Privacy Policy — Wintoto

This Privacy Policy (hereinafter "Policy") issued by Wintoto (hereinafter "Wintoto", "we", "us", or "our") and applies to all personal data collected, processed, and stored in connection with your use of the Wintoto platform, accessible at wintoto.cam, including all associated services, features, games, and products offered thereon.

Wintoto operates as an online casino and sports betting platform serving players in Malaysia and other jurisdictions where access to our services is not legally restricted. As part of our operations, we process personal data belonging to registered players, prospective applicants, and visitors to our platform. This Policy sets out the basis upon which that data is processed.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the legal framework governing your relationship with Wintoto. By using our platform, you acknowledge that you have read and understood this Privacy Policy.

The following terms carry specific meanings throughout this Policy:

Wintoto collects personal data in categories comensurate with the services we provide. We collect only what is necessary for the purposes stated in this Policy. The categories of data we may collect include:

A. Identity & Registration Data

• Full legal name as it appears on government-issued identification.
• Date of birth (for age verification —21+ requirement strictly enforced).
• Nationality and country of residence.
• Government-issued identification number (e.g., Malaysian IC number / passport number).
• Username and account credentials (passwords are stored in encrypted form and are never accessible to Wintoto staff in plain text).

B. Contact Information

• Email address (primary account communication channel).
• Mobile phone number.
• Residential address — including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam) and postcode.

C. Financial & Transaction Data

• Payment method details — including bank account identifiers, e-wallet account references (e.g., Touch 'n Go eWallet, Boost, GrabPay), and card information (truncated, not full card numbers).
• Deposit and withdrawal transaction records, including amounts MYR and timestamps.
• Wagering history and account balance records.
• Source of funds documentation provided during enhanced KYC verification.

D. Technical & Device Data

• IP address and approximate geolocation derived therefrom.
• Device type, operating system, and browser information.
• Session logs, login timestamps, and platform interaction data.
• Cookie identifiers and similar tracking technologies (see Section 8).

E. Communications Data

• Records of correspondence between you and Wintoto support, including live chat transcripts and email exchanges.
• Feedback, survey responses, and support request details.

Wintoto collects personal data through the following channels and mechanisms:

• Direct Collection: Information you provide voluntarily during account registration, KYC verification, payment processing, customer support interactions, and promotional claim processes.
• Automated Technologies: Data collected automatically as you interact with the platform, including cookies, session tracking, device fingerprinting, and server logs. This data is collected regardless of whether you are a registered account holder.
• Third-Party Sources: Information received from identity verification service providers, fraud detection partners, payment processors, and publicly available sources where necessary to fulfil our KYC and AML obligations.
• Game Providers: Aggregated, anonymised gameplay statistics from our third-party game suppliers (e.g., Evolution Gaming, Pragmatic Play, PG Soft, Microgaming) relating to game performance on our platform. Individual player data shared with game providers is governed by separate data processing agreements.

Wintoto processes your personal data for the following purposes:

Wintoto processes personal data under one or more of the following lawful bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions — including account management, service delivery, and payment processing.
• Legal Obligation: Processing necessary to comply with our legal and regulatory obligations, including KYC verification, AML monitoring, age verification (21+), and responses to lawful authority requests.
• Legitimate Interests: Processing for purposes such as fraud prevention, platform security, responsible gambling monitoring, and internal analytics, where these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and certain cookie-based analytics, where we have obtained your explicit prior consent. You retain the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Wintoto does not sell your personal data to any third party for commercial purposes. We share personal data only in the following limited circumstances, and only to the extent strictly necessary:

• Service Providers and Data Processors: Third-party vendors engaged by Wintoto to provide services essential to platform operation — including payment processors (such as those facilitating FPX, DuitNow, e-wallet transactions via Touch 'n Go, Boost, and GrabPay), identity verification providers, cloud infrastructure providers, customer support tools, and fraud detection services. All such providers are bound by data processing agreements and may not use your data for any purpose beyond the specific service they provide to Wintoto.
• Game Software Providers: Where gameplay data is transmitted to third-party game studios (such as Evolution Gaming or Pragmatic Play) as part of game operation, this is subject to the game provider's own data processing obligations. Only the minimum data necessary for game operation is shared.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to competent regulatory bodies, law enforcement agencies, or gaming authorities where we are required to do so by applicable law, a court order, or our licensing obligations.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of Wintoto's business assets, personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.
• With Your Consent: We may share data with third parties in any other circumstance where you have provided explicit prior consent.

Wintoto uses cookies and similar tracking technologies on its platform to support core functionality, improve user experience, and collect analytics data. By continuing to use the platform after being presented with our cookie notice, you consent to our use of cookies in accordance with this Policy.

The categories of cookies we use are as follows:

You may manage cookie preferences at any time through your browser settings. Note that disabling certain cookies may affect the functionality of the Wintoto platform, particularly session management and security features.

Wintoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Active Accounts: Personal data associated with an active Wintoto account is retained for the duration of the account's existence and for a minimum period thereafter as required by our licensing obligations.
• Closed Accounts: Following account closure, we are required under our international gaming licence to retain certain account records — including identity verification documents, transaction history, and communications — for a minimum of five (5) years from the date of closure. This is a regulatory obligation that we cannot waive at individual request.
• Financial Records: Transaction records may be retained for up to seven (7) years in accordance with standard financial record-keeping obligations applicable to licensed gaming operators.
• Self-Exclusion Records: Records of self-exclusion requests and responsible gambling interactions are retained for the duration of the exclusion period plus an additional five (5) years to prevent re-registration in breach of exclusion conditions.
• Marketing Data: Marketing consent records and communication preferences are retained until you withdraw consent or for three (3) years from last interaction, whichever is earlier.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in manner that prevents re-identification.

Wintoto implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security framework includes:

• Transport Layer Security (TLS / SSL): All data transmitted between your device and Wintoto's servers is encrypted using industry-standard TLS 1.2 or higher. Our platform operates exclusively over HTTPS.
• Password Security: Account passwords are hashed using a strong cryptographic algorithm. Wintoto staff do not have access to your password in plain text under any circumstances.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo regular data protection training and are bound by confidentiality obligations.
• Infrastructure Security: Our platform infrastructure is hosted on enterprise-grade cloud servers with regular security patching, intrusion detection systems, and DoS mitigation measures in place.
• Incident Response: Wintoto maintains a formal data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected players and relevant authorities in accordance with applicable obligations.

Wintoto respects your rights in relation to your personal data. Subject to applicable law and certain exceptions (including our regulatory retention obligations), you may exercise the following rights by contacting us at [email protected]:

• Right of Access: You have the right to request confirmation of whether we hold personal data about you and, if so, to receive a copy of that data along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update many account details directly through your account settings.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data. Note that this right is subject to overiding obligations — we cannot delete data that we are legally required to retain under our licensing and AML obligations.
• Right to Restrict Processing: You may request that we limit processing of your personal data in certain circumstances — for example, while the accuracy of that data is under dispute.
• Right to Data Portability: Where technically feasible and where processing is based on consent or contract performance, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Once you object to marketing, we will cease using your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by an additional 60 days, in which case we will notify you of the extension and the reason for it.

As a platform operating under an international gaming licence and utilising globally-distributed cloud infrastructure and third-party service providers, Wintoto may transfer your personal data to countries outside Malaysia. Such transfers are necessary to deliver our services effectively.

Where personal data is transferred internationally, Wintoto ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections described in this Policy. These safeguards may include:

• Standard contractual clauses approved by competent data protection authorities.
• Transfers to jurisdictions recognised as providing an adequate level of data protection.
• Binding corporate rules or equivalent intra-group data transfer mechanisms where applicable.

If you would like further information about the specific safeguards applied to international transfers of your personal data, please contact us at the address provided in Section 15.

The Wintoto platform is strictly intended for use by individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process.

If Wintoto becomes aware or has reasonable grounds to suspect that personal data has been provided by or in respect of an individual under the age of 21, we will:

• Immediately suspend the relevant account pending investigation.
• Delete all personal data associated with the minor account upon confirmation.
• Refund any deposits made, subject to the outcome of any fraud investigation.
• Take appropriate steps to prevent any further access by the underage individual.

If you believe that an individual under 21 has registered on the Wintoto platform using false information, please notify us immediately at [email protected].

Wintoto reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The effective date of the current version of this Policy is displayed at the top of this page and in the "Last Updated" indicator.

Material changes to this Policy — those that significantly affect your rights or how your data is used — will be communicated to registered players via a prominent notice on the platform and, where appropriate, by direct communication to the email address registered on your account.

Your continued use of the Wintoto platform following publication of an updated Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not accept the updated terms, you should close your account and cease using the platform.

We recommend reviewing this Policy periodically. Previous versions are available upon written request to our support team.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way Wintoto handles your personal data, please contact us using the following details:

• Email: [email protected] — for privacy-related enquiries, data rights requests, and data breach reports.
• Live Chat: Available 24 hours a day, 7 days a week via the platform's chat widget. Average response time: under 2 minutes.
• Operational Hours: Peak support coverage from 10:00am to 2:00am MYT (Malaysian Time, GMT+8).

When submitting a data rights request, please include your full name, the email address registered on your Wintoto account, and a clear description of your request. We may need to verify your identity before actioning any request.

This Privacy Policy was last reviewed and updated on 1 January 2026. Wintoto reserves all rights not expressly granted herein.