winlah Privacy Policy

Last updated: 1 January 2026  |  Effective date: 1 January 2026

1. Introduction and Scope

This Privacy Policy ("Policy") describes how winlah ("the Company", "we", "us", or "our") collects, uses, stores, and discloses personal data in connection with the operation of the winlah online gaming platform available at winlah.win ("the Platform"). This Policy applies to all users of the Platform, including registered account holders and visitors who have not registered an account.

By accessing or using the winlah Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the winlah Platform.

This Policy should be read alongside the winlah Terms & Conditions, which govern the overall relationship between winlah and its users.

2. Data Controller

winlah is the data controller in respect of personal data collected through the Platform. As data controller, winlah determines the purposes and means of processing personal data obtained from users. For all data protection enquiries, users may contact winlah at the address set out in Section 14 of this Policy.

3. Personal Data We Collect

3.1 Registration and Account Data

When you register a winlah account, we collect the personal data you provide during the registration process, which typically includes:

• Full legal name;
• Date of birth (to verify age eligibility of 21 years and above);
• Malaysian mobile number;
• Email address (where provided);
• Residential address (where required for identity verification);
• Username and hashed password credential.

3.2 Identity Verification Data

In compliance with anti-money laundering (AML) obligations and responsible gaming requirements, winlah may request and collect copies of identity documents including, but not limited to, your Malaysian National Identity Card (MyKad), passport, or other government-issued identification. Where required, we may also collect proof of address documentation and proof of payment method ownership.

3.3 Financial Transaction Data

winlah collects records of all financial transactions conducted through your account, including deposit amounts, withdrawal amounts, payment method references, transaction timestamps, and associated wallet balances. Note that winlah does not directly store full card numbers or bank account credentials — these are handled via tokenisation by certified payment service providers.

3.4 Gaming and Betting Activity Data

We collect detailed records of your gaming and betting activity on the Platform, including games played, bet amounts, results, session durations, and bonus usage. This data is used for account management, fraud prevention, responsible gaming monitoring, and regulatory compliance purposes.

3.5 Technical and Device Data

When you access the winlah Platform, we automatically collect certain technical information, including:

• IP address;
• Device type, operating system, and browser version;
• Mobile carrier information (e.g., Maxis, Celcom, Digi);
• Session login and logout timestamps;
• Pages visited and features accessed within the Platform.

3.6 Communications Data

If you contact winlah customer support, we retain records of those communications including the content of messages, contact timestamps, and resolution outcomes. This is used for quality assurance, training, and dispute resolution purposes.

4. How We Collect Your Data

winlah collects personal data through the following means:

• Direct collection: Data you provide during registration, account updates, identity verification, or when contacting support;
• Automated collection: Technical data collected automatically when you access the Platform via cookies, server logs, and similar technologies (see Section 10);
• Payment processors: Transaction reference data received from our certified payment service providers when you deposit or withdraw;
• Third-party game providers: Gaming session and outcome data received from licensed game studios integrated into the winlah Platform.

5. Purposes and Legal Basis for Processing

winlah processes your personal data for the following purposes:

• Account creation and management: To register your account, verify your identity, and manage your ongoing relationship with winlah;
• Service delivery: To provide access to games, process bets, credit winnings, and facilitate deposits and withdrawals;
• Legal and regulatory compliance: To meet anti-money laundering (AML) obligations, age verification requirements, and any other applicable regulatory duties;
• Responsible gaming: To monitor gaming behaviour, identify potential problem gambling indicators, and enforce account-level responsible gaming tools;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and abuse of the Platform;
• Customer support: To respond to your enquiries, resolve disputes, and improve service quality;
• Platform improvement: To analyse usage patterns and improve the functionality, performance, and design of the winlah Platform;
• Marketing communications: To send you promotional offers and information about winlah products where you have consented to receive such communications.

6. Disclosure of Personal Data

winlah does not sell, rent, or trade your personal data to third parties. We may disclose your personal data to the following categories of recipients where necessary and lawful:

• Payment service providers: To process your deposit and withdrawal transactions via FPX, DuitNow, Touch n Go eWallet, Boost, and other accepted payment methods;
• Game content providers: To deliver gaming sessions from third-party certified studios integrated into the Platform;
• Identity verification services: To conduct AML and age verification checks using specialised third-party verification providers;
• IT and infrastructure providers: Cloud hosting, database, and security service providers who process data on winlah's behalf under strict data processing agreements;
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or at the direction of a competent regulatory or law enforcement authority.

All third parties with whom winlah shares personal data are contractually required to handle that data securely and in accordance with applicable data protection obligations.

7. International Data Transfers

The winlah Platform may involve the transfer of personal data to processors or sub-processors located outside Malaysia. Where such transfers occur, winlah takes steps to ensure that appropriate safeguards are in place to protect your personal data, including standard contractual clauses, data processing agreements, and assessments of the recipient country's data protection framework. By using the winlah Platform, you consent to such transfers as described in this Policy.

8. Data Retention

winlah retains personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and accounting obligations. Specifically:

• Account and identity data is retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in line with AML retention obligations;
• Transaction records are retained for a minimum of seven (7) years;
• Customer support communications are retained for a minimum of two (2) years;
• Technical log data is typically retained for 90 days unless required for an ongoing investigation.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised.

9. Security Measures

winlah implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit;
• Hashed and salted credential storage — passwords are never stored in plaintext;
• Payment tokenisation via certified payment gateway partners;
• OTP-based two-factor authentication on account login;
• Access controls limiting internal data access on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is entirely secure. winlah cannot guarantee absolute security, and you use the Platform at your own risk. In the event of a data breach affecting your personal data, winlah will notify affected users and relevant authorities in accordance with applicable legal requirements.

10. Cookies and Tracking Technologies

winlah uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and support fraud prevention. The types of cookies used include:

• Essential cookies: Necessary for the Platform to function (e.g., session authentication, security tokens). These cannot be disabled without impairing Platform functionality;
• Analytical cookies: Used to understand how users interact with the Platform, which pages are visited most frequently, and where performance improvements may be made;
• Preference cookies: Store your display preferences and settings to personalise your experience across sessions.

You may configure your browser to refuse all cookies or to alert you when cookies are being sent. Disabling essential cookies may impair your ability to use certain features of the winlah Platform, including login functionality.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by winlah:

• Right of access: You may request a copy of the personal data winlah holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data, subject to winlah's legal retention obligations;
• Right to restrict processing: You may request that winlah restricts its processing of your data in certain circumstances;
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to winlah;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, please contact winlah at the details provided in Section 14. winlah will respond to verified data subject requests within 14 business days of receipt.

12. Children and Minors

The winlah Platform is strictly for individuals aged 21 years and above. winlah does not knowingly collect personal data from individuals below the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. Parents or guardians who believe a minor has registered on the Platform should contact winlah immediately at [email protected].

13. Changes to This Policy

winlah reserves the right to update this Privacy Policy at any time. Where changes are material, winlah will provide reasonable notice via email to registered account holders or by prominent notice on the Platform. The effective date at the top of this Policy indicates when the current version entered into force. Your continued use of the Platform following notification of any change constitutes your acceptance of the revised Policy.

14. Contact and Complaints

For all privacy-related enquiries, data subject requests, or complaints regarding winlah's data handling practices, please contact us. All communications should be directed to:

Email: [email protected]

winlah will acknowledge data protection enquiries within 2 business days and provide a substantive response within 14 business days of receiving all necessary information to process the request.

If you are not satisfied with winlah's response to your complaint, you may have the right to escalate your complaint to a relevant data protection supervisory authority in your jurisdiction.