Privacy Policy — Datowin

This Privacy Policy ("Policy") describes how Datowin ("we", "us", "our", "the Platform") collects, processes, stores, and protects the personal data of users ("you", "the User", "the Player") who access or use the services available at https://datowin.cam, including online casino games, live dealer games, sports betting, and all associated account management and customer support functions.

Datowin is committed to responsible data handling and aligns its privacy practices with the principles of the General Data Protection Regulation (GDPR) as a globally recognised standard of best practice, notwithstanding the jurisdictional basis of our operations. We are equally attentive to the data rights of Malaysian users and take our obligations under international data protection principles seriously.

By registering an account on datowin, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not register an account or use the platform's services.

The following defined terms are used throughout this Policy:

Datowin collects personal data across several categories depending on how you interact with the platform. The following table summarises the types of data collected, examples of each, and the context in which they are gathered:

We do not collect sensitive personal data such as biometric data, racial or ethnic origin, political opinions, religious beliefs, or health data, unless specifically required for enhanced KYC verification in limited circumstances.

Personal data is collected through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, using live chat or email support, or submitting feedback.
• Automated technical collection: Technical data such as IP address, device identifiers, and session information is automatically captured when you access the datowin platform, using server logs and first-party cookies.
• Payment and verification partners: Where you complete a DuitNow transfer, FPX transaction, or e-wallet payment (Touch 'n Go, Boost, GrabPay), our payment processing partners share transaction confirmation data — including the reference ID and amount — with datowin to facilitate deposit and withdrawal processing.
• KYC verification partners: Identity documents submitted for KYC are processed by our appointed third-party verification provider, which returns a verification result to datowin. The raw document images may be retained by the verification partner in accordance with their own privacy policies and applicable AML regulations.
• Responsible gambling interactions: When you configure deposit limits, request self-exclusion, or use other responsible gambling tools, this data is recorded against your account to ensure the restrictions are applied correctly and maintained across all sessions.

Datowin processes your personal data for the following purposes:

• Account creation and management: To create, maintain, and operate your datowin player account, including authentication, balance management, and account security.
• Identity and age verification (KYC): To verify that you are aged 21 or above and to confirm your identity before processing withdrawals, in compliance with our anti-money laundering obligations.
• Payment processing: To process deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and USDT TRC20; and to process approved withdrawal requests to your registered payment method.
• Platform delivery and improvement: To ensure the platform operates correctly, to identify and resolve technical issues, and to analyse platform performance in order to improve the user experience for Malaysian players.
• Fraud prevention and security: To detect and investigate potentially fraudulent activity, multi-accounting, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gambling compliance: To record and enforce responsible gambling restrictions including deposit limits, self-exclusion, and cooling-off periods. This data is treated with the highest level of sensitivity.
• Legal and regulatory compliance: To comply with applicable anti-money laundering (AML) regulations, record-keeping obligations, and requests from lawful authorities.
• Customer support: To handle enquiries, resolve disputes, and communicate with you regarding your account via live chat and email.
• Marketing communications: Where you have opted in, to send you promotional offers, bonus notifications, and platform updates. You may opt out of marketing communications at any time via your account settings or by contacting support.

Datowin processes your personal data under the following legal bases, in alignment with GDPR principles:

• Contractual necessity: Processing necessary to perform our contractual obligations to you — including account operation, payment processing, and service delivery — is conducted on the basis that such processing is required to fulfill the agreement between you and datowin.
• Legal obligation: Certain processing activities — including KYC identity verification and AML record-keeping — are carried out to comply with applicable legal and regulatory requirements binding upon datowin as an internationally licensed gaming operator.
• Legitimate interests: Fraud prevention, platform security, technical performance monitoring, and responsible gambling enforcement are conducted on the basis of datowin's legitimate interests in operating a safe, fair, and compliant platform. We conduct proportionality assessments to ensure these interests do not override your fundamental rights.
• Consent: Where we rely on consent — specifically for marketing communications and for any processing that is not strictly necessary for platform operation — you retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

Datowin does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties where strictly necessary and under appropriate contractual safeguards:

• Payment processors: E-wallet providers (Touch 'n Go, Boost, GrabPay), banking platforms (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency processors (USDT TRC20 gateway). These parties receive only the data required to process the specific transaction and are bound by their own privacy obligations and relevant financial regulations.
• KYC and identity verification providers: Our appointed KYC partner processes identity documents submitted during the account verification process. This partner operates under a data-processing agreement with datowin and is prohibited from using your data for any purpose other than identity verification.
• Game content providers and studios: Where game sessions are provided by third-party studios integrated into the datowin platform, technical session data (e.g., session token, game round ID) may be shared with the studio for the purpose of game delivery and dispute resolution. Personal identity data is not shared with game studios.
• IT infrastructure and security providers: Cloud hosting, DDoS mitigation, and security monitoring partners may process technical data as part of service delivery. These providers operate as data processors under contractual obligations consistent with this Policy.
• Legal and regulatory authorities: Datowin will disclose personal data to law enforcement, regulatory authorities, or licensing bodies where legally compelled to do so, or where such disclosure is necessary to protect the rights, property, or safety of datowin, its users, or the public.

Datowin operates on infrastructure hosted in jurisdictions that may be outside Malaysia. Where personal data is transferred to, stored in, or processed in countries that may not have data protection laws equivalent to those in force in Malaysia or the European Economic Area, datowin implements appropriate safeguards to ensure your data remains protected to a consistent standard.

Safeguards for international transfers include, but are not limited to:

• Data-processing agreements incorporating standard contractual clauses modelled on GDPR-equivalent protections
• Technical measures including encryption in transit and at rest
• Contractual restrictions limiting recipient use of data to the specified processing purpose
• Periodic review of third-party data handling practices to ensure ongoing adequacy

By using the datowin platform, you acknowledge that your data may be transferred, stored, and processed outside Malaysia in accordance with these safeguards.

Datowin retains personal data only for as long as is necessary for the purposes for which it was collected, taking into account legal, regulatory, and operational requirements. The following general retention periods apply:

• Active account data: Retained for the duration of the account's active status plus a minimum of five (5) years following account closure, to comply with AML record-keeping obligations.
• KYC identity documents: Retained for a minimum of five (5) years from the date of submission, consistent with standard anti-money laundering regulatory requirements applicable to internationally licensed gaming operators.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in line with applicable financial record-keeping standards.
• Customer support communications: Retained for three (3) years from the date of the most recent communication, for dispute resolution and quality assurance purposes.
• Gaming and betting session logs: Retained for two (2) years from the date of each session, for fraud prevention, dispute resolution, and platform analytics.
• Marketing opt-in/opt-out records: Retained for three (3) years from the date of the most recent preference change, for compliance with marketing consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the resulting anonymised dataset no longer constitutes personal data and may be retained for statistical purposes.

The datowin platform uses first-party cookies and similar technologies to support platform functionality and to collect analytical data about platform usage. We do not use third-party advertising cookies, retargeting pixels, or cross-site behavioural tracking technologies.

The following categories of cookies are used on the datowin platform:

• Essential / Functional Cookies: Strictly necessary for the platform to operate. These include session authentication cookies, language preference cookies, and responsible gambling configuration cookies. These cannot be disabled without materially affecting your ability to use the platform.
• Analytics Cookies: First-party cookies used to understand how users navigate the platform — including pages visited, session duration, and feature usage. This data is aggregated and does not identify individual users. Analytics data is used solely to improve the datowin platform experience for Malaysian players.
• Security Cookies: Used to detect and prevent fraudulent access attempts, unusual login patterns, and other security threats. These cookies support our fraud prevention obligations.

You may configure your browser to reject or delete cookies. Please note that disabling essential cookies will impair the platform's functionality and may prevent you from accessing certain features, including account login and responsible gambling tools.

Datowin recognises the following data rights and will act on valid requests within thirty (30) calendar days of receipt, unless an extension is required for complex requests (in which case we will notify you within the initial 30-day period):

• Right of Access: You have the right to request confirmation of whether datowin holds personal data about you, and to receive a copy of that data in a commonly used electronic format.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. Note that corrections to identity data may require re-submission of KYC documents.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to overriding legal obligations — datowin is required to retain certain data for AML compliance purposes and cannot delete such data upon request during the applicable retention period.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis, including profiling for fraud prevention purposes. Where we cannot demonstrate compelling legitimate grounds that override your interests, we will cease the processing in question.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our support team via live chat or by email at the address provided in Section 16 of this Policy. We may need to verify your identity before processing a data rights request to ensure we do not disclose personal data to an unauthorised third party.

The datowin platform is strictly intended for adults aged 21 years and above. Datowin does not knowingly collect, process, or store personal data relating to persons under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If datowin becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the account, investigate the matter, delete the data in question to the extent permitted by applicable legal obligations, and return any deposited funds to the originating payment method.

If you are a parent or guardian and have reason to believe that a minor under your care has registered an account on datowin, please contact our support team immediately at the address provided in Section 16. We will treat such reports with the highest priority.

Datowin implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the datowin platform is encrypted using TLS 1.2 / 1.3 with 256-bit AES encryption — the same standard used by major Malaysian financial institutions.
• Encryption at rest: Sensitive personal data and financial records stored on datowin's servers are encrypted at rest using AES-256 encryption.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. Access privileges are reviewed periodically and revoked immediately upon staff departure or role change.
• Penetration testing: Datowin's platform and infrastructure undergo regular external security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: We maintain documented data breach response procedures. In the event of a personal data breach that poses a risk to affected users, we will notify those users and relevant authorities within the timeframe required by applicable law.
• Fraud monitoring: Automated systems monitor for unusual login behaviour, suspicious transactions, and other indicators of account compromise or fraud, triggering alerts and account protections where necessary.

While datowin takes all reasonable steps to protect your personal data, no system is entirely immune to security risks. You are responsible for maintaining the confidentiality of your account password and for promptly notifying us of any suspected unauthorised access to your account.

The datowin platform may contain references to or integrations with third-party services, including payment gateway interfaces for Touch 'n Go eWallet, DuitNow, FPX, and other providers. When you interact with these third-party interfaces, you may be subject to the privacy policies of those providers, which are independent of this Policy.

Datowin is not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of payment providers and any other third-party services you interact with in connection with your use of the datowin platform.

Where datowin shares your data with third-party processors (as described in Section 7), such sharing is conducted under data-processing agreements that restrict the third party's use of your data to the specified purpose. However, the third party's general privacy practices are governed by their own policies and applicable law.

Datowin reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will update the "Last Updated" date displayed at the top of this page. For changes that materially affect your rights or the way we process your personal data, we will, where practicable, notify registered users via the email address associated with their account prior to the changes taking effect.

We encourage you to review this Policy periodically to remain informed of how we handle your personal data. Your continued use of the datowin platform following the publication of any amendment constitutes your acknowledgement of the updated Policy.

If you do not accept any amendment, you must cease using the platform and may request account closure in accordance with our Terms & Conditions. Upon account closure, your data will be retained for the periods specified in Section 9 of this Policy, as required by applicable law.

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the datowin privacy and support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the datowin platform. For data rights requests, please identify your query as a "privacy request" at the start of the conversation so it can be directed to the appropriate team.
• Email: [email protected] — privacy-related requests will be acknowledged within 3 business days and resolved within 30 calendar days.
• Language: Our support team handles enquiries in both English and Bahasa Malaysia.

When submitting a data rights request, please include your registered account username and email address to allow us to locate and verify your account before processing the request. We may ask for additional identity confirmation in line with our security procedures.