Privacy Policy 28win – Malaysia Player Data Protection Commitment

This Privacy Policy ("Policy") is published by 28win and applies to all users who access or use the 28win platform through the website 28win.site and all its subdomains, including access via mobile browser.

28win is committed to protecting every member's privacy and ensuring your personal data is handled in a transparent, secure, and responsible manner. This Policy clearly explains what types of data we collect, how we use it, who may access it, and the rights you hold as a 28win platform user in Malaysia.

28win collects information from you in several ways. The following are the types of data we may collect:

Every piece of data collected by 28win have a clear and legitimate purpose. We process your personal data for the following purposes:

• Account management: Creating, verifying and maintaining your 28win account, including identity verification (KYC) required prior to your first withdrawal.
• Transaction processing: Processing deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u (FPX) and CIMB Clicks securely and efficiently.
• Service provision: Enabling you to access and enjoy all games and services on the 28win platform — from slots, Live Casino and poker to lottery, Sports Betting and cricket.
• Security & fraud prevention: Identifying and preventing fraud, money laundering, bonus abuse and unauthorised access to 28win accounts.
• Legal compliance: Fulfilling applicable legal and regulatory obligations, including anti-money laundering (AML) requirements and Malaysia's Personal Data Protection Act 2010.
• Service improvement: Analysing usage patterns to improve the interface, platform performance, and overall experience for 28win members.
• Service communications: Sending important notices related to your account, changes to terms, relevant bonus promotions and security updates.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may need responsible gaming support, in line with 28win's commitment to member well-being.

28win implement comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure:

• Encryption in transit: All data transmitted between your browser or app and 28win's servers is encrypted using the latest version of Transport Layer Security (TLS) with 256-bit SSL.
• Storage encryption: Sensitive data stored in 28win's databases — including financial information and KYC documents — is encrypted at rest using AES-256 encryption.
• Internal access controls: Only 28win staff with a legitimate business need are granted access to member personal data. All access is automatically logged and monitored.
• Two-factor authentication (2FA): 28win encourages all members to enable two-factor authentication for an added layer of security. All internal administrative access at 28win requires 2FA.
• Regular security audits: 28win's systems undergo regular security audits and independent penetration testing to identify and address potential vulnerabilities.
• Financial data segregation: Members' financial information (banking details and transaction history) is stored in an environment separate from user profile data to minimise the risk of a combined breach.

28win does not sell or permit the use of members' personal data for third-party commercial purposes. However, there are limited circumstances in which we may share your information with certain parties:

• Technology service providers: Cloud infrastructure providers, payment systems (such as gateway providers for Touch 'n Go, GrabPay, DuitNow, and FPX), and other IT service providers required to operate the 28win platform. All third parties are bound by strict confidentiality agreements.
• Game providers: Necessary game data may be shared with licensed game providers such as Pragmatic Play, Evolution Gaming, PG Soft, and others to enable game functionality — only the minimum required information is shared.
• Regulatory body: 28win will disclose information to regulatory authorities, law enforcement, or courts when required to do so by Malaysian law or a valid court order.
• Fraud prevention: 28win may share limited information with industry bodies or other platforms for cross-platform fraud detection purposes — for example, to verify the identity of a new registration applicant.

28win retain your personal data for as long as your account is active and for such period thereafter as required to fulfil legal obligations, resolve disputes and enforce our agreements:

• Active account data: For as long as your account remains active with 28win, your personal data will be retained to ensure smooth service delivery and account security.
• After account closure: Once an account is closed at your request, 28win will retain financial transaction records for a minimum of 7 years in accordance with Malaysia's anti-money laundering legal requirements. Other profile data will be deleted or anonymised within 90 days.
• KYC documents: Copies of identity verification documents are retained for a minimum of 5 years from the date of the last verification, in accordance with regulatory requirements.
• Support communication logs: Records of conversations with 28win's customer support team are retained for 3 years for reference and dispute resolution purposes.
• Deletion request: You may request deletion of your personal data by contacting us at support@28win.site. We will process your request within 30 days, subject to applicable legal retention obligations.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data at 28win:

• Right to Access: You have the right to request a copy of the personal data we hold about you. This request can be made by emailing support@28win.site and will be processed within 14 business days.
• Right to rectification: If you find that your personal data held by 28win is inaccurate or incomplete, you have the right to request a correction. Some data can be updated directly through your account settings.
• Right to object to processing: You have the right to object to the processing of your personal data for direct marketing purposes. Opt out of 28win marketing communications at any time via the unsubscribe link in any email or through your account settings.
• Right to erasure: You have the right to request the deletion of your personal data ("right to be forgotten"), subject to applicable legal retention obligations. Each request will be assessed on a case-by-case basis.
• Right to data portability: You have the right to receive your personal data in a machine-readable format (such as CSV or JSON) for transfer to another platform should you choose to do so.
• Right to lodge a complaint: If you believe 28win has processed your personal data in a manner that violates the PDPA, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

28win use cookies and similar tracking technologies to enhance the user experience and ensure the platform operates correctly. Below are the types of cookies we use:

• Essential cookies: Required for core 28win platform functions such as login verification and game session maintenance. Without these cookies, the platform cannot function properly.
• Preference cookies: Stores your preferences such as language, preferred odds format, and display settings to deliver a more personalised experience each time you browse 28win.
• Analytics cookies: Helping us understand how players use the 28win platform — which pages are visited most, how long sessions last and where users encounter technical difficulties. This allows us to continuously improve the platform.
• Security cookies: Used to detect suspicious activity, prevent fraud and ensure your login sessions are protected from account takeover attempts.

You can manage cookie settings through your web browser. However, blocking essential cookies may affect the functionality of the 28win platform. To block optional or analytics cookies, go to your browser settings and choose to block non-essential third-party cookies.

28win is an entertainment platform intended solely for individuals aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we discover that personal data belonging to a minor has been collected without our knowledge — whether through dishonest account registration or otherwise — we will take immediate steps to delete that data and close the associated account.

Parents or guardians who believe their child may have registered a 28win account without authorisation are encouraged to contact us immediately at support@28win.site so that immediate action can be taken.

Although 28win taking all reasonable precautions, no technology system can be guaranteed 100% secure. In the event of a data breach affecting members' personal data, the following procedures will be followed:

• Detection & assessment: As soon as 28win becomes aware of a suspected breach, our security team will immediately conduct an investigation to determine its scope and impact.
• Containment: Immediate steps will be taken to contain the breach, including cutting off unauthorised access and restoring system security.
• Notice to members: Members whose personal data may have been affected will be notified within 72 hours via email and an in-platform notice — detailing what occurred, what data may have been affected, and what steps to take.
• Reporting to authorities: Serious data breaches will be reported to the Personal Data Protection Commissioner of Malaysia and relevant authorities in accordance with legal requirements.
• Remediation actions: 28win will take all reasonable steps to restore system security and prevent similar breaches from occurring in the future.

28win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements or platform improvements.

When significant amendments are made to this Privacy Policy, 28win will notify members via a prominent notice on the platform's homepage and by email to the address registered to your account, at least 14 days before the changes take effect.

Continued use of the 28win platform after an amendment takes effect constitutes acceptance of the updated Privacy Policy. If you disagree with any amendment, you have the right to close your 28win account by contacting our customer support before the amendment comes into effect.

If you have any questions, concerns or requests regarding how 28win handling your personal data, please reach out to us through the following channels:

• Privacy email: support@28win.site — please use the subject line "Privacy Enquiry" or "Data Request" so your email is promptly handled by the right team.
• Live chat: Use the live chat feature on the 28win website, available 24/7. State that you have a privacy-related enquiry and you will be connected to the appropriate representative.
• Response time: 28win is committed to responding to all privacy enquiries within 5 business days. For more complex data requests, a 14-business-day turnaround may be required.