (for example, when you initiate a payment via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX), you are subject to that provider's terms and privacy policy. We encourage you to review the privacy policies of any third-party service you use in connection with your winmy10 account.

winmy10 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. When we make material changes to this policy, we will:

• Post a revised version on the Platform with an updated "Last Updated" date at the top of this page.
• Send a notification to your registered email address at least seven (7) days before the changes take effect, where the changes are material.
• Display a prominent notice on the Platform homepage for a reasonable period following the update.

Your continued use of the Platform after any amendments have taken effect constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you should cease using the Platform and contact our support team to close your account and request data deletion.

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data held by winmy10, please contact us through the following channels:

• Email: [email protected] — Please mark your subject line as "Privacy Request" for faster routing. We respond within 4 business hours.
• Live Chat: Available 24/7 via the chat widget on the winmy10 Platform. Ask to be connected to the Data Privacy team.
• Response Language: English

For data subject access requests, rectification requests, erasure requests, or objections to processing, please include your full name, registered email address, and a description of your request. We may require identity verification before processing your request.

For responsible gambling queries, self-exclusion requests, or deposit limit settings, please visit our dedicated Responsible Gambling page.

This Privacy Policy was last updated on 1 January 2026. Previous versions are available upon request.