OneWin Privacy Policy

Introduction

This Privacy Policy ("Policy") sets out the basis on which OneWin ("OneWin", "we", "us", "our") collects, uses, processes, discloses, and protects personal data obtained from individuals ("you", "User", "Data Subject") who access or use our online gaming platform at onewin.cam ("Platform").

OneWin is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy has been drafted to reflect best-practice data governance standards and to provide you with clear, accessible information about how your data is managed throughout your relationship with OneWin.

This Policy applies to all personal data collected through: the OneWin website and mobile-optimised interface; account registration and KYC processes; deposit and withdrawal transactions conducted via Malaysian payment methods including Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, GrabPay, Boost, and Hong Leong Connect; customer support interactions; and any other service-related communications between you and OneWin.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and digital identifiers such as IP addresses and cookies.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, alteration, retrieval, consultation, transmission, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. OneWin is the Data Controller for personal data collected via the Platform.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under a formal data processing agreement.
• "Data Subject" means the natural person to whom personal data relates — in this context, any registered or visiting User of the OneWin Platform.
• "KYC" means Know Your Customer — the identity verification process required before a User may process withdrawals from the Platform.
• "Consent" means freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data for a specified purpose.
• "Legitimate Interest" means a lawful ground for processing personal data where such processing is necessary for the genuine interests of OneWin or a third party, provided those interests are not overridden by the Data Subject's rights.

Data Controller Information

OneWin is the Data Controller responsible for the personal data collected and processed via the Platform at onewin.cam. As Data Controller, OneWin determines the purposes for which personal data is collected and the means by which it is processed.

OneWin operates its Platform in compliance with applicable international gaming licensing requirements and applicable data protection legislation. All data processing activities are conducted in accordance with the data protection obligations embedded within OneWin's operating licence conditions.

Data We Collect

OneWin collects personal data across several categories depending on your interactions with the Platform. The table below provides a structured overview of the types of data collected, the source of collection, and the purpose for which each category is gathered.

4.1 Data You Provide Directly

The majority of personal data OneWin holds is provided directly by you through registration, KYC document submission, payment transactions, and support communications. You are under no statutory obligation to provide this data; however, failure to provide data required for KYC or payment processing will prevent you from accessing withdrawal functionality or certain Platform features.

4.2 Data Collected Automatically

When you access the OneWin Platform, certain technical data is collected automatically through server logs, cookies, and similar tracking technologies. This includes your IP address, device identifiers, session duration, pages visited, and geolocation at country or region level. This data is used for fraud prevention, security monitoring, regulatory compliance, and to improve Platform performance.

4.3 Data from Third Parties

OneWin may receive personal data from third-party payment processors (such as FPX, DuitNow, or e-wallet providers) in the course of processing your deposit and withdrawal transactions. We may also receive verification data from identity verification service providers engaged as part of our KYC process. Such data is used only for the purpose for which it was shared and is handled in accordance with this Policy.

Legal Basis for Processing

OneWin processes your personal data on one or more of the following lawful bases, in accordance with applicable data protection principles:

• Contractual Necessity: Processing required to fulfil our obligations under the contract we have with you as a registered User — including account management, processing deposits and withdrawals, settling bets and casino game outcomes, and providing customer support.
• Legal Obligation: Processing required to comply with legal and regulatory obligations, including anti-money laundering (AML) requirements, KYC identity verification obligations, and age verification to enforce the 21+ restriction.
• Legitimate Interests: Processing conducted in pursuit of OneWin's legitimate business interests, including fraud prevention, security monitoring, improving Platform performance, and ensuring the integrity of gaming operations — provided such processing does not override your fundamental rights and freedoms.
• Consent: Where we rely on your explicit consent as the legal basis for processing — such as for direct marketing communications, cookie-based analytics, or certain optional features — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How We Use Your Data

Personal data collected by OneWin is used for the following specific purposes. We will not use your data for any purpose that is incompatible with those listed below without first providing you with notice and, where required, obtaining your consent.

• Account Management: Creating, maintaining, and administering your OneWin account, including processing login credentials, storing account preferences, and handling account closure requests.
• Identity Verification (KYC): Verifying your identity, age, and eligibility to use the Platform in compliance with our regulatory obligations and the 21+ age restriction enforced across all OneWin accounts.
• Payment Processing: Processing deposits and withdrawal transactions in MYR via Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, GrabPay, Boost, Hong Leong Connect, and cryptocurrency methods.
• Gaming Services: Delivering the core Platform functionality, including live dealer games, slot titles, sports betting markets, and account balance management.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, AML violations, and other prohibited activities identified in our Terms & Conditions.
• Customer Support: Responding to support queries, resolving disputes, processing complaints, and maintaining records of support interactions for quality and compliance purposes.
• Responsible Gambling: Administering self-exclusion tools, deposit limits, loss limits, and session time restrictions as requested by Users, and monitoring for patterns indicative of problem gambling behaviour.
• Regulatory Compliance: Meeting mandatory reporting, record-keeping, and data retention obligations imposed by our operating licence conditions and applicable law.
• Marketing & Communications: Sending promotional offers, bonus notifications, and service updates to Users who have opted in to receive such communications. Marketing messages may be opted out of at any time.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve Platform performance, user experience, and the quality of games and betting markets offered.

Data Sharing & Disclosure

OneWin does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data is disclosed to third parties only in the circumstances described below:

7.1 Service Providers and Data Processors

OneWin engages third-party service providers who process personal data on our behalf under formal data processing agreements. These providers include: payment processors and banking partners (for deposit and withdrawal facilitation); identity verification and KYC service providers; cloud hosting and data storage providers; fraud detection and anti-money laundering screening services; and customer support platform providers. All such processors are contractually bound to process data only in accordance with OneWin's instructions and this Privacy Policy.

7.2 Game Providers

Where necessary to deliver live dealer and slot game functionality, limited technical data (such as session tokens and game identifiers) may be shared with OneWin's game content partners. No personally identifiable financial data or KYC documents are shared with game providers.

7.3 Regulatory and Legal Disclosures

OneWin may be required to disclose personal data to regulatory authorities, licensing bodies, law enforcement agencies, or courts of competent jurisdiction where: required by applicable law or legal process; necessary to protect the rights, property, or safety of OneWin, its Users, or the public; or required in connection with our AML obligations. We will notify you of any such disclosure where legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of OneWin's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any resulting material change to this Privacy Policy prior to the effective date of the transaction.

Cookies & Tracking Technologies

8.1 Types of Cookies Used

The OneWin Platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain session security, and gather analytical data. The following categories of cookies are deployed:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, layout choices, and responsible gambling tool configurations, to provide a more personalised experience.
• Analytical Cookies: Used to collect aggregated, anonymised data about how Users navigate and interact with the Platform, enabling us to improve performance and content relevance. Analytical cookies are deployed only with your consent.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent account activity, multi-accounting, and bot-driven behaviour by tracking device fingerprints and session patterns.

8.2 Managing Cookies

You may configure your browser settings to refuse or delete non-essential cookies at any time. However, disabling strictly necessary cookies will impair your ability to log in, maintain a session, or complete transactions on the Platform. Instructions for managing cookies are available in the Help section of all major browsers.

Data Retention

OneWin retains personal data only for as long as necessary to fulfil the purpose for which it was collected, to comply with legal obligations, or to resolve disputes and enforce agreements. The following retention periods apply as general guidance:

• Account and Identity Data (KYC): Retained for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements. Extended retention may apply where legal proceedings are pending or required by regulatory instruction.
• Transaction and Financial Records: Retained for a minimum of 5 years following the date of the relevant transaction, as required for AML compliance and financial regulatory obligations.
• Gaming Activity Records: Retained for a minimum of 3 years following account closure, for dispute resolution, regulatory audit, and responsible gambling monitoring purposes.
• Support and Communications Records: Retained for 2 years following the date of the final communication, unless the subject matter relates to a formal complaint or legal matter.
• Marketing Preference Records: Retained until you withdraw consent or opt out of marketing communications, plus 1 year thereafter as evidence of your consent status.
• Technical and Log Data: Retained for up to 12 months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction methods. Anonymised data, which can no longer identify you, may be retained indefinitely for analytical and statistical purposes.

Data Security

OneWin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption: All data in transit between your device and the Platform is protected by 256-bit SSL/TLS encryption. Sensitive data at rest, including KYC documents and financial records, is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within OneWin's systems is restricted on a strict need-to-know basis, governed by role-based access control policies and enforced through multi-factor authentication for all staff.
• Penetration Testing: OneWin's technical infrastructure undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Fraud Monitoring: Automated and manual monitoring systems operate around the clock to detect unusual account activity, suspicious transactions, and potential security threats.
• Incident Response: A formal data breach response plan is maintained and tested periodically. In the event of a confirmed breach affecting your personal data, you will be notified promptly, and OneWin will take all necessary steps to contain and remediate the incident.

While OneWin takes all reasonable precautions to protect your data, no system is completely impervious to determined attack. You also hold responsibility for maintaining the security of your account credentials and for reporting any suspected unauthorised access immediately.

International Data Transfers

As an internationally operating platform, OneWin may process or store your personal data in jurisdictions outside Malaysia. Where personal data is transferred to countries that do not offer a comparable level of data protection to that in Malaysia, OneWin ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses in data processing agreements with service providers, requiring them to apply equivalent data protection standards to those described in this Policy;
• Transfer impact assessments conducted prior to any new international data transfer arrangement; and
• Selection of service providers who operate within jurisdictions with recognised adequate data protection frameworks.

A list of the jurisdictions to which data may be transferred and the safeguards in place is available upon written request submitted to our support team. All international transfers are documented and reviewed annually.

Your Rights as a Data Subject

Subject to applicable data protection legislation, you hold the following rights in relation to the personal data OneWin processes about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Subject Rights Request".

OneWin will acknowledge all data subject rights requests within 24 hours and will provide a substantive response within 30 calendar days of receipt. Complex requests may require an additional 30-day extension, which we will notify you of in advance. OneWin will not charge a fee for processing standard data subject requests.

Children & Minors

The OneWin Platform is strictly intended for individuals who are 21 years of age or older. OneWin does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and any account found to belong to a minor will be immediately closed.

If you believe that a minor has submitted personal data to OneWin without appropriate parental consent, please contact us immediately at [email protected]. We will take all necessary steps to locate and delete such data as promptly as possible, subject to any mandatory legal retention requirements.

Parents and guardians who are concerned about potential exposure of minors to online gambling content are encouraged to use parental control software to restrict access to gambling websites. OneWin supports the responsible use of such tools and recommends their deployment on any device accessible to persons under the age of 21.

Third-Party Links

The OneWin Platform may contain references to or context about third-party payment systems, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect. While we mention these services by name for informational clarity, OneWin does not operate these external services and has no control over their privacy practices.

When you interact with a third-party payment gateway or service in connection with your OneWin account, that interaction is governed by the privacy policy of the respective third party. OneWin encourages you to review the privacy policies of all payment service providers you use in connection with your account to understand how they handle your financial and personal data.

OneWin bears no responsibility for the privacy practices, content, or data security standards of any third-party services referenced on or integrated with the Platform.

Amendments to This Policy

OneWin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, data protection best practices, or changes to our data processing activities.

Material amendments — those that significantly affect how we collect, use, or share your personal data — will be communicated to registered Users via email to the address on your Account, at least 14 days prior to the effective date of the change. A notice will also be displayed prominently on the Platform during the notice period.

Non-material amendments, such as corrections to typographical errors, clarifications of existing practices, or updates to contact information, may be made without advance notice. The effective date displayed at the top of this Policy will be updated to reflect any revision.

Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you object to the amended Policy, you should discontinue use of the Platform and contact us to request account closure.

Contact Us & Data Requests

For all privacy-related enquiries, data subject rights requests, or concerns about how OneWin handles your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 on the OneWin Platform. Suitable for general privacy queries and time-sensitive matters. Our support agents are available every day including Malaysian public holidays.
• Email — Data Protection Enquiries: [email protected] — use the subject line "Privacy / Data Request" for faster routing to our data protection team.

Our support team covers both English and Bahasa Malaysia. Response times for data protection enquiries are as follows: acknowledgement within 24 hours; substantive response within 30 calendar days. Complex or voluminous requests may require an additional 30-day extension, of which you will be notified in advance.