Privacy Policy — winrm20

winrm20 collects personal data through the following channels and methods:

• Direct submission: Data you provide voluntarily when creating an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or participating in promotions.
• Automated technical collection: Data collected automatically when you access the platform, including IP addresses, device fingerprints, browser characteristics, and session activity, via server logs, cookies, and analytics tools.
• Third-party payment processors: Transaction confirmation data received from payment service providers such as FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and USDT TRC20 networks when you initiate deposits or withdrawals.
• Identity verification providers: Data received from third-party KYC and identity verification service providers in connection with age and identity confirmation.
• Fraud prevention and security services: Data shared with or received from fraud detection platforms to protect the integrity of platform transactions and member accounts.

winrm20 processes personal data only where there is a documented lawful basis to do so. The table below sets out the primary purposes for which your data is processed and the corresponding legal basis:

winrm20 does not sell personal data. We do not share your personal data with third parties for their own marketing or commercial purposes without your explicit consent. Personal data may be disclosed to third parties only in the following circumstances:

• Payment service providers: To the extent necessary to process your deposits and withdrawals via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, or TRC20 network operators. These providers process data only for the purpose of completing the specific transaction.
• Identity verification providers: Third-party KYC service providers engaged to verify identity documents and confirm age eligibility. These providers are bound by confidentiality obligations and data processing agreements.
• Fraud prevention and security partners: Service providers engaged to detect, investigate, and prevent fraudulent activity, money laundering, and other platform security threats.
• Technology and infrastructure providers: Cloud hosting, database, and platform infrastructure providers who process data on winrm20's behalf as data processors, subject to appropriate contractual safeguards.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory directive — including disclosures to law enforcement authorities investigating criminal activity involving our platform.
• Business successors: In the event of a merger, acquisition, or restructuring of the winrm20 business, personal data may be transferred to the successor entity, subject to the same privacy protections as set out in this Policy.

In the course of operating the winrm20 platform, your personal data may be transferred to, stored in, or processed in countries outside Malaysia. This may occur where our platform infrastructure providers, cloud hosting services, or third-party processors operate servers or facilities in other jurisdictions.

Where personal data is transferred internationally, winrm20 ensures that appropriate safeguards are in place to protect the data, including:

• Contractual protections requiring overseas recipients to apply equivalent data security standards;
• Transfer to jurisdictions that maintain adequate data protection frameworks;
• Implementation of technical and organisational security measures comensurate with the risk level of the data transferred.

If you require further information about specific international data transfer arrangements, you may contact our support team via the channels set out in Section 15.

winrm20 uses cookies and similar tracking technologies to operate the platform, maintain your session, remember your preferences, and gather analytics data. The following categories of cookies are used:

• Essential / Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impacting platform functionality.
• Functional Cookies: Used to remember your preferences, language settings, and display options to enhance your experience on return visits.
• Analytics Cookies: Used to collect aggregated, anonymised data on how users interact with the platform, including page views, session duration, and navigation patterns. This data helps us improve the platform experience.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and account takeover attempts.

You may manage your cookie preferences through your browser settings. Note that disabling certain categories of cookies may affect your ability to use some platform features. Continued use of the platform following your first visit constitutes acceptance of our use of essential and functional cookies.

winrm20 retains personal data only for as long as is necessary for the purposes for which it was collected, subject to the following general retention guidelines:

• Active account data: Retained for the duration of the active account relationship and for minimum of five (5) years following account closure, to meet financial, anti-money laundering, and compliance obligations.
• KYC and identity verification documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction, in accordance with applicable regulatory requirements.
• Transaction records: Deposit, withdrawal, and wagering records are retained for a minimum of seven (7) years to satisfy financial record-keeping obligations.
• Customer support communications: Retained for a minimum of two (2) years from the date of the last communication, to facilitate reference in the event of future disputes.
• Marketing data: Retained until you withdraw consent for marketing communications, after which your data is removed from all active marketing lists within30 days.
• Analytics data: Aggregated, anonymised analytics data may be retained indefinitely as it is no longer attributable to an identifiable individual.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

winrm20 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and winrm20's servers is encrypted using 256-bit SSL/TLS protocols. Data stored in our databases is encrypted at rest.
• Access controls: Access to personal data within winrm20 is restricted on a strict need-to-know basis. Internal staff access is governed by role-based permissions and regular access reviews.
• Two-factor authentication: Available for all member accounts to add an additional layer of protection to login processes.
• Intrusion detection and monitoring: Continuous monitoring of platform systems for unusual activity, potential security breaches, and attempted intrusions.
• Regular security assessments: Periodic vulnerability assessments and penetration tests are conducted to identify and remediate potential security weaknesses before they can be exploited.
• Data breach response: winrm20 maintains a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, we will notify affected individuals and relevant authorities in accordance with applicable obligations.

While we take all reasonable measures to protect your data, no internet-based service can guarantee absolute security. You are encouraged to protect your Account by using a strong, unique password and enabling two-factor authentication.

As a data subject, you hold a number of rights in respect of your personal data. winrm20 respects and facilitates the exercise of these rights, subject to applicable legal requirements and proportionate verification of your identity prior to processing any request.

To exercise any of the above rights, please contact winrm20 via the details provided in Section 15. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Identity verification will be required before your request is actioned.

The winrm20 platform is strictly for adults aged21 years and above. winrm20 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and winrm20 employs technical and procedural controls to prevent underage registration.

If winrm20 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, that account will be immediately suspended, all associated personal data will be permanently deleted from our records, and any deposits will be returned via the original payment method where feasible.

If you believe that a minor may have registered on the platform, please contact our support team immediately via the channels in Section 15. winrm20 will investigate and act promptly.

winrm20 may update this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, applicable legal requirements, or for other operational reasons. The date of the most recent revision will be clearly displayed at the top of this page.

Where changes to this Policy are material — meaning they significantly alter how we collect, use, or share your personal data — we will provide advance notice via the platform or by email to your registered address, where reasonably practicable, prior to the changes taking effect.

We encourage you to review this Policy periodically. Your continued use of the winrm20 platform following the publication of a revised Policy constitutes your acceptance of the updated terms.

For any queries, concerns, or requests relating to this Privacy Policy or to the personal data winrm20 holds about you, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the winrm20 platform. Suitable for urgent queries and initial enquiries.
• Email: support@winrm20.cam — for formal data subject access requests, rectification requests, erasure requests, or complaints. Please include "Privacy Request" in the subject line and provide your registered username to expedite processing.

winrm20 will acknowledge all data protection correspondence within 5 business days. Substantive responses to formal data subject requests will be provided within 30 calendar days of receipt, subject to proportionate identity verification.

For further information on your rights as a player or to review our broader platform policies, please also refer to our Terms & Conditions and Responsible Gambling pages.