Privacy Policy

This Privacy Policy (hereinafter "Policy" or "Privacy Policy") sets out the manner in which Winbox9 (hereinafter "Winbox9", "the Company", "We", "Us", or "Our") collects, processes, stores, shares, and protects the personal data of individuals (hereinafter "User", "Member", "Data Subject", or "You") who access and use the Winbox9 platform, including the website athttps://winbox9.cam, any associated mobile applications, and all related digital services (collectively, "the Platform").

Winbox9 is committed to handling all personal data with integrity, transparency, and in full compliance with applicable data protection principles, including those aligned with the General Data Protection Regulation (GDPR) framework and the Personal Data Protection Act 2010 (PDPA) of Malaysia, where applicable.

This Policy should be read in conjunction with Winbox9's Terms & Conditions, which govern the overall contractual relationship between You and Winbox9.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, IP address, device identifiers, payment method details, and behavioural or transactional data — that Winbox9 processes in connection with the provision of the Platform.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, organisation, structuring, adaptation, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" means Winbox9, which determines the purposes and means of Processing of Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider engaged by Winbox9 to Process Personal Data on Winbox9's behalf, in accordance with Winbox9's instructions and this Policy.
• "Cookies" means small text files stored on Your device by Your browser when You visit the Platform, which may collect certain usage and preference data.
• "KYC" means Know Your Customer — the identity verification process Winbox9 applies to Members prior to processing withdrawal requests or at its sole compliance-driven discretion.

Winbox9 collects Personal Data through several channels in connection with the operation of the Platform. The categories of data we collect include the following:

3.1 Registration & Account Data

When You create a Winbox9 Account, we collect the information You provide during the registration process, including:

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and responsible gambling obligations, Winbox9 may request and retain identity verification documents, which may include:

3.3 Financial & Transaction Data

When You make deposits or request withdrawals through the Platform, we process transaction data necessary to facilitate payments via Malaysian payment methods including Touch'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Connect, Visa/Mastercard, and cryptocurrency networks (BTC, USDT, USDC). This includes transaction amounts in MYR or equivalent, timestamps, payment reference numbers, and payment method identifiers. We do not store complete card numbers or full banking credentials on our servers.

3.4 Usage & Behavioural Data

Winbox9 automatically collects technical and behavioural data when You use the Platform, including IP addresses, device type and operating system, browser type and version, pages visited, session duration, in-game actions, betting patterns, and interaction with promotional content. This data is used primarily for security, platform improvement, and responsible gambling monitoring purposes.

3.5 Communications Data

When You contact Winbox9's support team via live chat or email, we retain records of those communications for quality assurance, compliance, and dispute resolution purposes.

3.6 Data Provided Voluntarily

You may also voluntarily provide additional information through surveys, feedback mechanisms, or VIP programme onboarding processes. Such information is collected and processed in accordance with this Policy.

Winbox9 processes Your Personal Data only for the specific, explicit, and legitimate purposes described below. We do not process Personal Data in a manner incompatible with those stated purposes.

Winbox9 processes Personal Data on the following legal grounds, depending on the specific processing activity involved:

5.1 Contractual Necessity

The majority of Personal Data processing conducted by Winbox9 is necessary for the performance of the contract between Winbox9 and the Member — specifically, to operate the Platform, process transactions, manage accounts, and deliver the gaming and betting services that Members have registered to receive.

5.2 Legal Obligation

Certain processing activities are required by applicable law, including anti-money laundering (AML) regulations, know-your-customer (KYC) compliance obligations, international licensing requirements, and any applicable data retention laws. Winbox9 is obligated to process and retain certain data categories as a condition of its international operating licence.

5.3 Legitimate Interests

Winbox9 may process Personal Data on the basis of legitimate interests, including fraud prevention, platform security, abuse detection, product improvement through aggregated analytics, and responsible gambling monitoring. Where Winbox9 relies on legitimate interests, we ensure that those interests are proportionate and do not unduly override Your privacy rights.

5.4 Consent

Where processing is based on Your consent — for example, for receiving promotional communications or marketing materials — You have the right to withdraw that consent at any time by contacting our support team via live chat or by managing your notification preferences within your Account settings. Withdrawal of consent does not affect the lawfulness of any processing conducted prior to withdrawal.

Winbox9 does not sell, rent, or trade Your Personal Data to third parties for commercial purposes. We may share Your Personal Data with the following categories of recipients, strictly for the purposes described in this Policy:

6.1 Payment Service Providers

To process financial transactions, Winbox9 shares necessary payment data with licensed payment service providers and financial institutions operating the payment channels available on the Platform, including but not limited to Malaysian e-wallet operators (Touch 'n Go eWallet, Boost), DuitNow and FPX network operators, domestic banks (Maybank, CIMB, Public Bank, Hong Leong), international card networks (Visa, Mastercard), and cryptocurrency exchange processors. Such providers are bound by their own applicable data protection and financial regulatory obligations.

6.2 Identity Verification Partners

Winbox9 may engage third-party KYC and identity verification service providers to conduct document checks, liveness verification, and sanctions screening. These providers process only the data strictly necessary to complete verification procedures and are contractually bound to data processing terms consistent with this Policy.

6.3 Technology and Infrastructure Providers

Winbox9 utilises third-party cloud hosting, database management, security monitoring, and analytics service providers to operate the Platform. These providers act as Data Processors on Winbox9's behalf and are bound by data processing agreements that restrict their use of Personal Data to the services they provide to Winbox9.

6.4 Legal and Regulatory Authorities

Winbox9 may disclose Personal Data to governmental authorities, law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, valid legal process, court order, or to protect the rights, property, or safety of Winbox9, its Members, or the public.

7.1 What We Use

The Winbox9 Platform uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage objects) to recognise Your browser, store preferences, maintain session state, and gather aggregated usage analytics that help us improve the Platform experience.

7.2 Types of Cookies

7.3 Managing Cookies

You may configure Your browser settings to block or delete cookies at any time. Note that disabling strictly necessary cookies may prevent certain Platform features — including login and account access — from functioning correctly. Winbox9 does not use third-party advertising cookies or tracking pixels for external remarketing purposes.

Winbox9 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and licensing obligations. The following general retention principles apply:

• Active Account Data: Retained for the full duration of your Account's active status and for a minimum of five (5) years following account closure, in compliance with international anti-money laundering record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years following account closure or the conclusion of the last financial transaction, whichever is later, in accordance with AML compliance obligations applicable to Winbox9's licensing jurisdiction.
• Transaction Records: Retained for a minimum of seven (7) years for financial audit and regulatory compliance purposes.
• Support Communications: Retained for three (3) years from the date of the communication, for dispute resolution and quality assurance purposes.
• Anonymised Analytics Data: May be retained indefinitely in anonymised, aggregated form, as such data does not constitute Personal Data once de-identified.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with Winbox9's internal data management protocols.

Winbox9 implements a comprehensive set of technical and organisational security measures designed to protect Your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• Password hashing using industry-standard cryptographic algorithms — plain-text passwords are never stored;
• Two-factor authentication (2FA) available for all Member accounts to provide an additional layer of login security;
• Segregated server infrastructure isolating player financial data from public-facing Platform components;
• Continuous real-time security monitoring and intrusion detection systems;
• Regular internal security audits and penetration testing conducted by qualified technical personnel;
• Strict access controls limiting employee access to Personal Data on a need-to-know basis only.

Notwithstanding these measures, no digital transmission or storage system can guarantee absolute security. In the unlikely event of a personal data breach that poses a risk to Your rights, Winbox9 will notify affected Members and applicable supervisory authorities in accordance with applicable data protection laws.

Subject to the conditions and limitations imposed by applicable data protection law, You hold the following rights in respect of Your Personal Data processed by Winbox9. To exercise any of these rights, please contact us via24/7 live chat or at the email address provided in Section 15 of this Policy.

If Winbox9 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through misrepresentation during registration or any other means — we will immediately suspend the relevant Account, delete all associated Personal Data to the extent permitted by law, and void any financial transactions conducted by that Account.

Parents and guardians who have reason to believe that a minor under their care has registered an Account or provided Personal Data to Winbox9 are strongly encouraged to contact our support team via live chat immediately so that appropriate action may be taken without delay.

The Winbox9 Platform may contain references to or integrations with third-party payment processors, game providers, and technology services. Where such third-party services operate under their own distinct privacy policies and data processing frameworks, Winbox9 does not assume responsibility for the data practices of those third parties.

Members are encouraged to review the privacy policies of any third-party payment service they use in connection with Winbox9 transactions — including the terms applicable to Touch 'n Go eWallet, Boost, and other Malaysian e-wallet platforms — as those terms govern how those providers handle financial and identity data exchanged through their networks.

As a platform operating under an international gaming licence, Winbox9 may transfer certain categories of Personal Data to servers, infrastructure providers, or processing partners located in jurisdictions outside Malaysia. Any such international transfer of Personal Data is conducted only where Winbox9 has implemented appropriate safeguards to ensure a level of data protection consistent with applicable data protection standards, including:

• Standard contractual clauses or equivalent data transfer mechanisms binding the receiving party to data protection obligations aligned with GDPR principles;
• Selection of infrastructure and processing partners located in jurisdictions recognised as providing an adequate level of personal data protection;
• Contractual restrictions limiting the recipient's use of transferred data solely to the specific processing services engaged by Winbox9.

Players in Malaysia acknowledge that the Personal Data Protection Act 2010 (PDPA) of Malaysia may apply to certain aspects of how their data is processed. Winbox9 endeavours to align its data practices with PDPA principles of transparency, integrity, and security.

Winbox9 reserves the right to review, update, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business operations, or data processing practices. The "Last Updated" date displayed at the top of this page will be revised each time a material change is made.

Where changes to this Policy are material, Winbox9 will notify registered Members through a prominent notice on the Platform, or where practicable, via email to the address associated with their Account. Your continued use of the Platform following any amendment to this Policy constitutes your acceptance of the revised Policy.

If You disagree with any amendments to this Policy, You must cease use of the Platform and may request Account closure by contacting our support team.

For all privacy-related queries, data subject rights requests, or concerns regarding Winbox9's data processing practices, please contact us using the following channels:

• 24/7 Live Chat: Available directly on the Platform — fastest channel for data access requests, consent withdrawal, or urgent privacy concerns. Our support team will escalate data subject requests to the relevant internal team.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request — [Your Username]" so that your query is directed to the appropriate team promptly.

If You are Malaysian resident and believe that your Personal Data has been processed in a manner inconsistent with the Personal Data Protection Act 2010, You have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP). Information on how to do so is available on the official Malaysian government portal.