Winrm Privacy Policy — Personal Data Protection for Malaysian Players

Winrm ("we", "platform" or "winrm") is committed to protecting the privacy of every individual who uses our services at winrm.click. This Privacy Policy has been drafted to comply with Malaysia Personal Data Protection Act (PDPA) 2010 and is intended to inform you in a clear and straightforward manner how your personal data is handled by winrm.

Winrm is an online casino platform operating in Malaysia, offering gaming services including baccarat, slots, table games, live casino and progressive jackpots to Malaysian players. In the course of these operations, we collect and process certain personal data for legitimate purposes as set out in this policy.

For winrm, privacy is not merely a legal obligation — it is a core value we hold firmly. We believe Malaysian players deserve to know exactly what happens to their data, and we are committed to being fully transparent about it. This policy is written in plain language, not confusing legal jargon — because you deserve clarity, not ambiguity.

This Privacy Policy applies to all personal data you provide when registering, using the platform, contacting customer support, or interacting with any winrm feature. It also applies to data collected automatically when you browse winrm.click.

Winrm only collects personal data that is necessary to provide you with a safe, fair, and efficient service. Below are the categories of data we collect:

Winrm does not collect sensitive data such as medical information, political views, or religious beliefs unless you voluntarily provide it in the context of responsible gambling. Any data collected is strictly limited to legitimate operational requirements.

Winrm uses collected personal data solely for the following purposes — no use beyond this scope is permitted without your prior consent:

• Account Management: Creating, verifying, and managing your winrm member account, including the KYC (Know Your Customer) process required under Malaysia's anti-money laundering laws.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks and FPX, as well as winnings withdrawals in Malaysian Ringgit (RM), securely and accurately.
• Gaming Services Provision: Enabling you to access and enjoy all winrm games, including baccarat, slots, Live Casino, table games, and progressive jackpots.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, or platform abuse — to protect you and all other winrm members.
• VIP Programme & Rewards: Calculating and crediting VIP points, weekly cashback, and other rewards based on your gaming activity at winrm.
• Customer Support: Processing and resolving enquiries, complaints or disputes that you submit to the winrm support team.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing appropriate support where needed.
• Legal Compliance: Meeting reporting and record-keeping obligations under applicable Malaysian laws, including PDPA 2010 and anti-money laundering legislation.
• Platform Improvements: Analysing usage data in aggregate (not at an individual level) to improve the user experience, platform performance and winrm's game offerings.
• Service Communications: Sending important account notifications, transaction updates, changes to terms, or security alerts via email or SMS.

Winrm does not sell, rent, or transfer your personal data to any third party for marketing purposes without your express and explicit consent. This is an absolute commitment by winrm that will not be compromised under any circumstances.

However, there are limited situations where winrm needs to share data with certain parties for legitimate operational purposes:

• Payment Providers: Transaction information that needs to be shared with Malaysian payment processors such as DuitNow, FPX, Touch 'n Go eWallet, GrabPay, and others for the purpose of processing deposits and withdrawals in RM.
• Gaming Software Providers: Game session data shared with providers such as Evolution Gaming, Pragmatic Play and Playtech is limited strictly to what is required to run the games — no full identity information is shared.
• KYC Service Providers: Identity information that must be verified by an authorised third party to fulfil Malaysia's legal identity verification requirements.
• Malaysian Authorities: winrm will disclose personal data to the relevant authorities in Malaysia — such as Bank Negara Malaysia, the Royal Malaysia Police, or the courts — when required by law, court order, or a lawful directive.
• Auditors & Legal Advisors: Where required for audit, litigation or compliance purposes, data may be shared with professionals bound by strict confidentiality obligations.

All third parties that receive data from winrm are required to meet security and privacy standards equal to or higher than winrm's own. Detailed data processing agreements are signed with each relevant third party to ensure your data remains protected at all times.

Winrm continually invests in the latest cybersecurity infrastructure to ensure your personal data is protected to the highest possible standard. Below are the key security measures we have in place:

• 256-bit SSL Encryption: All communications between your browser or app and winrm's servers are encrypted using TLS 1.3 with 256-bit encryption keys — the same standard used by leading Malaysian banks such as Maybank and CIMB.
• Stored Data Encryption: All personal and financial data stored in winrm's databases is encrypted using AES-256 — meaning that even in the highly unlikely event of a breach, your data cannot be read without the decryption key.
• Two-Factor Authentication (2FA): winrm offers two-factor authentication via OTP to your registered phone number as an added layer of security during login.
• 24/7 Monitoring: winrm's security monitoring system operates 24 hours a day to detect any suspicious activity or unauthorised access attempts in real time.
• Regular Security Assessments: winrm conducts regular penetration testing and security audits carried out by independent third parties to identify and address any vulnerabilities.
• Internal Access Controls: Only specifically authorised winrm staff may access members' personal data, and every instance of access is logged and monitored for accountability.

Winrm uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small data files stored on your device when you browse winrm.click. The following are the types of cookies we use:

You can manage your cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality of some parts of the winrm platform. winrm does not use cookies to track your activity on other websites or for third-party advertising purposes.

As a winrm member and data subject under Malaysia Personal Data Protection Act (PDPA) 2010, you have the following rights regarding your personal data held by winrm:

To exercise any of the rights above, please contact us by email at support@winrm.click stating the right you wish to exercise and sufficient identifying information for us to verify your identity. winrm will respond within 21 business days in accordance with Malaysia's PDPA requirements.

Winrm retains your personal data only for as long as necessary to fulfil the original purpose of collection and any related legal obligations. The following are our data retention guidelines:

• Active Account Data: For as long as your account remains active with winrm, plus 5 years after account closure in accordance with Malaysia's anti-money laundering legislation.
• Financial Transaction Records: Minimum 7 years in accordance with Malaysian financial and tax regulatory requirements.
• KYC Records (Identity Documents): Minimum 5 years after the member's business relationship with us ends, in accordance with Malaysia's AMLA (Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act).
• Live Casino Recordings: 90 days for dispute resolution and quality monitoring purposes.
• Customer Support Communication Logs: 2 years for reference and service improvement purposes.
• Security & Access Logs: 12 months for security monitoring and incident investigation purposes.

Once the designated retention period has ended, your personal data will be securely deleted or anonymised using procedures that ensure the data cannot be recovered. winrm conducts periodic reviews of stored data to ensure nothing is retained longer than necessary.

Winrm takes the protection of children and minors extremely seriously. The winrm platform is strictly for individuals who are aged 21 years and above only. winrm does not intentionally collect or process any personal data from individuals under the age of 21.

If winrm discovers that personal data belonging to an individual under the age of 21 has been collected without our knowledge — for example, as a result of false information provided during registration — we will take the following steps immediately:

• Suspending the account in question immediately
• Permanently deleting all personal data belonging to that individual from our systems
• Voiding all winnings earned by the account in question
• Returning all deposits made into that account

If you are a parent or guardian who believes your child or ward has registered on winrm without your consent, please contact us immediately at support@winrm.click. winrm will act promptly to resolve the situation.

In the course of winrm's operations, there are situations where personal data may be processed or stored outside Malaysia — for example, by international gaming software providers or cloud service providers that we engage. winrm ensures that any such cross-border data transfers are protected by adequate safeguards equivalent to those required under Malaysia's PDPA.

The measures winrm takes to protect cross-border data transfers include:

• Only engaging third-party providers outside Malaysia that comply with internationally recognised data privacy standards (such as GDPR in Europe or equivalent regulations)
• Signing legally binding data processing agreements with all overseas service providers
• Ensuring data is encrypted in transit between Malaysia and overseas servers
• Limiting data transferred outside the country to the minimum necessary

The majority of winrm's core infrastructure operates from data centres located within the Asia-Pacific region to minimise risks associated with long-distance cross-border data transfers.

Winrm reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Any significant amendments will be communicated to members via:

• A prominent notice on the winrm.click homepage at least 14 days before the amendments take effect
• Email notifications to all active members for amendments that materially affect your privacy rights
• In-platform notifications when you log in to your winrm account

The latest version of the Privacy Policy is always accessible at winrm.click/privacy-policy. The "Updated" date at the top of this document indicates when the policy was last reviewed. Continued use of the winrm platform after any amendments take effect constitutes your acceptance of the revised policy.

For any enquiries, concerns or requests relating to this Privacy Policy or the handling of your personal data by winrm, please contact us through any of the following channels:

• Privacy Email: support@winrm.click — please mark the email subject as "PDPA / Data Privacy" for faster processing
• Live Chat: Available 24 hours a day via the winrm platform — contact our agent and let them know you'd like to discuss a privacy matter

Winrm is committed to responding to all privacy-related inquiries within 24 business hours. For formal requests under the PDPA (such as data access or deletion applications), processing time is within 21 working days as required by law.

If you are not satisfied with how winrm has handled your privacy enquiry, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia, the authority established under PDPA 2010 to receive and investigate complaints relating to breaches of the Act.