wondawin Privacy Policy

1 Who We Are

This Privacy Policy is issued by the operator of the wondawin platform, accessible at wondawin.win ("wondawin", "we", "us", "our"). wondawin is an online casino and sports betting platform that operates under an international gaming authority licence, offering its services primarily to players in Malaysia and other eligible jurisdictions.

As the data controller for personal information collected through the wondawin platform, we are responsible for determining how and why your personal data is processed. For any privacy-related enquiries, please contact our support team using the details provided in Section 15 of this Policy.

2 Personal Data We Collect

2.1 Registration Data

When you create a wondawin Account, we collect the following information: your full legal name, date of birth, residential address, email address, Malaysian mobile number, and the username and password you select. This information is required to create and administer your Account.

2.2 Identity Verification (KYC) Data

To comply with our licensing obligations and to verify that you are 21 years of age or older, wondawin requires identity documentation before processing your first withdrawal. This includes a copy of your MyKad or valid passport, and may include a selfie photograph or proof of address document such as a recent utility bill or bank statement issued to your registered address in Malaysia.

2.3 Financial Data

wondawin collects information about your deposit and withdrawal transactions, including payment method details (e-wallet account identifiers, bank account identifiers used for FPX), transaction amounts, timestamps, and transaction reference numbers. wondawin does not store full card numbers or banking credentials; payment processing is handled by our contracted payment service providers.

2.4 Usage and Activity Data

We collect data about how you use the wondawin platform, including: games played, bets placed, betting history, session duration, login timestamps, pages visited, search queries within the platform, and bonus activity. This data is used to operate your Account, detect fraud, and improve the platform.

2.5 Technical Data

When you access the wondawin platform, our systems automatically collect certain technical information: your IP address, device type (phone model, operating system version), browser type and version, screen resolution, and referring URL. This data is used for security monitoring, fraud detection, and platform optimisation.

2.6 Communications Data

If you contact wondawin via live chat, email, or any other communication channel, we retain records of that correspondence, including the content of messages and timestamps. This data is used to resolve your query, train our support team, and maintain records for dispute resolution purposes.

3 How We Collect Your Data

wondawin collects your personal data through the following means:

• Directly from you: When you register an Account, complete KYC verification, make deposits or withdrawals, contact support, set responsible gaming limits, or interact with any feature of the Platform.
• Automatically: Through cookies, web beacons, and server logs when you access and use the Platform. See Section 9 for detail on our cookie practices.
• From third parties: From our payment service providers (transaction confirmation and fraud screening data), from identity verification services used in the KYC process, and from fraud prevention databases where we have a legitimate interest in confirming the integrity of your Account.

4 How We Use Your Personal Data

wondawin uses personal data collected from Malaysian players and other users for the following purposes:

• Account management: Creating, maintaining, and operating your wondawin Account, including processing deposits, withdrawals, and bonus transactions.
• Identity and age verification: Fulfilling our KYC obligations and verifying that all registered players are 21 years of age or older, as required by our gaming licence.
• Legal and regulatory compliance: Meeting obligations under our international gaming authority licence, applicable anti-money laundering (AML) regulations, and other applicable laws.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, and money laundering.
• Customer support: Responding to your enquiries, resolving disputes, and improving the quality of our support services.
• Platform improvement: Analysing usage patterns to improve game selection, payment flows, interface design, and overall platform performance.
• Responsible gaming: Monitoring account activity to identify potential problem gambling behaviours and to apply responsible gaming tools you have activated on your Account.
• Marketing communications: Sending promotional communications about wondawin offers, bonuses, and new features — only where you have given your consent to receive such communications. You may withdraw marketing consent at any time.

5 Legal Bases for Processing

wondawin processes your personal data on the following legal bases:

• Contract performance: Processing necessary to operate your Account, process transactions, and provide the services you have registered for.
• Legal obligation: Processing required to comply with our gaming licence conditions, AML obligations, KYC requirements, and other applicable regulations.
• Legitimate interests: Processing for fraud prevention, platform security, and improving our services, where these interests are not overridden by your rights.
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing and Disclosure

wondawin does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients in the circumstances described:

6.1 Service Providers

We engage third-party service providers who process personal data on our behalf under contractual data processing agreements. These include: payment service providers (Touch n Go eWallet, Boost, Maybank/CIMB/Public Bank FPX processing partners), identity verification services, cloud hosting and infrastructure providers, customer support platform providers, and fraud detection services.

6.2 Regulatory and Law Enforcement Authorities

wondawin may disclose personal data to our licensing authority, financial intelligence units, law enforcement agencies, or other regulatory bodies where required by applicable law or where we have a good-faith belief that disclosure is necessary to comply with a legal obligation, protect the rights or safety of wondawin, its players, or the public, or to prevent or investigate suspected illegal activity including fraud and money laundering.

6.3 Business Transfers

In the event of a merger, acquisition, or transfer of the wondawin business or its assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained. We will notify registered players of any such transfer affecting their personal data.

7 International Data Transfers

wondawin's operations involve the transfer of personal data to countries outside Malaysia, including to the jurisdiction in which our licensing authority is based and where our server infrastructure is located. Where personal data is transferred internationally, wondawin ensures that appropriate safeguards are in place, including contractual protections with data recipients that are equivalent to those required under applicable data protection law.

By registering a wondawin Account, you acknowledge and consent to the transfer of your personal data for the purposes described in this Policy.

8 Data Retention

wondawin retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. Specific retention periods include:

• Account data: Retained for the duration of your active Account and for a minimum of 5 years following Account closure, as required by our gaming licence and AML obligations.
• KYC documentation: Retained for a minimum of 5 years following Account closure or the last transaction, in accordance with applicable financial crime regulations.
• Transaction records: Retained for a minimum of 5 years following the transaction date.
• Support correspondence: Retained for up to 3 years from the date of the communication, unless retention is required for ongoing dispute resolution.
• Marketing consent records: Retained for the duration of consent and for up to 3 years following withdrawal of consent.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with wondawin's data destruction procedures.

9 Cookies & Tracking Technologies

9.1 What We Use Cookies For

wondawin uses cookies and similar tracking technologies for the following purposes: maintaining your login session (session cookies), remembering your platform preferences such as language and display settings, detecting and preventing fraudulent access, and analysing aggregate platform usage to improve performance.

9.2 Types of Cookies

• Strictly necessary cookies: Required for the Platform to function. You cannot opt out of these cookies while using wondawin, as they are essential to your Account session and security.
• Functional cookies: Remember your preferences and settings to improve your experience on subsequent visits.
• Analytics cookies: Collect anonymised, aggregate data about how the Platform is used to help us understand which features are most useful and where improvements are needed. No individual browsing profiles are created.

9.3 Managing Cookies

You may control cookie settings through your browser preferences. Note that disabling certain cookies may affect the functionality of the wondawin Platform, including the ability to stay logged in to your Account.

10 Your Data Rights

Subject to applicable law and our regulatory retention obligations, you have the following rights in respect of your personal data held by wondawin:

• Right of access: You may request a copy of the personal data wondawin holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to our legal retention obligations.
• Right to restrict processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: You may request a copy of data you have provided to wondawin in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on consent (e.g. marketing communications), you may withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, contact wondawin via live chat or the support email listed in Section 15. We will respond to verified data requests within 30 days.

11 Security Measures

wondawin implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• 256-bit SSL encryption for all data transmitted between your device and the Platform
• Encrypted storage of passwords using industry-standard hashing algorithms
• Two-factor authentication (2FA) available to all registered players
• Access controls limiting internal access to personal data to authorised personnel with a legitimate business need
• Regular security audits and penetration testing of Platform infrastructure
• Incident response procedures for detecting, reporting, and responding to data breaches

In the event of a data breach that poses a risk to your rights, wondawin will notify affected players and relevant regulatory authorities in accordance with applicable legal requirements.

12 Children and Minors

The wondawin Platform is strictly for individuals aged 21 and above. wondawin does not knowingly collect personal data from any person under the age of 21. Age verification is enforced through the KYC process as a condition of withdrawal access.

If wondawin becomes aware that personal data has been collected from a person under 21, the associated Account will be immediately suspended, all data relating to that Account will be securely deleted, and any transactions processed through the Account will be investigated and reversed where possible.

If you have reason to believe that a minor has accessed or registered on the wondawin Platform, please contact us immediately using the details in Section 15.

13 Third-Party Links

The wondawin Platform may contain links to third-party websites or services — for example, links to our licensed payment partners' own information pages. wondawin is not responsible for the privacy practices of third-party websites and this Privacy Policy does not apply to any site outside of the wondawin Platform. We encourage you to review the privacy policy of any third-party site you visit.

14 Changes to This Privacy Policy

wondawin reserves the right to update this Privacy Policy at any time. Where changes are material — that is, where they affect the legal basis for processing, the categories of data collected, or the rights available to you — we will notify registered players via the email address or mobile number associated with their Account, with a minimum of 14 days' notice before the revised policy takes effect.

The "Last updated" date at the top of this Policy reflects the date on which the most recent revisions were made. We encourage you to review this Policy periodically to stay informed about how wondawin handles your personal data.

Continued use of the wondawin Platform following the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by wondawin, please contact our support team through the following channels:

• Live Chat: Available on all Platform pages after login, 24 hours a day, 7 days a week. Average response time 3–5 minutes.
• Email: support at wondawin.win (plain text only — not a clickable link)

Our support team communicates in Malaysian English and is available around the clock. Data-related requests will be acknowledged within 5 business days and resolved within 30 days of receipt, subject to identity verification.