Privacy Policy

This Privacy Policy ("Policy") is issued by Winway33 ("the Platform", "we", "us", "our") and describes how we collect, use, store, share, and protect the personal data of individuals ("Player", "User", "you") who access or register on the Winway33 platform at winway33.cam.

Winway33 is an internationally licensed online gaming and sports betting platform serving players in Malaysia, including those located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond. Given the nature of our services — which involve financial transactions, identity verification, and account management — we handle a range of personal data and take our obligations as a data controller seriously.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling policy, which together form the full framework governing your relationship with Winway33.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably identify a living individual, including name, email address, phone number, financial account details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is Winway33.
• "Data Processor" means any third party that processes personal data on behalf of the Data Controller under a written agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a specific purpose.
• "KYC" means Know Your Customer — the identity verification process required under our licensing obligations before withdrawals are processed.
• "Sensitive Personal Data" means categories of personal data that warrant heightened protection, including government-issued identification numbers, financial account details, and health-related information where disclosed in the context of responsible gambling interactions.
• "Cookie" means a small text file stored on a user's device by a web browser at the request of a website, used to retain session information or track usage behaviour.

Winway33 collects personal data across the following categories, depending on your level of interaction with the platform:

Identity & Contact Data

Financial Data

Technical & Usage Data

Communications Data

Winway33 collects personal data through the following channels and mechanisms:

Winway33 processes your personal data only where there is a lawful basis for doing so. The following table sets out our primary processing purposes and the corresponding legal bases:

Winway33 does not sell, rent, or trade personal data. We share personal data only in the following limited and defined circumstances:

• Payment Processors: We share financial data with payment service providers — including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels — strictly for the purpose of processing your transactions. These providers are contractually bound to process data only for payment purposes.
• Identity Verification Providers: We engage licensed KYC service providers to assist in verifying the identity documents submitted by players. These providers are bound by strict data processing agreements and may not retain or use your data for their own purposes.
• Licensing Authorities: We may be required to disclose player data to our licensing authority as part of routine compliance audits or in response to specific regulatory enquiries.
• Law Enforcement & Legal Obligations: Where required by law, court order, or at the direction of a competent regulatory or law enforcement authority, Winway33 will disclose personal data as necessary. Where permitted, we will notify affected players of any such disclosure.
• Fraud Prevention Agencies: In cases of suspected fraud, money laundering, or other financial crime, we may share data with specialist fraud prevention services or financial intelligence units as required under our anti-money laundering obligations.
• Game Studio Technical Partners: Aggregated, non-personally-identifiable gameplay data (e.g., game session metadata, bet sizes in aggregate) may be shared with licensed game studios for technical performance and RNG audit purposes. This data does not identify individual players.

As an internationally operated platform, Winway33's infrastructure and some of its third-party service providers may process personal data in countries outside Malaysia. Where data is transferred internationally, Winway33 takes the following safeguards:

• We only transfer personal data to countries or entities that provide an adequate level of data protection as assessed by relevant international standards.
• Where adequate protection cannot be assumed by default, we implement standard contractual clauses or equivalent transfer mechanisms to ensure the receiving party is bound to data protection obligations equivalent to those under this Policy.
• All servers used for storing Winway33 player data at rest are located in data centres operating under internationally recognised security certifications (including ISO/IEC 27001 or equivalent).

Winway33 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods required under our operating licence and applicable regulatory obligations:

Upon expiry of the applicable retention period, personal data is either securely deleted from our systems or anonymised such that it can no longer be attributed to any individual.

Winway33 uses cookies and similar tracking technologies (including local storage and session tokens) to ensure the platform operates correctly and securely. We do not use third-party advertising cookies or behavioural targeting technologies.

The types of cookies deployed by Winway33 are categorised as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They include session authentication tokens, security cookies that protect against cross-site request forgery (CSRF), and language preference cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: These remember your preferences — such as your preferred language, display settings, and responsible gambling limit configurations — to personalise your experience on return visits.
• Analytical Cookies: Winway33 uses privacy-first analytics tools to understand aggregate platform usage patterns — including which game categories are most popular and which support pathways are most frequently used. This data is processed in anonymised or pseudonymised form and is not linked to individual user profiles.

Subject to applicable data protection principles and our legal retention obligations, you hold the following rights in relation to your personal data held by Winway33:

To exercise any of the above rights, please contact our support team via live chat or email at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing any request and respond within 30 days. Complex requests may require an additional 30-day extension, which will be communicated to you in advance.

Winway33 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption in Transit: All data exchanged between your browser or app and Winway33 servers is protected by 256-bit SSL/TLS encryption. We enforce HTTPS across all platform endpoints with no insecure fallback.
• Encryption at Rest: Sensitive personal data — including identification documents, financial account details, and hashed passwords — is stored in encrypted form using industry-standard algorithms.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their accounts. All administrative access to Winway33 internal systems requires multi-factor authentication.
• Access Controls: Personal data is accessible internally only on a strictly need-to-know basis. Role-based access controls ensure that support agents, finance teams, and compliance personnel can access only the data categories necessary for their function.
• Security Monitoring: Winway33 operates a 24/7 security monitoring function that reviews access logs, detects anomalous activity, and responds to potential data security incidents in real time.
• Penetration Testing: We commission regular third-party penetration tests of the Winway33 platform infrastructure. Critical findings are remediated within defined SLA windows.
• Data Breach Response: In the event of a personal data breach that poses a risk to affected individuals, Winway33 will notify the relevant supervisory authority within the timeframe required under applicable obligations and notify affected players without undue delay.

Winway33 operates an age-21-minimum policy for all registered users. The platform does not knowingly collect personal data from individuals under the age of 21. Registration requires a date of birth entry that is cross-referenced during KYC verification.

If we become aware that personal data has been collected from an individual under the age of 21 — whether through a misrepresentation of age at registration or any other means — we will immediately suspend the relevant account, conduct an investigation, and permanently delete the data associated with that account. Any deposits associated with an under-age account will be returned to the payment source where possible.

If you have reason to believe that a minor is accessing Winway33, please contact us immediately at [email protected] with details so we can investigate and act promptly.

Winway33 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or our data processing practices. The date of the most recent revision is displayed prominently at the top of this page.

Where a material change is made to this Policy — specifically one that significantly affects your rights or alters how we handle your data — Winway33 will provide advance notice to active registered players via email or an in-platform notification, giving you reasonable time to review the changes before they take effect.

Your continued use of the Winway33 platform after a Policy update constitutes acceptance of the revised terms. If you do not agree with the updated Policy, you are entitled to close your account as described in our Terms & Conditions.

We recommend reviewing this Privacy Policy at least quarterly, particularly if you regularly use the platform for deposits, withdrawals, or bonus activities involving the disclosure of financial data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data Winway33 holds about you, please reach out through the following channels:

• Live Chat: Available 24/7 on the Winway33 platform — average first response time under 4 minutes. This is the fastest channel for general privacy queries.
• Email: [email protected] — for formal data rights requests, please use subject line "Data Rights Request" and include your account username.
• Languages supported: English, Bahasa Melayu, and Mandarin Chinese.