Privacy Policy

winmr ("we", "us", "our", "the Company") operates the online gaming platform accessible at winmr.cam ("the Platform"). We are committed to handling the personal data of our players — including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia — with transparency, integrity, and care.

This Privacy Policy ("Policy") describes the types of personal data winmr collects when you use our Platform, the purposes for which that data is processed, the legal bases upon which processing is conducted, and the rights available to you as a data subject. It applies to all individuals who register an account, make a deposit or withdrawal, use any gaming service, or otherwise interact with the winmr Platform.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with its terms, you should cease use of the Platform immediately.

The following terms have specific meanings throughout this Policy:

• "Personal Data" — any information that identifies or can reasonably be used to identify a living natural person, directly or indirectly.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Subject" — the identified or identifiable natural person to whom Personal Data relates (i.e., you, the Player).
• "Controller" — the entity that determines the purposes and means of processing Personal Data (i.e., winmr).
• "Processor" — any third party that processes Personal Data on behalf of winmr under a binding data processing agreement.
• "KYC" — Know Your Customer, the identity and age verification process required to process withdrawals and meet anti-money-laundering obligations.
• "AML" — Anti-Money Laundering, the body of regulatory requirements designed to prevent the use of financial services for the purposes of concealing illicit funds.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.

winmr collects personal data through various interactions with the Platform. The categories of data collected, the contexts in which they are gathered, and their primary purposes are set out in the table below:

We do not collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless it is strictly necessary for a regulatory compliance purpose and you have provided explicit consent.

winmr uses your personal data for the following purposes:

• Account Management: To create, administer, and maintain your player account, including authentication and access control.
• Payment Processing: To process deposits and withdrawals in MYR via your chosen payment method, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and cryptocurrency methods.
• KYC and AML Compliance: To verify your identity and age (21+ requirement), detect and prevent money laundering, fraud, and other financial crimes, and meet our obligations under applicable regulatory frameworks.
• Service Delivery: To provide access to all gaming, sports betting, live casino, and other entertainment services available on the Platform.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance across our support channels.
• Security and Fraud Prevention: To monitor Platform activity, detect suspicious behaviour, prevent unauthorised account access, and protect the integrity of our gaming environment.
• Responsible Gambling: To administer and enforce responsible gambling tools including deposit limits, loss limits, cooling-off periods, and self-exclusion, and to identify players who may be at risk of problem gambling behaviours.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the functionality, design, and content of the Platform.
• Legal Obligations: To comply with applicable laws, regulatory directives, court orders, and requests from competent authorities.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about winmr — but only where you have provided explicit consent and subject to your right to withdraw consent at any time.

winmr processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to upon registration — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable law, including KYC, AML, and responsible gambling regulatory requirements.
• Legitimate Interests: Processing necessary for winmr's legitimate business interests — such as fraud prevention, security monitoring, and Platform improvement — provided those interests are not overridden by your rights and freedoms as a data subject.
• Consent: Processing for purposes that are not strictly necessary for service delivery — including direct marketing — where you have given specific, informed, and freely revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

winmr does not sell, rent, or trade your personal data to third parties for their independent marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Service Providers: Malaysian payment partners (e-wallet operators, banks participating in the DuitNow and FPX networks, cryptocurrency payment processors) receive the minimum data necessary to execute your transactions.
• Identity Verification Providers: Third-party KYC and AML service providers used to verify your identity documents and screen against regulatory watchlists.
• Game Content Providers: Licensed game studios whose software is hosted on our Platform may receive anonymised or pseudonymised session data for the purpose of game integrity auditing. No personally identifiable information is shared with game studios.
• Analytics and Security Providers: Technology partners who assist us in monitoring Platform performance, detecting fraud, and improving user experience. These providers operate under binding data processing agreements and may not use data for their own independent purposes.
• Regulatory Authorities: We will disclose personal data to law enforcement agencies, gaming regulators, financial intelligence units, and courts where we are legally required to do so or where we believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Professional Advisers: Lawyers, auditors, accountants, and insurers who provide professional services to winmr, subject to applicable professional secrecy obligations.

All third-party processors engaged by winmr are required to implement adequate technical and organisational security measures and are contractually prohibited from using your personal data for any purpose beyond the specific service they provide to us.

As an internationally licensed online gaming operator serving Malaysian players, winmr may transfer personal data to countries outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect the transferred data to a standard at least equivalent to that required under applicable data protection laws.

Safeguards employed for international transfers may include: standard contractual clauses approved by a relevant data protection authority; adequacy decisions recognising the recipient country's data protection framework; or binding corporate rules where intra-group transfers are involved.

Transfers necessary to fulfil payment processing obligations — for example, routing transactions through international payment networks for DuitNow, FPX, or cryptocurrency settlement — are treated as necessary for the performance of the contract between winmr and the Player and are conducted in accordance with applicable financial regulation.

winmr retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders re-identification impossible. Where deletion is not technically feasible (for example, where data is held in backup archives), the data will be isolated and protected until deletion becomes practicable.

Subject to applicable law and certain conditions, you have the following rights in relation to your personal data held by winmr. All rights requests should be submitted to our support team and will be addressed within 30 calendar days of receipt:

The winmr Platform uses cookies and similar tracking technologies to ensure proper functionality, improve user experience, and support security monitoring. A cookie is a small text file stored on your device by your web browser when you visit a website. Cookies do not contain executable code and cannot directly access other information on your device.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, although certain personalisation features may be affected. Essential and security cookies cannot be disabled without impacting core account functionality and security.

winmr implements a layered information security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Transport Security: All data transmitted between your browser or device and the Platform is encrypted using 256-bit TLS (Transport Layer Security) encryption.
• Data-at-Rest Encryption: Sensitive personal data, including identity documents and financial records, is encrypted when stored in our databases.
• Access Controls: Internal access to player personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication: winmr supports 2FA for player accounts and mandates 2FA for all administrative access to internal systems.
• Penetration Testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities in our infrastructure.
• Incident Response: winmr maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and any relevant supervisory authority within the timeframes required by applicable law.

Whilst we take extensive measures to protect your data, no internet-based transmission or storage system can guarantee absolute security. You are encouraged to use a strong, unique password for your winmr account and to enable two-factor authentication.

The Platform may contain references to or integrations with third-party payment services (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX). These services operate under their own privacy policies and data processing terms, which are entirely independent of this Policy.

winmr has no control over the data practices of third-party services and accepts no responsibility for the privacy, security, or data handling practices of any third party. We recommend that you review the privacy policy of any third-party service you interact with in connection with your use of the Platform, particularly your chosen payment provider.

The winmr Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from persons under the age of 21. This restriction is enforced through mandatory KYC age verification as a condition of account activation.

In the event that winmr becomes aware that personal data has been inadvertently collected from an individual under the age of 21, we will take immediate steps to delete that data, close the associated account, and — where applicable — refund any deposited funds in accordance with our Terms & Conditions. If you believe that a minor may have accessed the Platform, please contact our support team immediately.

winmr reserves the right to update or amend this Privacy Policy at any time. Changes may be made in response to developments in applicable data protection law, changes in our business practices, new product or service offerings, or feedback received from players and regulatory authorities.

Where amendments are material — for example, where we introduce a new category of processing or a new category of third-party recipient — we will provide at least 14 days' advance notice to registered players via email or an in-platform notification before the revised Policy takes effect.

The "Last Reviewed" date displayed at the top of this page will be updated each time changes are published. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern about how winmr handles your personal data, please contact us through one of the following channels:

• Live Chat: Available 24/7 within the Platform. Average response time under 5 minutes. Support in English, Bahasa Melayu, and Chinese.
• Email: support@winmr.cam — not a clickable link; please type this address into your email client. Responses within 1–2 hours during business hours.
• Data Protection Enquiries: For formal data protection requests (access, erasure, portability), clearly label your email with the subject line "Data Rights Request" to ensure prompt routing to the appropriate team.

winmr will acknowledge all data protection requests within 5 business days and aim to resolve them fully within 30 calendar days. If an extension is required, we will notify you of the reason and anticipated completion date.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority or data protection regulator in your jurisdiction.