Privacy Policy

This Privacy Policy ("Policy") describes how WinChat ("WinChat", "we", "us", or "our") collects, processes, stores, and shares personal data relating to individuals ("you", "User", or "Player") who access and use the WinChat online gaming platform available at winchat.cam and any associated mobile interfaces, tools, or services (collectively, the "Platform").

WinChat is committed to protecting the privacy of all persons who interact with our Platform and to processing personal data in a lawful, fair, and transparent manner in accordance with applicable data protection laws and regulations, including those applicable in the jurisdiction from which you access our services.

By registering an Account, accessing the Platform, or otherwise engaging with our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you should not use the Platform.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the WinChat platform.

For the purposes of this Privacy Policy, the following definitions apply:

WinChat collects and processes several categories of Personal Data, depending on how you interact with our Platform. The categories and specific data points we collect are as follows:

We apply the principle of data minimisation — we collect only the Personal Data that is necessary for the stated purposes described in this Policy. We do not collect sensitive data categories (such as racial or ethnic origin, political opinions, or religious beliefs) unless specifically required for legal compliance purposes.

WinChat processes your Personal Data for the following purposes:

• Account Management: To create, maintain, and administer your WinChat Account, including authentication and security management;
• Service Delivery: To provide access to gaming products, process wagers, settle transactions, and deliver the full range of WinChat services;
• Financial Processing: To process deposits and withdrawals via your selected payment methods, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, and Public Bank, and to maintain accurate transaction records;
• Identity Verification (KYC): To verify your identity, age, and the ownership of payment instruments in compliance with Anti-Money Laundering (AML) and Know Your Customer obligations;
• Regulatory Compliance: To fulfil our obligations under applicable laws and regulations, respond to lawful requests from regulatory or law enforcement authorities, and maintain audit records;
• Customer Support: To respond to your enquiries, resolve complaints, and provide technical assistance via live chat and email;
• Responsible Gambling: To monitor gaming behaviour, apply player-requested limits, identify at-risk patterns, and fulfil our duty of care obligations toward all players;
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other prohibited conduct;
• Platform Improvement: To analyse usage patterns, conduct A/B testing, and improve the performance, design, and functionality of the WinChat Platform;
• Marketing Communications: Where you have provided consent, to send promotional offers, bonus notifications, and news updates about WinChat services relevant to players in Malaysia.

We will not use your Personal Data for purposes that are incompatible with those described above without first obtaining your consent or as otherwise required or permitted by applicable law.

WinChat processes your Personal Data on the basis of one or more of the following legal grounds:

• Contractual Necessity: Processing is necessary to perform the contract between you and WinChat — i.e., to provide the gaming services you have registered to use. This covers Account management, transaction processing, and service delivery;
• Legal Obligation: Processing is required to comply with applicable laws, including AML regulations, KYC requirements, responsible gambling regulations, and data retention mandates;
• Legitimate Interests: Processing is necessary for our legitimate business interests — such as fraud prevention, platform security, service improvement, and responsible gambling monitoring — provided those interests are not overridden by your fundamental rights and freedoms;
• Consent: For marketing communications, optional analytics cookies, and any other processing activities that require explicit agreement, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without detriment.

WinChat does not sell your Personal Data. We may share your data with the following categories of third parties only to the extent necessary for the stated purposes:

• Payment Service Providers: Entities facilitating deposit and withdrawal transactions on your behalf, including financial institutions, e-wallet operators (Touch 'n Go, Boost, GrabPay), and banking partners (Maybank, CIMB, Public Bank, Hong Leong). These parties process your payment data strictly to execute transactions;
• Identity Verification Partners: Regulated third-party KYC service providers engaged to verify your identity and age in compliance with applicable regulations;
• Gaming Software Providers: Game studios and platform technology providers who supply the games and betting engines accessible on WinChat. These providers may receive session data to deliver game functionality and maintain RNG certification;
• Regulatory & Law Enforcement Authorities: Government bodies, financial intelligence units, and law enforcement agencies where disclosure is required by applicable law or court order;
• IT & Security Service Providers: Cloud infrastructure, cybersecurity, and fraud prevention vendors operating under binding data processing agreements with strict confidentiality obligations;
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged in the ordinary course of WinChat's business operations, subject to professional confidentiality duties.

All third parties with whom WinChat shares Personal Data are required to maintain appropriate technical and organisational security measures and to process your data only as instructed by WinChat or as required by law.

WinChat uses cookies, web beacons, pixel tags, and similar tracking technologies to operate the Platform effectively, maintain your session, and gather aggregated usage analytics. The categories of cookies we use are as follows:

You may manage cookie preferences through your browser settings or, where provided, through the WinChat cookie preference centre. Please note that disabling strictly necessary cookies may impair your ability to use certain features of the Platform, including Account login.

WinChat retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, tax, or accounting obligations. The following general retention periods apply:

• Account and Registration Data: Retained for the duration of your active Account plus a minimum of five (5) years following Account closure, to comply with AML record-keeping requirements;
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years from the date of submission or the date of Account closure, whichever is later, in accordance with applicable anti-money laundering regulations;
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with financial record-keeping requirements;
• Gaming Activity Logs: Retained for a minimum of three (3) years following the relevant gaming session, for dispute resolution and regulatory purposes;
• Customer Support Communications: Retained for three (3) years following resolution of the relevant matter;
• Marketing Consent Records: Retained for three (3) years from the date consent was provided or last exercised.

Where Personal Data is no longer required for any of the above purposes, it will be securely deleted or anonymised in accordance with our data disposal procedures.

WinChat implements a comprehensive suite of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and WinChat servers is encrypted in transit using industry-standard protocols;
• Password Hashing: User passwords are stored using strong one-way cryptographic hashing algorithms and are never stored in plain text;
• Two-Factor Authentication (2FA): Available to all registered players as an additional Account security layer;
• Access Controls: Strict role-based access controls limit internal access to Personal Data to authorised personnel on a need-to-know basis;
• Regular Security Audits: Our systems are subject to periodic vulnerability assessments and penetration testing conducted by independent security specialists;
• Incident Response: WinChat maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant authorities in accordance with applicable legal requirements.

While WinChat takes all reasonable precautions to protect your data, no method of electronic transmission or storage is completely infallible. You are responsible for maintaining the security of your Account credentials and for notifying us immediately of any suspected unauthorised access.

WinChat may transfer your Personal Data to servers or service providers located outside of Malaysia in order to deliver the Platform and its associated services. Where such international transfers occur, WinChat takes steps to ensure that appropriate safeguards are in place to protect your data, including:

• Transferring data only to jurisdictions that maintain an adequate level of data protection as recognised by applicable law;
• Entering into data transfer agreements with recipient parties that incorporate appropriate contractual data protection clauses;
• Ensuring that all third-party processors receiving international transfers are bound by data processing agreements that require them to maintain security standards equivalent to those applied within Malaysia.

By using the WinChat Platform, you acknowledge and consent to the transfer of your Personal Data outside of Malaysia where required for the delivery of our services, subject to the safeguards described above.

Subject to applicable law and certain legal exceptions, you have the following rights in relation to your Personal Data held by WinChat:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how and why it is processed;
• Right to Rectification: You may request that inaccurate or incomplete Personal Data be corrected or updated without undue delay;
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations;
• Right to Restrict Processing: You may request that we limit the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to its processing;
• Right to Data Portability: Where processing is based on your consent or performed by automated means, you may request that we provide your Personal Data in a structured, commonly used, and machine-readable format;
• Right to Object: You may object to the processing of your Personal Data for direct marketing purposes or where processing is based on our legitimate interests, subject to compelling grounds on our part;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Privacy team via the details set out in Section 14 of this Policy. We will respond to all verified requests within thirty (30) days. In complex cases, this period may be extended by a further sixty (60) days, with prior notification to you.

The WinChat Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data relating to persons under the age of 21. The minimum age requirement is a fundamental eligibility condition for Account registration, and we employ age verification procedures as part of our KYC process to enforce this requirement.

If WinChat becomes aware that Personal Data has been collected from a person under the minimum eligible age, we will take immediate steps to delete such data and close the associated Account. If you believe that a person under the age of 21 has registered an Account on our Platform using false age information, please notify us immediately via the contact details in Section 14.

Parents and guardians are encouraged to monitor the online activities of minors in their care and to utilise parental control tools and website filtering software to restrict access to gambling-related content.

WinChat reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or the nature of our services. The most current version of this Policy will always be published at winchat.cam/privacy-policy, with the "Last Updated" date clearly indicated at the top of the page.

Where changes to this Policy are material — meaning they significantly affect the way we process your Personal Data or your rights in relation to that data — we will provide you with advance notice by email or by a prominent notification on the Platform prior to the changes taking effect, and, where required by law, seek your renewed consent.

Your continued use of the WinChat Platform following the publication of any revised version of this Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must cease using the Platform and may request Account closure by contacting our support team.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which WinChat processes your Personal Data, please contact our Privacy and Data Protection team through the following channels:

For responsible gambling concerns, self-exclusion requests, or limit-setting tools, please visit our dedicated Responsible Gambling page.