Privacy Policy

This Privacy Policy ("Policy") is issued by Winbox2 ("we", "us", "our", "Platform") and governs the collection, processing, storage, and disclosure of personal data relating to registered users ("User", "you", "your") and visitors to the Winbox2 platform, accessible at winbox2.cam and any associated mobile applications or digital services.

Winbox2 understands that privacy is a fundamental right. We are fully committed to handling your personal data with care, transparency, and accountability. This Policy is designed to give you a clear and complete picture of how your data is used when you interact with the Winbox2 platform — from the moment you create an account through to every deposit, withdrawal, and gaming session thereafter.

By registering an account with Winbox2, accessing the Platform, or using any of our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should not use the Platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

Winbox2 collects personal data through a variety of channels in the course of providing our Services. The categories of personal data we collect include the following:

Winbox2 processes your personal data for the following specific and legitimate purposes:

• Account Management: To create, maintain, and administer your Winbox2 account, including authentication and account security;
• Service Delivery: To provide access to casino games, sports betting markets, live dealer products, and all other Platform Services;
• Financial Processing: To process deposits via methods such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency; and to process withdrawal requests to your verified payment method;
• Identity Verification (KYC): To verify your identity and age (21+ requirement) in accordance with anti-money laundering and responsible gambling obligations;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and other prohibited conduct;
• Regulatory Compliance: To comply with applicable international gaming regulatory requirements, AML/CFT obligations, and legal obligations including responses to lawful authority requests;
• Customer Support: To respond to your enquiries, resolve disputes, and manage support interactions;
• Responsible Gambling: To monitor for indicators of problem gambling and to administer deposit limits, self-exclusion requests, and cooling-off periods;
• Platform Improvement: To analyse usage patterns, fix bugs, optimise performance, and develop new features based on aggregated and anonymised usage data;
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Users who have opted in to receive such communications. You may opt out at any time.

Winbox2 processes your personal data on the following lawful bases:

• Contractual Necessity: Processing is necessary for the performance of the Terms and Conditions governing your use of the Winbox2 Platform, including account management, service delivery, and financial transactions;
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including AML/CFT obligations, identity verification requirements, and responses to lawful authority requests;
• Legitimate Interests: Processing is in the legitimate interests of Winbox2 for fraud prevention, platform security, and business analytics — where those interests are not overridden by your privacy rights;
• Consent: Where processing is based on your consent — for example, for direct marketing communications — you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Winbox2 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may, however, share your data with the following categories of recipients in accordance with this Policy:

• Payment Service Providers: Financial institutions and e-wallet operators — including but not limited to Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, and DuitNow — for the purpose of processing deposits and withdrawals;
• Identity Verification Services: Third-party KYC and age verification providers engaged to confirm the identity and age of Users in accordance with applicable regulations;
• Game Content Providers: Licensed third-party game suppliers who provide slot, live dealer, sports, and other game content through the Platform. These providers receive only session and game-interaction data necessary to deliver their services;
• IT and Hosting Providers: Cloud infrastructure and server hosting providers that store and transmit Platform data under strict data processing agreements;
• Analytics Providers: Aggregated and anonymised usage analytics services used to improve Platform performance and user experience;
• Regulatory and Legal Authorities: Government bodies, law enforcement agencies, or gaming regulatory authorities where disclosure is required by law, court order, or regulatory direction;
• Professional Advisers: Legal counsel, auditors, and compliance consultants bound by professional confidentiality obligations;
• Business Successors: In the event of a merger, acquisition, or sale of all or substantially all of Winbox2's assets, User data may be transferred to the successor entity, subject to equivalent data protection standards.

Winbox2 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory retention obligations. The following general retention periods apply:

• Account Data: Retained for the duration of the active account and for a minimum of five (5) years following permanent account closure, in compliance with applicable anti-money laundering record-keeping requirements;
• KYC and Identity Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with AML/CFT regulatory requirements;
• Transaction Records: All financial transaction records are retained for a minimum of five (5) years in accordance with financial regulatory obligations;
• Customer Support Communications: Retained for three (3) years following the closure of the relevant support interaction;
• Marketing Preference Data: Retained until you withdraw your consent or request erasure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents its re-identification. Where data must be retained for legal compliance purposes beyond your request for erasure, we will notify you accordingly.

Winbox2 implements robust technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Winbox2 platform is encrypted using industry-standard SSL/TLS protocols, ensuring that information in transit cannot be intercepted or read by unauthorised parties;
• Encrypted Data Storage: Sensitive personal and financial data is stored in encrypted form on secure, access-controlled servers hosted in enterprise-grade data centres;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Winbox2 employees and contractors are granted data access permissions commensurate with their specific role and are subject to binding confidentiality obligations;
• Two-Factor Authentication: 2FA is available for User account access and is strongly recommended for all registered players;
• Intrusion Detection & Monitoring: Real-time monitoring systems are in place to detect and respond to suspicious access attempts, data breaches, and network intrusions;
• Regular Security Audits: The Platform undergoes periodic security assessments and penetration testing conducted by qualified third-party security professionals.

While Winbox2 takes all reasonable steps to protect your personal data, no method of internet transmission or electronic storage is 100% secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, Winbox2 will notify affected Users in accordance with applicable regulatory requirements.

Winbox2 uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session continuity, and gather analytics data. The categories of cookies used by Winbox2 are as follows:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including maintaining your login session, processing transactions, and ensuring platform security. These cookies cannot be disabled without impairing core platform functionality;
• Functional Cookies: Enable personalisation features such as language preferences, game history, and display settings. These cookies remember your choices to enhance your experience;
• Analytical Cookies: Used to collect aggregated, anonymised data about how Users interact with the Platform, including pages visited, session duration, and navigation patterns. This data is used exclusively to improve Platform performance and user experience;
• Session Cookies: Temporary cookies that expire when you close your browser, used to maintain your active session on the Winbox2 Platform.

Winbox2 does not use third-party advertising cookies or allow third-party ad networks to place tracking technologies on the Platform. You may configure your browser to refuse cookies, though doing so may impair the functionality of certain Platform features.

Winbox2 respects your rights in relation to your personal data. Subject to applicable legal limitations and regulatory retention obligations, you have the following rights:

• Right of Access: You have the right to request a copy of the personal data Winbox2 holds about you, together with information about how it is being processed;
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held about you;
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Restriction: You have the right to request that Winbox2 restricts the processing of your personal data in certain circumstances, such as while the accuracy of the data is being contested;
• Right to Data Portability: Where processing is based on consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including direct marketing;
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

Winbox2 operates an exclusively adult platform. The Platform is strictly prohibited to any person under the age of 21. Winbox2 does not knowingly collect, process, or store personal data relating to individuals under the age of 21.

All registration attempts are subject to age declaration, and Winbox2 conducts mandatory KYC age verification before permitting withdrawals. Where Winbox2 identifies or reasonably suspects that a registered User is under 21 years of age, the account will be immediately suspended pending investigation, and any funds held in the account will be withheld. Confirmed underage accounts will be permanently closed and relevant data may be retained solely for the purpose of preventing re-registration.

If you are a parent or guardian and believe that a minor may have registered an account using false age information, please contact our support team immediately at [email protected].

Winbox2 operates as an international online gaming platform, and the processing of your personal data may involve transfers to, or access from, countries outside Malaysia. These international transfers may occur in connection with cloud infrastructure providers, game content suppliers, payment processors, and other third-party service providers with whom Winbox2 maintains data processing agreements.

In all cases where personal data is transferred internationally, Winbox2 takes reasonable steps to ensure that equivalent levels of data protection are maintained through the implementation of appropriate contractual safeguards, including standard data protection clauses and data processing agreements that impose binding obligations on the recipient party.

The Winbox2 Platform integrates with a number of third-party services to facilitate platform functionality. These include, but are not limited to, payment gateway providers (such as those processing Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency transactions), live dealer game streaming providers, sports data feed providers, and customer support tools.

Each of these third-party providers operates under their own privacy policies and data handling practices, which are independent of this Policy. Winbox2 does not accept responsibility for the privacy practices of third-party service providers. However, all third parties engaged by Winbox2 are contractually required to implement data protection measures consistent with applicable privacy standards.

The Winbox2 Platform does not contain links to external third-party websites. Users are advised to independently review the privacy policies of any payment service they use to transact with the Platform.

Winbox2 reserves the right to update, revise, or replace this Privacy Policy at any time. All revisions will be published on this page with an updated "Last Updated" date. Where changes are material, Winbox2 will make reasonable efforts to notify affected Users by email or in-platform notification prior to the changes taking effect.

Your continued use of the Winbox2 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure by contacting our support team.

We recommend that all Users review this page periodically to stay informed of how Winbox2 is protecting and managing their personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Winbox2, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within your Winbox2 account dashboard. Our support team is based in Malaysia and responds to privacy enquiries with an average first response time of under 3 minutes.
• Email: Send your privacy-related enquiry to [email protected]. Please include "Privacy Request" in the subject line and provide your registered account username to help us locate your records efficiently. We aim to respond to all written privacy enquiries within 30 days.

For requests relating to the exercise of your data subject rights (access, rectification, erasure, portability, restriction, or objection), please include your full name, registered email address, and a clear description of your request. Identity verification will be required before we can process rights requests to ensure we protect your data from unauthorised access.