Winbox — online casino Malaysia
Join
Winbox Privacy Policy — winboxbets.com

Privacy Policy

This Privacy Policy explains how Winbox ("we," "us," or "our") collects, uses, stores, shares, and protects personal data when you use our website at winboxbets.com, the Winbox mobile application (Android and iOS), and any related services (collectively, the "Platform").

Winbox is committed to protecting your privacy in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA) and its 2025 amendments, and applicable data-protection laws in other jurisdictions where we operate.

By creating a Winbox account or using the Platform, you confirm that you have read this Privacy Policy and consent to the practices described.

1. Who We Are

Winbox is an online gaming platform operated under Curaçao eGaming licensing with PAGCOR certification, serving players in Malaysia and selected Southeast Asian markets. For the purposes of this Privacy Policy, Winbox is the data controller of your personal data.

If you have any questions, complaints, or wish to exercise your data-subject rights under this policy, contact us at:

2. Personal Data We Collect

We collect personal data when you register, deposit, play games, communicate with support, or otherwise interact with the Platform. The data falls into the following categories:

We do not knowingly collect data from anyone under 18. If you are under 18, do not use the Platform.

2.1 Identity and contact data

  • Full name (as on government-issued ID)
  • Date of birth
  • Nationality
  • Government-issued identification number (NRIC for Malaysian players, passport for international)
  • Residential address
  • Email address
  • Mobile phone number

2.2 Financial data

  • Bank account details (account number, bank name, account holder name) for deposits and withdrawals
  • E-wallet account identifiers (Touch 'n Go, DuitNow, etc.)
  • USDT wallet addresses where applicable
  • Transaction history including deposits, withdrawals, transfers, and game-related debits and credits

2.3 Account and usage data

  • Username and encrypted password
  • Account creation date
  • Login history (timestamps, IP addresses, device types)
  • Game-play activity (games played, bets placed, outcomes, session duration)
  • Wallet balances, including /interest-fd/">Interest FD subscriptions and /rebate/">rebate earnings
  • Referral activity (your QR code usage, downline player IDs)

2.4 Device and technical data

  • Device type, operating system, and browser version
  • IP address and approximate geolocation derived from it
  • Device fingerprint identifiers (used for fraud prevention via Iovation and ThreatMetrix)
  • Cookies and similar tracking technologies (see Section 9)

2.5 Verification and compliance data

  • Copies of identification documents submitted during Know Your Customer (KYC) verification
  • Selfie or liveness-check images
  • Source-of-funds documentation where required
  • Records of compliance-related communications

2.6 Communications data

  • Live chat transcripts and email correspondence with our support team
  • Phone or WhatsApp message records where applicable
  • Feedback, survey responses, and complaints

3. How We Collect Your Personal Data

We collect personal data in three ways:

Directly from you: When you register an account, complete KYC verification, deposit or withdraw funds, place bets, contact support, or respond to our communications.

Automatically through the Platform: When you log in, play games, or browse the website or app. This includes data captured by cookies, device fingerprinting tools, and our payment and security systems.

From third parties: Our payment processors confirm transaction completion. Our KYC verification providers help us confirm your identity. Our fraud-prevention partners (Iovation, ThreatMetrix) provide risk scores based on device behaviour. Our game providers report your game-play activity to our wallet system so balances stay accurate.

4. Why We Use Your Personal Data

We process your personal data for the following purposes, each tied to a legal basis under PDPA and equivalent frameworks:

To provide the Platform. Creating and maintaining your account, processing deposits and withdrawals, calculating rebates and Interest FD interest, settling bets, and crediting winnings.

Legal basis: performance of contract.

To comply with regulatory and legal obligations. KYC verification, anti-money-laundering (AML) checks, age verification, responsible-gambling controls, tax reporting where applicable, and responding to lawful requests from authorities.

Legal basis: compliance with legal obligation.

To prevent fraud and protect the Platform. Detecting suspicious activity, multi-account abuse, payment fraud, bonus abuse, and security threats. This includes device fingerprinting and behavioural risk scoring.

Legal basis: legitimate interest in protecting the Platform and other users.

To provide customer support. Responding to your enquiries, resolving disputes, and improving our service quality.

Legal basis: performance of contract and legitimate interest.

To send transactional communications. Confirmations of deposits, withdrawals, rebate credits, FD redemptions, and other account activity.

Legal basis: performance of contract.

To send marketing communications. Promotional offers, new game launches, tournament announcements, and bonus campaigns — only where you have given consent or where applicable law permits. You can opt out at any time (see Section 11).

Legal basis: consent.

To improve and develop the Platform. Analysing aggregated usage data to enhance features, identify popular game providers, and optimise the player experience. We use anonymised or aggregated data wherever possible.

Legal basis: legitimate interest.

5. Who We Share Your Personal Data With

Winbox does not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

All third-party recipients are contractually required to protect your personal data and use it only for the purposes for which it was shared.

Game providers. /slots/">Slot, /live-casino/">live casino, /sports/">sports, /lottery/">lottery, /fish-shooter/">fishing, /cards/">card, /fast-games/">fast-game and /cockfighting/">cockfighting providers (e.g. Pragmatic Play, Evolution, JDB, SV388, etc.) receive the minimum data needed to operate their games for you — typically a session identifier and your wallet balance, not your full identity.

Payment processors and banks. When you deposit or withdraw, we share the data needed to complete the transaction (bank account details, amounts, transaction references) with our payment partners, including Malaysian banks (Maybank, CIMB, Public Bank, etc.), Touch 'n Go, and USDT processing partners.

KYC and fraud-prevention providers. Identity-verification services, document authentication providers, Iovation, and ThreatMetrix process your identity and behavioural data to confirm you are who you claim to be and to detect fraud.

Independent auditors and certification bodies. BMM Testlabs, iTech Labs, Gaming Laboratories International (GLI), and TST Global may access aggregated transaction and game-play data during certification audits — not your personal identity unless legally required.

Regulatory and law-enforcement authorities. We will disclose personal data when required to do so by law, court order, regulatory request, or to comply with our licensing obligations under Curaçao eGaming and PAGCOR.

Professional advisors. Our lawyers, accountants, and auditors, where access to personal data is necessary for them to perform their services for us.

Marketing service providers. Email and SMS delivery platforms, analytics providers (such as Google Analytics, where used), and advertising platforms — where you have consented to marketing.

Corporate transactions. In the event of a merger, acquisition, restructuring, or sale of business assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6. Cross-Border Data Transfers

Winbox operates across Malaysia, Thailand, Singapore, Vietnam, Indonesia, and Australia. Some of our service providers (including cloud hosting, KYC verification, and fraud-prevention partners) are based outside Malaysia. When we transfer your personal data outside Malaysia, we ensure the receiving country provides an adequate level of data protection, or we put in place contractual safeguards equivalent to PDPA standards.

7. How Long We Keep Your Personal Data

We retain your personal data only as long as necessary for the purposes described in this policy. Specific retention periods include:

After the applicable retention period expires, your personal data is deleted, anonymised, or archived in a secure form that does not permit re-identification.

  • Account data: For as long as your account is active, plus seven (7) years after closure, to meet AML and regulatory record-keeping requirements.
  • Transaction and financial records: Seven (7) years from the date of transaction, to meet financial-record-keeping obligations.
  • KYC verification documents: Seven (7) years after account closure, as required by AML regulations.
  • Communications and support records: Two (2) years after the conclusion of the relevant matter, unless extended retention is required for dispute resolution.
  • Marketing data: Until you withdraw consent, plus a reasonable period to process the withdrawal.
  • Device and security logs: Up to two (2) years, after which they are deleted or anonymised.

8. How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data, including:

No system is perfectly secure. In the event of a personal data breach that poses a risk to your rights, we will notify you and the relevant authorities within the timeframes required by PDPA and applicable laws.

  • End-to-end SSL/TLS encryption for all data transmitted between your device and our servers.
  • Encrypted storage of sensitive data, including passwords (hashed and salted) and KYC documents.
  • Device intelligence and fraud-prevention systems (Iovation, ThreatMetrix) that monitor for suspicious access patterns in real time.
  • Two-factor authentication (2FA) available on all accounts and required for sensitive actions.
  • Access controls and audit logging within Winbox — only authorised personnel can access personal data, and access is logged.
  • Regular security testing including penetration testing and vulnerability scanning.
  • Independent platform audits by BMM Testlabs, iTech Labs, GLI, and TST Global.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to make the Platform work, remember your preferences, analyse usage, and (where you consent) deliver relevant marketing. Categories include:

You can manage cookie preferences through your browser settings or through the cookie banner on the Platform. Disabling certain cookies may affect Platform functionality.

  • Strictly necessary cookies — required for login, session management, security, and core functionality. These cannot be disabled.
  • Functional cookies — remember your language, region, and display preferences.
  • Analytics cookies — help us understand how players use the Platform so we can improve it. We use aggregated data where possible.
  • Marketing cookies — used only with your consent, to deliver personalised offers and measure campaign performance.

10. Your Rights

Under the PDPA and applicable data-protection laws, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@winboxbets.com. We will respond within 21 days under PDPA timelines. We may need to verify your identity before processing your request.

Right to access. Request a copy of the personal data we hold about you.

Right to correction. Request correction of inaccurate or incomplete data.

Right to withdraw consent. Withdraw consent for processing based on consent at any time. This will not affect the lawfulness of processing before withdrawal.

Right to object. Object to processing based on legitimate interests, including direct marketing.

Right to data portability. Request your personal data in a structured, commonly used format where technically feasible.

Right to limit processing. Request that we limit how we use your data in certain circumstances.

Right to delete. Request deletion of your personal data, subject to legal retention obligations. Note that AML and regulatory rules generally require us to retain account and transaction records for seven years, even after account closure.

Right to complain. Lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Suruhanjaya Pelindungan Data Peribadi Malaysia) if you believe we have not handled your data correctly.

11. Marketing Communications

If you have consented to receive marketing communications, you can opt out at any time by:

Opting out of marketing does not affect transactional communications (deposit confirmations, security alerts, etc.), which we must send to operate your account.

  • Clicking the "unsubscribe" link in any marketing email
  • Replying "STOP" to any marketing SMS
  • Updating your communication preferences in your account settings
  • Contacting privacy@winboxbets.com

12. Responsible Gambling and Self-Exclusion

If you choose to self-exclude or set deposit and play limits through our /responsible-gaming/">Responsible Gambling tools, we will retain the data necessary to enforce those limits, including after account closure. This is to prevent the limits from being circumvented and to comply with our licensing obligations.

13. Children's Privacy

The Platform is strictly for persons aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected such data, we will delete it immediately. If you believe we have collected data from a minor, contact privacy@winboxbets.com.

14. Third-Party Websites and Links

The Platform may contain links to third-party websites (such as game providers' landing pages, social media, or partner sites). This Privacy Policy does not apply to those external sites. Review their privacy policies before sharing personal data with them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. The "Last updated" date at the top will reflect any changes. Where the changes are material, we will notify you by email or through a prominent notice on the Platform before they take effect.

16. Contact Us

For any questions, complaints, or requests relating to this Privacy Policy or your personal data:

You also have the right to contact the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled.