1. Introduction
This Privacy Policy ("Policy") is published by Winbox02 ("Winbox02", "we", "us", or "our") and applies to all personal data collected, processed, and stored in connection with the online gaming and sports betting services available at https://winbox02.cam and all associated pages, interfaces, and mobile-optimised views (collectively the "Platform").
Winbox02 is committed to protecting the privacy and personal data of all members registered on the Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. We process personal data in accordance with applicable international data protection principles and our internal data governance framework.
By registering an account on Winbox02 or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should not register an account or use the Platform.
This Policy should be read alongside the Winbox02 Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference into this document. Together these documents govern your entire relationship with the Platform.
2. Definitions
The following terms carry the meanings assigned below throughout this Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, and online identifiers. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, and deletion. |
| "Data Controller" | Winbox02, which determines the purposes and means of processing personal data collected through the Platform. |
| "Data Subject" | The natural person to whom personal data relates — in the context of this Policy, primarily registered members of the Platform. |
| "Third-Party Processor" | An entity engaged by Winbox02 to process personal data on Winbox02's behalf and under Winbox02's instructions. |
| "Cookies" | Small text files stored on a user's device by a web browser, used to remember session state, preferences, and facilitate analytics. |
| "KYC" | Know Your Customer — the identity and document verification process required before withdrawal processing and at other compliance checkpoints. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose. |
3. Data We Collect
Winbox02 collects the following categories of personal data in the course of providing its services. Data collection is limited to what is necessary for the specified purposes (the principle of data minimisation).
3.1 Identity and Registration Data
- Full legal name as it appears on a government-issued identity document;
- Date of birth (collected to verify minimum age of 21 years);
- Malaysian IC number (MyKad) or passport number;
- Gender (optional, for personalisation purposes);
- Username and account credentials (password stored in hashed form only).
3.2 Contact Data
- Email address (primary communication channel);
- Mobile telephone number (used for account security and SMS notifications where enabled);
- Residential address (collected for KYC and regulatory compliance purposes).
3.3 Financial and Payment Data
- Details of payment methods used for deposits and withdrawals, including e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay), FPX bank account identifiers, and bank account names for Maybank, CIMB, Public Bank, and Hong Leong Bank transfers;
- Cryptocurrency wallet addresses used for deposits and withdrawals (BTC, ETH, USDT, BNB);
- Transaction history — amounts deposited, amounts withdrawn, and dates;
- Full card details are never collected or stored by Winbox02 — card payments, where applicable, are processed by PCI-DSS-compliant payment processors.
3.4 Gaming and Behavioural Data
- Game play history including game titles, session durations, wager amounts, and outcomes;
- Sports betting history including selections, stake amounts, odds, and settlement outcomes;
- VIP tier status and loyalty programme activity;
- Bonus and promotion claims and wagering progress.
3.5 Technical and Device Data
- IP address at the time of registration, login, and transaction;
- Device type, operating system, and browser version;
- Geolocation data derived from IP address (used to verify jurisdictional eligibility);
- Session logs, access times, and navigation patterns within the Platform.
3.6 Communication Data
- Records of all support communications via live chat, email, and Telegram;
- Responses to surveys or feedback requests (where voluntarily provided);
- Records of responsible gambling tool activations (deposit limits, self-exclusion requests).
What we do not collect: Winbox02 does not collect, store, or process sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data unless specifically required by law or regulation in a particular compliance context.
4. How We Collect Your Data
Winbox02 collects personal data through the following channels:
4.1 Directly from You
The majority of personal data is provided directly by you when you: complete the registration form on the Platform; submit KYC documentation; make a deposit or withdrawal request; contact our support team; or update your account profile or responsible gaming settings.
4.2 Automatically through Platform Use
Technical and behavioural data — including IP addresses, device identifiers, session logs, and game play records — is collected automatically when you access and use the Platform through standard web server logging, analytics systems, and session management technology.
4.3 From Third-Party Payment Processors
Where you make a deposit or withdrawal via a third-party payment channel (e.g., Touch 'n Go eWallet, DuitNow, FPX, or cryptocurrency network), Winbox02 receives transaction confirmation data from that processor, including the transaction reference, amount, and payment method identifier. Full payment credentials remain with the payment processor.
4.4 From Identity Verification Services
During KYC processing, Winbox02 may engage third-party identity verification services to cross-reference the documents you submit against official databases. These services are engaged as data processors acting under Winbox02's instructions.
4.5 Through Cookies and Similar Technologies
The Platform uses cookies and similar tracking technologies to manage your session, remember your preferences, and gather aggregate analytics data. See Section 10 for full details of our cookie practices.
5. Legal Bases for Processing
Winbox02 processes personal data only where a valid legal basis exists. The applicable legal bases for each category of processing are as follows:
| Processing Purpose | Legal Basis |
|---|---|
| Account registration and authentication | Contractual necessity — required to provide the services you have requested |
| Payment processing and transaction management | Contractual necessity — required to complete deposits and withdrawals |
| Identity verification (KYC) | Legal obligation — required by applicable anti-money laundering and gaming regulatory frameworks |
| Fraud prevention and security monitoring | Legitimate interest — protecting members and the platform from financial crime and abuse |
| Responsible gambling monitoring | Legal obligation and legitimate interest — protecting member wellbeing per regulatory requirements |
| Marketing and promotional communications | Consent — only where you have explicitly opted in to receive marketing material |
| Platform analytics and improvement | Legitimate interest — improving the service and user experience for all members |
| Regulatory record-keeping and reporting | Legal obligation — compliance with applicable gaming and financial regulations |
6. How We Use Your Data
Winbox02 uses the personal data it collects for the following purposes:
6.1 Service Delivery
To create and maintain your account; to process deposit and withdrawal transactions via your chosen Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency networks); to make games, live casino tables, and sports betting markets available to you; and to administer VIP tier status and loyalty rewards.
6.2 Regulatory Compliance
To conduct KYC identity verification before processing withdrawal requests; to comply with anti-money laundering (AML) obligations including transaction monitoring and suspicious activity reporting; to verify that you meet the minimum age requirement of 21 years; and to maintain records as required by applicable gaming regulations.
6.3 Security and Fraud Prevention
To detect and prevent fraudulent activity, account sharing, bonus abuse, and other violations of the Terms and Conditions; to investigate security incidents and unauthorised account access; and to protect the financial integrity of the Platform and its members.
6.4 Responsible Gambling
To administer responsible gaming tools including deposit limits, session time limits, reality check notifications, and self-exclusion requests; to monitor gaming patterns for indicators of problematic gambling behaviour; and to communicate with members about responsible gaming resources where appropriate.
6.5 Customer Support
To process and respond to support enquiries via live chat, email, and Telegram; to investigate and resolve disputes relating to game outcomes, transaction records, and bonus terms; and to maintain communication records for quality assurance and training.
6.6 Platform Improvement and Analytics
To analyse aggregate, anonymised gaming and navigation data to improve the Platform's performance, game selection, and user experience; to identify technical issues; and to inform product development decisions.
6.7 Marketing Communications
Where you have explicitly consented, to send you information about Winbox02 promotions, new game launches, VIP programme updates, and other relevant offers. You may withdraw your consent to marketing communications at any time without affecting the legality of any processing that took place prior to withdrawal.
7. Data Sharing & Disclosure
Winbox02 does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared only in the following limited and controlled circumstances:
7.1 Payment Processors
To process deposits and withdrawals, Winbox02 shares the minimum necessary transaction data with licensed payment processors — including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX, as well as Malaysian banks including Maybank, CIMB, Public Bank, and Hong Leong Bank. These processors are bound by their own privacy and data security obligations.
7.2 Identity Verification Providers
KYC documentation submitted by members may be shared with licensed identity verification service providers engaged by Winbox02 as data processors. These providers act solely on Winbox02's instructions and are contractually prohibited from using your data for any purpose beyond the verification service.
7.3 Licensed Game Providers
Winbox02 partners with licensed international game studios to deliver casino games, live dealer tables, and sports markets. These providers may receive anonymised session data necessary to deliver game functionality and to support dispute resolution. They do not receive personally identifiable information beyond what is technically required for game delivery.
7.4 Legal and Regulatory Authorities
Winbox02 may disclose personal data to regulatory authorities, law enforcement agencies, or other competent government bodies where required to do so by applicable law, court order, or legitimate regulatory request. We will notify the affected member where permitted to do so by law.
7.5 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of Winbox02's business assets, personal data held by Winbox02 may be transferred to the successor entity. Affected members will be notified of any such transfer and the privacy policy applicable to their data following the transfer.
⚠ No Sale of Data: Winbox02 does not and will not sell, license, or otherwise commercially exploit your personal data for the benefit of any third-party advertiser, data broker, or marketing platform.
8. International Data Transfers
The Winbox02 Platform serves members primarily in Malaysia, and the majority of data processing activities are conducted within secure infrastructure. However, as an internationally-licensed gaming platform, certain processing activities — particularly in respect of game delivery and payment processing — may involve data transfers to processors or service providers located outside Malaysia.
Where personal data is transferred internationally, Winbox02 ensures that appropriate safeguards are in place, including contractual data protection clauses with receiving entities, to ensure that your data receives a standard of protection equivalent to that applied within Malaysia. By using the Platform, you consent to such transfers where necessary for the delivery of the services described in this Policy.
9. Data Retention
Winbox02 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention guidelines apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Regulatory and AML compliance |
| KYC documentation | Duration of account + 5 years post-closure | Anti-money laundering regulations |
| Financial transaction records | Duration of account + 7 years post-closure | Financial record-keeping obligations |
| Gaming activity records | Duration of account + 3 years post-closure | Responsible gambling monitoring, dispute resolution |
| Support communication records | 3 years from date of communication | Quality assurance, dispute resolution |
| Marketing consent records | Until consent is withdrawn + 2 years | Demonstrating lawful basis for marketing |
| Technical logs (IP, session) | Up to 12 months from collection | Security monitoring, fraud prevention |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identified individual. Data subject to an ongoing legal hold or regulatory investigation will be retained until the matter is resolved.
10. Cookies & Tracking Technologies
10.1 What Are Cookies?
Cookies are small text files placed on your device by your browser when you visit a website. They are widely used to make websites function correctly, to remember your preferences, and to provide site operators with aggregate information about how visitors use their sites.
10.2 Cookies Used by Winbox02
Winbox02 uses the following categories of cookies:
- Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and cookies that maintain your logged-in state. These cannot be disabled without impairing Platform functionality.
- Functional Cookies: Used to remember your preferences such as language settings, preferred game categories, and responsible gaming alert settings. Disabling these may affect your user experience.
- Analytics Cookies: Used by Winbox02 to collect aggregate, anonymised data about how members navigate the Platform — such as pages visited, time spent, and features used. This data is used solely to improve the Platform.
- Security Cookies: Used to detect and prevent fraudulent access attempts, to enforce account security policies, and to identify unusual session patterns that may indicate account compromise.
10.3 Managing Cookies
You can control and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to the Platform and accessing core services. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.
Note: Winbox02 does not use third-party advertising or cross-site tracking cookies. No cookie data from the Winbox02 Platform is shared with advertising networks or used for behavioural advertising.
11. Your Data Rights
As a data subject, you have the following rights in relation to your personal data processed by Winbox02. To exercise any of these rights, please contact us at [email protected]. We will respond to all requests within thirty (30) calendar days of receipt.
Right of Access
Request a copy of the personal data Winbox02 holds about you and information about how it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your account records.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to applicable legal retention obligations.
Right to Restriction
Request that processing of your personal data be temporarily suspended while accuracy or legality is reviewed.
Right to Portability
Request a structured, machine-readable export of the personal data you provided to Winbox02 for transfer to another service provider.
Right to Object
Object to the processing of your personal data where Winbox02 relies on legitimate interest as the legal basis, including profiling for marketing purposes.
Withdraw Consent
Withdraw consent for processing activities based on consent (e.g., marketing emails) at any time without affecting prior lawful processing.
Right to Complain
Lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been infringed. Please contact us first to allow us to address your concern.
12. Children's Privacy
The Winbox02 Platform is strictly intended for adults aged 21 years and above. Winbox02 does not knowingly collect, solicit, or process personal data from individuals under the age of 21. Age verification is conducted as part of the registration process and further verified during KYC procedures.
If Winbox02 becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately closed, all associated data will be securely deleted (subject only to any minimum retention obligations imposed by applicable regulations), and any funds held in the account will be returned to the source payment method following an investigation.
⚠ Parents and guardians who believe that a minor in their care may have registered on Winbox02 are urged to contact our support team immediately at [email protected]. We will treat such reports as priority and investigate within 24 hours.
13. Security Measures
Winbox02 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure:
- 256-bit SSL/TLS encryption on all data transmitted between your device and Winbox02's servers;
- Encrypted storage for sensitive data fields including passwords (stored as hashed values), financial identifiers, and KYC documents;
- Access controls limiting internal access to personal data to authorised personnel only, on a strict need-to-know basis;
- Audit logging of all internal access to personal data records;
- Multi-factor authentication options available to all member accounts;
- Regular security assessments and penetration testing of Platform infrastructure;
- Incident response procedures to detect, report, and respond to personal data breaches within applicable regulatory timeframes.
Notwithstanding these measures, no internet transmission or electronic storage system is completely secure. Winbox02 cannot guarantee absolute security and recommends that all members use strong, unique passwords and enable available account security features.
14. Amendments to This Privacy Policy
Winbox02 reserves the right to update or amend this Privacy Policy at any time to reflect changes in law, regulatory requirements, business practices, or technology. Where amendments are material — for example, where we introduce a new purpose for which we process your data — Winbox02 will notify affected members via the email address registered to their account and/or by displaying a prominent notice on the Platform prior to the change taking effect.
The effective date at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the Platform following publication of an amended Policy constitutes your acceptance of the revised terms. If you do not accept an amended Policy, you must close your account before the effective date of the revision.
15. Contact & Data Requests
For any questions, concerns, or requests relating to this Privacy Policy or to your personal data held by Winbox02, please contact our support team using the details below. All privacy requests will be acknowledged within five (5) business days and fully responded to within thirty (30) calendar days.
[email protected]
Plain text — not a clickable link. Response within 2–4 hours for account matters.
Live Chat
Available 24 hours a day, 7 days a week.
Average first response: under 60 seconds.
Data Rights Requests
To exercise your rights under Section 11 (access, erasure, portability etc.), contact support with "Data Rights Request" as the subject. Provide your registered email and account username to help us process your request efficiently.
Related Documents
Platform: Winbox02 — https://winbox02.cam
Support Email: [email protected] (plain text — not a clickable link)
Age Restriction: For players aged 21 and above only
Policy Version: 1 January 2026