Privacy Policy 23win — Your Data, Your Rights

23win collects members' personal data carefully and only for legitimate purposes. We do not collect more than what is necessary to operate the platform safely and efficiently. There are two main categories of data we collect.

Data you provide directly:

• Registration information: Full name, date of birth, identification card number (MyKad), email address, phone number, and encrypted password.
• KYC information: Copies of identity documents, utility bills, or other official documents required for identity verification.
• Financial information: Bank account number, account holder name, and eWallet details used for deposits and withdrawals.
• Support communications: Any messages, complaints, or inquiries you submit to our customer support team.

Automatically collected data:

• Device and technical data: IP address, device type, operating system, browser version, and screen resolution.
• Usage data: Pages visited, time spent, gaming patterns, betting history, and game category preferences.
• Cookies and similar technologies: Login session data, language preferences, and customised display settings for a better user experience.

All data we collect is used for specific, legitimate purposes. 23win does not use your data for purposes unrelated to platform operations or that conflict with your interests as a member.

If we intend to use your data for any new purpose not listed above, we will notify you in advance and obtain your consent where required.

23win does not sell, rent, or disclose members' personal data to any third party for marketing purposes. Data sharing only occurs in very limited situations and solely for legitimate operational purposes.

Third parties that may receive your data:

• Payment service providers: FPX, Touch 'n Go eWallet, GrabPay, Boost, and other payment partners only receive the data necessary to process your transaction. They are bound by strict confidentiality agreements.
• KYC service providers: Licensed third-party identity verification companies are used to process KYC documents securely and efficiently.
• Technology infrastructure providers: The cloud servers and hosting services used comply with international security standards and have no unauthorized access to data.
• Legal authorities: 23win may be required to disclose certain data to government authorities or law enforcement agencies if mandated by law or a valid court order.

Member data security is the highest priority at 23win. We continuously invest in security infrastructure to ensure your data is always protected from unauthorized access, leaks, or misuse.

• 256-bit SSL encryption: All data transmitted between your device and 23win's servers is protected by 256-bit SSL encryption — the same level of encryption used by leading financial institutions worldwide.
• Data encryption at rest: Sensitive data such as banking information and KYC documents are stored in encrypted form using AES-256 algorithms.
• Two-factor authentication (2FA): Members are encouraged to enable 2FA for an additional layer of protection on their accounts.
• 24/7 monitoring: Our security monitoring system operates around the clock to detect and block any unauthorized access attempts or suspicious activity.
• Regular security audits: Our platform undergoes regular independent security audits conducted by certified third-party cybersecurity firms.
• Internal access controls: Only 23win staff with specific authorisation may access members' personal data, and every access is logged and monitored.

23win does not retain your personal data longer than necessary. Data retention periods are determined based on operational requirements, legal obligations, and the platform's legitimate interests.

• Active account data: For as long as your account remains active, your registration and profile data are retained to ensure uninterrupted use of the platform.
• Financial transaction data: Deposit, withdrawal, and financial activity records are retained for a minimum of 7 years in accordance with Malaysia's financial regulatory requirements.
• KYC documents: Retained for 5 years after account closure, in line with anti-money laundering (AML) compliance requirements.
• Support communication logs: Customer support conversation records are retained for 2 years for reference and dispute resolution purposes.
• Anonymous usage data: Anonymised analytics data is retained indefinitely for platform improvement purposes.

When data is no longer needed and there is no legal obligation to retain it, 23win will securely delete or anonymise that data using approved procedures.

As a 23win member, you have certain rights regarding your personal data, which we fully respect. Below is a list of your rights and how to exercise them.

To exercise any of the above rights, contact our privacy team via Live Chat customer support or email us at [email protected]. We will process your request within 14 business days.

23win uses cookies and similar tracking technologies to enhance the user experience, maintain login session security, and understand how members use our platform.

• Essential cookies: Required for core platform functions such as login verification, session security, and language preferences. These cookies cannot be disabled.
• Performance cookies: Collecting anonymous usage data to help us understand which parts of the platform are most popular and where improvements are needed.
• Functional cookies: Remembering your preferences such as language, display theme, and personal settings for a more comfortable experience.

You can manage or disable certain cookies through your browser settings. However, disabling essential cookies may affect platform functionality.

23win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or platform improvements.

• Amendment notice: Any significant changes will be communicated to members via their registered email or a notice displayed on the login page at least 30 days before the changes take effect.
• Continued use: Continued use of the 23win platform after the effective date of any changes constitutes acceptance of the updated policy.
• Archived version: Previous versions of the Privacy Policy are stored in our archive and can be requested through customer support if needed for reference.