Privacy Policy

TokeWin (hereinafter referred to as "the Platform", "we", "us" or "our") is committed to protecting the privacy and personal data of all individuals who access or use the services available attokewin.cam. This Privacy Policy describes how we collect, use, store, share and protect personal information provided by or collected from our users ("you", "the Player" or "the User") in the course of your interaction with the Platform.

This Privacy Policy applies to all personal data processed by TokeWin in connection with the provision of our online casino, sports betting, payment processing and customer support services to Malaysian players and other users of the Platform. It should be read in conjunction with our Terms & Conditions, which govern your overall use of the Platform.

By registering an account on the Platform, making a deposit, accessing any game or service, or otherwise interacting with TokeWin, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, processing and use of your personal data as described herein. If you do not agree with any aspect of this Privacy Policy, you should refrain from using the Platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• Personal Data — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data and online identifiers.
• Processing — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission or deletion.
• Data Controller — TokeWin, which determines the purposes and means of processing personal data collected via the Platform.
• Data Subject — the individual to whom the personal data relates — i.e., you, the Player or User of the Platform.
• Third Party — any natural or legal person, public authority, agency or body other than the Data Subject and TokeWin.
• Cookies — small text files placed on your device by the Platform to store session information, preferences and tracking data.
• KYC — Know Your Customer: identity and address verification procedures required prior to processing withdrawals or in response to compliance obligations.
• Platform — the TokeWin website accessible at tokewin.cam, including all services, features and sub-pages therein.

TokeWin collects the following categories of personal data from users of the Platform:

TokeWin collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide voluntarily when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, respond to a survey or participate in a promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including your IP address, device identifiers, browser information and browsing behaviour on our pages, collected via server logs, cookies and similar tracking technologies (see Section 10).
• Payment Processors: Transaction confirmation data received from our integrated payment partners (Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank and cryptocurrency processing services) to verify and reconcile deposits and withdrawals.
• Identity Verification Services: Where applicable, data received from third-party KYC and identity verification service providers used to validate the authenticity of documents and confirm player identities.
• Fraud Prevention Services: Data received from third-party fraud detection and risk management services used to identify potentially fraudulent account activity.

TokeWin processes your personal data for the following clearly defined purposes:

• Account Management: To create, maintain and administer your account on the Platform, including authentication, session management and account security.
• Service Delivery: To provide access to casino games, sports betting markets and all other services available on the Platform.
• Payment Processing: To process deposits and withdrawals in MYR via your chosen payment method, verify payment authenticity and maintain accurate financial records.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with our internal policies and to satisfy due diligence obligations.
• Compliance & Legal Obligations: To comply with applicable laws and regulations, respond to lawful requests from competent authorities, and maintain records required for audit purposes.
• Fraud Prevention & Security: To detect, investigate and prevent fraudulent transactions, unauthorised account access, bonus abuse and other prohibited activities as defined in our Terms & Conditions.
• Customer Support: To respond to your queries, complaints and support requests, and to maintain records of communications for quality assurance and dispute resolution.
• Responsible Gambling: To monitor gaming activity for signs of problem gambling behaviour and to administer self-exclusion, deposit limit and cooling-off requests in accordance with our Responsible Gambling policy.
• Marketing Communications: To send promotional offers, bonus notifications and platform updates to players who have opted in to receive such communications. You may opt out at any time.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve Platform performance, user experience and game offerings.

TokeWin processes your personal data one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you as set out in our Terms & Conditions — including account administration, game access, payment processing and customer support.
• Legal Obligation: Processing is necessary to comply with a legal obligation, including identity verification, anti-money-laundering requirements and responding to lawful orders from competent authorities.
• Legitimate Interests: Processing is necessary for our legitimate business interests (or those of a third party), provided those interests are not overridden by your fundamental rights and freedoms — for example, fraud prevention, platform security, analytics and responsible gambling monitoring.
• Consent: Where processing is based on your consent — principally in relation to marketing communications and certain cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

TokeWin does not sell, rent or otherwise transfer your personal data to third parties for their own independent commercial purposes. We may share your personal data with third parties only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: We share transaction-relevant data with payment processors (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank and cryptocurrency processors) to facilitate deposits and withdrawals. These providers are contractually bound to process your data only for payment fulfilment purposes.
• Identity Verification Partners: KYC documents and identity data may be shared with accredited identity verification service providers for the purpose of fulfilling our age and identity verification obligations.
• Fraud & Risk Management Services: Technical and account data may be shared with fraud prevention service providers to identify and mitigate risks of fraudulent activity, money laundering or account abuse.
• IT Infrastructure & Hosting Providers: Personal data is stored on secure servers operated by contracted hosting and cloud infrastructure providers. These providers operate under data processing agreements that require them to maintain appropriate security standards.
• Legal & Regulatory Authorities: We may disclose personal data to competent law enforcement agencies, courts, regulatory bodies or other public authorities where we are required to do so by law, court order or regulatory direction, or where we have a good-faith belief that disclosure is necessary to protect the rights, property or safety of TokeWin, our users or the public.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections as described in this Policy.

All third parties with whom we share personal data are required to comply with applicable data protection standards and are prohibited from using your data for any purpose beyond what is necessary to fulfil their contracted role.

TokeWin retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as outlined in Section 5, and in accordance with applicable legal retention obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your active account, plus minimum of 5 years following account closure to satisfy financial record-keeping and compliance obligations.
• Transaction & Financial Records: Retained for a minimum of 7 years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• KYC Documents: Retained for the duration of your account plus 5 years following account closure, or longer where required by applicable law.
• Customer Support Communications: Retained for 3 years from the date of the last communication, for dispute resolution and quality assurance purposes.
• Gaming Activity Logs: Retained for 5 years from the date of each gaming session.
• Technical & Usage Data: Retained for up to 24 months in identifiable form; thereafter retained only in anonymised or aggregated form for analytics purposes.
• Marketing Opt-In Records: Retained for the duration of your opt-in status plus 2 years following opt-out, as evidence of consent management.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in manner that makes re-identification impossible. Requests for early deletion are addressed in Section 11.

TokeWin takes the security of your personal data seriously and implements a range of technical, organisational and procedural measures to protect it against unauthorised access, loss, alteration, disclosure or destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using industry-standard TLS (Transport Layer Security) with 256-bit encryption.
• Encryption at Rest: Sensitive personal data stored on our servers, including financial records and identity documents, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorised TokeWin personnel and contracted service providers who have a demonstrated need to access such data to perform their roles. All access is logged and regularly audited.
• Password Security: Account passwords are stored in hashed and salted form. We do not store plain-text passwords. Players are encouraged to use strong, unique passwords and to enable any available two-factor authentication.
• Regular Security Assessments: Our systems are subject to periodic security testing, vulnerability assessments and penetration testing to identify and remediate potential security weaknesses.
• Data Breach Response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected players without undue delay and report the breach to the relevant authorities in accordance with applicable obligations.

While we take all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. We encourage all players to adopt good personal security practices, including using strong passwords and avoiding logging in from shared or public devices.

TokeWin uses cookies and similar tracking technologies to operate and improve the Platform, remember your preferences, maintain your login session and collect analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including session management, authentication and security functions. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences and settings (such as language preference and display settings) to improve your experience on return visits.
• Analytics Cookies: Used to collect anonymised data about how users interact with the Platform — including pages visited, time spent and navigation paths — to help us improve Platform performance and content. Data collected via analytics cookies is aggregated and not used to identify individual users.
• Security Cookies: Used to support our fraud detection and account security systems, including identifying unusual access patterns or suspicious login behaviour.

TokeWin does not use third-party advertising cookies or tracking pixels for the purpose of building advertising profiles or serving targeted advertisements on external platforms. Any third-party scripts used on the Platform are limited to those necessary for payment processing, analytics and security functions.

As a Data Subject, you have the following rights with respect to your personal data held by TokeWin. To exercise any of these rights, please contact us using the details provided in Section 16.