Your privacy is a core responsibility at Winboxx, not a compliance checkbox. This Policy explains in plain, structured terms what personal data we collect, why we collect it, how we process and store it, and what rights you hold as a player and a data subject.
Privacy at a Glance
We collect only the data necessary to operate your account, process payments, and comply with KYC obligations. This includes identity documents, contact details, payment method information, and gameplay transaction records.
Your data is processed for specific, legitimate purposes: account management, payment processing, fraud prevention, regulatory compliance, and where you have provided consent, marketing communications.
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is restricted on a strict need-to-know basis. We conduct periodic security reviews and maintain a documented incident response plan.
We do not sell your personal data. Data is shared only with vetted service providers (payment processors, KYC partners, fraud detection services) under strict contractual data protection obligations.
You have the right to access, correct, download, or request deletion of your personal data. You may also withdraw marketing consent at any time. Exercise these rights by contacting our Data Protection team.
Active account data is retained for the duration of your account relationship. Following closure, most data is retained for a minimum of 5 years to satisfy AML and regulatory obligations, then securely deleted.
Winboxx ("we", "us", "our", "the Platform") is committed to protecting the personal data of every individual who interacts with our platform at winboxx.cam. This Privacy Policy ("Policy") describes how Winboxx collects, uses, stores, shares, and protects personal information relating to registered players and other users of the Platform.
This Policy is published in accordance with applicable data protection legislation, including obligations consistent with the Malaysian Personal Data Protection Act 2010 (PDPA) and internationally recognised data governance standards. All players located in Malaysia are entitled to the rights and protections described in this Policy.
By registering an account on Winboxx, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read together with our Terms & Conditions. If you do not agree with any part of this Policy, you should not register or continue using the Platform.
We may update this Policy periodically to reflect changes in our data practices, applicable law, or business operations. The most current version will always be available at winboxx.cam/privacy-policy. Material changes will be communicated to registered users via email notification or in-platform alert.
The following definitions apply throughout this Privacy Policy:
When you register, verify your account, or interact with the Platform, we collect:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, nationality, IC / MyKad number, Passport number, Driver's Licence number | Registration & KYC |
| Contact Data | Email address, mobile phone number, residential address (Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere in Malaysia) | Registration & KYC |
| Identity Document Images | Scanned or photographed copies of your IC, Passport, or Driver's Licence; selfie holding ID; utility bills | KYC Verification |
| Financial Data | GrabPay account identifier, Touch 'n Go eWallet account, Boost account, bank account details (Maybank, CIMB, Public Bank, RHB, Hong Leong), cryptocurrency wallet addresses (BTC, ETH, USDT, LTC) | Deposit / Withdrawal |
| Account Credentials | Username (hashed password — we never store passwords in plain text) | Registration |
| Support Communications | Live chat transcripts, email correspondence, feedback submissions | Customer Support |
When you use the Platform, we automatically collect:
We may receive personal data about you from third-party service providers engaged to assist with KYC verification, fraud detection, or payment processing. All such third parties are required to have a lawful basis for sharing data with us and are bound by data protection agreements.
Winboxx processes your personal data on the following lawful grounds:
Withdrawal of Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact us at [email protected] or adjust your account notification settings.
We use your personal data for the following specific purposes:
Your identity and contact data are used to create, maintain, and administer your Winboxx account. This includes processing your registration, validating login sessions, managing password resets, and communicating account-related notices.
Financial data — including GrabPay identifiers, Touch 'n Go eWallet details, Boost account information, DuitNow / FPX bank linkages, and cryptocurrency wallet addresses — is processed solely for the purpose of executing deposits, processing withdrawal requests, and reconciling transaction records. Payment data is transmitted to payment service providers using encrypted channels and is never stored on Winboxx servers in unencrypted form.
Identity document images and selfie photographs are processed for the purpose of verifying your identity in compliance with AML and regulatory requirements. KYC data is handled by authorised personnel and vetted third-party verification partners only.
Transaction data, IP address logs, device fingerprints, and usage patterns are analysed by automated and human review systems to detect and prevent fraudulent activity, money laundering, bonus abuse, and account compromise. This processing is carried out on the basis of legitimate interests.
Support communications (live chat transcripts, emails) are retained for quality assurance, dispute resolution, and staff training purposes. These records are accessible only to authorised support and compliance personnel.
Aggregated and anonymised usage data is analysed to understand how players interact with the Platform, identify areas for improvement, and optimise the user experience. Where analytics data is attributable to an individual, it is treated as personal data under this Policy.
Where required by law, Winboxx may be obligated to report certain transactions or provide data to regulatory authorities, law enforcement agencies, or licensing bodies. Such disclosures will only be made to the extent required by applicable law.
Cookies are small text files placed on your device when you access the Platform. They enable certain functions, preserve your session state, and allow us to understand how the Platform is being used.
You may control non-essential cookie use through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or receive a notification before a cookie is set. Please note that disabling certain cookies may affect the functionality and security of the Platform.
Winboxx does not sell, rent, or trade your personal data to third parties for their independent commercial use. Data is shared only in the limited circumstances described below:
No sale of personal data: Under no circumstances does Winboxx sell, licence, or otherwise transfer your personal data to third parties for marketing, profiling, or any other commercial purposes without your explicit prior consent.
In the course of providing the Platform's services, your personal data may be transferred to, stored in, or processed by systems located outside of Malaysia. This may occur in connection with our cloud infrastructure, KYC verification partners, or payment processing networks.
Winboxx ensures that any international transfer of personal data is subject to appropriate safeguards, including: data processing agreements incorporating standard contractual clauses; transfers only to jurisdictions with an adequate level of data protection as assessed by relevant supervisory authorities; or other legally recognised transfer mechanisms.
Players in Malaysia are entitled to the protections of the PDPA regardless of where their data is processed. If you have concerns about a specific international transfer, please contact our Data Protection contact (see Section 16).
We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration & identity data | Duration of account + 5 years post-closure | AML / PDPA regulatory obligation |
| KYC identity documents | Duration of account + 5 years post-closure | Regulatory obligation |
| Transaction & financial records | 7 years from transaction date | AML / tax reporting obligations |
| Customer support communications | 3 years from date of communication | Dispute resolution / QA |
| Marketing consent records | Until consent is withdrawn + 1 year | Consent audit trail |
| Analytics / session logs | 13 months on a rolling basis | Legitimate interests |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, it may be retained for statistical and analytical purposes without time limit, as it no longer constitutes personal data.
As a data subject and Winboxx player, you hold the following rights in relation to your personal data. These rights may be exercised at any time by contacting us using the details in Section 16.
You have the right to request confirmation of whether Winboxx holds personal data about you and, if so, to receive a copy of that data along with information about how it is processed.
You have the right to request correction of any inaccurate or incomplete personal data held about you. Certain corrections (e.g., name changes) may require supporting documentation.
Subject to applicable retention obligations and ongoing legal requirements, you may request deletion of your personal data. We will fulfil erasure requests to the extent permitted by law. Data subject to mandatory regulatory retention cannot be deleted early.
You have the right to request that Winboxx restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is under dispute, or pending assessment of an objection to processing.
Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
You may object to processing carried out on the basis of legitimate interests, including profiling. You may also object at any time to the processing of your data for direct marketing purposes, after which we will cease that processing immediately.
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Withdrawal will take effect from the date we receive your request.
We will respond to all valid data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, of which you will be notified. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.
Winboxx implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:
Your role in security: While we take robust measures to protect your data, the security of your account also depends on you keeping your login credentials confidential. Do not share your password with anyone, and contact us immediately if you suspect your account has been accessed without authorisation.
The Winboxx platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under 21 years of age. Our KYC verification process is specifically designed to detect and reject underage registrations.
If we become aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe that a minor may have registered on our platform, please contact us immediately at [email protected].
Where you have provided explicit consent during registration or subsequently through your account settings, Winboxx may send you promotional communications relating to bonuses, new game releases, sporting events (EPL, Liga Super Malaysia, UFC, and others), and other platform news. These communications may be delivered via email or in-platform notification.
You may opt out of marketing communications at any time by:
Opting out of marketing communications will not affect the delivery of transactional or account-related communications, which are sent on the basis of contractual necessity and cannot be disabled while your account remains active.
The Winboxx platform may contain references or informational links to third-party services, including payment partners such as GrabPay, Touch 'n Go eWallet, Boost, and major Malaysian banks. Where such links appear, Winboxx is not responsible for the privacy practices or content of those third-party services.
This Privacy Policy applies solely to the Winboxx platform and its associated services. We encourage you to review the privacy policies of any third-party services you access in connection with your use of the Platform.
Winboxx reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, our data practices, or our service offering. Where changes are material, we will provide at least 30 days' advance notice via email to your registered address or through a prominent in-platform notification.
The updated Policy will be published at winboxx.cam/privacy-policy with a revised "Last Updated" date. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you object to any change, you should cease using the Platform and contact us to close your account.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how your personal data is being handled, please contact the Winboxx Data Protection team:
Live Chat Support
Available 24/7 via the Platform interface
Average response: under 90 seconds
We commit to acknowledging all data rights requests within 3 business days and providing a substantive response within 30 calendar days of receipt.
If you are not satisfied with our response to a data rights request or privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For players in Malaysia, the relevant authority is the Department of Personal Data Protection (JPDP).
Back to the Platform
Our Data Protection team is available 24/7. For anything beyond privacy queries, visit the homepage or check our FAQ for quick answers.
21+ For players aged 21 and above only. Please gamble responsibly.