Privacy Policy CWIN – Our Commitment to Your Data

CWIN collects your personal data through several different means, depending on how you interact with our platform. The following are the categories of data we collect:

CWIN uses collected personal data solely for legitimate and transparent purposes. The following is a complete list of those purposes:

• Account Management – Creates, verifies, and manages member accounts, including the identity verification (KYC) process required by law.
• Transaction Processing – Processes deposits and withdrawals via supported Malaysian local payment methods, and maintains transaction records for account statement purposes.
• Service Provision – Provides access to all platform games and features CWIN including slots, live casino, poker, table games, cricket, Virtual Sports, and lottery.
• Security and Fraud Prevention – Detects and prevents fraudulent activity, money laundering, multiple account usage, and unauthorised access.
• Legal Compliance – To fulfil legal and regulatory obligations applicable to the platform's operations, including Anti-Money Laundering (AML) and KYC requirements.
• Service Communications – Sends important notifications about your account, policy changes, system maintenance, and security updates.
• Marketing (with consent) – Sends information about the latest promotions, bonuses and offers CWIN to members who have consented to receive marketing communications.
• Platform Improvement – Analyses usage patterns on an aggregated and anonymised basis to improve the user experience, identify technical issues, and plan new features.

CWIN processes your personal data on the following legal bases under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent – For marketing and promotional communications, we process data based on the consent you explicitly provided during registration or through the communication preference settings in your account.
• Contract Performance – Data processing necessary to provide platform services to you as a member CWIN, including account management and transaction processing.
• Legitimate Interest – Processing for platform security, fraud prevention, service improvement and internal analytics purposes, where such interests do not override your privacy rights.
• Legal Compliance – Processing necessary to fulfil binding legal and regulatory obligations CWIN as an online entertainment platform operator.

CWIN does not sell or disclose member personal data to third parties for their own marketing purposes. However, there are limited situations in which CWIN need to share data with certain parties to ensure the platform operates smoothly and remains legally compliant:

• Payment Service Providers – Payment gateways that process transactions via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay and FPX receive the transaction information needed to process your deposits and withdrawals. All such providers are bound by strict confidentiality agreements.
• Game Software Providers – Third-party game providers that supply slots, live casino, and other games on the platform CWIN may receive the session ID required for gaming functionality. Full personal identity information is not shared.
• Regulatory Authorities – CWIN is required to share necessary information with regulatory bodies, law enforcement authorities or Malaysian government agencies when mandated by law or court order.
• Fraud Prevention Services – Third-party security and fraud prevention service providers that assist CWIN to identify and prevent unlawful activity may receive the technical data required for risk assessment.
• Business Transfer – In the event that CWIN involved in a merger, acquisition or asset sale, member data may be transferred to the new entity, subject to appropriate notice being given to members and equivalent protections being maintained.

CWIN implements a comprehensive range of technical and organisational security measures to protect member personal data from unauthorised access, loss, destruction or inadvertent disclosure:

• 256-bit SSL Encryption – All communications between your browser or app and our servers CWIN encrypted using the latest TLS/SSL protocols, ensuring that data cannot be intercepted during transmission.
• Data-at-Rest Encryption – Sensitive data stored in our databases is encrypted using industry-recognised encryption algorithms. Passwords are stored in hashed form using the bcrypt algorithm — even we cannot view your password in its original form.
• Multi-Level Access Control – Access to systems containing members' personal data is restricted to staff with a legitimate operational need only. All access is automatically logged and monitored.
• Two-Factor Authentication (2FA) – Internal administration system CWIN requires two-factor authentication for all staff. Platform members are also encouraged to enable 2FA on their accounts.
• Regular Security Scanning – Technical infrastructure CWIN undergo regular penetration testing and vulnerability scanning by independent cybersecurity experts to identify and address any weaknesses before they can be exploited.
• Incident Response Plan – CWIN has a comprehensive incident response procedure to handle any security breaches promptly, including notification procedures for affected members and the relevant regulatory authorities.

CWIN retains members' personal data only for as long as necessary to fulfil the original purpose of collection, or as required by law. The following are retention guidelines for key data categories:

• Active Account Data – Retained for the duration of your active account and used to ensure continuous platform service delivery.
• Financial Transaction Records – Retained for 7 years after a transaction occurs, in accordance with Malaysian legal requirements for financial records and auditing.
• KYC Records & Identity Verification – Retained for 5 years after account closure, in accordance with Anti-Money Laundering (AML) legal requirements.
• Customer Support Chat Logs – Retained for 2 years for quality control and dispute resolution purposes.
• Marketing Data – Retained until you withdraw consent or close your account, whichever comes first.
• Technical Log Data – Retained for 90 days for security and fraud detection purposes before being automatically deleted.

Once the applicable retention period expires, data will be securely deleted or anonymised using methods that meet industry standards, ensuring it cannot be recovered or re-linked to you.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a data subject have the following rights regarding your personal data held by CWIN:

CWIN uses cookies and similar tracking technologies to enhance the user experience, analyse usage patterns, and maintain platform security. The following are the types of cookies we use:

• Essential Cookies – Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies – Collects anonymous information about how visitors use the platform to help us identify areas requiring technical improvement.
• Functional Cookies – Saves your preferences such as language selection and display settings to provide a more personalised experience on your next visit.
• Security Cookies – Assists security systems CWIN identify suspicious access patterns and protect your account from unauthorised access attempts.

You can manage your cookie preferences through your internet browser settings. Please note, however, that disabling essential cookies may affect the functionality of the platform CWIN. Most modern browsers allow you to view, manage and delete stored cookies through the settings menu.

CWIN takes children's protection very seriously. Our platform is restricted to individuals aged 18 and above only. We do not knowingly collect personal data from individuals under the age of 18.

Should we find that personal data belonging to an individual under the age of 18 has been collected without valid consent, we will take immediate steps to delete that data from our systems and close the relevant account. Parents or guardians who believe their child has registered on the platform CWIN are advised to contact us immediately at support@cwin.bio for prompt action.

CWIN has appointed a Data Protection Officer (DPO) responsible for ensuring ongoing compliance with Malaysia's PDPA and international privacy standards. If you have any questions, concerns, or complaints about how we handle your personal data, please contact us:

• Email: support@cwin.bio (please state "Privacy Enquiry" in the subject line)
• Live Chat: Available 24 hours a day on the platform – simply indicate that you wish to discuss data privacy
• Target Response Time: 14 business days for data rights requests; 3 business days for urgent security reports

If you are not satisfied with our response CWIN regarding your privacy complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under the Ministry of Communications and Digital. This Privacy Policy was last updated on 1 January 2026. Any significant changes will be communicated to members via their registered email address at least 7 days before taking effect.