SpinWin Privacy Policy – Personal Data Protection for Malaysian Members

This Privacy Policy ("Policy") describes how SpinWin ("we", "platform") collects, uses, stores, discloses and protects your personal information when you register for and use the SpinWin online casino platform. This Policy applies to all registered members, guest users and anyone who interacts with the SpinWin website or services.

SpinWin operates fully within the applicable data protection legal framework in Malaysia. We take this responsibility seriously and ensure that every decision relating to the handling of your personal data is made with your best interests and privacy as a member at the forefront.

By registering an account or using the SpinWin platform, you agree to the terms set out in this Privacy Policy. If you do not agree with any aspect of this policy, please contact us before continuing to use the platform, or choose not to use SpinWin's services.

SpinWin collects various categories of personal information depending on how you use our platform. Below are the main categories of data we collect and the purpose of each:

Identity Information:

• Full name as stated on your identification card or passport
• National identification card or passport number
• Date of birth
• An active Malaysian phone number
• Email address
• Current residential address

Financial Information:

• E-wallet account details (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay)
• Bank account details for FPX (Maybank2u, CIMB Clicks)
• Deposit and withdrawal transaction history in MYR (RM)
• Betting and gaming activity history

Technical & Usage Information:

• Your device's IP address
• Web browser type and operating system
• Cookie information and similar tracking technologies
• In-platform activity logs, including pages visited and games played
• Gaming session times and duration

SpinWin only collects information that is strictly necessary to provide its services, comply with legal requirements such as the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), and ensure the security of the platform and all members.

The personal data SpinWin collects is used for the following purposes, all of which are lawful and necessary for the operation of the platform:

• Identity Verification (KYC): To confirm that you are who you claim to be and that you meet the minimum age requirement of 18 to use SpinWin.
• Transaction Processing: Processing deposits via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and FPX, and handling your withdrawal requests in Malaysian Ringgit (RM).
• Account Management: Managing your SpinWin account, including your game history, set limits and personal preference settings.
• Platform Security: Detect and prevent fraud, money laundering, multi-account use and activities that breach SpinWin's Terms & Conditions.
• Customer Support: Enables the SpinWin support team to assist you with any issues or enquiries you raise.
• Legal Compliance: Meet reporting and disclosure obligations required under applicable Malaysian law.
• Platform Improvement: Analysing usage patterns to improve the design, functionality, and overall experience of the SpinWin platform.
• Service Communications: Sending important account notifications, changes to terms, promotions you are eligible for and security updates.

SpinWin does not sell, rent, or trade members' personal data to third parties for commercial purposes. However, in the course of operating the platform, there are situations where SpinWin may need to share certain information with approved parties:

Third-Party Service Providers:

SpinWin works with trusted service providers to support platform operations, including casino game providers (Evolution Gaming, Pragmatic Play Live, SA Gaming, Asia Gaming), payment processors for e-wallets and Malaysia FPX, as well as cloud and technical infrastructure providers. All these providers are bound by strict confidentiality agreements and are only permitted to use your data for the specific purposes related to the services they provide to SpinWin.

Legal Requirements:

SpinWin may be required to disclose members' personal information to authorities under Malaysian law, including Bank Negara Malaysia, the Financial Intelligence Unit (FIU) or relevant law enforcement agencies where there is a legitimate requirement. Such disclosures are made solely to fulfil legal obligations and are not at SpinWin's discretion.

Business Transfer:

Should SpinWin be involved in any merger, acquisition, asset sale or business restructuring, members' personal data may be transferred as part of the platform's assets. Members will be notified before their data becomes subject to a different privacy policy.

SpinWin implements a range of robust technical and organisational measures to protect members' personal data against unauthorised access, alteration, disclosure, or accidental destruction. Key security measures implemented by SpinWin include:

• 256-bit SSL Encryption for all data transmitted between your browser and SpinWin's servers — meaning every deposit via Touch 'n Go or DuitNow and every live casino session on SpinWin is protected by the same level of encryption used by leading financial institutions.
• Data-at-Rest Encryption for sensitive information stored in SpinWin's databases, including KYC data and financial transaction history.
• Role-Based Access Control which ensures that only SpinWin staff with a legitimate business need are able to access members' personal data, with every access logged in an audit trail.
• Continuous Security Monitoring to detect any suspicious activity or unauthorised access attempts on SpinWin's systems in real time.
• Regular Security Assessments including penetration testing and security audits conducted by independent experts to ensure SpinWin's systems consistently meet the latest security standards.

That said, it is important to understand that no data transmission over the internet or electronic storage method can be guaranteed 100% secure at all times. SpinWin is committed to using all commercially reasonable means to protect your data, but we cannot make absolute guarantees regarding its security.

SpinWin retains members' personal data for as long as necessary to fulfil the original purpose of collection or to comply with applicable legal requirements — whichever is longer. In general:

• Active Account Data: Retained for as long as your SpinWin account remains active, and for a reasonable period following account closure.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysian financial legal requirements.
• KYC Records: Retained for the period required by applicable anti-money laundering legislation, which is typically 6 years after the business relationship ends.
• Support Communication Logs: Retained for 3 years from the date of interaction for reference and service quality purposes.
• Technical Data & Cookies: Retained according to the retention period specified in each cookie's settings, which you can review and adjust through your web browser.

When your personal data is no longer needed and there is no legal requirement to retain it, SpinWin will securely delete or anonymise that data in line with industry best practices.

As a SpinWin member and the owner of your personal data, you hold certain rights regarding how your data is handled. SpinWin respects these rights and provides straightforward ways for you to exercise them.

To exercise any of the above rights, please contact the SpinWin support team by email at support@spinwin.my, including a clear request and sufficient proof of identity. SpinWin will respond to your request within 30 business days of receiving a complete submission.

SpinWin uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you visit the SpinWin website. They help us recognise you as a returning user, remember your preferences, and enable certain platform features to function correctly.

Types of cookies SpinWin uses:

• Essential Cookies: These cookies are essential for core SpinWin platform functions such as login authentication and session security. The platform cannot operate properly without them and they cannot be disabled.
• Functional Cookies: Allowing the SpinWin platform to remember your preferences, such as language, preferred betting limits and display settings, to deliver a more personalised experience.
• Analytics Cookies: Helps SpinWin understand how members interact with the platform — which pages are visited most, where players spend the most time, and which areas may need improvement.
• Performance Cookies: Collects information on how the SpinWin platform is used, helping us identify and resolve technical issues more quickly.

You may manage or delete cookies through your web browser settings at any time. Please note, however, that disabling certain cookies may affect the functionality and experience of using the SpinWin platform.

SpinWin is a platform intended exclusively for adults aged 18 and above. We do not knowingly collect or process personal data from individuals under 18. Should SpinWin discover that personal data of a person under 18 has been collected without adequate verification, we will take immediate steps to delete that data and close the account in question.

If you believe someone under the age of 18 may have registered a SpinWin account, please contact us immediately at support@spinwin.my so that prompt action can be taken.

The SpinWin platform may from time to time contain links to third-party websites or services. It is important to note that this SpinWin Privacy Policy applies solely to the SpinWin platform and does not cover the privacy practices of any other websites you may visit through those links.

SpinWin is not responsible for the content, privacy policies or practices of any third-party websites. We encourage you to read the privacy policy of every website you visit before providing them with any personal information.

SpinWin reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our operational practices, applicable law, or improvements in how we protect your data. Any material changes to this policy will be communicated to members via email or in-platform notification on SpinWin at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the current version of the Privacy Policy in force. We encourage you to review this page periodically to stay informed about how SpinWin protects your personal information.

Your continued use of the SpinWin platform after any changes to this Privacy Policy take effect constitutes your acceptance of the updated terms. If you do not agree with the changes made, you have the right to close your SpinWin account by contacting our support team.

If you have any questions, concerns or complaints about how SpinWin handles your personal data, or if you wish to exercise any of the privacy rights set out in this Policy, please reach us through the following channels:

• Data Privacy Email: support@spinwin.my
• Live Chat: Available 24/7 directly through the SpinWin platform

When contacting us regarding data privacy, please clearly state:

• Your full name and SpinWin account number
• The type of request or query you submitted
• Any additional relevant information to help us process your request

SpinWin is committed to responding to all privacy-related enquiries within 14 business days of receipt. For more complex requests, additional time may be required — we will keep you informed of your request's progress within that timeframe.