Privacy Policy phwin – Malaysian Player Data Security

This Privacy Policy applies to all users of the phwin platform, including:

• Individuals who visit phwin-jit.com even without registering an account.
• Registered members who are actively using any phwin services.
• Former members whose accounts have been closed but whose data may still be retained in accordance with the applicable retention periods.

This policy covers all ways you interact with phwin — through the website, mobile app, email, Live Chat, or any other communication channel we provide. It also covers data collected automatically as you browse our platform, such as activity logs, device information, and cookies.

Data Controller: The data controller responsible for processing your personal data in connection with the phwin platform is phwin (phwin-jit.com). Any enquiries regarding how your data is handled may be directed to us at support@phwin-jit.com.

Phwin collects various types of personal data when you use our platform. This data is organised into three main categories:

A. Data You Provide Directly:

• Your full name as it appears on your Malaysian identity card.
• An active Malaysian mobile number (used for account verification and communications).
• Email address (if provided during registration or updated at a later date).
• Date of birth (for age verification — you must be 18 years of age or older).
• Payment account information — Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, FPX, Maybank2u, or CIMB Clicks account numbers used for deposits and withdrawals.
• Identity verification documents such as a copy of your Malaysian identity card or passport (requested only during the KYC process or for large withdrawal verification).

B. Automatically Collected Data:

• The IP address of your device when accessing the phwin platform.
• Device type, operating system, and web browser version you are using.
• Session records — including login time, logout time, and the duration of each play session.
• Navigation history within the phwin platform — pages visited, buttons clicked, and time spent in each section.
• Cookie data and other tracking technologies (see Section 6 for more details).

C. Transaction & Game Data:

• Records of all deposits and withdrawals in Malaysian Ringgit (MYR) — including date, amount, payment method, and transaction status.
• Sports betting history — markets selected, odds accepted, stake amounts, and outcomes for all football, badminton, e-sports, and other sports bets.
• Casino and slots game history — game titles played, bet amount per round, winnings, and jackpot records.
• Bonuses and promotions claimed, along with rollover fulfilment status.

Phwin uses the personal data we collect solely for legitimate, stated purposes. We will not use your data for any other purpose without first obtaining your renewed consent:

You may withdraw your consent to receive promotional communications at any time by contacting the phwin support team. Withdrawing this consent will not affect your core account services.

Phwin does not sell your personal data to any third party. However, there are limited situations where we may need to share certain data with the following parties:

A. Payment Service Providers: To process your deposits and withdrawals via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX (Maybank2u, CIMB Clicks), we are required to share the necessary transaction information with these service providers. Only the minimum information needed to process the transaction is shared — nothing more.

B. Game Software Providers: Our game providers — including Pragmatic Play, NetEnt, Microgaming, Play'n GO, and PG Soft — may receive game session data for the purposes of game delivery and RNG fairness verification. This data is typically transmitted in the form of session tokens that do not contain directly identifiable personal information.

C. Legal Authorities: phwin will disclose required data to Malaysian authorities — such as the PDRM, Bank Negara Malaysia, or SPRM — upon receiving a valid official request under applicable Malaysian law. In such situations, phwin will endeavour to notify you in advance where permitted by law.

D. Auditors & Security Services: Independent auditors conducting security and compliance reviews of the phwin platform may have access to aggregated or anonymised data. All such parties are bound by strict confidentiality agreements with phwin.

Phwin invests heavily in security infrastructure to keep your personal data safe. The technical and organisational measures we employ include:

• Data Encryption in Transit: All communications between your device and phwin's servers are encrypted using TLS 1.3 (Transport Layer Security), the most current and secure encryption protocol available today.
• Stored Data Encryption: Sensitive data stored on phwin's servers — including passwords (stored as salted hashes), KYC documents, and payment information — is encrypted using AES-256.
• Tiered Access Control: Access to members' personal data within phwin's internal systems is restricted on a least-privilege basis — staff may only access the data necessary to carry out their specific job responsibilities.
• 24/7 Security Monitoring: phwin's systems are continuously monitored for suspicious activity, intrusion attempts, and anomalies that may indicate a security breach.
• Regular Security Testing: phwin conducts regular penetration testing and security audits carried out by independent cybersecurity experts to identify and address any vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): For sensitive operations such as withdrawals and account information changes, phwin applies an additional verification step via OTP (One-Time Password) sent to your registered Malaysian phone number.

Even with all these measures in place, no security system can guarantee absolute 100% protection. phwin is committed to responding promptly in the event of any security breach and will notify affected members in accordance with the requirements of PDPA 2010.

Phwin uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

Essential Cookies (Cannot Be Disabled): These cookies are essential for the phwin platform to function properly. They include login session cookies that keep you signed in while using the platform, as well as security cookies that help us detect unauthorised activity. Without these cookies, the phwin platform will not function.

Functional Cookies (Optional): These cookies save your preferences — such as language, preferred bet limits, and favourite games — so you do not have to reconfigure them each time you use the phwin platform.

Analytics Cookies (Optional): We use analytics cookies to understand how players use the phwin platform — which pages are most popular, where players typically drop off, and how long play sessions generally last. This data is used in aggregated, anonymised form to improve our platform.

How to Manage Cookies: You can manage cookie settings through your web browser preferences. Most modern browsers allow you to view, delete, and block cookies from specific websites. Please note that disabling essential cookies may affect the functionality of the phwin platform.

The phwin platform does not use third-party cookies for targeted advertising or retargeting purposes. We do not share your cookie data with third-party advertising networks.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices, you have the following rights with respect to your personal data held by phwin:

Phwin retains your personal data only for as long as necessary for the purposes stated in this Policy, or as required by applicable Malaysian law. The following are our data retention guidelines:

• Active Account Data: For as long as your phwin account remains active, we retain all data associated with your account to enable the continued delivery of our services.
• Financial Transaction Records: Records of all deposits and withdrawals in MYR are retained for a minimum of 7 years from the date of each transaction, in compliance with Malaysian legal requirements on financial records and anti-money laundering.
• Betting & Game History: Betting records for football, badminton, slots, jackpot, and casino games are retained for 5 years from the transaction date for audit and dispute resolution purposes.
• KYC Documents: Identity verification documents (copies of ID cards, bank statements) are retained for 7 years from the date of submission or from the account closure date, whichever is later.
• Communication Records: Customer support communication logs are retained for 2 years for service quality and reference purposes.
• Closed Accounts: After a phwin account is closed — whether at your request or by phwin — your data will be retained for the period required by law before being securely deleted.

When data is no longer required and there is no legal obligation to retain it, phwin will securely delete or anonymise that data using methods approved under the applicable security standards.

Phwin strictly does not provide any services to individuals under the age of 18. The phwin platform — including Sports Betting, slots, jackpot, and all casino games — is exclusively for adults aged 18 and above.

Phwin does not knowingly collect, store, or process any personal data from children or underage individuals. Should we discover that data belonging to someone under the age of 18 has been collected, we will take immediate action to delete that data and close the account in question.

If you believe a minor may have registered a phwin account or provided us with their personal data, please contact us immediately at support@phwin-jit.com so that we can respond promptly.

The phwin platform may contain links to other websites or services not operated by phwin — such as payment service provider pages or gaming software vendor websites. Once you click those links and leave the phwin platform, this Privacy Policy no longer applies.

Phwin is not responsible for the content, privacy policies, or security practices of any third-party websites. We recommend reading the privacy policy of every website you visit, especially before providing any personal information.

Phwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data handling practices, new legal requirements, or improvements to how we protect your data. Any amendments will be published on this page with an updated effective date.

For material amendments — that is, changes that significantly affect how we use or protect your data — phwin will endeavour to provide advance notice via in-platform notifications or email before the changes take effect, giving you the opportunity to review them.

Your continued use of the phwin platform following the publication of any amendments to this Policy will be deemed as your acceptance of the latest version of the Privacy Policy. If you do not agree with the changes made, you have the right to close your phwin account and request deletion of your data in accordance with the procedure set out in Section 7.

If you have any questions, concerns, or complaints regarding how phwin handles your personal data, or if you wish to exercise any of your rights as a data subject, please contact us through the following channels:

• Email: support@phwin-jit.com (include "Privacy Enquiry" in the subject line for a faster response)
• Live Chat: Available 24 hours a day, 7 days a week in Bahasa Melayu via the chat icon on the phwin platform

Phwin is committed to responding to all privacy enquiries and complaints within 5–10 business days. For more complex cases requiring in-depth investigation, we will inform you of the expected timeline and keep you updated throughout the process.

If you are dissatisfied with how phwin has handled your privacy complaint, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) or the relevant data protection authority.