Privacy Policy

01 Introduction

This Privacy Policy ("Policy") issued by 96win ("we", "us", "our", "the Platform") and applies to all individuals who access or use the 96win online gambling platform at96win.click, including registered account holders, visitors browsing the Platform without an account, and any person submitting personal data via support, KYC, or promotional channels.

96win is committed to handling personal data responsibly, transparently, and in full compliance with applicable data protection regulations. This Policy is designed to give you a clear and complete understanding of your privacy rights and of how your personal information is managed throughout your relationship with us.

By registering an account on 96win, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.

02 Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, contact details, financial information, device identifiers, and behavioural data.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transmission, erasure, or any combination thereof.
• "Data Subject" — the individual to whom personal data relates; the context of this Policy, the96win player or Platform visitor.
• "Data Controller" — the entity that determines the purposes and means of processing personal data;96win is the Data Controller for all player data processed on this Platform.
• "Data Processor" — a third party that processes personal data on behalf of96win pursuant to a written agreement and under documented instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data.
• "KYC" — Know Your Customer; the regulatory process of verifying a player's identity and age prior to permitting withdrawals or ongoing account activity.

03 Data Controller Identity

For the purposes of applicable data protection legislation, 96win — operating the Platform at 96win.click — acts as the Data Controller with respect to all personal data collected from players, visitors, and other individuals who interact with the Platform.

96win operates under an international gaming licence and maintains its data processing obligations in accordance with the requirements attached to that licence and with internationally recognised data protection standards.

All enquiries concerning the processing of personal data, including requests to exercise Data Subject rights, should be directed to our dedicated privacy contact at: [email protected]

04 Personal Data We Collect

96win collects personal data that is strictly necessary for the purposes described in Section 6 of this Policy. The categories of personal data we collect are detailed in the table below:

05 How We Collect Personal Data

96win collects personal data through the following channels and interactions:

• Account registration: When you complete the registration form on the Platform, you provide identity and contact data directly.
• KYC submission: When you submit identity documents for verification prior to processing withdrawals.
• Deposits and withdrawals: When you transact via Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank), or USDT TRC20, financial data is generated and recorded.
• Gameplay and betting activity: Each game session, wager placed, and bet settled generates account data that is automatically recorded in our systems.
• Customer support interactions: When you contact 96win via live chat or email, communications data is created and stored.
• Automated technologies: Cookies, log files, and session trackers automatically collect technical and usage data during your Platform sessions.
• Third-party payment processors: Payment data is also received from our payment gateway partners when processing e-wallet and bank transfer transactions.

06 Purposes of Data Processing

96win processes your personal data for the following specific and lawful purposes:

1. Account creation and management: To register your account, maintain your profile, manage your balance, and provide access to Platform features.
2. Identity and age verification (KYC): To confirm that you meet the 21+ age requirement and that your identity matches the payment methods on your account, as required by our licensing obligations.
3. Payment processing: To facilitate deposits via Touch 'n Go eWallet, DuitNow, FPX bank transfers (Maybank, CIMB, Public Bank), and other accepted methods, and to process withdrawal requests to your nominated payment account.
4. Fraud prevention and Anti-Money Laundering (AML) compliance: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, and money laundering activity, in accordance with the AML obligations attached to our gaming licence.
5. Regulatory compliance: To fulfil the legal and regulatory obligations required by our international gaming licence, including record-keeping and reporting obligations.
6. Responsible gambling: To monitor wagering patterns that may indicate problem gambling behaviour, to enforce deposit limits and self-exclusion settings where activated, and to comply with responsible gambling regulations.
7. Customer support: To respond to your enquiries, process complaints, and provide assistance with account-related issues via live chat and email.
8. Platform security: To protect the integrity of the Platform, detect and prevent unauthorised access, and safeguard the interests of all players.
9. Service improvement: To analyse usage patterns and user experience data in aggregate and anonymised form to improve the Platform's features, performance, and player experience.
10. Communications: To send transactional communications (e.g., deposit confirmations, withdrawal status updates, KYC request notifications) that are necessary for the operation of your account.

07 Legal Basis for Processing

96win processes personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between96win and the player — including account operation, payment processing, and KYC verification — is necessary for the performance of the Terms & Conditions you have agreed to.
• Legal obligation: Processing required to comply with applicable laws, licensing conditions, and regulatory requirements — including AML checks, age verification, and record retention — is mandated by legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gambling monitoring is carried out on the basis of 96win's legitimate interests, subject to balancing against the rights and interests of individual data subjects.
• Consent: Where96win sends optional marketing communications or uses non-essential cookies, this is done on the basis of your freely given and withdrawable consent.

08 Sharing Your Personal Data

96win does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your data may be shared with the following categories of recipients, strictly for the purposes described in Section 6:

• Payment processors and e-wallet providers: Personal and financial data is shared with payment gateway partners (including FPX infrastructure providers and e-wallet integrators) to the extent necessary to process your deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank, CIMB, and Public Bank.
• KYC and identity verification providers: Identity documents and verification data may be shared with third-party KYC technology providers that process such information on our behalf under strict contractual data processing agreements.
• Regulatory and licensing authorities: 96win may be required to disclose player data to our gaming licence issuing authority, financial intelligence units, or law enforcement agencies where legally required or where there is reasonable suspicion of serious criminal activity.
• IT and platform infrastructure providers: Technical service providers who host Platform infrastructure or provide security services may access limited technical and account data in the course of providing those services, under strict contractual obligations.
• Professional advisers: Legal, compliance, and audit advisers may have access to personal data to the extent required for the provision of professional services to96win, subject to professional confidentiality obligations.

09 Third-Party Data Processors

96win engages third-party Data Processors to perform certain functions that require access to player personal data. All Data Processors are engaged under formal Data Processing Agreements that:

• Prohibit the processor from using personal data for any purpose other than performing the contracted service for 96win.
• Require the processor to implement appropriate technical and organisational security measures.
• Require the processor to assist 96win in responding to Data Subject rights requests within applicable timeframes.
• Require the processor to notify 96win promptly in the event of any data breach or security incident affecting player personal data.
• Require the processor to return or securely delete all personal data upon termination of the processing relationship.

96win periodically reviews its third-party processor relationships to ensure ongoing compliance with these requirements. A list of current Data Processors can be provided upon written request to [email protected].

10 Data Retention

96win retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following retention considerations:

• Account data: Retained for the duration of the account relationship and for a period thereafter as required by applicable regulatory obligations — typically a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification, as required by applicable anti-money laundering legislation.
• Transaction records: Financial transaction records, including deposit and withdrawal histories in MYR, are retained for a minimum of five (5) years from the date of the transaction.
• Communications data: Live chat logs and support email correspondence are retained for a period of two (2) years from the date of the interaction, unless a longer retention period is required for complaint resolution or legal proceedings.
• Technical and usage data: Log files and session data are typically retained for up to twelve (12) months for security and fraud detection purposes.
• Marketing consent records: Records of consent to receive marketing communications are retained for the duration of the account relationship and for one (1) year after the last interaction or opt-out event.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data deletion procedures.

11 Data Security Measures

96win implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Transport Layer Security (TLS / SSL): All data transmitted between your browser or mobile device and the96win Platform is encrypted using 256-bit SSL/TLS encryption, protecting it from interception during transit.
• Encryption at rest: Sensitive personal and financial data stored on 96win servers is encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to player data are subject to confidentiality obligations and undergo data protection training.
• Two-factor authentication (2FA): 96win encourages all players to enable 2FA on their accounts. Internal system access by96win personnel requires multi-factor authentication.
• Regular security audits: 96win conducts periodic security assessments of its Platform infrastructure, including penetration testing and vulnerability assessments, to identify and remediate security risks.
• Incident response procedures: In the event of a security incident or data breach affecting player personal data, 96win maintains documented incident response procedures to contain the breach, assess the risk, notify affected parties, and report to relevant authorities where required.

Notwithstanding the above measures, no data transmission over the internet or storage system can be guaranteed to100% secure. Players are advised to take responsibility for the security of their own account credentials and to notify 96win immediately at [email protected] if they suspect unauthorised access to their account.

12 Cookies & Tracking Technologies

96win uses cookies and similar tracking technologies on the Platform to enable essential functionality, enhance performance, and support security operations. The types of cookies used are described below:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They include session cookies that maintain your login state, security tokens, and cookies required to process transactions. These cookies cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: These cookies collect anonymised information about how players interact with the Platform — pages visited, session durations, error encounters — to help us improve the Platform. This data does not identify individual users.
• Functionality cookies: These cookies remember your preferences (such as your selected language or display settings) to provide a more personalised experience.
• Security cookies: Used to detect and prevent fraudulent activity, including bot access, credential stuffing attacks, and session hijacking attempts.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies may affect certain Platform features. Strictly necessary and security cookies cannot be disabled without significantly impairing your ability to use the Platform.

13 Your Data Subject Rights

As a Data Subject whose personal data is processed by 96win, you hold the following rights in relation to your personal data. These rights may be exercised at any time by submitting a written request to [email protected]: