Privacy Policy

This Privacy Policy ("Policy") is issued by Winbox8 ("Winbox8", "we", "us", or "our") and applies to all personal data collected, processed, stored, and used in connection with your access to and use of the Winbox8 online gaming platform, accessible at https://winbox8.cam (the "Platform"), and all related services, features, and communications.

Winbox8 operates as a premier online casino and sports betting platform serving players across Malaysia, including users in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other regions. In the course of providing our gaming services, we necessarily collect and process certain personal information about our users. This Policy sets out our practices with respect to that data.

By creating a Winbox8 account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers.
• "Data Controller" means Winbox8, which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Winbox8, under contractual obligation.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, and transmission.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a specified purpose.
• "KYC" (Know Your Customer) means the identity and age verification process conducted by Winbox8 in accordance with its responsible gambling and anti-fraud obligations.
• "User", "You", "Member" means any individual who accesses or uses the Winbox8 Platform.
• "Cookies" means small data files stored on your device by the Winbox8 Platform for the purposes described in Section 9 of this Policy.

Winbox8 collects the following categories of personal data in connection with the provision of its gaming services:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (for mandatory 21+ age verification purposes);
• Residential address, including city, state, and postcode;
• Email address and mobile telephone number;
• Copies of identity documents provided during KYC verification (Malaysian IC, passport, or driving licence).

3.2 Financial & Payment Data

• Payment method details used for deposits and withdrawals (e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; bank account details for FPX/DuitNow transactions with Maybank, CIMB, Public Bank, or Hong Leong Bank);
• Transaction history, including deposit amounts, withdrawal amounts, and timestamps, all denominated in Malaysian Ringgit (MYR);
• Cryptocurrency wallet addresses associated with USDT TRC20 deposits where applicable.

3.3 Account & Gaming Activity Data

• Username and account registration information;
• Gaming history, including games played, bet amounts, outcomes, and session durations;
• Sports betting activity, including markets wagered on (EPL, Liga Super Malaysia, UFC, etc.), odds accepted, and stake amounts;
• Bonus usage history and wagering requirement fulfilment records;
• Responsible gambling settings, including deposit limits, loss limits, and self-exclusion status.

3.4 Technical & Device Data

• IP address and geolocation data (at country/region level);
• Device type, operating system, and browser type;
• Session logs, including login times, session durations, and pages visited;
• Cookie identifiers and similar tracking technologies as described in Section 9.

3.5 Communications Data

• Records of customer support interactions, including live chat transcripts and email correspondence;
• Complaints and dispute correspondence;
• Responses to surveys or promotional communications where you have opted in.

Winbox8 collects personal data through the following means:

• Direct Provision: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion;
• Automated Collection: Technical data collected automatically when you access the Platform, including IP addresses, device data, and cookie-based identifiers;
• Payment Processors: Transaction confirmation data received from payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, and cryptocurrency networks;
• KYC Verification Partners: Identity verification data returned by third-party KYC service providers where applicable;
• Gaming Systems: Game round data and betting history generated through your use of casino and sportsbook features on the Platform.

Winbox8 processes your personal data for the following purposes. The table below summarises each processing purpose alongside the data categories involved:

Winbox8 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our obligations to you under our Terms and Conditions — including account management, payment processing, and game provision;
• Legal Obligation: Processing required to comply with applicable legal obligations under our international gaming licence, including KYC, anti-money laundering obligations, and responsible gambling requirements;
• Legitimate Interests: Processing carried out for legitimate business purposes including fraud prevention, platform security, customer support, and analytics — where such interests are not overridden by your data protection rights;
• Consent: Processing based on your explicit consent where required — for example, for certain marketing communications. You may withdraw consent at any time by contacting our support team.

Winbox8 does not sell your personal data to third parties. We share personal data only in the following limited circumstances:

7.1 Service Providers

We engage carefully selected third-party service providers to assist in operating the Platform. These providers process personal data solely on our behalf, under contractual data processing agreements, and are not permitted to use your data for their own purposes. Categories of service provider include:

• Payment processing partners (including e-wallet operators and FPX-connected banking networks);
• KYC and identity verification service providers;
• Game content and casino software providers;
• Customer support platform providers;
• Cybersecurity and fraud detection service providers;
• Cloud hosting and infrastructure providers.

7.2 Legal and Regulatory Disclosure

Winbox8 may disclose personal data to competent authorities, regulators, or law enforcement agencies where we are legally obligated to do so, or where disclosure is necessary to prevent fraud, money laundering, or other serious criminal activity. Such disclosures are made only to the extent required and in compliance with applicable data protection principles.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Winbox8, your personal data may be transferred to the successor entity as part of that transaction, subject to the same data protection obligations set out in this Policy. We will notify affected users of any such transfer in advance where reasonably practicable.

Winbox8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following general retention periods apply:

• Active Accounts: Personal data is retained for the duration of your account registration and for a minimum of five (5) years following account closure, to meet our obligations under applicable anti-money laundering and licensing requirements;
• KYC Documents: Identity verification documents are retained for the duration of the account relationship and for a minimum of five (5) years thereafter;
• Transaction Records: Financial transaction records including deposits, withdrawals, and gaming transactions in MYR are retained for a minimum of five (5) years from the date of each transaction;
• Customer Support Records: Communications and complaint records are retained for three (3) years from the date of the last interaction;
• Technical & Log Data: System access logs and technical data are typically retained for twelve (12) months unless required for an active investigation or legal proceeding.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with Winbox8's internal data deletion procedures.

The Winbox8 Platform uses cookies and similar tracking technologies to ensure proper functionality, enhance user experience, and gather anonymous usage analytics.

9.1 Types of Cookies Used

• Essential Cookies: Required for core Platform functionality including session authentication, account security, and payment flow management. These cannot be disabled without impacting core Platform features;
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including page visit frequency, session duration, and navigation paths. This data helps us improve Platform performance;
• Preference Cookies: Store your settings and preferences to personalise your Platform experience, such as preferred language and display options;
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised account access, and bot interactions.

9.2 Managing Cookies

You may control cookie settings through your browser's privacy settings. Please note that disabling essential cookies will impair your ability to use the Winbox8 Platform, including logging in and processing payments. Most modern browsers provide the option to block or delete cookies — consult your browser's help documentation for instructions specific to your browser type.

Winbox8 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the Winbox8 Platform is encrypted using Transport Layer Security (TLS). Look for the padlock icon in your browser address bar to confirm a secure connection;
• Encrypted Data Storage: Sensitive personal and financial data is stored in encrypted form within our secure server infrastructure;
• Access Controls: Access to personal data within Winbox8's internal systems is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls enforced;
• Continuous Monitoring: Our security team conducts continuous monitoring of Platform infrastructure for suspicious activity, attempted intrusions, and data anomalies;
• Vendor Security Standards: All third-party data processors engaged by Winbox8 are contractually required to maintain security standards equivalent to or exceeding our own.

While Winbox8 takes all reasonable precautions to safeguard your data, no online platform can guarantee absolute security against all possible threats. You are encouraged to protect your own account by using a strong, unique password and never sharing your login credentials with any third party.

As a user of the Winbox8 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our Data Privacy team via the support channels listed in Section 16.

In the course of providing our services, your personal data may be transferred to, and processed in, jurisdictions outside of Malaysia. This may occur where our cloud hosting infrastructure, KYC verification partners, or gaming software providers are located in other countries.

Where personal data is transferred internationally, Winbox8 ensures that appropriate safeguards are in place to protect your data, including contractual data protection clauses with all recipients. We do not transfer personal data to jurisdictions that do not provide adequate data protection standards without implementing additional protective measures.

By using the Winbox8 Platform, you acknowledge that your personal data may be transferred and processed in jurisdictions outside Malaysia in connection with the provision of our services.

The Winbox8 Platform integrates with third-party services including payment processors, KYC verification providers, and gaming software providers. When you interact with these services — for example, completing a payment via Touch 'n Go eWallet, Boost, GrabPay, or DuitNow — you may be providing data directly to those third-party providers, and their own privacy policies will govern the handling of that data.

Winbox8 is not responsible for the privacy practices of third-party services that are independent of the Platform. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of Winbox8.

The Winbox8 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of our account registration and KYC process.

If Winbox8 becomes aware that personal data has been collected from an individual below the minimum age threshold, we will immediately suspend the relevant account, delete all associated personal data, and forfeit any funds associated with the account in accordance with our Terms and Conditions.

Winbox8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or operational requirements. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

Where material changes are made to this Policy, Winbox8 will provide reasonable notice to existing Members via email notification or a prominent notice on the Platform. We recommend that you review this Policy periodically to stay informed of any updates.

Your continued use of the Winbox8 Platform following notification of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to any amendments, you should discontinue use of the Platform and may contact our support team to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of the data rights described in Section 11, please contact our Data Privacy support team through the following channels:

• Live Chat: Available 24/7 directly on the Winbox8 Platform — the fastest way to reach our support team for any data-related enquiry;
• Email: [email protected] (plain text address — not a clickable link; please type this address into your email client manually);
• Subject Line: When submitting a data rights request by email, please use the subject line "Data Privacy Request" to ensure your message is directed to our privacy team.

We are committed to responding to all privacy-related enquiries within 30 calendar days. For requests that are complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for the delay within the initial 30-day window.