28win Privacy Policy – Data Protection & Privacy for Malaysian Players

This Privacy Policy explains how 28win ("Platform", "we") collects, uses, stores, protects, and in certain circumstances shares the personal data you provide to us or that we collect while you use the 28win sports betting, online casino, poker, slots jackpot, and e-sports platform.

This policy applies to all users of the 28win platform who are based in Malaysia – whether you are a registered member actively placing football bets on the Malaysia Super League every week, a new player who has just signed up, or simply a visitor browsing our website. We want you to make informed decisions about your privacy, and this Privacy Policy is the document we use to make sure that happens.

By registering a 28win account or using our services, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read together with Terms & Conditions 28win sets out your rights and responsibilities as a user of the platform.

28win collects your personal data from various sources. Below is a full explanation of the data collected and how it is received:

Data you provide directly to 28win:

• Account registration details: full name, date of birth, Malaysian mobile number, and email address
• Identity verification documents (KYC): a copy of your MyKad or Malaysian passport uploaded during the verification process
• Payment information: your Malaysian bank account number, or the Touch 'n Go eWallet, GrabPay, Boost, ShopeePay or DuitNow digital wallet number you use for deposits and withdrawals.
• Communications with 28win: records of questions, complaints and requests you submit via Live Chat or email to our support team.
• Optional information you provide, such as sports preferences (Malaysia Super League, EPL, badminton, e-sports), used to personalise your content experience

Data collected automatically when you use 28win:

• Log and technical data: IP address, web browser type, operating system, screen resolution, and device ID
• Platform usage data: pages visited, time on page, buttons clicked, and navigation paths within the 28win platform
• Transaction data: complete records of all deposits, withdrawals, bets placed and wins or losses
• Location data: approximate location derived from IP address for eligibility verification and account security purposes
• Cookie data and similar tracking technologies – explained in further detail in Section 10

28win uses your personal data for the following purposes, all of which are necessary to operate a safe and well-managed online betting platform:

• Account management: Creating, verifying, and maintaining your 28win account, including the KYC process required for licence compliance
• Transaction processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX and other Malaysian payment methods, as well as processing your winnings withdrawals.
• Bet management: Recording, verifying, and settling all sports bets, football matches, slots jackpot sessions, poker hands, and other gaming activity on 28win
• Security and fraud prevention: Detecting and preventing unauthorised access, identity fraud, money laundering and platform abuse
• Legal compliance: Meeting legal obligations related to anti-money laundering (AML), know your customer (KYC), and applicable licence reporting requirements
• Service communications: Sending important account notices, policy updates, security alerts, and responses to customer support enquiries
• Product improvement: Analysing platform usage patterns on an anonymised basis to improve the user experience, platform speed and 28win product quality
• Marketing (with your consent): Sending promotional information, bonus offers and 28win news via email or message – only where you have given your consent. You may withdraw this consent at any time

28win processes your personal data on lawful bases in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010). Depending on the type of data and the purpose of processing, the applicable lawful bases are as follows:

• Contract performance: Processing necessary to carry out the service agreement between you and 28win – including account management, bet processing and winnings payouts
• Legitimate interests: Processing for security, fraud prevention, risk management, and platform improvement purposes necessary for responsible business operations
• Legal obligation compliance: Processing required under Malaysian law, including AML and KYC requirements and reporting to relevant authorities
• Consent: For marketing communications and non-essential cookie usage – you provide consent that can be withdrawn at any time without affecting the core services you receive from 28win

28win does not sell, rent or trade players' personal data to any third party for marketing or commercial purposes. However, there are limited situations where 28win may need to share data with certain parties:

• Payment service providers: Required transaction details are shared with payment processors such as FPX, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and DuitNow solely to process the transactions you request. These providers are bound by strict confidentiality agreements.
• Technology service providers: Companies that assist us in operating the 28win platform – such as server service providers, identity verification systems and cybersecurity infrastructure – are all bound by data processing agreements that restrict their use of data to the specified purposes only
• Legal authorities: 28win will disclose data when required by court order, official request from Malaysian law enforcement authorities, or other applicable legal reporting obligations, including AML obligations
• Audit and compliance providers: Independent auditors assessing the fairness and RNG compliance of the 28win platform may receive anonymised game data solely for certification purposes

In the course of operating the 28win platform, some data may be processed or stored on servers located outside Malaysia. When this occurs, 28win ensures that such international data transfers comply with applicable legal requirements and that your data is protected to a standard equivalent to that provided in Malaysia.

The measures 28win takes to protect your data during international transfers include:

• We work with server service providers that have recognised security track records and relevant international certifications.
• Executing binding data processing agreements with all third-party providers that receive 28win player data
• Ensuring all data is encrypted both in transit and at rest
• Restricting access to transferred data only to personnel who require it for service purposes.

28win retains your personal data only for as long as necessary to fulfil the original purpose of collection or to meet legal obligations. Retention periods vary by data type:

• Active account data: Retained for as long as your 28win account is active and for a reasonable period after closure for audit purposes
• Financial transaction records: Retained for a minimum period of seven (7) years in accordance with Malaysian legal requirements relating to financial records and AML compliance
• KYC and identity verification records: Retained for the period required by applicable legal compliance obligations — typically five (5) years after the business relationship ends
• Customer support communication logs: Retained for two (2) years for service quality purposes and dispute reference.
• Technical and log data: Retained for 90 days for security and fraud detection purposes, then deleted or anonymised.
• Marketing data: Retained until you withdraw marketing consent or request deletion

Once the retention period has expired and there is no legal obligation to continue retaining it, 28win will delete or anonymise your data in a secure and irreversible manner.

28win invests seriously in security infrastructure to protect the personal data of our Malaysian players. The technical and organisational security measures we implement include:

• Data encryption in transit: All communications between your device and 28win servers are protected with 256-bit SSL/TLS encryption – no data travels in readable plain text over the internet.
• Data encryption at rest: Sensitive data, including financial information and identity documents, is encrypted at rest within our databases.
• Strict access controls: Only 28win staff with a clear business need may access players' personal data, and all access is logged and monitored
• Two-factor authentication (2FA): Available and recommended for all 28win player accounts as an added layer of security
• 24/7 security monitoring: An active intrusion and anomaly detection system monitors the 28win platform around the clock to identify suspicious activity
• Regular penetration testing: 28win conducts regular security audits by independent experts to identify and address system vulnerabilities before they can be exploited.

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding the personal data 28win holds about you:

• Right to access: You have the right to request a copy of the personal data we hold about you. 28win will provide this within 21 days of receiving a valid request.
• Right to rectification: If you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction and we will make the necessary update within a reasonable timeframe
• Right to withdraw consent: For processing based on your consent (such as marketing emails), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing that took place prior to the withdrawal.
• Right to object: You have the right to object to the processing of your personal data for certain purposes, subject to 28win's legitimate interests or legal obligations that override this right
• Right to erasure: In certain circumstances and where no legal obligation prevents it, you may request the deletion of your personal data from 28win's records

To submit any request relating to the above rights, please contact the 28win privacy team via Live Chat or email your request to support@28win.im by stating the type of request and your account details. We will process the request within 48 business hours and provide a full response within 21 days.

28win uses cookies and similar tracking technologies to enhance the user experience, ensure the platform functions correctly and for analytical purposes. The following are the types of cookies we use:

You can manage cookie settings through your web browser. Most browsers allow you to view, delete, and block cookies from specific websites. Please note that if you block all cookies, including essential ones, some features of the 28win platform may not function correctly.

The 28win platform is strictly for users aged 18 and above. 28win does not knowingly collect, process, or store any personal data relating to individuals under the age of 18.

If you believe we may have inadvertently collected personal data from someone under the age of 18, please contact us immediately via Live Chat or email at support@28win.im. We will investigate promptly and take appropriate action, including deleting the relevant data and closing the account where applicable.

28win reserves the right to update or modify this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements or changes to the products and services we offer.

When significant changes are made to this Privacy Policy, 28win will notify you via a prominent notice on the platform or by email to the address registered to your account. The date of the most recent update is always displayed at the top of this page.

Continued use of the 28win platform after notice of changes has been given constitutes your acceptance of the updated Privacy Policy terms. If you do not agree with the changes made, you have the right to close your account and discontinue use of the 28win platform.