Winlah Privacy Policy — Your Personal Data Protection

Welcome to the winlah Privacy Policy. This document represents our written commitment to every member who uses the winlah platform — whether through our official website at winlah.wine or via our mobile app. We understand that your trust is our most valuable asset, and we take our responsibility to protect your personal information seriously.

Winlah operates in full compliance with the provisions of Malaysia Personal Data Protection Act 2010 (PDPA). This means every process of collecting, storing, using, and sharing your data is carried out within a legally recognised framework, with full priority given to your rights and interests as an individual.

By registering or continuing to use the Winlah platform, you agree to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, we recommend you discontinue use of the platform and contact our support team for further discussion.

Winlah only collects information that is genuinely necessary to deliver the best service to you. We do not collect data excessively or without a clear purpose. The following are the categories of information we collect:

We may also collect information automatically through cookie and tracking pixel technology when you browse our platform. Further details are outlined in Section 6 of this document.

Every piece of data we collect is used for a specific and legitimate purpose. winlah does not use your information for any undisclosed purpose without obtaining your consent first. The following are the primary purposes for which your data is used:

• Account Management: Creating, verifying, and managing your member account, including the mandatory KYC process.
• Transaction Processing: Processing all deposits and withdrawals securely and accurately using winlah's integrated payment system.
• Platform Security: Detecting and preventing fraudulent activity, money laundering, and unauthorized access to your account.
• Customer Support: Providing technical assistance and resolving any queries or complaints you submit.
• Marketing Communications: Sending promotional information and the latest offers — only if you have given consent to receive such communications.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and provide the necessary support.
• Legal Compliance: Meeting legal and regulatory obligations, including reporting suspicious transactions to the relevant authorities.
• Product Enhancements: Analyzing usage patterns to improve platform performance and the overall user experience.

Winlah does not make automated decisions that significantly affect you based solely on data processing without any human involvement. Every important decision, such as account closure or withdrawal rejection, is subject to review by our team.

Winlah does not sell, rent, or trade your personal information to any third party for commercial purposes. This is our absolute policy and has never changed since the platform launched. Your data belongs to you.

However, there are limited situations where winlah needs to share your information with certain parties:

• Payment Provider: Transaction information that must be shared with licensed payment gateways such as FPX, Touch 'n Go eWallet, GrabPay, and Boost to process your deposits and withdrawals.
• KYC Provider: A licensed identity verification service that helps us verify your documents securely and efficiently.
• Game Providers: Limited information required by third-party game software providers to enable access to their games on our platform.
• Regulatory Authorities: When required by law, court order, or a legitimate request from a law enforcement agency.
• Cloud Services & Infrastructure: IT infrastructure provider that stores and processes data on behalf of winlah, subject to strict data protection agreements.

Winlah invests seriously in cybersecurity infrastructure to ensure your data is protected at all times. Our security approach employs a layered defence model designed to prevent, detect, and respond to any cyber threat.

• 256-bit SSL Encryption: All data transmitted between your device and winlah's servers is encrypted using the latest TLS 1.3 protocol, making it unreadable to any unauthorised party.
• Static Data Encryption: Sensitive data stored in our databases — including financial information and KYC documents — is encrypted using AES-256 algorithms.
• Two-Factor Authentication (2FA): An additional security layer available to all member accounts, making unauthorized access virtually impossible even if your password is compromised.
• 24/7 Monitoring: Our automated monitoring system detects suspicious activity in real time and will immediately block any abnormal access.
• Regular Security Audits: winlah conducts regular penetration testing and independent security audits to identify and patch any vulnerabilities before they can be exploited.
• Internal Access Controls: Only specifically authorised Winlah staff may access member data, and all access is logged and monitored.

Winlah uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you browse our website.

We use several types of cookies, each serving a different purpose:

• Essential Cookies (Required): Required for core platform functions such as login sessions and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how you use the platform — pages visited, time spent, and errors encountered. This data helps us improve the platform.
• Functional Cookies: Saving your preferences such as language, time zone, and display settings so you don't need to reconfigure them every time you log in.
• Analytics Cookies: Used to understand aggregated usage patterns for product improvement and strategic planning purposes.

You can manage or delete cookies through your web browser settings at any time. However, disabling essential cookies may affect your ability to log in or use certain platform features.

Under the Malaysia Personal Data Protection Act 2010 (PDPA), you have certain rights regarding your personal data held by Winlah. Winlah fully respects these rights and will carefully process every request within the stipulated timeframe.

• Right of Access: You have the right to request a copy of the personal information we hold about you. This request will be processed within 21 business days.
• Right to Rectification: If any of your information is inaccurate or outdated, you have the right to request a correction without undue delay.
• Right to Erasure: Under certain circumstances, you may request that we delete your personal data. This request is subject to our legal retention obligations.
• Right to Object to Marketing: You may withdraw your consent to receive marketing communications at any time through your account settings or by contacting our team.
• Right to Restrict Processing: In certain situations, you may request that we restrict how we process your data while a dispute is being resolved.
• Right to Data Portability: You may request that we deliver your data in a machine-readable format to you or to another service provider.

To exercise any of the above rights, contact our Data Protection Officer (DPO) via email at [email protected]. Please clearly state the nature of your request and include proof of identity for verification purposes.

Winlah retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy, or for as long as required by applicable Malaysian law.

• Active Account Data: Retained for the duration your account remains active with Winlah.
• Data After Account Closure: Transaction records and KYC documents are retained for a minimum of 7 years after account closure to comply with anti-money laundering (AML) laws and regulatory audit requirements.
• Security Log Data: Access logs and security data are retained for 2 years for investigation purposes if required.
• Marketing Data: Retained until you withdraw your consent or request deletion.

Once the designated retention period ends, your data will be securely deleted or anonymised in a manner that can no longer be linked back to you as an individual.

The winlah platform may contain links or integrations with third-party services such as game providers and payment gateways. It is important to understand that this Privacy Policy applies solely to the winlah platform itself and does not cover the privacy practices of those third parties.

When you interact with third-party services integrated within our platform, your data may be subject to their own privacy policies. We recommend reading the privacy policy of each service provider you use.

Winlah is not responsible for the privacy practices or content of any third-party websites or services. Linking to or integrating with such services does not imply that winlah endorses or recommends their privacy policies.

Winlah reserves the right to amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or service improvements. All amendments take effect upon publication of the latest version on this website.

For significant amendments that affect your privacy rights, we will provide at least 14 days' notice before the changes take effect through one of the following methods:

• In-account notifications on winlah when you log in
• Email sent to the address registered in your account
• A clear notice on our platform's home page

The "Updated" date at the top of this document always reflects the date of the latest amendment. Your continued use of the winlah platform after any amendment takes effect will be considered acceptance of the revised privacy terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by winlah, we encourage you to contact us directly. Our team is ready to assist in both Bahasa Melayu and English.

For formal complaints regarding data protection, you may also contact Department of Personal Data Protection Malaysia (JPDP) which is the official regulatory body under the Malaysian Ministry of Communications and Digital.