Privacy Policy 68win — Member Personal Data Protection

68win is an online entertainment platform operating under the official domain 68win.pw. We take our responsibility to protect the privacy and personal data security of every member using our platform seriously.

This Privacy Policy is formulated in accordance with the requirements of the Personal Data Protection Act 2010 (PDPA) Malaysia and international best-practice data protection principles. This document aims to give you a clear and transparent overview of how your data is handled from the moment you register until you no longer use our platform.

By using the 68win platform — whether through our website or mobile app — you are deemed to have read and agreed to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, please stop using our platform and contact us to close your account.

68win collects various types of information to provide a safe, seamless, and responsible service. The information we collect falls into three main categories:

A. Personal Information You Provide Directly:

• Full name as per valid identity document.
• National Identity Card (MyKad) number or passport number for identity verification (KYC) purposes.
• Date of birth for age verification.
• An active mobile phone number.
• A valid and actively used email address.
• Bank account or digital wallet details for processing deposits and withdrawals.
• Residential address for verification and regulatory compliance purposes.

B. Information Collected Automatically:

• The IP address of your device when accessing the platform.
• Device type, operating system, and web browser version used.
• Session data including login times, session duration, and in-platform activity.
• Betting and financial transaction records.
• Cookie data and similar tracking technologies.

C. Information From Third Parties:

• Verification information from accredited KYC service providers.
• Payment verification data from licensed payment processors.
• Information relating to individuals listed on legally recognised exclusion databases.

Every piece of data we collect is used for a specific and legitimate purpose. The table below summarises the primary purposes for which your personal data is used on the 68win platform:

We will not use your data for any purpose beyond those stated above without first obtaining your consent. Should the purpose of processing change, you will be notified directly via email or platform notification.

68win maintains a fully transparent data sharing policy. We do not share your personal information with third parties except in the following legally permitted situations:

• Trusted Service Providers: Third parties that assist us in platform operations — including licensed payment processors, KYC service providers, cloud service providers, and analytics providers — are all bound by strict confidentiality agreements and may only use data for the specified purposes.
• Legal Authorities: When required by applicable Malaysian law, a court order, or a legitimate request from a law enforcement agency.
• Game Providers: Necessary technical data (not full personal data) may be shared with our game software providers for session continuity and dispute resolution purposes.
• Your Explicit Consent: In specific cases where you have given explicit consent for data sharing with a particular party.

All third parties that receive personal data of 68win members are required to comply with data protection standards equal to or higher than our own. We conduct periodic reviews of all our data processing partners.

Protecting your personal data from unauthorised access, breaches, alteration, or destruction is a core responsibility of 68win. We implement multiple layers of technical and organisational security controls, including:

• Data encryption in transit using TLS 1.3 and 256-bit SSL protocols.
• Data encryption at rest using the AES-256 algorithm.
• Two-factor authentication (2FA) for all staff accounts accessing sensitive data.
• Round-the-clock 24/7 security monitoring via a SIEM (Security Information and Event Management) system.
• Penetration testing conducted periodically by independent security experts.
• A role-based access control (RBAC) policy ensuring staff can only access the data necessary for their respective duties.
• Mandatory security and privacy training for all 68win staff.
• A comprehensive incident response plan to address any data breaches swiftly and effectively.

While we take all reasonable measures to protect your data, no security system is entirely perfect. We therefore also encourage you to take responsibility for your own account security by using a strong password and not sharing your login credentials with anyone.

68win uses cookies and similar tracking technologies to enhance your experience on our platform, analyze usage patterns, and ensure account security. The types of cookies we use are as follows:

• Essential Cookies: Required for core platform functions including login, session management, and security. These cookies cannot be disabled.
• Performance Cookies: Collecting anonymous information about how visitors use our platform to help us improve our services. This data does not identify individual users.
• Functionality Cookies: Storing your preferences such as language, display settings, and login details to streamline repeat visits.
• Analytics Cookies: Used to understand aggregate traffic patterns and user behaviour for platform improvement purposes.

You can manage cookie settings through your web browser settings. However, disabling certain cookies may affect platform functionality. For more information on how to manage cookies, please refer to your web browser's help documentation.

68win retains your personal data for as long as your account is active and as long as necessary to fulfil the purposes stated in this Privacy Policy. After your account is closed, data will be retained for any additional period required by Malaysian law and the following operational requirements:

• Financial transaction records — retained for a minimum of 7 years in accordance with Malaysia's tax and financial legal requirements.
• Identity verification documents (KYC) — retained for 5 years after account termination in accordance with anti-money laundering (AML) legal requirements.
• Customer support communication records — retained for 3 years for dispute resolution purposes.
• Log and security data — retained for 2 years for audit and security investigation purposes.

After the specified retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered. The deletion process is carried out automatically on a scheduled basis.

As a 68win member and data subject under Malaysia's PDPA, you have the following rights regarding your personal data. All requests will be processed within 14 working days:

The 68win platform is exclusively for individuals aged 18 years and above. We do not knowingly collect, process, or store any personal data from individuals under the age of 18.

If we become aware that personal data has been collected from a minor without appropriate age verification, we will take immediate action to delete that data and terminate the relevant account.

• 68win enforces a strict age verification system during the registration process.
• KYC checks ensure all members meet the minimum age requirements.
• Any reports of accounts suspected to be owned by minors will be investigated promptly.

If you are a parent or guardian and discover that your child has registered on our platform without authorisation, please contact us immediately at [email protected] and we will address this as a priority.

68win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements.

Each time this Privacy Policy is updated, we will:

• Updating the "Last Updated" date at the top of this page.
• Sending notifications to your registered email address if the changes are material and significant.
• Displaying prominent notices on our platform for changes that affect your rights.

Continued use of the 68win platform after any amendments take effect will be considered acceptance of the updated policy terms. We encourage you to review this page periodically to stay informed about how your data is protected.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, the 68win team is ready to assist you at any time.

• Data Protection Email: [email protected]
• Live Chat: Available 24/7 via the chat icon at the bottom corner of the platform.
• Response Time: We aim to respond to all privacy-related enquiries within 2 business days.

For official requests relating to your personal data rights, please clearly state the type of request (access, correction, deletion, etc.) along with your account information to expedite processing. Our team may require additional identity verification before processing sensitive requests.