2win Privacy Policy – Personal Data Protection for Malaysian Members

2win takes the privacy of our members very seriously. We understand that when you register an account and use our platform — whether to play slots, bet on BWF badminton matches, enjoy live casino, or participate in the lottery — you are entrusting us with your personal information. That trust is a responsibility we uphold with full commitment.

This Privacy Policy is drafted in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and clearly sets out your rights as a data subject, our obligations as a data controller, and how we handle all personal data collected in connection with the operation of the 2win platform.

This Privacy Policy applies to all users of the 2win platform, including unregistered visitors, registered members, and former members whose accounts have been closed. It also covers all the ways you interact with 2win — whether through the website, mobile app, live chat, email, or WhatsApp.

This document should be read together with 2win Terms & Conditions which together form the entire agreement between you and the platform. In the event of any conflict between these documents, this Privacy Policy shall prevail on all matters relating to personal data.

2win collects the following categories of personal data in the course of operating the platform:

• Identity Data: Full name, Malaysian identification card number (MyKad), date of birth, gender, and a copy of the identification card (for the KYC process).
• Contact Details: Malaysian mobile number, email address, and current residential address.
• Financial Data: Bank account numbers, e-wallet account numbers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow), deposit and withdrawal transaction records, and betting activity history.
• Technical Data: IP address, browser type, device operating system, login session data, and in-platform activity records.
• Behavioural Data: Records of games played (slots, casino, Sports Betting, badminton, lottery), session duration, bet values, and game preferences.
• Communications Data: Records of live chat conversations, emails, and WhatsApp communications with the 2win support team.

2win collects personal data through various channels in the course of operating the platform:

• Account Registration: When you complete the 2win registration form, you provide basic information such as your name, phone number, and email address directly.
• KYC Process: During the identity verification process (Know Your Customer), you will be required to submit a copy of your MyKad and proof of address. This data is necessary to meet regulatory compliance and anti-money laundering (AML) legal requirements.
• Financial Transactions: Each time you make a deposit via Touch 'n Go, GrabPay, DuitNow, FPX, or any other e-wallet, or make a withdrawal, the 2win system records the details of that transaction.
• Platform Usage: Our system automatically logs your activity on the platform — games played, matches wagered on, bet amounts, and timestamps.
• Cookies and Similar Technologies: The 2win website uses cookies to enhance the user experience and collect aggregated analytics data. Further details are outlined in Section 7.
• Communications: When you contact 2win support via live chat, email, or WhatsApp, the content of those communications is retained for service quality and complaint resolution purposes.

2win uses the personal data collected for the following purposes, all of which are lawful under Malaysia's PDPA:

• Account Management: Creating and managing your 2win account, including the login process, identity verification, and profile updates.
• Service Delivery: Giving you access to all features on the 2win platform — slots, live casino, roulette, badminton betting, virtual sports, lottery, and all other games.
• Transaction Processing: Processes deposits via Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as withdrawals of winnings to your bank account or e-wallet.
• Regulatory Compliance: Meeting the anti-money laundering (AML), KYC, and regulatory reporting requirements set by the relevant Malaysian authorities.
• Fraud Prevention: Identifying, investigating, and preventing fraudulent activity, bonus abuse, multiple account usage, and other unlawful activities on the 2win platform.
• Customer Support: Enabling the 2win support team to assist you effectively whenever you encounter an issue or have an enquiry.
• Responsible Gambling: Monitoring betting activity patterns to identify early signs of problem gambling and provide appropriate support.
• Service Communications: Sending important notifications related to your account, transactions, policy changes, and security information. This is not marketing — it is essential service communication.
• Platform Improvement: Using aggregated and anonymised data to understand usage patterns and improve the overall user experience on the 2win platform.

2win does not sell, rent, or trade your personal data to any third party for their own marketing purposes. However, to operate the platform effectively, 2win may share your data with the following categories of third parties under limited and controlled circumstances:

• Payment Providers: Payment service providers we work with to process deposits and withdrawals — including FPX processors, e-wallet gateway providers, and relevant financial institutions. This sharing is necessary to complete your transactions and is limited to the minimum information required.
• Game Software Providers: Game development companies that supply slots, live casino, and other games to the 2win platform may receive your game session data as required for technical functionality. All such providers are bound by strict data confidentiality agreements.
• KYC & AML Services: Third-party identity verification service providers that assist us in conducting KYC checks and AML compliance as required under Malaysian law.
• Legal Authorities: 2win will disclose your personal data to Malaysian government or law enforcement authorities when required to do so by law, court order, or valid regulatory directive.
• Business Transfers: In the event of a merger, acquisition, or sale of 2win's assets, user data may be transferred as part of that business transaction. You will be notified in advance should such a transfer occur.

2win invests seriously in security infrastructure to protect your personal data from unauthorised access, alteration, disclosure, or destruction. The key security measures we have implemented include:

• 256-bit SSL Encryption: All communications between your device and 2win's servers are protected by TLS/SSL protocol with 256-bit encryption. This means your data cannot be intercepted or read by unauthorised parties during transmission.
• Two-Factor Authentication (2FA): 2win members are encouraged to enable 2FA for an added layer of security on their account. With 2FA active, logging in requires verification via a one-time OTP code sent to your registered phone number.
• 24/7 Monitoring: An automated security monitoring system operates around the clock to detect and respond to any suspicious activity or intrusion attempts.
• Internal Access Controls: User data is accessible only to 2win staff with a legitimate business need who have undergone background checks. All access is logged and periodically audited.
• Data-at-Rest Encryption: Data stored in 2win's databases is also encrypted, meaning that even if our servers were physically compromised, the data cannot be read without the correct encryption key.
• Regular Security Testing: 2win conducts regular penetration testing and security audits by independent third parties to identify and address vulnerabilities before they can be exploited.

While we take all reasonable measures to protect your data, no security system is infallible. In the event of a data breach affecting your personal information, 2win will notify you within the timeframe stipulated by Malaysia's PDPA and take appropriate remedial action.

The 2win website uses cookies and similar tracking technologies to enhance the user experience, maintain login sessions, and collect analytics data that helps us understand how the platform is used. The types of cookies we use include:

• Essential Cookies: Required for core platform functionality — including maintaining your login session and ensuring account security. These cookies cannot be disabled without affecting platform functionality.
• Preference Cookies: Saves your preferences such as language, display settings, and game preferences so you don't have to reconfigure them each time you log in.
• Analytics Cookies: Collecting aggregated and anonymised data on how users interact with the 2win platform — pages visited, time spent, and navigation paths. This data is used solely to improve the platform.
• Security Cookies: Helps the 2win system detect suspicious login attempts, brute force attacks, and other fraudulent activity.

You can manage cookie settings through your browser preferences. However, disabling essential cookies may affect your ability to use the 2win platform fully, including potentially being unable to log in or complete transactions.

In the course of operating the 2win platform, your personal data may be processed or stored by cloud infrastructure service providers whose servers may be located outside Malaysia. Any such data transfers are subject to the following conditions:

• Transfers only take place to countries or entities that offer data protection standards equivalent to or higher than Malaysia's, or are covered by an appropriate data transfer agreement.
• All third-party service providers involved in cross-border data transfers are bound by data processing agreements that ensure your data is protected to at least the standards required under Malaysia's PDPA.
• Sensitive financial data, including your bank account and e-wallet information, is processed and stored wherever possible within systems located in Malaysia or in a recognised regulatory jurisdiction.

For more information about cross-border data transfers, or if you have questions about where your data is stored, please contact the 2win support team.

2win retains your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, subject to record retention requirements stipulated under Malaysian law. General retention period guidelines are as follows:

• Active Account Data: For the duration your account remains active and for a minimum of 7 years after account closure, to fulfil Malaysia's AML and accounting legal requirements.
• Financial Transaction Records: A minimum of 7 years in accordance with Malaysia's financial and taxation legal requirements, even after account closure.
• KYC Records: Minimum 5 years after the business relationship ends, as required by the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).
• Support Communication Records: 3 years for service quality and future complaint resolution purposes.
• Analytics & Technical Log Data: Maximum 24 months in identifiable format, after which data is aggregated and anonymised.

When data is no longer needed and there is no legal requirement to retain it, 2win will delete or anonymise it using approved secure deletion procedures.

As a data subject under Malaysia's PDPA, you have the following rights regarding the personal data held by 2win:

• Right of Access: You have the right to request and receive a copy of the personal data we hold about you. 2win will process access requests within 21 business days.
• Right to Rectification: You have the right to request corrections to any personal data that is inaccurate, incomplete, or outdated. Some corrections can be made directly through your 2win account profile settings.
• Right to Withdraw Consent: You may withdraw your consent for the use of your data for marketing or preferred communications at any time through your account settings or by contacting 2win support.
• Right to Object: Under certain circumstances, you have the right to object to the processing of your personal data where it is not based on your consent or our legitimate interests.
• Right to Erasure (Limited): You may request the deletion of your personal data, subject to legal record-keeping obligations that may require us to retain certain data even after a deletion request.

To exercise any of the above rights, please contact the 2win Privacy team by email at support@2win-jit.com clearly stating the type of request and the relevant account information. We may need to verify your identity before processing the request.

The 2win platform is restricted to individuals aged 18 and above. We do not knowingly collect or process any personal data from children or individuals under the age of 18.

Should 2win discover that personal data belonging to an individual under the age of 18 has been collected without our knowledge — whether through a false registration or any other means — we will take immediate steps to delete that data and close the account in question.

2win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or developments in platform operations. Any material amendments — meaning those that significantly affect your rights or how we use your data — will be communicated to you at least 14 days before taking effect, via in-account notification or email.

Your continued use of the 2win platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically to stay informed on how we protect your data.

The latest version of this Privacy Policy is always accessible on this page. The date of the last update is stated at the top of the document.

If you have any questions, concerns, or complaints regarding how 2win handles your personal data, or wish to exercise any of the rights set out in this Privacy Policy, please contact us through the following channels:

• Privacy Email: support@2win-jit.com (please state "Privacy Enquiry" in the subject line of your email)
• Live Chat: Available 24/7 within the 2win platform for general enquiries
• WhatsApp: Bahasa Melayu support via WhatsApp, available 24 hours a day, 7 days a week

2win is committed to responding to all privacy-related enquiries within 3 working days, and to resolving formal personal data requests within 21 working days as stipulated by the PDPA Malaysia. Should you be unsatisfied with our response, you have the right to refer your complaint to Malaysia's Personal Data Protection Department (JPDP).