Privacy Policy

This Privacy Policy ("Policy") is issued by WondaWin ("WondaWin", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the WondaWin platform, available at wondawin.cam (the "Platform"), including all associated mobile interfaces and services.

WondaWin operates as a premium online casino and sports betting platform serving players primarily in Malaysia. In operating this service, we necessarily collect and process personal data relating to our players. This Policy explains the categories of data we collect, the purposes for which it is processed, the legal bases upon which processing is carried out, how long we retain data, and the rights that you hold in relation to your personal information.

We are committed to processing your personal data in a manner that is lawful, fair, transparent, and consistent with applicable data protection standards. We review and update this Policy periodically to reflect changes in our data practices, applicable law, or regulatory guidance.

In this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person ("Data Subject"), including but not limited to name, email address, identification documents, IP address, and payment details.
• "Processing" — any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, alteration, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In the context of this Policy, WondaWin acts as Data Controller in respect of player data collected via the Platform.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, under instruction and subject to appropriate contractual safeguards.
• "Consent" — any freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data for one or more specific purposes.
• "KYC" — Know Your Customer; the identity verification process used by WondaWin to confirm the identity and eligibility of players, in accordance with applicable anti-money laundering obligations.

WondaWin collects personal data across several categories, depending on how you interact with the Platform. The primary categories of data we collect are set out in the table below:

3.1 Data Collected Indirectly

In addition to data you provide directly, WondaWin may collect technical and behavioural data automatically as you browse and use the Platform. This includes clickstream data, page visit sequences, in-game behaviour, and device fingerprinting data used for fraud prevention and platform security purposes.

3.2 Data We Do Not Collect

WondaWin does not intentionally collect sensitive special categories of personal data such as racial or ethnic origin, religious beliefs, health or medical information, or biometric data beyond what is strictly required for identity verification purposes. If you voluntarily provide such information in a support communication, we will handle it with the highest level of care and will not use it for any purpose other than resolving your query.

WondaWin processes personal data for the following specific and documented purposes:

1. Account Creation & Management: To register your Account, verify your identity (KYC), manage your player profile, and maintain accurate account records including your transaction history and balance in Malaysian Ringgit (MYR).
2. Service Delivery: To provide access to the Platform's gaming and betting services, process deposits and withdrawals via Malaysian payment methods (Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, etc.), credit bonus awards, and deliver sports betting and live casino services.
3. Legal & Regulatory Compliance: To fulfil WondaWin's obligations under applicable anti-money laundering (AML) regulations, age verification requirements, and other applicable legal obligations. This includes retaining transaction records and KYC documentation for the required regulatory period.
4. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised access, money laundering, bonus abuse, and other security threats to the Platform or to our players' Accounts.
5. Customer Support: To respond to your enquiries, process complaints, and provide technical assistance through our 24/7 live chat and email support channels.
6. Responsible Gambling: To monitor gaming patterns for indicators of problem gambling behaviour, to apply player-requested tools such as deposit limits and self-exclusion, and to ensure compliance with our responsible gambling obligations.
7. Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications. You may withdraw consent at any time by updating your notification preferences in your Account settings.
8. Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, user interface design, game selection, and overall player experience.

WondaWin relies on the following legal bases when processing your personal data, in accordance with applicable data protection law. Each processing activity is mapped to one or more of these bases:

• Contractual Necessity: Processing required to fulfil the contract between WondaWin and you as a registered player — including account management, payment processing, and service delivery.
• Legal Obligation: Processing required by applicable law, including KYC verification, AML transaction monitoring, and retention of financial records for the mandated regulatory period.
• Legitimate Interests: Processing conducted for WondaWin's legitimate business interests, including fraud prevention, security monitoring, platform analytics, and responsible gambling monitoring — provided these interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in respect of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

WondaWin does not sell, rent, or trade your personal data. We may share personal data with third parties in the following limited and documented circumstances only:

1. Payment Service Providers: We share relevant transaction data with our integrated payment processors (including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and Malaysian bank portals) to enable deposit and withdrawal processing. These providers are contractually bound to process data only for the specific purpose of transaction execution.
2. Game Software Providers: Certain technical data (such as player session identifiers and anonymised game activity data) may be shared with our licensed game software providers for the purposes of delivering live dealer and RNG casino games. Game providers do not receive personally identifiable information beyond what is technically required.
3. KYC Verification Services: Identity documents submitted during KYC are processed by our third-party identity verification partner. These providers are bound by strict confidentiality and data processing agreements and operate under data protection standards no less stringent than those described in this Policy.
4. Regulatory Authorities & Law Enforcement: We may disclose personal data to applicable regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or where we determine such disclosure is necessary to prevent or detect crime or to protect our legal rights.
5. Professional Advisors: Personal data may be shared with legal, accounting, or auditing professionals where necessary for the discharge of their professional services to WondaWin, under obligations of professional confidentiality.

WondaWin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable legal or regulatory obligations. Our general retention schedule is as follows:

• Active Account Data: Retained for the full duration of your Account's active status, plus a period of five (5) years following account closure, to satisfy regulatory and audit requirements.
• KYC Documentation: Retained for a minimum of five (5) years following account closure, or longer where required by applicable anti-money laundering regulations.
• Transaction Records: Retained for a minimum of five (5) years following each transaction date, in line with applicable financial record-keeping obligations.
• Customer Support Interactions: Retained for three (3) years following the closure of each support interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained until you withdraw consent, plus a period of three (3) years thereafter as evidence of consent management compliance.
• Technical & Log Data: Server log data is retained for a rolling period of twelve (12) months for security and fraud detection purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

WondaWin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• TLS 1.3 encryption for all data in transit between your device and WondaWin's servers.
• AES-256 encryption for all sensitive data at rest, including identity documents and financial records.
• Role-based access controls ensuring that personal data is accessible only to WondaWin personnel with a documented operational need.
• Multi-factor authentication for all internal systems that hold or process personal data.
• Regular third-party penetration testing and vulnerability assessments of Platform infrastructure.
• Continuous security monitoring with automated intrusion detection and alerting systems.
• Staff training on data protection obligations and security best practices, conducted at least annually.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, WondaWin will notify affected players without undue delay and in accordance with applicable data breach notification requirements.

WondaWin uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device that helps us recognise you, maintain your session, and understand how you use the Platform.

9.1 Categories of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Platform. These cookies enable core functionality such as account authentication, session management, and security features. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Remember your preferences — such as language settings, notification preferences, and display options — to improve your experience on subsequent visits.
• Analytical Cookies: Collect aggregated, anonymised information about how visitors use the Platform, such as which pages are visited most frequently and how users navigate between sections. This data is used exclusively to improve Platform performance.
• Security Cookies: Used to detect fraudulent or abusive activity, to protect user sessions, and to monitor for suspicious account access patterns.

9.2 Managing Cookies

You may configure your browser to refuse all cookies or to alert you when cookies are being sent. However, disabling strictly necessary cookies will prevent you from logging in to your Account and using core Platform features. Instructions for managing cookies are available in your browser's help documentation. By continuing to use the Platform after being notified of our cookie usage, you consent to our use of cookies as described in this Policy.

Subject to applicable data protection law and certain exceptions, you hold the following rights in respect of your personal data held by WondaWin:

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Subject Request — [Your Username]". WondaWin will acknowledge all requests within 72 hours and will respond in full within thirty (30) calendar days. Where a request is complex or numerous, we may extend this period by a further sixty (60) days with prior notice.

WondaWin may need to verify your identity before processing a data subject request. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

WondaWin's primary operations and data storage infrastructure are located in jurisdictions appropriate for serving the Malaysian market. However, certain third-party service providers engaged by WondaWin — including game software providers, cloud infrastructure providers, and fraud detection services — may be located in or process data from jurisdictions outside Malaysia.

Where personal data is transferred to a third country, WondaWin ensures that appropriate safeguards are in place to protect the data, including (as applicable) standard contractual clauses, the recipient country's adequacy determination, or binding corporate rules. In all cases, the level of protection afforded to your data will be no less than that described in this Policy.

WondaWin reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where updates are material, we will notify registered players by email or via a prominent notice on the Platform at least fourteen (14) days prior to the changes taking effect.

The current version of this Policy, together with its effective date, is always available at wondawin.cam/privacy-policy. Your continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy. If you disagree with any changes, you may close your Account and request erasure of your personal data in accordance with Section 10 above.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a complaint about how WondaWin handles your personal data, please contact our Data Protection team using the details below:

If you are not satisfied with WondaWin's response to your privacy complaint, you may have the right to lodge a complaint with an applicable data protection supervisory authority in your jurisdiction. WondaWin commits to cooperating fully with any regulatory investigation into our data processing practices.