Privacy Policy
At Winboz, your privacy is not a compliance checkbox — it is a core commitment. This Privacy Policy explains exactly what personal data we collect, why we collect it, how we use it, and what rights you have over your own information as a player on our platform.
🔞 21+ Only — Play ResponsiblyYour Data, Our Responsibility
End-to-End Encryption
All data transmitted between your browser and the Winboz platform is protected by 256-bit SSL/TLS encryption. Your login credentials, payment details, and personal information are never transmitted in plain text.
No Third-Party Data Sales
Winboz does not sell, rent, or trade your personal data to third-party marketers under any circumstances. Any data shared with external partners is strictly limited to what is necessary for platform operations and regulatory compliance.
Full Transparency
This policy clearly documents every category of data we collect, every purpose we use it for, and every type of third party who may process it. No hidden data pipelines, no buried consent clauses.
Your Rights, Respected
You have the right to access, correct, export, or request deletion of your personal data at any time. Winboz responds to all data subject requests within 30 days of receipt, in line with international privacy standards.
Cookie Control
We use only the cookies necessary for platform functionality, security, and performance analytics. You can manage non-essential cookie preferences through your browser settings at any time without losing access to core platform features.
Data Retention Limits
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, or resolve disputes. Inactive account data is reviewed and purged on a regular schedule.
Introduction
This Privacy Policy ("Policy") describes how Winboz ("Company", "we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("you", "Player", "User") who access or use the online casino and sports betting platform operated at https://winboz.cam ("Platform").
Winboz is committed to protecting the privacy and personal data of all players who interact with our Platform, including players based in Malaysia, Kuala Lumpur, Penang, Johor Bahru, and across the country. We process personal data in accordance with applicable international data protection laws and the obligations placed upon us by our gaming licensing authority.
By registering an account on the Platform or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy.
ℹ️ Your Privacy Matters: Winboz does not sell personal data to advertisers or data brokers. This has been our policy since launch and will not change. All data processing at Winboz is either necessary to provide you with our services, required by our licensing obligations, or explicitly consented to by you.
Definitions
The following terms are used throughout this Policy with the meanings set out below:
Any information relating to an identified or identifiable natural person — including name, email address, phone number, payment details, IP address, device identifiers, and behavioural data linked to a specific individual.
Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction — whether automated or manual.
Winboz, as the entity that determines the purposes and means of processing personal data collected through the Platform.
A third party that processes personal data on behalf of Winboz strictly in accordance with Winboz's documented instructions and applicable data protection obligations.
A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to the processing of their personal data for one or more specific purposes.
Identity verification documents and information collected as part of the Know Your Customer process, including government-issued photo ID, proof of address, and selfie verification materials.
Categories of Personal Data We Collect
Winboz collects personal data across several categories, depending on your interaction with the Platform. The following table outlines the categories of data we collect and their specific examples:
| Data Category | Examples | Collected When |
|---|---|---|
| Identity Data | Full name, date of birth, gender, nationality | Registration and KYC verification |
| Contact Data | Email address, phone number, residential address | Registration, account settings |
| KYC Documents | MyKad / passport copy, proof of address, selfie | Identity verification (KYC process) |
| Financial Data | e-wallet account reference, bank account identifier crypto wallet address, transaction history | Deposits, withdrawals, payment processing |
| Technical Data | IP address, browser type and version, device type, operating system, session tokens | Every platform visit (automated) |
| Usage Data | Pages visited, games played, betting history, session duration, navigation paths | Platform usage (automated) |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | Customer support interactions |
| Preference Data | Responsible gambling settings, notification preferences, language settings, deposit limits | Account settings and tool activation |
Winboz does not collect or process special categories of sensitive personal data (such as health information, biometric data, racial or ethnic origin, or political opinions) except where explicitly required by our responsible gambling obligations — for example, where a player voluntarily discloses information in the context of a self-exclusion request.
How We Collect Your Personal Data
We collect personal data through the following channels and mechanisms:
- Direct Submission: Information you voluntarily provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or updating your account settings.
- Automated Collection: Technical and usage data collected automatically when you access or use the Platform, including via cookies, server logs, and session tracking technology. See Section 9 for full cookie details.
- Payment Processors: Transaction confirmation data and payment method reference identifiers provided to us by our payment processing partners, including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, and cryptocurrency network data.
- Identity Verification Partners: Confirmation results from third-party KYC and identity verification service providers used to validate documents submitted during the verification process.
- Fraud Prevention Systems: Risk scoring data and fraud signals from automated detection systems used to protect player accounts and prevent financial crime.
Purposes of Data Processing
Winboz processes personal data for the following specific purposes:
| Processing Purpose | Data Categories Used |
|---|---|
| Account registration and ongoing account management | Identity, Contact |
| Age verification and KYC compliance (21+ enforcement) | Identity, KYC Documents |
| Processing deposits, withdrawals, and financial transactions | Financial, Identity |
| Delivery of gaming and sports betting services | Usage, Preference, Financial |
| Customer support and dispute resolution | Identity, Communications |
| Anti-money laundering (AML) monitoring and reporting | Financial, Identity, Technical |
| Fraud detection, account security, and abuse prevention | Technical, Usage, Financial |
| Responsible gambling monitoring and intervention | Usage, Preference, Financial |
| Platform performance analysis and product improvement | Technical, Usage |
| Promotional communications (with your consent) | Contact, Preference |
| Regulatory reporting and legal compliance | Identity, Financial, KYC Documents |
Legal Basis for Processing
Each processing activity described in this Policy is carried out one or more of the following legal bases:
- Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Terms & Conditions — including account management, payment processing, and service delivery.
- Legal Obligation: Processing required to comply with applicable laws and our licensing obligations — including AML reporting, KYC verification, age verification, and responsible gambling requirements.
- Legitimate Interests: Processing carried out in pursuit of Winboz's legitimate business interests — including fraud prevention, platform security, and product analytics — where those interests are not overridden by your fundamental rights and freedoms.
- Consent: Processing based on your freely given and specific consent — primarily marketing communications and non-essential cookie use. You may withdraw consent at any time without affecting the lawfulness of prior processing.
📋 Withdrawing Consent: Where processing is based on consent, you may withdraw your consent at any time by updating your communication preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.
Data Sharing & Third-Party Disclosure
Winboz does not sell your personal data. We do not share your personal information with third parties for their own marketing or advertising purposes. We may share your data with carefully selected third parties only in the following circumstances and only to the extent necessary:
- Payment Service Providers: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Bank, and cryptocurrency network processors — solely for the purpose of completing financial transactions you initiate.
- Identity Verification Providers: Third-party KYC service providers who process document images and biometric comparisons to fulfil our age and identity verification obligations.
- Fraud Prevention & Security Providers: Automated risk management platforms that assess transactions and login events for fraud indicators, used to protect your account and the integrity of the Platform.
- Game Content Providers: Licensed game studios and live dealer providers whose games are hosted on the Platform. These providers may receive the minimum data necessary to deliver game content and record wager outcomes.
- Customer Support Tooling: Live chat and ticketing software providers who process communications data strictly to enable support delivery on our behalf.
- Regulatory and Law Enforcement Authorities: Where required by law, court order, or our licensing obligations, Winboz may disclose personal data to relevant regulatory bodies, law enforcement agencies, or financial intelligence units.
All third parties with whom Winboz shares personal data are contractually bound to process that data only for the specified purpose, in accordance with data protection requirements equivalent to those applied by Winboz, and to implement appropriate technical and organisational security measures.
International Data Transfers
As an internationally operated platform, Winboz may transfer your personal data to servers, processors, or sub-processors located outside of Malaysia. Where such transfers occur, Winboz ensures that appropriate safeguards are in place to protect your data, including:
- Transfers to jurisdictions that have been determined to provide an adequate level of data protection by applicable regulatory standards.
- Use of standard contractual clauses (SCs) or equivalent contractual protections between Winboz and the receiving entity.
- Binding corporate rules or equivalent intra-group data transfer agreements where applicable.
You may request further information regarding the specific safeguards applied to international transfers of your personal data by contacting our support team at the address provided in Section 15.
Cookies & Tracking Technologies
The Winboz Platform uses cookies and similar tracking technologies to ensure proper functionality, maintain your session security, and analyse platform usage. Cookies are small text files stored on your device when you visit the Platform.
We use the following categories of cookies:
Essential for the Platform to function correctly. These include session cookies that maintain your login state, security tokens, and load-balancing cookies. These cookies cannot be disabled without breaking core Platform functionality.
Used to understand how players interact with the Platform — including which games are played most, which pages generate errors, and how navigation flows work in practice. Data collected is aggregated and anonymised where possible.
Used to remember your preferences, including language settings, preferred game lobby layout, and notification preferences, so you do not need to reconfigure them each session.
Used by our security systems to identify unusual patterns of behaviour that may indicate account takeover attempts, bot activity, or other fraudulent access.
You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging into the Platform. We do not use advertising or behavioural targeting cookies, and we do not permit third-party ad networks to place cookies on the Platform.
Data Retention
Winboz retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, comply with applicable legal and regulatory obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years after closure | Legal and regulatory obligation |
| KYC Documents | 5 years from submission or account closure | AML licensing obligation |
| Financial Transaction Records | 7 years from transaction date | Financial record-keeping obligation |
| Betting & Game History | 5 years from transaction date | Regulatory obligation and dispute resolution |
| Customer Support Communications | 3 years from last interaction | Dispute resolution and service quality |
| Technical & Log Data | 90 days rolling | Security monitoring and fraud prevention |
| Marketing Preferences | Until consent is withdrawn or account closed | Consent |
After the applicable retention period has elapsed, personal data is securely deleted or anonymised in accordance with our data destruction procedures. Anonymised data that can no longer be linked to an individual may be retained indefinitely for statistical and analytical purposes.
Your Data Protection Rights
As a data subject, you have the following rights in relation to your personal data processed by Winboz. These rights may be subject to certain limitations and exceptions under applicable law, particularly where processing is required by legal obligation or for the prevention of fraud.
Request a copy of all personal data we hold about you and information about how it is processed.
Request correction of any inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data where it is no longer necessary for its original purpose and no overiding legal obligation applies.
Request that we restrict the processing of your data in certain circumstances, such as when you contest its accuracy.
Receive a copy of your data in a structured, machine-readable format where processing is based on consent or contractual necessity.
Object to processing based on legitimate interests or for direct marketing purposes. Marketing objections will be honoured immediately.
To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Subject Request." We will acknowledge your request within 5 business days and respond in full within 30 calendar days. In cases of complexity or volume, this period may be extended by a further 30 days with prior notice.
We may request verification of your identity before processing a data subject request to ensure we do not disclose your data to an unauthorised third party.
Security Measures
Winboz implements comprehensive technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:
- Transport Encryption: All data in transit between your browser and our servers is encrypted using 256-bit SSL/TLS protocols. Connections using outdated or insecure protocols are rejected.
- Encryption at Rest: Sensitive personal data fields — including identity documents, financial data, and authentication credentials — are encrypted at rest using industry-standard encryption algorithms.
- Access Controls: Access to personal data within Winboz is restricted on a strict need-to-know basis. All internal access is logged, monitored, and subject to regular review.
- Two-Factor Authentication: All administrative access to systems holding personal data requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their own accounts.
- Penetration Testing: The Platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
- Incident Response: Winboz maintains a formal data breach response procedure. In the event of a security incident that materially affects your personal data, we will notify you and relevant authorities within the timeframes required by applicable law.
⚠️ Your Role in Security: While we maintain robust security controls, you also play an important role in keeping your account secure. Use a strong, unique password for your Winboz account, enable two-factor authentication, and never share your login credentials. Winboz will never ask for your password.
Children's Privacy
The Winboz Platform is strictly intended for individuals aged 21 years and above. Winboz does not knowingly collect, process, or retain personal data relating to persons under the age of 21. Age verification is a mandatory component of the account registration process, and accounts where age verification cannot be confirmed are suspended pending documentation.
If Winboz discovers that personal data belonging to a person under the age of 21 has been collected — whether through a fraudulent registration or any other means — that data will be immediately deleted, the account will be permanently closed, and any associated funds will be returned to the payment method used, subject to verification.
If you believe that a minor has registered an account on the Platform or that we have inadvertently collected data from an individual under 21, please contact us immediately at [email protected].
Changes to This Privacy Policy
Winboz reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.
Where changes are material — particularly changes that expand the categories of data collected, introduce new processing purposes, or alter your rights — we will notify you in advance via email to your registered address and via a prominent notice on the Platform, no less than 14 days before the changes take effect.
Your continued use of the Platform after the effective date of any amended Policy constitutes your acceptance of those changes. If you do not agree to the revised Policy, you may close your account and request deletion of your data as described in Section 11.
Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the Winboz Data Protection team through the following channels:
Use subject line: "Privacy Policy Enquiry" or "Data Subject Request". Responses within 5 business days.
For urgent privacy concerns, our live chat team is available around the clock and can escalate data protection issues to the appropriate internal team on your behalf.
Winboz is committed to resolving all privacy-related concerns promptly and transparently. We serve players across Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and all major cities in Malaysia. All privacy communications are handled in English.
Play with Confidence — Your Data isProtected
Now that you understand how Winboz handles your data, explore the rest of the platform with confidence. Our FAQ answers the most common questions, and our Responsible Gambling page explains every tool available to help you stay in control.
For players aged 21 and above only. Please gamble responsibly.