Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by WinBoleh ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals ("you", "the Member", "the User") who visit, register with, or use the services available through the WinBoleh website and associated applications (collectively, "the Services").

WinBoleh operates as Malaysia's Black Diamond VIP online casino and sports betting platform, serving members across Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and throughout Malaysia. Given the nature of our services — which include financial transactions, identity verification, and age-gated gambling — the responsible handling of personal data is a matter of fundamental importance to us.

This Policy is designed to give you a clear and transparent account of our data processing practices. It applies in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. By accessing the Platform or registering an account, you acknowledge that you have read and understood this Policy.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Data We Collect

WinBoleh collects personal data through several channels. The categories of data we collect and their sources are set out below:

3.1 Data You Provide Directly

• Registration details: full legal name, date of birth, email address, mobile number, and chosen username.
• KYC documents: government-issued identity documents (MyKad, passport), proof of residential address, and supplementary verification documents where requested.
• Financial data: payment method details provided during deposit or withdrawal, including eWallet account identifiers (Touch 'n Go, Boost, GrabPay), bank account details for FPX or DuitNow transactions, and cryptocurrency wallet addresses.
• Communications: the content of messages sent to our support team via live chat or email.
• Responsible gambling preferences: deposit limit settings, self-exclusion elections, and reality check configurations.

3.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage data: pages visited, games played, betting history, session duration, click-stream data, and feature interactions.
• Cookie data: session cookies, preference cookies, and analytics cookies as described in Section 7.
• Geolocation data: approximate location derived from your IP address, used for jurisdictional access controls and fraud detection.

3.3 Data from Third Parties

• Identity verification results from our KYC and AML compliance partners.
• Fraud risk signals from payment processing partners and fraud detection services.
• Publicly available information used to verify the accuracy of data you have provided.

Legal Basis for Processing

WinBoleh processes personal data only where a valid legal basis exists. The primary legal bases we rely on are summarised in the table below:

How We Use Your Data

We use the personal data we collect for the following purposes:

• Account management: creating, maintaining, and securing your Member account; verifying your identity and age at registration and upon withdrawal.
• Service delivery: enabling access to casino games, live dealer tables, and sports betting markets; processing deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and internet banking; processing withdrawals to your verified payment methods.
• Compliance: conducting KYC and anti-money laundering checks; monitoring transactions for suspicious activity; fulfilling reporting obligations to our licensing authority.
• Responsible gambling: applying your chosen deposit limits, session reminders, and self-exclusion elections; monitoring usage patterns to identify potential problem gambling indicators and intervene proactively.
• Fraud prevention and security: detecting unauthorised account access; identifying multi-accounting, bonus abuse, and collusion; protecting the integrity of our gaming and betting products.
• Customer support: responding to enquiries, resolving disputes, and processing account modification requests via live chat and email.
• Platform improvement: analysing usage data to improve game selection, user interface design, payment flow efficiency, and overall member experience.
• Marketing (with consent): sending promotional offers, reload bonus notifications, and VIP programme updates to members who have opted in to marketing communications.

Data Sharing & Disclosure

WinBoleh does not sell, rent, or trade your personal data to third-party marketers or data brokers under any circumstances. We share personal data with third parties only in the limited circumstances described below, and only to the extent necessary for each stated purpose:

• Payment processors: We share payment-related data with Malaysian payment infrastructure providers — including Touch 'n Go, Boost, GrabPay, DuitNow, FPX gateways, and participating banks (Maybank, CIMB, Public Bank, RHB, Hong Leong) — solely to process your transactions.
• KYC and AML providers: Identity verification data is shared with licensed third-party KYC and AML screening services to fulfil our regulatory compliance obligations. These providers operate under strict data processing agreements.
• Game and technology providers: Gameplay data (user ID, session identifiers, bet values) is shared with our licensed game content providers to enable game functionality. Providers are contractually prohibited from using this data for their own marketing purposes.
• Regulatory and law enforcement authorities: We may disclose personal data to our licensing regulator, financial intelligence units, or law enforcement agencies where required to do so by law, court order, or regulatory instruction.
• Professional advisors: Legal counsel, auditors, and compliance advisors may access relevant personal data under obligations of professional confidentiality.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of WinBoleh's assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom we share personal data are required to process it in accordance with applicable data protection standards and, where applicable, under the terms of a formal data processing agreement.

Cookies & Tracking Technologies

WinBoleh uses cookies and similar tracking technologies to enable core platform functionality, remember your preferences, and gather analytics data to improve the Platform. The types of cookies we use are described in the table below:

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features. Non-essential cookies are only placed with your consent, which may be withdrawn at any time.

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations and applicable legal requirements. The following indicative retention periods apply:

• Account and registration data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification, as required by our licensing authority.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the final communication in a support case.
• Marketing preferences and consent records: Retained for three (3) years from the date consent was given or last updated, or until you withdraw consent, whichever comes first.
• Analytics and usage data: Anonymised or aggregated after thirteen (13) months, after which no individual member can be identified from the data.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is shared with third-party processors, we require those processors to apply equivalent retention and deletion practices.

Data Security

WinBoleh implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Multi-factor authentication for all administrative access to systems containing personal data.
• Regular independent security audits and penetration testing of our platform infrastructure.
• Real-time intrusion detection and monitoring systems covering all production environments.

Notwithstanding the above, no internet-based service can guarantee absolute security. In the event we become aware of a data security incident affecting your personal data, we will notify you and take all steps required under our licensing obligations to contain and remediate the incident.

Your Rights

Subject to applicable data protection law and our legal obligations, you have the following rights in respect of the personal data WinBoleh holds about you:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Where data is linked to active KYC records, we may require re-verification before applying corrections.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligation to retain certain records as described in Section 8.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances — for example, while a complaint or rectification request is being resolved.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing processing, we will cease such processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our support team via live chat or at [email protected]. We will respond to all verifiable requests within thirty (30) days. We may need to verify your identity before processing certain requests.

Minors & Age Policy

WinBoleh's services are strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data belonging to persons under the age of 21. Age verification is conducted as part of our registration and KYC processes, and accounts found to belong to individuals under 21 will be immediately suspended.

If you become aware that a minor has provided personal data to WinBoleh, or has accessed the Platform, please contact our support team immediately. We will take prompt action to delete the data concerned and close the relevant account.

Third-Party Services

The WinBoleh Platform may contain references to or integrations with third-party services, including game content providers, payment processors, and analytics tools. This Privacy Policy applies solely to data processed by WinBoleh in its capacity as Data Controller. Third-party services operate under their own privacy policies, which we encourage you to review independently.

Our payment processing integrations — including those supporting Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and other Malaysian payment providers — are subject to those providers' own terms and privacy practices. WinBoleh is not responsible for the data handling practices of third-party payment services once data is passed to them for transaction processing.

International Data Transfers

WinBoleh operates under international online gaming licensing and may process or store personal data in jurisdictions outside Malaysia. Where such transfers occur, we implement appropriate safeguards to ensure your data receives a standard of protection consistent with this Policy, including the use of standard contractual clauses and data processing agreements with all international third-party processors.

By using the Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in countries outside Malaysia. We will at all times take reasonable steps to ensure that such transfers are made securely and in compliance with applicable data protection standards.

Policy Amendments

WinBoleh reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. Where material changes are made, we will notify you via a platform notification or email to your registered address prior to the changes taking effect.

The revised Policy will be published on this page with an updated effective date. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed of how WinBoleh handles your personal data.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how WinBoleh has handled your personal data, please contact us through any of the channels below. We will acknowledge all privacy-related enquiries within three (3) business days and aim to resolve complaints within thirty (30) days.

For broader guidance on data protection rights and obligations relevant to Malaysian residents, you may wish to consult publicly available resources from the Personal Data Protection Department of Malaysia (JPDP). If you are dissatisfied with our handling of a privacy complaint, you may refer the matter to the relevant supervisory authority under our licensing jurisdiction.

For matters related to our Terms & Conditions, responsible gambling tools, or account management, please visit the respective pages or contact our support team directly.