Privacy Policy Interwin

Interwin is an online entertainment platform operating in Malaysia, offering a wide range of gaming services including slots, live casino, fish shooting, sports betting, and more. In the course of our operations, we collect and process certain personal information from users to ensure our services run smoothly, securely, and in compliance with applicable legal requirements.

This Privacy Policy is prepared in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and related regulations. We are committed to ensuring your personal information is handled responsibly, transparently and only for legitimate purposes.

This policy covers all ways you interact with Interwin — whether through the official website, mobile app, customer support services, or other communication channels we provide. We encourage you to read this document carefully and contact us if you have any questions or concerns.

Interwin collects your personal information through several means depending on how you interact with our platform. The following are the categories of information we collect:

Information You Provide Directly

• Registration information: Full name, date of birth, email address, mobile number, and password during the account registration process
• KYC verification documents: MyKad copy (front and back), selfie holding your identification document, and proof of address if required
• Financial information: Bank account number, eWallet account number, or cryptocurrency wallet details you use for deposits and withdrawals
• Support communications: Any messages, complaints, or inquiries you submit to the interwin customer support team

Automatically Collected Information

• Technical data: IP address, device type, operating system, browser type and language settings
• Usage data: Pages visited, time spent, games played, login frequency, and navigation patterns
• Transaction data: Deposit, withdrawal, betting, wins, and any financial activity history on the platform
• General location data: Approximate location based on IP address for jurisdiction verification and compliance purposes
• Cookie data: Information stored via cookies and tracking technologies as described in Section 6

All data we collect is used solely for legitimate, necessary purposes directly related to the operation of the interwin platform. The following are the primary purposes for which your data is used:

We will not use your data for purposes unrelated to Interwin's services without obtaining your consent first. Any new use of data not covered under this policy will be communicated to you through a clear notice.

Interwin does not sell, rent, or trade users' personal information to any third party for marketing or commercial purposes. However, in certain limited situations, we may need to share your information with the following parties:

• Payment service providers: DuitNow, FPX, Touch 'n Go, GrabPay, Boost, and USDT providers receive the transaction information required to securely process your deposits and withdrawals.
• Gaming service providers: Third-party game providers integrated with the Interwin platform receive only the minimum session data required for game functionality.
• KYC service providers: Our identity verification partners process your KYC documents in a secure and trusted environment to verify the identity of new members.
• Legal authorities: Interwin will disclose required information to government authorities, law enforcement bodies, or courts when lawfully required to do so under Malaysian law.
• Auditors and professional advisors: Audit firms, lawyers and consultants involved in Interwin's business operations are bound by strict confidentiality obligations.

Protecting your personal data is Interwin's highest priority. We implement multiple layers of technical and organisational security to ensure your information is always protected from unauthorised access, disclosure, or modification.

Technical Security Measures

• 256-bit SSL/TLS Encryption: All data transmitted between your device and interwin's servers is encrypted using the latest SSL/TLS protocols, ensuring no third party can intercept or read the data in transit.
• At-rest data encryption: Data stored in Interwin's databases is also encrypted to protect sensitive information even in the event of a physical breach.
• Two-factor authentication (2FA): 2FA is available and encouraged for all user accounts to add an extra layer of protection against unauthorized access.
• Real-time threat monitoring: Our intrusion detection system continuously monitors account activity and network traffic to detect and block suspicious activity.
• Financial data segregation: Users' financial information is stored in an isolated environment separate from general operational data, with strictly controlled access.

Organisational Security Measures

• Access to users' personal data is granted only to staff who require it to perform their duties
• All staff who handle user data undergo regular data protection training.
• Internal and external security audits are conducted regularly to identify and address vulnerabilities
• A clear and tested data breach incident response procedure is in place to address any data breach events.

The interwin platform uses cookies and similar tracking technologies to enhance the user experience, understand usage patterns, and deliver more relevant services. The following are the types of cookies we use:

You can manage cookie settings through your browser at any time. Please note, however, that disabling essential cookies may affect the login functionality and security of your Interwin account. Analytics and functional cookies can be disabled without affecting core platform features.

Interwin retains your personal data only for as long as necessary to fulfil the original purpose of collection or to comply with applicable legal obligations. Our retention policy is as follows:

• Active account data: Retained for the duration your account remains active on the Interwin platform
• Financial transaction records: Retained for a minimum of 7 years from the transaction date in compliance with financial and anti-money laundering (AML) legal requirements
• KYC documents: Retained for 5 years after account closure or in line with the requirements of relevant authorities
• Support communication logs: Retained for 3 years for reference and dispute resolution purposes
• Anonymous analytics data: May be retained indefinitely as it contains no personally identifiable information

Once the retention period expires, your personal data will be securely deleted or permanently anonymised using recognised data deletion procedures. This deletion is irreversible.

Under Malaysia's Personal Data Protection Act 2010 and Interwin's internal policies, you have the following rights regarding the personal data we hold:

• Right of access: You have the right to request a copy of the personal data that Interwin holds about you at any time.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data through your account settings or by contacting our support team.
• Right to erasure: Under certain circumstances, you may request deletion of your personal data, subject to applicable legal retention obligations.
• Right to restrict processing: You may request that we restrict the processing of your data in certain situations, such as when you are contesting the accuracy of that data.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to data portability: You may request your data in a machine-readable format for transfer to another service provider.
• Right to withdraw consent: For processing that relies on your consent, you may withdraw that consent at any time without affecting the validity of prior processing.

To exercise any of the above rights, please contact the interwin privacy team via email or live chat. We will process your request within 14 business days. For more complex cases, the processing period may be extended to 30 days with notice to you.

The interwin platform integrates with several third-party services to deliver a complete and seamless gaming experience. These services include game providers, payment gateways, and analytics tools. Each third-party provider has its own privacy policy governing how they handle the data they receive.

Interwin ensures that all third-party partners we work with meet data protection standards equivalent to or higher than our own. Legally binding data processing agreements are signed with every vendor before any integration is implemented.

If you follow any link that takes you outside the interwin platform, the privacy policy of the destination website will apply, and interwin is not responsible for the privacy practices of that third-party website.

Interwin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our business practices, new legal requirements, or improvements in how we protect your data. Any material changes will be communicated to you via:

• An email notice sent to your registered address at least 14 days before the changes take effect
• A clear notice displayed on the login page and key sections of the platform
• Update the "Last Updated" date shown at the top of this document

Continued use of the interwin platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you disagree with any changes, you have the right to close your account and request data deletion in accordance with the established procedures.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how Interwin handles your personal data, our privacy team is always ready to assist.

• Live Chat: Available 24 hours a day, 7 days a week directly within the interwin platform
• Email: [email protected] — we aim to respond within one business day

We take every privacy complaint seriously and will investigate and respond within a reasonable timeframe. If you are not satisfied with our response, you have the right to refer your complaint to Malaysia's Personal Data Protection Commissioner.