Privacy Policy 23win — Protection of Malaysian Members' Personal Data

1. Introduction & Scope of Privacy Policy

This Privacy Policy ("Policy") describes how 23win ("we", "Platform") collect, use, disclose, store, and protect your personal data when you use the website, mobile application, and all services related to 23win.

This policy applies to all registered members and users of the 23win based in Malaysia and subject to the Personal Data Protection Act 2010 (Malaysia PDPA). By using the platform 23win, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.

"Personal data" in the context of this Policy means any information that can be used to identify you directly or indirectly, including but not limited to: name, identification card number, phone number, email address, financial information, and platform usage data.

This policy should be read together with Terms & Conditions and Responsible Gaming Policy which together form the complete agreement between you and 23win.

2. Personal Data We Collect

23win only collects data that is strictly necessary to provide a secure, compliant, and high-quality service. Below are the categories of data we collect and how they are gathered:

Data you provide directly:

• Registration information: full name, date of birth, Malaysian phone number, email address.
• Identity verification (KYC) information: MyKad copy, verification selfie, proof of residential address in Malaysia.
• Financial information: payment method details (Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX via Maybank2u or CIMB Clicks) — account numbers are stored in tokenized format, not in full.
• Customer support communications: live chat transcripts, emails, and call records with our support team.

Data collected automatically during use:

• Technical data: IP address, device type, operating system, browser type, and language settings.
• Usage data: pages visited, games played, bets placed, session duration, and navigation patterns within the platform.
• Approximate location data: derived from IP address for permitted-region verification purposes — we do not collect GPS data from your device.
• Cookie and tracking data: please refer to the Cookies section of this Policy for further details.

3. How We Use Your Personal Data

23win uses your personal data solely for lawful and necessary purposes in the context of providing online betting platform services in Malaysia. These purposes are as follows:

• Account management: Creating and maintaining your account, processing registrations, verifying identity, and managing account settings.
• Transaction processing: Processing deposits via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX, as well as handling withdrawals to supported Malaysian payment methods.
• Legal compliance (AML/KYC): To fulfil anti-money laundering obligations, identity verification, and reporting requirements as prescribed by applicable law.
• Security and fraud prevention: Identifying and investigating suspicious activity, protecting the platform from misuse, and ensuring the integrity of all transactions.
• Customer support: Processing enquiries, resolving disputes, and providing technical assistance to 23win members.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and provide proactive support to members who may need it.
• Service improvement: Analysing aggregated (non-personal) usage data to understand how the platform is used and to make ongoing improvements.
• Service communications: Sending important account-related notices, transaction confirmations, and terms updates. This is distinct from marketing communications — please refer to the details below.

Regarding marketing communications: 23win will only send you marketing communications (promotions, bonus offers, new game updates) if you have given explicit consent during or after registration. You may withdraw this consent at any time through your account settings or by contacting our support team.

4. Legal Basis for Data Processing

Under Malaysia's PDPA, all personal data processing must have a lawful basis. 23win processes your personal data on the following legal bases, depending on the purpose of processing:

• Consent: For marketing communications and the use of optional cookies — you provide consent explicitly and may withdraw it at any time.
• Contract performance: To provide platform services, process deposits and withdrawals, and manage your account — this processing is necessary to fulfil the agreement between you and 23win.
• Legal obligation: For KYC, AML compliance, and reporting requirements prescribed by Malaysian law — we are legally obligated to process this data.
• Legitimate interest: For platform security, fraud prevention, and responsible gaming — legitimate interests 23win and other members to maintain a safe environment.

5. Data Sharing with Third Parties

23win does not sell, rent, or transfer members' personal data to any third party for their own commercial purposes. However, in the course of operating our services, personal data may be shared with limited third parties in the following circumstances:

• Payment processors: Payment gateway providers required to process deposits and withdrawals via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX. They receive only the minimum data necessary to process each transaction.
• Technology service providers: Companies that support the platform's technical infrastructure — such as cloud hosting, cybersecurity, and analytics services — are subject to strict data processing agreements.
• Game providers: Pragmatic Play, Evolution Gaming, and other game providers may receive the minimum session data required to operate live games and ensure game integrity.
• Regulatory bodies and law enforcement: When required by Malaysian law, court order, or direction from a competent authority — 23win are required to comply with such requests.
• Third-party identity verification: KYC service providers that assist in verifying the identity of new members — this process is subject to strict data security standards.

All third parties that receive members' personal data 23win are bound by data confidentiality agreements and are prohibited from using that data for any purpose other than those authorised by 23win.

6. Data Security & Protection Measures

23win implement comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. The key measures we have in place include:

• Data encryption in transit: All communications between your device and the 23win are protected using TLS 1.3 protocol with AES-256 encryption — the same standard used by Malaysia's leading banking institutions.
• Data encryption at rest: Sensitive data such as passwords is stored using irreversible cryptographic hash functions. Financial details are stored in tokenised format.
• Multi-layer access controls: Only staff with a legitimate business need and who have undergone background checks may access members' personal data, and all access is automatically logged and audited.
• 24/7 security monitoring: A real-time threat detection system monitors all activity on the platform to identify and respond promptly to unauthorised access attempts.
• Periodic penetration testing: 23win conducts regular cybersecurity assessments, including penetration testing by independent security experts, to identify and address system vulnerabilities before they can be exploited.
• Incident Response Plan: 23win maintains tested incident response procedures to address any data breach swiftly and to notify affected members in accordance with Malaysia's PDPA requirements.

While we take all reasonable steps to protect your data, no security system can guarantee absolute 100% protection against every threat. You also play an important role in your account's security by keeping your password and login credentials confidential.

7. Data Retention Period

23win only retains your personal data for as long as is necessary to fulfil the original purpose of collection, or as required by applicable Malaysian laws and regulations.

• Active account data: Retained for as long as your account remains active with 23win and for a reasonable period following account closure.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian legal requirements on financial records and AML.
• KYC documents: Retained for a minimum of 6 years from the account closure date, in line with international compliance requirements.
• Support communication data: Retained for 3 years for reference and dispute resolution purposes.
• Technical log data: Retained for 90 days for security and technical troubleshooting purposes.

When data is no longer needed and there is no legal requirement to retain it, 23win will securely delete or dispose of such data using methods that ensure it cannot be recovered by any party.

8. Your Rights under the Malaysia PDPA

As a member 23win as a resident of Malaysia, you have the following rights regarding your personal data under the Personal Data Protection Act 2010 (PDPA):

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you.
• Right to restriction: Under certain circumstances, you have the right to request the deletion of your personal data — subject to any applicable legal retention requirements.
• Right to object to processing: You may object to the processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time without affecting the validity of any processing carried out prior to withdrawal.

To exercise any of the rights above, please contact the support team 23win via Live Chat or email at support@23win-play.com, clearly stating your request. 23win will process your request within 21 business days and may require identity verification before acting on any data-related request.

9. Cookies & Tracking Technologies

23win uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device by your web browser when you visit our platform.