Privacy Policy – maxwin Data Protection Commitment

1. Scope and Application

This Privacy Policy applies to all personal data processed by maxwin in connection with the operation of the maxwin.lat platform, including data collected from Players, registered account holders, and anonymous visitors to the website. It applies regardless of the device or browser used to access the Platform.

This Policy should be read in conjunction with the maxwin Terms & Conditions and Responsible Gaming Policy, both of which contain additional provisions relevant to account management and player welfare obligations.

2. Data Controller Identity

The data controller responsible for personal data processed through maxwin.lat is the licensed operator of the maxwin platform. For all data protection enquiries, requests, or complaints, Players should contact the maxwin Data Protection team at [email protected] with the subject line "Data Protection Enquiry".

3. Categories of Personal Data Collected

maxwin collects and processes the following categories of personal data:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identification document details (Malaysian MyKad number, Passport number).
• Contact Data: Email address, mobile telephone number (where provided for account security purposes), and residential address (where required for KYC verification).
• Financial Data: Payment method details (e-wallet account identifiers, bank account numbers where applicable for FPX transfers), deposit and withdrawal transaction records, and MYR wallet balance history.
• Account Data: Username, account registration date, login history, session timestamps, game play history, wager records, and responsible gaming limit settings.
• Technical Data: IP address, device type and operating system, browser type and version, screen resolution, and referring URL.
• Communications Data: Records of communications between you and the maxwin support team, including live chat transcripts and email correspondence.
• Marketing Preferences: Your preferences regarding receipt of promotional communications from maxwin.

4. How We Collect Personal Data

maxwin collects personal data through the following means:

• Direct provision: Data you submit during account registration, KYC verification, deposit and withdrawal requests, support communications, or completion of any form on the Platform.
• Automated collection: Technical and usage data collected automatically when you access maxwin.lat, including via cookies, server logs, and session tracking technologies.
• Third-party sources: Identity verification data from KYC service providers engaged by maxwin to verify documents submitted during registration or withdrawal processing. Payment processing data from e-wallet and banking partners (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateway providers) confirming transaction completion.

5. Purposes and Legal Bases for Processing

maxwin processes personal data for the following purposes, each supported by a defined lawful basis:

• Account registration and authentication — necessary for performance of the contract between maxwin and the Player.
• Identity verification (KYC) — necessary for compliance with maxwin's legal obligations under its international gaming authority licence, including anti-money laundering (AML) and age verification requirements.
• Processing deposits and withdrawals — necessary for performance of the contract and for compliance with financial services record-keeping obligations.
• Game delivery and platform personalisation — necessary for performance of the contract; legitimate interest in improving Platform quality and relevance.
• Fraud prevention and security monitoring — legitimate interest in protecting Players and the Platform from financial crime and account compromise.
• Responsible gaming monitoring — necessary for compliance with gaming authority responsible gaming obligations; legitimate interest in player welfare.
• Marketing communications — consent (where obtained); you may withdraw consent at any time by contacting [email protected].
• Legal claims and regulatory investigations — necessary for compliance with legal obligations and for establishment or defence of legal claims.

6. Sharing of Personal Data

maxwin shares personal data with third parties only in the following circumstances and subject to appropriate contractual protections:

• KYC and identity verification providers: To process identity document verification as required for account registration and withdrawal processing.
• Payment processors: To facilitate deposit and withdrawal transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-connected banking institutions.
• Game content providers: Game studios and live dealer operators may receive anonymised session data necessary for game delivery and RNG auditing. No personally identifiable information is shared with game studios beyond what is technically required for game session management.
• Regulatory and law enforcement authorities: Where required by maxwin's gaming licence obligations, AML regulations, or by valid legal process (court order, regulatory demand). maxwin will notify you of such disclosures to the extent permitted by law.
• Professional advisers: Lawyers, auditors, and accountants engaged in connection with maxwin's legal and compliance obligations, under strict confidentiality obligations.

maxwin does not sell personal data to data brokers, advertisers, or any third party for independent commercial use. All third-party service providers engaged by maxwin are contractually bound to process personal data only as directed by maxwin and in accordance with applicable data protection requirements.

7. International Data Transfers

Some of maxwin's service providers — including KYC verification platforms and game studio partners — may process personal data in jurisdictions outside Malaysia. Where such transfers occur, maxwin takes steps to ensure that appropriate safeguards are in place, including contractual data protection clauses equivalent to internationally recognised standards. Players may request further information about specific international transfers by contacting [email protected].

8. Data Retention

maxwin retains personal data for the following periods:

• Account and identity data: For the duration of your active maxwin account, plus a minimum of five (5) years following account closure, as required by anti-money laundering record-keeping obligations.
• Transaction records: A minimum of five (5) years from the date of each transaction, in accordance with applicable financial records retention requirements.
• Support communications: Three (3) years from the date of the communication.
• Technical and session data: Up to thirteen (13) months from collection, in line with standard web analytics retention practice.
• Marketing preference data: Until withdrawal of consent or account closure, whichever is earlier.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be attributed to an individual Player.

9. Security Measures

maxwin implements technical and organisational security measures appropriate to the risk level of the personal data processed, including:

• 256-bit SSL/TLS encryption for all data in transit between Players and the Platform.
• Encryption of personally identifiable data and financial records at rest.
• Role-based access controls limiting staff access to personal data to those with a demonstrable operational need.
• Multi-factor authentication for all administrative access to systems processing personal data.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Mandatory data protection training for all staff with access to Player personal data.

In the event of a personal data breach that poses a risk to Players, maxwin will notify affected Players and, where required by applicable law or the gaming authority licence, the relevant regulatory authority, within the timeframe mandated by applicable obligations.

10. Cookies and Tracking Technologies

maxwin.lat uses cookies and similar tracking technologies to operate the Platform, remember your session, and understand how the Platform is used. The following categories of cookies are used:

• Strictly necessary cookies: Required for Platform functionality including account login sessions, fraud prevention, and load balancing. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect anonymised usage data helping maxwin understand page performance, navigation patterns, and technical errors. No personally identifiable information is included in analytics data.
• Preference cookies: Store your language and display preferences to improve your experience on return visits.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent you from accessing your maxwin account. Blocking analytics or preference cookies will not affect your ability to play on the Platform.

11. Your Data Subject Rights

Subject to applicable data protection law, you have the following rights in respect of personal data held by maxwin:

• Right of access: Request a copy of the personal data maxwin holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of personal data where there is no lawful basis for continued processing (note: AML and licence retention obligations may prevent full erasure for defined periods).
• Right to restriction: Request that processing of your personal data be temporarily restricted while a correction or objection request is evaluated.
• Right to data portability: Request your account and transaction data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request – [Your Account Email]". maxwin will respond within 30 days. We may request identity verification before processing rights requests to prevent unauthorised access to another Player's data.

12. Marketing Communications

maxwin may send promotional communications — including bonus offers, tournament announcements, and new game notifications — to Players who have opted in to receive such communications during registration or through their account settings. You may opt out of marketing communications at any time by emailing [email protected] with the subject "Marketing Opt-Out". Opt-outs are processed within 5 business days. Transactional communications (account confirmations, withdrawal notifications, security alerts) will continue regardless of marketing preferences as they are necessary for account management.

13. Minors

The maxwin platform is strictly for individuals aged 21 and above. maxwin does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an underage individual, the associated account will be immediately suspended, the data will be deleted to the extent permitted by AML record-keeping obligations, and any deposited funds will be returned to the payment source. Parents or guardians who believe an underage person has registered a maxwin account should contact [email protected] immediately.

14. Changes to This Policy

maxwin may update this Privacy Policy from time to time to reflect changes in operational practice, applicable law, or gaming authority requirements. Material changes will be communicated to registered Players via their account email address. The current version of the Privacy Policy is always accessible at maxwin.lat/privacy-policy. Continued use of the Platform after notification of changes constitutes your acceptance of the revised Policy.

15. Contact and Complaints

For all privacy-related enquiries, rights requests, or complaints, contact the maxwin Data Protection team:

• Email: [email protected]
• Subject line for rights requests: "Data Rights Request – [Account Email]"
• Subject line for complaints: "Privacy Complaint – [Account Email]"
• Response time: Acknowledgement within 2 business days; substantive response within 30 calendar days.

If you are not satisfied with maxwin's response to a privacy complaint, you may escalate the matter to the relevant data protection supervisory authority in your jurisdiction or to the dispute resolution body designated by the applicable international gaming authority under whose licence maxwin operates.