wintoto Privacy Policy

1. Who We Are

wintoto is the operator of the online gaming platform accessible at wintoto.asia ("Platform"). References to "wintoto," "we," "us," or "our" in this Privacy Policy refer to the Platform operator. wintoto operates under international gaming licensing and is committed to protecting the privacy and personal data of all Platform members and visitors, including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and throughout Malaysia.

This Privacy Policy applies to all personal data collected through the Platform, including data submitted during account registration, during gameplay, through payment transactions, and through any communications with our support team.

2. Data We Collect

2.1 Data You Provide Directly

When you register for a wintoto account, make a deposit or withdrawal, contact support, or interact with any wintoto service, you may provide:

• Full name, date of birth, and nationality;
• Email address and mobile phone number;
• Residential address (including city and state within Malaysia);
• Government-issued identification documents submitted for KYC verification (e.g., MyKad, passport);
• Payment method details (e.g., Touch 'n Go eWallet account reference, Boost account reference, bank account details for Maybank, CIMB, or Public Bank transfers);
• Username, password (stored in hashed form), and account preferences;
• Support communications, including chat transcripts and email correspondence.

2.2 Data Collected Automatically

When you access the Platform, wintoto automatically collects certain technical data, including:

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Session duration, pages visited, and features accessed;
• Bet history, game history, deposit and withdrawal transaction logs;
• Cookie identifiers and similar tracking technologies (see Section 6).

2.3 Data from Third Parties

wintoto may receive personal data from third parties in limited circumstances, including identity verification service providers used to fulfil KYC obligations, payment processors used to facilitate deposits and withdrawals, and fraud prevention partners used to protect the integrity of the Platform.

3. How We Use Your Data

wintoto processes personal data for the following purposes:

• Account management: to register, verify, maintain, and administer your wintoto account;
• Service delivery: to facilitate betting, gaming, deposits, withdrawals, and customer support;
• Regulatory compliance: to meet Know Your Customer (KYC), Anti-Money Laundering (AML), and age verification obligations imposed by our licensing authority;
• Fraud prevention: to detect, investigate, and prevent fraudulent activity, unauthorised access, and other prohibited conduct;
• Responsible gaming: to monitor gaming behaviour for indicators of problem gambling and to enforce responsible gaming tools where triggered;
• Communications: to send account notifications, transaction confirmations, security alerts, and — where you have consented — promotional messages;
• Platform improvement: to analyse usage patterns and improve the functionality, security, and content of the Platform;
• Legal obligations: to respond to lawful requests from regulatory authorities, law enforcement agencies, or courts of competent jurisdiction.

4. Legal Basis for Processing

wintoto processes personal data on the following legal grounds:

• Contractual necessity: processing required to perform the agreement between you and wintoto (e.g., operating your account, processing bets, and handling withdrawals);
• Legal obligation: processing required to comply with applicable laws and licensing conditions, including KYC and AML obligations;
• Legitimate interests: processing necessary for fraud prevention, platform security, and service improvement, where those interests are not overridden by your fundamental rights;
• Consent: where you have provided explicit consent, such as opting in to marketing communications. You may withdraw consent at any time by contacting [email protected].

5. Data Sharing & Disclosure

wintoto does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Service providers: third-party processors engaged to provide services on our behalf, including payment processors (Touch 'n Go, Boost, bank transfer operators), identity verification providers, IT infrastructure providers, and customer support platforms. These parties are contractually bound to process data only as instructed by wintoto and to maintain appropriate security standards;
• Game suppliers: where necessary to facilitate access to a game provided by a third-party studio, limited technical identifiers may be shared with that supplier;
• Regulatory and legal disclosure: where required by a valid court order, regulatory directive, or law enforcement request, wintoto will disclose personal data to the extent legally required;
• Business transfers: in the event of a merger, acquisition, or sale of all or part of wintoto's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

In all cases of third-party data sharing, wintoto takes reasonable steps to ensure the recipient maintains adequate data protection standards.

6. Cookies & Tracking Technologies

wintoto uses cookies and similar technologies to operate and improve the Platform. The categories of cookies used include:

• Strictly necessary cookies: essential for the Platform to function, including session authentication and security tokens. These cannot be disabled;
• Functional cookies: used to remember your preferences such as language settings, last game played, and display options;
• Analytics cookies: used to understand how members navigate the Platform so that we can improve usability and content. Analytics data is aggregated and does not identify individuals;
• Responsible gaming cookies: used to track session duration and display responsible gaming reminders in accordance with your account settings.

You may adjust cookie preferences through your browser settings. Disabling strictly necessary cookies may impair Platform functionality, including the ability to log in to your wintoto account.

7. Data Retention

wintoto retains personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy and to comply with applicable legal and regulatory requirements. Specifically:

• Account data is retained for the duration of the account and for a minimum of five (5) years following account closure, in line with standard AML record-keeping requirements;
• Transaction records are retained for a minimum of five (5) years from the date of the transaction;
• KYC documents are retained for the period required by the applicable licensing authority's record-keeping rules;
• Support communications are retained for two (2) years from the date of the last communication in a thread, unless a longer period is required for dispute resolution.

Where data is no longer required for any lawful purpose, wintoto will securely delete or anonymise it.

8. Data Security

wintoto implements technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• SSL/TLS encryption for all data in transit between your device and the Platform;
• Encryption at rest for sensitive data fields including payment information and identification documents;
• Bcrypt password hashing — passwords are never stored in plain text;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular penetration testing and security audits by independent third parties;
• Intrusion detection systems and 24/7 security monitoring of Platform infrastructure.

Despite these measures, no security system is impenetrable. In the event of a data breach that is likely to result in a risk to your rights, wintoto will notify affected members in accordance with applicable notification requirements.

9. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by wintoto:

• Right of access: to request a copy of the personal data wintoto holds about you;
• Right of rectification: to request correction of inaccurate or incomplete personal data;
• Right of erasure: to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal or regulatory retention requirements;
• Right to restrict processing: to request that wintoto limits processing of your data in certain circumstances;
• Right to object: to object to processing based on legitimate interests, including direct marketing;
• Right to data portability: to receive your personal data in a structured, machine-readable format where processing is based on consent or contract.

To exercise any of the above rights, submit a written request to [email protected] with your account username and a description of your request. wintoto will respond within thirty (30) calendar days. Identity verification may be required before a request is fulfilled.

10. Children & Minors

The wintoto Platform is strictly for persons aged 21 years and above. 21+ wintoto does not knowingly collect personal data from persons under the age of 21. Where wintoto becomes aware that personal data has been collected from an individual below the required age, that data will be deleted and the associated account will be closed without delay. If you believe that a minor has registered on the Platform, please notify us immediately at [email protected].

11. Changes to This Policy

wintoto may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or licensing requirements. Material changes will be notified to registered members via the email address on file or by prominent notice on the Platform before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Platform following notification of changes constitutes acceptance of the revised Policy.

12. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact wintoto's Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 on wintoto.asia

If you are not satisfied with wintoto's response to your privacy concern, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.