WinXBox Privacy Policy

This Privacy Policy ("Policy") is issued by WinXBox ("WinXBox", "we", "us", or "our") and governs the collection, use, storage, sharing, and protection of personal data obtained from users ("you", "Player", or "Member") who access or use the WinXBox platform, including the website at winxbox.cam, its mobile-optimised interfaces, and any associated services (collectively, the "Platform").

WinXBox is committed to processing your personal data responsibly, transparently, and in accordance with applicable data protection principles. We recognise that the trust you place in us when you share personal information is significant, and we take the protection of that information seriously.

By registering an account, making a deposit, or otherwise using the WinXBox Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned to them below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, payment details, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, WinXBox.
• "Data Processor" means any third party that processes Personal Data on behalf of WinXBox under a data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data for a stated purpose.
• "KYC Data" means identity and age verification documentation, including copies of government-issued identification (e.g., MyKAD) and associated selfie photographs.
• "Cookies" means small text files placed on your device by the Platform to enable session management, analytics, and personalisation functions.
• "Sensitive Data" means Personal Data that requires heightened protection, including financial account details, government-issued identification numbers, and biometric data.

WinXBox acts as the Data Controller in respect of all Personal Data collected through and processed in connection with the Platform. As Data Controller, WinXBox determines the purposes for which your Personal Data is collected and the manner in which it is processed.

Where WinXBox engages third-party service providers (such as payment processors, fraud detection services, or cloud infrastructure providers) to process Personal Data on its behalf, such third parties act as Data Processors and are bound by contractual obligations that restrict their use of your data to the specific services they provide to WinXBox.

For all matters relating to this Privacy Policy or the exercise of your data rights, please refer to the contact details provided in Section 16 of this Policy.

WinXBox collects Personal Data that is necessary for the operation of the Platform, the provision of gaming and betting services, and compliance with applicable legal and regulatory obligations. The categories of Personal Data we collect are set out below:

WinXBox does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or political opinions from Players, except where expressly required for regulatory compliance or responsible gambling assessment purposes.

WinXBox collects Personal Data through the following primary channels:

• Directly from you — When you register an account, complete the KYC process, make a deposit or withdrawal, contact our support team, or participate in a promotional offer, you voluntarily provide Personal Data to us.
• Automatically through Platform use — When you access and navigate the Platform, we automatically collect technical data including your IP address, device information, browser characteristics, and session activity data via cookies, server logs, and similar technologies.
• From payment service providers — When you transact via Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Boost, GrabPay, or any other supported payment method, we receive transaction confirmation data from the relevant payment processor. We do not receive or store full payment credentials such as online banking passwords or full card numbers.
• From fraud prevention and identity verification services — WinXBox may use third-party KYC and AML screening services to verify identity and screen for financial crime risk. These services may provide risk assessment data based on the information you supply.
• From cookies and analytics tools — The Platform uses first-party cookies and analytics tools to understand how users interact with the Platform, which pages are visited most frequently, and where technical issues arise. This data is used in aggregate form for platform improvement purposes.

WinXBox processes your Personal Data for specific, legitimate purposes and always on a valid legal basis. The primary purposes of processing and their corresponding legal bases are as follows:

• Account creation and management — Processing is necessary for the performance of the contract between WinXBox and the Player (i.e., the Terms & Conditions). Without this data, we cannot operate your account.
• Payment processing and withdrawal management — Processing is necessary for the performance of the contract and for compliance with financial regulations applicable to money movement through payment networks including DuitNow, FPX, and e-wallet providers.
• KYC and age verification — Processing is necessary for compliance with legal obligations regarding the prevention of underage gambling and anti-money laundering (AML) requirements. All accounts must pass age verification (21+ minimum) before any withdrawal is processed.
• Fraud detection and platform security — Processing is based on WinXBox's legitimate interest in protecting the integrity of the Platform and the interests of all players from fraudulent or abusive activity.
• Responsible gambling monitoring — Processing is based on WinXBox's legal obligation and legitimate interest in identifying players who may be exhibiting signs of problem gambling and providing appropriate intervention tools including deposit limits, self-exclusion, and support resources.
• Customer support and dispute resolution — Processing is necessary for the performance of the contract and WinXBox's legitimate interest in resolving complaints and improving service quality.
• Promotional communications — Where you have provided explicit consent to receive marketing communications from WinXBox, we may use your contact details to send information about bonuses, promotions, and new features. You may withdraw this consent at any time by contacting our support team or adjusting your account communication preferences.
• Legal and regulatory compliance — WinXBox may process and retain your data to the extent required by applicable law, including financial record-keeping obligations, court orders, and regulatory investigations.

WinXBox does not sell, rent, or trade your Personal Data to unaffiliated third parties for their own commercial purposes. However, we may share your Personal Data with the following categories of recipient where necessary and on a strictly controlled basis:

• Payment processors and e-wallet providers — To facilitate deposit and withdrawal transactions via Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and supported cryptocurrency networks. Data shared is limited to what is necessary to complete the specific transaction.
• KYC and identity verification service providers — To verify the identity and age of Players as required by our compliance obligations. These providers process your KYC Data under strict confidentiality and data processing agreements.
• Fraud prevention and AML screening services — To screen accounts and transactions for signs of financial crime, bonus abuse, or unauthorised account access. These services receive only the minimum data necessary to perform their risk assessment function.
• Cloud hosting and infrastructure providers — WinXBox uses reputable cloud infrastructure providers to host the Platform. These providers may process Personal Data as part of platform operation but are contractually restricted from using such data for any purpose other than providing the agreed services.
• Regulatory and law enforcement authorities — Where WinXBox is legally required to do so by court order, regulatory directive, or applicable law, we may disclose Personal Data to competent authorities. We will notify affected Players of such disclosure where legally permitted to do so.
• Professional advisers — WinXBox may share Personal Data with lawyers, auditors, and other professional advisers under obligations of confidentiality, where necessary for the conduct of legal proceedings, audit processes, or regulatory compliance reviews.

WinXBox uses cookies and similar tracking technologies to enable essential Platform functionality, understand user behaviour, and improve the quality of our services. The types of cookies used on the Platform are as follows:

• Essential (Strictly Necessary) Cookies: These cookies are required for the Platform to function. They enable core features such as session management, login authentication, and security token validation. The Platform cannot operate without these cookies, and they cannot be disabled.
• Functional Cookies: These cookies remember your preferences and settings — such as your preferred language, last-visited game category, and notification preferences — to personalise your experience on the Platform.
• Analytics Cookies: WinXBox uses first-party analytics tools to collect aggregate, anonymised data about how users navigate the Platform. This data is used solely to identify usage patterns and areas for improvement. No individual player is identified through analytics data.
• Security Cookies: These cookies assist in detecting fraudulent activity, unusual login patterns, and account takeover attempts. They contribute to the protection of your account and the integrity of the Platform.

You may manage or delete cookies via your browser settings at any time. Please note that disabling certain cookies (particularly Essential Cookies) may impair the functionality of the Platform or prevent you from accessing certain features. WinXBox does not use cookies to track your activity across unaffiliated third-party websites.

WinXBox implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and WinXBox servers.
• AES-256 encryption at rest for all sensitive Personal Data stored on WinXBox infrastructure.
• Two-factor authentication (2FA) available to all registered Players to enhance account security.
• Role-based access controls (RBAC) ensuring that only authorised WinXBox personnel with a legitimate business need can access specific categories of Personal Data.
• Regular penetration testing and security audits conducted by independent third-party security specialists.
• Intrusion detection and monitoring systems operating continuously across all Platform infrastructure.
• Secure KYC document storage — identity documents are stored in encrypted, access-controlled repositories and are not accessible outside of the compliance and fraud prevention teams.

Notwithstanding the above, no security system is entirely infallible. In the event of a data security incident that is likely to result in a risk to the rights and freedoms of affected Players, WinXBox will take appropriate steps to contain the incident and notify affected individuals in a timely manner as required by applicable law.

You are responsible for maintaining the security of your own account credentials. WinXBox will never ask for your password via live chat, email, or any communication channel other than the secure login interface on the Platform itself.

WinXBox retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, to comply with applicable legal and regulatory obligations, or to resolve disputes and enforce our agreements. The following retention principles apply:

• Active account data: Retained for the duration of the Player's account, plus an additional period following account closure as required by applicable financial record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of the last transaction on the account, in compliance with anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years in accordance with financial reporting and audit obligations.
• Customer support records: Retained for three (3) years from the date of the last support interaction, for quality assurance and dispute resolution purposes.
• Marketing preference data: Retained until the Player withdraws consent for marketing communications, after which it is deleted or anonymised within 30 days.
• Analytics and log data: Aggregated and anonymised analytics data may be retained indefinitely. Identifiable log data is retained for a maximum of twelve (12) months.

Following the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

As a WinXBox Player, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our support team via the details provided in Section 16. WinXBox will respond to all substantive rights requests within thirty (30) calendar days of receipt.

WinXBox may request that you verify your identity before processing certain rights requests, to ensure that Personal Data is not disclosed to or modified by unauthorised parties. There is no charge for standard rights requests; however, WinXBox reserves the right to charge a reasonable administrative fee for requests that are manifestly unfounded, excessive, or repetitive.

WinXBox may process and store Personal Data on servers or through service providers located outside of Malaysia. Where such international transfers occur, WinXBox takes appropriate steps to ensure that your Personal Data is afforded an equivalent level of protection to that which applies within Malaysia.

These safeguards may include: transfers to jurisdictions that have been assessed as providing adequate data protection; execution of standard contractual clauses with Data Processors in third countries; or the application of other legally recognised transfer mechanisms.

For further information about the safeguards applied to any specific international transfer of your Personal Data, please contact us using the details provided in Section 16.

The WinXBox Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store Personal Data from individuals below the age of 21. The collection of Personal Data from minors is a material violation of our Terms & Conditions and this Privacy Policy.

All accounts are subject to mandatory age verification (KYC) before any withdrawal can be processed. Where WinXBox becomes aware that Personal Data has been collected from an individual who is under 21 years of age, such data will be deleted immediately, the associated account will be closed, and any funds in the account will be returned to the originating payment method after deduction of any fraudulently obtained bonus winnings.

If you are a parent or guardian and believe that your child has registered an account or provided Personal Data to WinXBox without your consent, please contact our support team immediately using the details in Section 16.

The WinXBox Platform may contain references to or integrations with third-party services — such as payment processors (Touch 'n Go, DuitNow, Boost, GrabPay), game software providers, or analytics platforms. This Privacy Policy applies solely to data collected and processed by WinXBox and does not govern the privacy practices of any third party.

WinXBox is not responsible for the privacy policies, data practices, or security measures of any third-party service that you interact with in connection with your use of the Platform. We encourage you to review the privacy policies of any third-party services that handle your data before engaging with them.

WinXBox does not display advertising banners or embed tracking technologies from unaffiliated third-party advertising networks on the Platform. Our commitment is to keep the Platform free from non-consensual cross-site tracking.

WinXBox reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where material changes are made, WinXBox will notify affected Players via the email address registered to their account or via an in-platform notification prior to the changes taking effect.

The "Last Updated" date at the top of this page reflects the date of the most recent material revision. We encourage you to review this Policy periodically to remain informed of how your Personal Data is being handled.

Continued use of the WinXBox Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease use of the Platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by WinXBox, please contact us through the following channels. All contact details are provided as plain text and are not clickable links.

If you are not satisfied with WinXBox's response to a data rights request or a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. WinXBox will cooperate fully with any such regulatory investigation.