Privacy Policy 32win — Personal Data Protection for Malaysian Players

1Introduction & Scope of This Privacy Policy

This Privacy Policy describes the practices of 32win regarding the collection, use, storage, protection and disclosure of personal information provided by you or automatically collected when you use our platform — including the website, mobile interface and all related services offered under the name 32win.

By registering an account or continuing to use the platform 32win, you agree to the data protection practices described in this Privacy Policy. This document should be read together with the Terms & Conditions and Responsible Gaming Policy which form part of the overall agreement between you and 32win.

32win is the data controller for personal information collected through this platform and is fully responsible for ensuring that your data is managed in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and any other applicable data protection legislation.

2Types of Personal Data We Collect

32win collects various categories of personal information necessary to provide our services safely, efficiently, and accurately. Below is a detailed breakdown of the data categories we collect and their respective purposes:

All data categories above are collected only to the extent necessary for the stated purposes and will not be used for any other purpose without prior notice to you as a member 32win.

3How We Collect Your Personal Information

32win collects your personal information through several different methods depending on how you interact with our platform:

• Account Registration: When you register a new account, you provide us directly with basic information such as your Malaysian phone number, email address, and password.
• Identity Verification (KYC): During the identity verification process required for withdrawals, or when requested by 32win, you may be asked to submit documents such as a copy of your Malaysian identity card.
• Financial Transactions: Payment-related information — including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX — is collected when you make a deposit or withdrawal on the 32win platform.
• Gaming Activity: Game data is collected automatically when you play on the platform — including game preferences, bet amounts, session results and play duration.
• Customer Support Interactions: When you contact the 32win support team via live chat or email, records of those conversations are retained for reference and service improvement purposes.
• Automatic Technical Data: 32win servers automatically log technical information such as IP addresses, browser types and session data for security purposes and to detect suspicious activity.

4How Your Personal Data Is Used

32win using the personal information collected for the following lawful and necessary purposes in operating our platform:

• Account Management: Creating, verifying, and maintaining your 32win member account, including secure login processes and account settings management.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, and other supported Malaysian payment methods, as well as handling your withdrawal requests promptly and securely.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, money laundering, multi-account abuse and other security threats that could compromise the integrity of the platform and the interests of other members.
• Legal Compliance: To fulfil legal obligations under the PDPA 2010, anti-money laundering laws (AMLA), and other applicable regulatory compliance requirements in Malaysia.
• Service Improvement: Analysing platform usage patterns to better understand member needs and to improve the user experience, platform features and 32win game offerings.
• Service Communications: Sending important notifications about your account, transactions, changes to our terms or policies, and relevant promotional information based on your communication preferences.
• Responsible Gaming Programme: Monitors gameplay patterns to identify early signs of gambling control issues and activates appropriate self-control tools based on each member's needs.

5Third-Party Data Sharing & Disclosure

32win does not sell, rent or disclose members' personal data to third parties for marketing purposes. However, in a limited number of situations as outlined below, data may be shared with certain parties:

• Payment Service Providers: Transaction information is shared as necessary with Malaysian payment service providers such as Touch 'n Go eWallet, GrabPay, DuitNow and FPX to process your deposits and withdrawals. These providers are bound by their own strict privacy and security policies.
• Game Software Providers: Minimal data is shared with integrated game providers such as Pragmatic Play, Evolution Gaming, and PG Soft for the technical purposes of game operation and dispute resolution.
• Legal Requirements: 32win may disclose your personal data to government authorities, law enforcement, courts, or regulatory bodies when required by Malaysian law, court order, or to fulfil legitimate investigative requirements.
• Fraud Prevention: In situations where there are reasonable grounds to suspect fraud or money laundering, relevant data may be shared with Malaysian authorities responsible for handling financial crime.

All data sharing with authorised third parties is subject to legally binding data protection agreements, ensuring those parties handle your data to a standard of protection equivalent to our own 32win.

6Data Security Measures at 32win

32win invests seriously in security infrastructure to protect the personal and financial data of all our members. The security measures we have implemented encompass multiple layers of protection:

• 256-Bit SSL Encryption: All communications between your device and 32win's servers are encrypted using 256-bit TLS/SSL protocol — the same security standard used by Malaysian banking institutions.
• Two-Factor Authentication (2FA): 32win members are encouraged to enable two-factor authentication for an added layer of account protection beyond just a password.
• 24/7 Security Monitoring: Automated monitoring systems operate around the clock to detect suspicious login activity, unauthorised access attempts, and transaction anomalies in real time.
• Secure Data Storage: All sensitive data is stored on servers protected by strict access controls, encryption at rest, and regular encrypted backups.
• Internal Access Controls: Access to member personal data within the 32win organisation is restricted to personnel with a legitimate business need and is subject to strict confidentiality agreements.
• Regular Security Testing: The 32win platform undergoes regular penetration testing and independent security audits to identify and address potential vulnerabilities before they can be exploited.

7Personal Data Retention Period

32win retains members' personal data only for as long as necessary to fulfil the original purpose of collection, or as required under applicable Malaysian law. General data retention guidelines are as follows:

• Active Account Data: For as long as your account remains active on the 32win platform, related personal data is retained to allow us to deliver consistent and effective services to you.
• Financial Transaction Records: In accordance with Malaysian legal requirements on financial records and anti-money laundering (AMLA), transaction records are retained for a minimum of 6 years from the date the transaction occurred.
• Identity Verification (KYC) Data: Identity verification documents and data are retained for a minimum of 5 years after account closure, in line with applicable regulatory compliance requirements in Malaysia.
• Support Communication Records: Chat history with the 32win support team is retained for 2 years for reference purposes and to assist in resolving any disputes that may arise at a later date.
• After Account Closure: If your account is closed at your own request and no terms have been violated, personal data that is no longer required for legal purposes will be deleted or anonymised within 90 days of the closure date.

Once the applicable retention period has expired and there is no legal requirement to retain the data, 32win will delete or anonymise your personal data securely so that it can no longer be associated with you.

8Your Rights Under Malaysia's PDPA 2010

As a member 32win and data subjects under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold about you:

9Cookies, Tracking Technologies & Your Choices

Platform 32win uses cookies and similar tracking technologies to enhance the user experience, maintain login session security and analyse platform usage patterns. The types of cookies we use are as follows:

• Essential Cookies (Required): Cookies required for the core functions of the 32win platform — including login authentication, session management, and account security. These cookies cannot be disabled as they are essential for the platform to operate correctly.
• Performance Cookies: Used to collect anonymised, aggregated data on how users interact with the 32win platform — helping us identify and resolve technical issues, and improve platform speed and stability.
• Functional Cookies: Allows the 32win platform to remember your preferences — such as language, display settings, and game choices you've previously set — for a more comfortable experience.

You can manage cookie usage through your web browser settings. However, disabling certain cookies may affect the functionality of the platform 32win and your overall gaming experience. For more information on how to manage cookies in your browser, please refer to your browser's help documentation.

10Children's Privacy Protection

Platform 32win is strictly for individuals aged 18 years and above. We do not knowingly collect, process or store personal data from minors. Should we become aware that personal data belonging to a child or individual under the age of 18 has been collected without the knowledge and consent of their legal guardian, we will take immediate steps to delete that data and close the associated account.

Parents and guardians concerned that their child may have accessed the platform 32win is encouraged to contact our support team immediately by email at support@32win-win.com. 32win will promptly investigate such reports and take appropriate action to safeguard the interests of the children involved.

11Amendments to This Privacy Policy

32win reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our practices, relevant Malaysian legislation, or platform improvements that affect how we handle data. The "Updated" date at the top of this page will reflect the date of the most recent amendment.

For material or significant amendments, 32win will endeavour to notify affected members via in-platform notifications or their registered email before any amendments take effect. It is your responsibility to review this page periodically to stay informed of how we manage your personal data.

12How to Contact Us About Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 32win manage your personal data, we encourage you to reach out to us directly. Our team is committed to taking all privacy-related enquiries seriously and addressing them within a reasonable timeframe.

• Privacy Email: support@32win-win.com — please include "Data Privacy Enquiry" in your email subject line to help us process your request faster.
• Live Chat: The live chat function within the 32win platform is available 24 hours a day, 7 days a week for immediate enquiries regarding your account privacy.

Support team 32win who handles privacy enquiries are able to communicate in both Bahasa Melayu and English. We will endeavour to respond to all privacy-related enquiries within 5 working days from the date the enquiry is received, and for more complex data access or deletion requests within 14 business days.

If you are not satisfied with the way 32win handling your privacy enquiries or complaints, you have the right to lodge a complaint with the Department of Personal Data Protection under Malaysia's Ministry of Communications and Digital, which enforces the PDPA 2010.