Privacy Policy winlaju

1. Introduction and Purpose of This Policy

winlaju ("we", "platform", "operator") respects the privacy of every user who registers and uses our services. This Privacy Policy is set out to provide full clarity on our personal data handling practices to all users, particularly players from Malaysia.

This policy applies to all information collected through the winlaju website at winlaju.org, our mobile application (if available), and any interaction you have with our support team. We encourage you to read this document carefully before registering an account or using any of the services we offer.

By accessing or using winlaju's services, you acknowledge that you have read, understood and agreed to this Privacy Policy. If you do not agree with any provision in this policy, please stop using our platform.

2. Types of Information We Collect

We collect information in two main categories — information you provide directly to us, and information collected automatically when you use the platform.

2.1 Information You Provide Directly

During the registration process and ongoing use of the platform, you may be required to provide:

• Full name as stated in your identity document
• Identity card number (MyKad) or passport for age and identity verification purposes
• An active email address for account communications
• Mobile phone number for two-factor authentication and notifications
• Bank account or e-wallet details for processing deposits and withdrawals
• Date of birth to confirm the player meets the age requirement of 21
• Residential address for compliance and verification purposes

2.2 Information Collected Automatically

When you use our platform, our systems automatically record:

• IP address and general geolocation data
• Device type, operating system and web browser version used
• History of gaming and betting activity on the platform
• Deposit and withdrawal transaction logs
• Session records — login time, logout time and session duration
• Cookie data and relevant device identifiers

3. How We Use Your Information

winlaju only uses your personal data for legitimate purposes related to delivering platform services. The following are the primary purposes for data processing:

• Verification and management of user accounts including age and identity checks
• Processing financial transactions — deposits, withdrawals and bonuses accurately and securely
• Detection and prevention of fraud, money laundering and other unlawful activities
• Compliance with anti-money laundering (AML) and Know Your Customer (KYC) requirements
• Providing 24/7 customer support via live chat and email
• Sending important communications related to accounts, transactions and policy changes
• Ongoing improvement of the platform, user experience and system security
• Management of the VIP programme and bonus eligibility based on account activity
• Compliance with legal obligations under the international licensing framework

4. Information Sharing and Disclosure

In certain circumstances, winlaju may need to share your personal information with carefully selected third parties. This sharing is done based on operational requirements and legal obligations only.

4.1 Authorised Payment Processors

To process transactions through methods such as Touch 'n Go eWallet, DuitNow, FPX, Boost, ShopeePay and cryptocurrency, your payment information is shared with the relevant payment processors. All such processors are subject to strict data security standards.

4.2 Regulatory Authorities

winlaju may be required to disclose certain information to regulatory bodies, international licensing authorities, or law enforcement agencies where there is a valid legal obligation to do so.

4.3 Technical Service Providers

Technical infrastructure providers, gaming software platforms and cloud hosting service providers may have limited access to technical data for system operation and maintenance purposes. All agreements with these parties include data protection terms that must be complied with.

• Information is not shared across the corporate group for cross-marketing purposes
• Any international data transfers are subject to appropriate contractual protections
• Data sharing is carried out on a minimum necessary basis only ("need-to-know basis")
• You will be informed if there are significant changes to these data sharing practices

5. Data Security Measures

We take the security of your personal data seriously. winlaju implements multiple layers of technical and organisational protection to reduce the risk of unauthorised access, data breaches or data loss.

• SSL/TLS encryption on all communications between your device and our servers
• Password storage using strong one-way hashing algorithms — no plain-text password storage
• Two-factor authentication (2FA) available for additional account protection
• Continuous system monitoring to detect suspicious or unusual activity
• Internal access to personal data is restricted based on role and job requirements
• Regular security audits by internal teams and independent third parties
• Clear incident response procedures in the event of a data breach

6. Use of Cookies and Tracking Technologies

winlaju uses cookies and similar tracking technologies to improve the user experience, maintain session security, and understand how the platform is used.

6.1 Types of Cookies Used

• Essential Cookies — required for core platform functions such as login session management and security. Cannot be disabled.
• Performance Cookies — collect anonymous data about how users interact with the platform for improvement purposes.
• Functional Cookies — store your preferences such as display language and platform settings.
• Marketing Cookies — used to deliver relevant promotional information to you based on your platform activity.

You can manage or disable non-essential cookies through your web browser settings. However, disabling essential cookies may affect platform functionality.

7. Data Retention Period

winlaju retains your personal data only for as long as necessary to fulfil the purposes stated in this policy, or as required by applicable laws and regulations.

• Active account data is retained for the duration your account remains active on the platform
• KYC records and identity verification data are retained for at least five years after account closure for AML compliance
• Financial transaction logs are retained for the minimum period set by the licensing authority
• Customer support data is retained for a period sufficient to resolve any disputes that may arise
• Marketing data is deleted once you withdraw your consent or close your account

When data is no longer needed, it is securely deleted or anonymised using appropriate procedures to ensure it cannot be recovered or linked back to your identity.

8. International Data Transfers

As winlaju operates under an international licence, some of your personal information may be processed or stored on servers located outside Malaysia. All such data transfers are carried out with appropriate safeguards in place.

• Data processing contracts that comply with international data protection standards are used with all third-party providers
• Servers are hosted in data centres that meet strict physical and logical security standards
• Data transfer procedures include risk assessments and adequate control measures
• Further information about international data transfers can be obtained by contacting our privacy team