Privacy Policy

Introduction

This Privacy Policy (the "Policy") is issued by waze2win, the operator of the online gaming and sports betting platform available at waze2win.cam (the "Platform"). This Policy applies to all users of the Platform, including registered Players and unregistered visitors.

This Policy explains how waze2win collects, processes, stores, and protects personal data in connection with your use of the Platform and our services. It also sets out your rights as a data subject and explains how to exercise them.

By registering an account on the Platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not use the Platform.

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject") — that is, any information that could directly or indirectly identify you, such as your name, identification number, contact details, or online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means waze2win, being the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party engaged by waze2win to process personal data on our behalf, such as payment service providers, KYC verification providers, and cloud hosting services.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a particular purpose.
• "KYC" refers to Know Your Customer — identity and age verification procedures applied at account registration and at other stages as required.
• "Cookie" means a small text file placed on your device by the Platform that helps us remember your preferences and analyse platform usage patterns.

Personal Data We Collect

waze2win collects personal data from you in the following ways and categories:

3.1 Data You Provide Directly

• Account registration data: Full legal name, date of birth, residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru, Shah Alam, or Petaling Jaya), email address, phone number, and username.
• Identity verification (KYC) documents: Government-issued photo identification (e.g., Malaysian identity card, passport), proof of address documents (e.g., utility bills or bank statements), and payment method verification documents.
• Financial data: Bank account details, e-wallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay account references), FPX or DuitNow transaction references, and cryptocurrency wallet addresses used for deposits and withdrawals.
• Communication data: The content of support requests, live chat transcripts, email correspondence, and any feedback you submit to us.

3.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device type (mobile or desktop), screen resolution, and referring URL.
• Usage data: Pages visited on the Platform, games played, bets placed, session duration, click-through patterns, and feature interactions.
• Transaction data: Records of all deposits, withdrawals, bets placed, bonuses claimed, and account balance changes.
• Cookie and tracking data: Data collected through cookies and similar technologies as described in Section 8 of this Policy.

3.3 Data from Third Parties

• Identity verification providers: Verification status and risk assessment results from third-party KYC and anti-money laundering screening services.
• Payment processors: Transaction status and reference data from payment service providers including banks and e-wallet operators.
• Fraud prevention services: Device fingerprint data and risk indicators from third-party fraud detection systems.

Legal Basis for Data Processing

waze2win processes your personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between you and waze2win — including account creation, payment processing, withdrawal execution, and provision of gaming services.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and age verification mandates.
• Legitimate interests: Processing conducted for waze2win's legitimate business interests, including fraud prevention, platform security monitoring, responsible gambling enforcement, and internal analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given consent, such as the sending of promotional communications and marketing materials. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

How We Use Your Personal Data

waze2win uses the personal data we collect for the following purposes:

• Creating and administering your account on the Platform
• Verifying your identity and age as required by our licensing obligations (21+ enforcement)
• Processing deposits and withdrawals in MYR and cryptocurrency
• Providing access to casino games, live dealer tables, and sports betting markets
• Providing customer support via live chat, email, and WhatsApp
• Detecting, investigating, and preventing fraud, money laundering, and platform abuse
• Enforcing our Terms and Conditions and Responsible Gambling Policy
• Complying with legal and regulatory reporting obligations
• Administering bonuses, promotions, and the VIP loyalty programme
• Analysing platform usage to improve user experience and game offerings
• Sending account-related notifications, security alerts, and transactional communications
• Sending promotional communications where you have provided explicit consent (subject to opt-out rights)

Data Sharing & Disclosure

waze2win shares personal data with third parties only in the following circumstances and with appropriate safeguards in place:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to assist in operating the Platform. These providers process personal data solely on our instructions and are contractually bound to maintain confidentiality and security standards equivalent to those we apply ourselves. Categories of service providers include:

• Payment processors and e-wallet operators (including those facilitating Maybank2u, CIMB Clicks, DuitNow, FPX, and cryptocurrency transactions)
• KYC and identity verification providers
• AML screening and fraud detection services
• Cloud infrastructure and data hosting providers
• Customer support platform providers
• Email and communications delivery services
• Analytics and platform performance monitoring tools

6.2 Legal and Regulatory Disclosure

We may disclose personal data to regulatory authorities, law enforcement agencies, or other public bodies where we are required to do so by applicable law, court order, or regulatory directive — including anti-money laundering reporting obligations.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets involving waze2win, personal data held by us may be transferred to the acquiring or successor entity, subject to equivalent privacy protections being maintained.

6.4 What We Do Not Do

waze2win does not sell, rent, or trade personal data to third parties for their own commercial or marketing purposes. We do not share your data with sports teams, leagues (including Liga Super Malaysia or EPL), or media organisations without your explicit consent.

Data Retention

waze2win retains personal data for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable law and our regulatory obligations. Specific retention periods include:

• Account and identity data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, to comply with AML and KYC record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction for financial compliance purposes.
• Support communications: Retained for up to three (3) years from the date of the interaction, unless a longer period is required by an ongoing dispute or regulatory investigation.
• Marketing preference data: Retained until you withdraw your consent to receive marketing communications, at which point it is deleted or anonymised promptly.
• Cookie data: Session cookies expire at the end of your browser session. Persistent cookies expire in accordance with the durations set out in our cookie table (see Section 8).

Following the applicable retention period, personal data is securely deleted or irreversibly anonymised such that it can no longer be associated with any individual.

Cookies & Tracking Technologies

waze2win uses cookies and similar technologies on the Platform to support the operation and improvement of our services. The following table describes the categories of cookies we use:

Most web browsers permit you to control cookies through their settings. Disabling strictly necessary cookies may prevent you from accessing certain parts of the Platform. We do not use cookies for cross-site behavioural advertising or to share data with advertising networks.

Data Security

waze2win implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers
• Encryption at rest for sensitive personal data and financial records stored on our systems
• Role-based access controls ensuring that staff can only access data necessary for their specific role
• Multi-factor authentication requirements for all staff accessing systems containing personal data
• Regular independent security audits and penetration testing of Platform infrastructure
• Intrusion detection systems and 24/7 security monitoring
• Formal incident response procedures with defined timelines for breach notification

While we apply substantial measures to protect your data, no method of transmission over the internet or electronic storage is entirely secure. You also have a role to play in maintaining the security of your account — please ensure you use a strong, unique password and keep your login credentials confidential.

Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your personal data held by waze2win. To exercise any of these rights, please contact our Data Privacy team at the details provided in Section 15.

We will respond to all verifiable data subject requests within 30 days of receipt. In complex or high-volume cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. We do not charge a fee for the exercise of these rights unless requests are manifestly unfounded or excessive.

Minors and Age Restriction

waze2win strictly prohibits persons under the age of 21 from registering or using the Platform. We do not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory component of our account registration and KYC process.

If we become aware that personal data has been collected from a person under the age of 21, we will immediately close the associated account, delete the data as required by applicable law, and process any real-money balance in accordance with applicable regulatory guidance.

If you are a parent or guardian and believe that a minor in your care has registered an account on the Platform, please contact our support team immediately. We will investigate and take appropriate action without delay.

International Data Transfers

waze2win operates internationally and may process and store your personal data on servers located outside of Malaysia. Where personal data is transferred to countries that may not offer the same level of data protection as Malaysia's PDPA, we ensure that appropriate safeguards are in place. These may include:

• Standard contractual clauses approved under applicable data protection frameworks
• Binding corporate rules where applicable
• Transfers to jurisdictions that provide an adequate level of data protection as recognised by applicable regulatory standards

By using the Platform and providing personal data to waze2win, you acknowledge and consent to the transfer of your data to servers and processors located in jurisdictions outside Malaysia where this is necessary for the operation of our services.

Third-Party Services and Links

The waze2win Platform does not contain links to external third-party websites. However, where you interact with third-party payment services — such as Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX — to make deposits or withdrawals, those interactions are governed by the privacy policies of the respective payment service providers.

waze2win is not responsible for the privacy practices of any third-party service providers. We recommend that you review the privacy notices of any payment service providers you use to understand how they handle your personal data in connection with transactions processed for your waze2win account.

Amendments to This Policy

waze2win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or regulatory requirements. When material changes are made, we will notify registered Players by email to the address associated with their account and/or by displaying a prominent notice on the Platform.

The date of the most recent update to this Policy is displayed at the top of the page. We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of the Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms.

Contact Us & Data Requests

For any queries, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Privacy team through the following channels. All privacy-related correspondence will be acknowledged within 5 business days and responded to substantively within 30 days.

When submitting a data subject access request, please provide sufficient information to verify your identity (such as your registered email address and account username) so that we can locate your data and respond accurately. We may request additional identification where necessary to protect against fraudulent access requests.