Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Winbox1 ("we", "us", "our", "the Company"), the operator of the online gaming and sports betting platform accessible at winbox1.cam ("the Platform"), collects, uses, stores, and protects personal data submitted by users ("you", "your", "the User") of the Platform. This Policy forms part of our overall terms of engagement and should be read alongside our Terms & Conditions.

Winbox1 recognises that privacy is a fundamental right. We are committed to handling your personal data lawfully, transparently, and with the utmost care. We collect only what is necessary, retain it only as long as required, and protect it using robust security measures throughout its lifecycle on our systems.

This Policy applies to all personal data collected through the Platform, our customer support channels, and any other interaction you have with Winbox1 as a registered or prospective player. By using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing activities described herein, to the extent that consent is required by applicable law.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details, IP address, and device identifiers.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" — Winbox1, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of Winbox1under a contractual obligation and in accordance with our documented instructions.
• "Sensitive Personal Data" — a subset of personal data that warants heightened protection, including identity document numbers, financial account details, and biometric data submitted for KYC verification.
• "Cookies" — small text files placed on your device by the Platform to enable session management, preference storage, and usage analytics.
• "KYC" — Know Your Customer verification, the process through which we verify the identity and address of account holders before enabling full withdrawal access.

Data We Collect

We collect the following categories of personal data in the course of providing the Winbox1 Platform and related services:

How We Collect Your Data

Winbox1 collects personal data through the following channels and mechanisms:

4.1 Directly from You

The majority of personal data we hold is provided directly by you — during account registration, when completing KYC verification, when making deposits or requesting withdrawals, when contacting our customer support team, or when opting in to promotional communications.

4.2 Automatically via the Platform

When you access and use the Platform, certain technical and usage data is collected automatically through server logs, cookies, and analytics tools. This includes your IP address, session duration, pages visited, games played, and device identifiers. This data is collected to maintain platform security, detect fraud, and improve the user experience.

4.3 From Third Parties

We may receive limited personal data from third-party service providers in specific circumstances, including from payment processors (confirming transaction status), identity verification service providers (as part of KYC), and fraud prevention databases. Any such data is processed strictly in accordance with this Policy and the relevant contractual obligations with those third parties.

Legal Bases for Processing

Winbox1 processes your personal data only where there is a valid legal basis to do so. The legal bases we rely on are as follows:

• Contractual necessity: Processing required to perform our contractual obligations to you — including operating your account, processing deposits and withdrawals in MYR, administering bonuses, and providing customer support.
• Legal obligation: Processing required to comply with applicable legal obligations, including KYC identity verification, anti-money laundering (AML) record-keeping, age verification (21+ enforcement), and responding to regulatory or law enforcement requests.
• Legitimate interests: Processing based on the legitimate interests of the Company, including fraud detection and prevention, platform security monitoring, responsible gambling programme administration, and internal analytics — provided such interests are not overridden by your privacy rights.
• Consent: Where processing is based on your consent (principally for marketing communications and optional cookies beyond essential functionality), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

How We Use Your Data

We use the personal data we collect for the following specific purposes. All use is consistent with the legal bases identified in Section 5:

• Account creation and management — setting up and maintaining your Winbox1 player account, including login authentication and account settings management
• Identity and age verification (KYC) — verifying that you are who you say you are, that you are at least 21 years of age, and that your payment methods are in your name
• Payment processing — facilitating MYR deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks; processing withdrawal requests to your verified accounts
• Fraud prevention and security — monitoring account activity for suspicious patterns, detecting and preventing duplicate accounts, investigating chargebacks, and protecting the integrity of the Platform
• Responsible gambling monitoring — identifying gaming behaviour that may indicate problem gambling and enabling the application of responsible gambling tools such as deposit limits, session reminders, and self-exclusion where appropriate
• Customer support — investigating and resolving support tickets, account queries, payment disputes, and complaints submitted to our team
• Regulatory compliance — maintaining records required by our international gaming licence, anti-money laundering (AML) obligations, and responding to lawful requests from regulatory or law enforcement authorities
• Platform improvement — analysing aggregated and anonymised usage data to improve the user experience, game selection, and technical performance of the Platform
• Promotional communications — sending you information about offers, bonuses, and promotions where you have opted in to receive such communications

Sharing Your Data

Winbox1 does not sell your personal data to any third party. We share your data only in the following limited and defined circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers to perform specific functions on our behalf, including payment processing, identity verification, IT hosting, cybersecurity, and email delivery. These providers act as data processors under our instruction and are contractually bound to process your data only as directed by us and to maintain appropriate security standards. They are not permitted to use your data for their own purposes.

7.2 Regulatory and Legal Authorities

We may be required by law, regulation, or lawful court order to disclose certain personal data to regulatory authorities, law enforcement agencies, or gaming oversight bodies. We will only disclose the minimum data necessary to comply with such requirements and, where legally permissible, will notify you of any such disclosure.

7.3 AML and Fraud Prevention Databases

In order to comply with our anti-money laundering obligations and to protect the platform from fraudulent activity, we may check your details against relevant fraud prevention and sanctions screening databases. Records of such checks may be retained in accordance with our legal obligations.

7.4 Business Transfers

In the event that Winbox1 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to a successor entity as part of that transaction. We will notify you of any such transfer and the privacy terms applicable to your data following the transition.

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. The following retention guidelines apply:

• Active account data — retained for the full duration of your Account being open and active on the Platform
• KYC documentation — retained for a minimum of 5 years following account closure, in accordance with standard AML record-keeping obligations under international gaming licensing frameworks
• Financial transaction records — retained for a minimum of 7 years following the date of each transaction to satisfy financial compliance and audit requirements
• Customer support communications — retained for 3 years following resolution of a support interaction, or longer where the matter is subject to an ongoing dispute or legal proceding
• Marketing preference records — retained for the duration of your active consent and for 2 years thereafter as evidence of consent management
• Technical and log data — retained for up to 12 months for security monitoring purposes, after which it is anonymised or deleted

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical and platform improvement purposes.

Your Rights

Subject to applicable law and certain exemptions, you hold the following rights in relation to the personal data Winbox1 holds about you. To exercise any of these rights, please contact us using the details in Section 16.

• Right of Access: You may request confirmation of whether we hold personal data about you and, if so, a copy of that data along with information about how it is being processed. We will respond to access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may also update certain data directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there is no overiding legitimate interest. Note that this right is subject to our legal obligations to retain certain data, including KYC and financial records.
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while we verify the accuracy of data you have disputed, or while we assess your objection to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request its transfer to another data controller where technically feasible.
• Right to Object: You have the right to object at any time to processing of your personal data based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time through your account notification settings or by contacting [email protected]. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Cookies & Tracking Technologies

Winbox1 uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, and gather anonymised analytics about how the Platform is used. The following categories of cookies are deployed:

• Strictly Necessary Cookies: These are essential for the Platform to function. They enable you to log in, maintain a session, and complete transactions. They cannot be disabled without breaking core platform functionality.
• Functional Cookies: These remember your preferences — such as your language settings, favourite game categories, and notification settings — to provide a personalised experience across sessions.
• Analytics Cookies: These cookies collect aggregated, anonymised data about how users interact with the Platform — pages visited, session duration, navigation paths — to help us understand and improve the user experience. No personally identifiable information is transmitted via analytics cookies.
• Security Cookies: These cookies support fraud detection and authentication verification functions, including detecting multiple login attempts and verifying device consistency across sessions.

You may manage your cookie preferences through your browser settings. Please note that disabling cookies beyond strictly necessary ones may affect your experience on the Platform. We do not deploy third-party advertising or retargeting cookies on the Winbox1 Platform.

Data Security

Winbox1 implements a multi-layered approach to data security, incorporating both technical and organisational measures appropriate to the risk profile of the personal data we process. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encryption at rest for sensitive personal data and financial records stored on our infrastructure
• Role-based access controls ensuring that only authorised personnel have access to personal data, and only to the extent required for their specific function
• Regular independent penetration testing and security audits of the Platform's infrastructure
• Automated intrusion detection and monitoring systems operating continuously across all server environments
• Secure, segregated storage of KYC documents, accessed only by our compliance and verification teams
• Regular staff data protection training and clear internal policies governing access to and handling of personal data

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay once we become aware of the breach and have taken steps to contain it. Notification will be made via your registered email address and, where relevant, via on-platform notification.

Children & Underage Users

Winbox1 is strictly prohibited for use by anyone under the age of 21 years. We do not knowingly collect or process personal data from individuals under the age of 21. Our registration process requires date-of-birth verification, and our KYC process includes age confirmation via government-issued identification.

If we become aware that we have inadvertently collected personal data from an individual under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and return any deposited funds to the originating payment method. If you believe that a minor has registered an account on the Platform using false information, please notify us immediately at [email protected].

International Data Transfers

As an internationally licensed platform, Winbox1 may process and store personal data on servers located outside of Malaysia. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy.

Such safeguards may include contractual data protection clauses with data processors in third countries, transfers to jurisdictions with recognised adequate data protection frameworks, or other lawful mechanisms as recognised under applicable data protection law. For specific information about the international transfer safeguards applicable to your data, please contact us using the details in Section 16.

Third-party Links

The Winbox1 Platform may contain links to third-party websites, services, or resources. These links are provided for user convenience and informational purposes only. Winbox1 has no control over, and accepts no responsibility for, the privacy practices, content, or data handling of any third-party site. We encourage you to review the privacy policies of any external site you visit before submitting personal data to it.

Policy Updates

Winbox1 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The date of the most recent revision is displayed at the top of this Policy.

Where changes to this Policy are material — meaning they significantly affect how we use your personal data or the rights available to you — we will notify you in advance via your registered email address and/or a prominent on-platform notification, providing at least 14 days' notice before the revised Policy takes effect. Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement and acceptance of the changes.

Contact & Complaints

If you wish to exercise any of your data rights, have a question about how we process your personal data, or wish to make a complaint about our data handling practices, please contact our Data Protection team using the following details:

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate your complaint to a relevant data protection supervisory authority in your jurisdiction. For guidance on the applicable authority in your country, we recommend consulting a qualified legal professional familiar with the data protection laws of your jurisdiction.

For general Platform support, account queries, or responsible gambling assistance, please also visit our FAQ page or our Responsible Gambling page.