Privacy Policy Winbox 2 — Full Data Protection for Malaysian Players

This Privacy Policy ("Policy") describes our data protection practices Winbox 2 ("we", "platform") accessible at winbox2.asia. This Policy applies to all personal information collected from individuals ("members", "users", "you") who register an account, access, or use the Winbox 2 platform in any capacity.

Winbox 2 acts as the data controller for all personal information collected through our platform. This means we are responsible for ensuring that your data is collected, used, stored, and disposed of in accordance with proper data protection practices and applicable law, in particular Malaysia's Personal Data Protection Act 2010 (PDPA).

Any terms not defined in this Policy carry the same meaning as stated in the Winbox 2 Terms and Conditions. In the event of any conflict between this Policy and other provisions, the terms of this Privacy Policy shall prevail in all matters relating to personal data.

Winbox 2 only collects personal data that is strictly necessary to operate the platform and provide services to members. We do not collect excessive or irrelevant data. The following are the categories of data we collect:

Account Registration Data:

• Full name as it appears on official identity documents
• An active Malaysian phone number (for OTP verification)
• Email address (for account communications and opted-in promotions)
• Date of birth (for 18+ age limit verification)
• Your chosen username and password (passwords are stored in encrypted form, never as plain text)

Identity Verification Data (KYC):

• Malaysian Identity Card (MyKad) number or passport number
• Copies of identity documents requested for account verification
• Proof of address where required for specific compliance purposes

Financial & Transaction Data:

• Deposit details via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX
• Withdrawal history and transaction records within the platform
• Bonus history and promotion usage

Platform Usage Data:

• IP address, device type, and web browser used
• Game history and in-platform activity
• Login times and duration of gaming sessions
• Account settings and communication preferences

Personal data collected by Winbox 2 used solely for legitimate and necessary purposes in the operation of the platform. We do not use your data for purposes not stated here without first obtaining your consent. The purposes for which data is used are as follows:

• Account management: Creating, maintaining, and securing your account on Winbox 2.
• Transaction processing: Accurately and securely managing deposits, withdrawals, bonuses, and all financial transactions in your account.
• Identity verification: Verifying that you meet the age and identity eligibility requirements before your account is fully activated.
• Customer support: Enabling our support team to identify your account, understand your gaming history, and resolve any issues efficiently.
• Legal compliance: Meeting reporting and compliance requirements under applicable anti-money laundering (AML) laws and KYC obligations.
• Platform security: Detecting and preventing fraud, abuse, unauthorized access, and any activity that violates the Terms and Conditions.
• Service improvement: Analysing aggregated usage data (with no personally identifiable information) to understand usage patterns and improve the platform.
• Marketing communications: Sending promotional information and special offers to members who have consented to receive such communications. You may unsubscribe at any time.

Winbox 2 does not use your personal data to make automated decisions that carry legal or similarly significant consequences without appropriate human involvement.

Winbox 2 does not sell, rent, or share members' personal data with third parties for marketing purposes. However, there are limited situations where we need to share certain data with selected third parties strictly for legitimate operational purposes:

• Payment service providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX-linked banks receive only the information necessary to process your deposit and withdrawal transactions. Data shared is strictly limited to what is required to complete the transaction.
• Game providers: Pragmatic Play, Evolution Gaming, PG Soft, Spribe, and other providers may receive anonymous session identifiers to enable games to function within our platform. They do not receive your full name, phone number, or any personally identifiable information.
• Law enforcement authorities: winbox 2 will comply with any lawful request from Malaysian authorities in connection with criminal investigations or binding legal requirements.
• Technical service providers: Cloud, cybersecurity, and analytics service providers that help us operate the platform may process data in a limited capacity as data processors on our behalf, subject to strict confidentiality agreements.

If winbox 2 is involved in any merger, acquisition, or sale of assets, members' personal data may be transferred as part of that transaction. In such cases, members will be notified via a prominent in-platform notice or by email before the data is transferred and becomes subject to a different privacy policy.

Winbox 2 implements a range of technical and organizational security measures to protect member personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Data encryption in transit: HTTPS protocol with valid SSL/TLS certificates for all communications between your browser and our servers.
• Data encryption at rest: Sensitive data such as passwords are stored in hashed form and cannot be decrypted.
• Role-based access control: Only authorized personnel are permitted to access member personal data, and their access is strictly limited to what is necessary for their specific role.
• Continuous security monitoring: A 24/7 monitoring system to detect any suspicious activity or unauthorised access attempts.
• Regular vulnerability assessments: Security testing and vulnerability assessments are conducted on a regular basis to identify and patch any potential security weaknesses.
• Staff training: All Winbox 2 staff with access to personal data receive ongoing data protection training.

While we implement comprehensive security measures, no security system can guarantee 100% protection under all circumstances. We therefore encourage members to take personal precautions as well — such as using a strong and unique password, not sharing login credentials, and notifying us promptly if they notice any suspicious activity in their account.

Winbox 2 uses cookies and similar tracking technologies to enhance the user experience and ensure that certain platform features function correctly. Below are the types of cookies we use:

You can manage cookie usage through your web browser settings. However, disabling essential cookies may affect certain platform functions and your gaming experience. Analytics and preference cookies are optional and can be disabled without affecting core platform functionality.

Winbox 2 does not use any cross-site tracking technologies or collect data about your online activity outside of our own platform. We do not use third-party tracking pixels for retargeting purposes that follow your movements across the internet.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and our privacy commitment Winbox 2, you have the following rights regarding the personal data we hold about you. All of these rights can be exercised by contacting our support team:

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this information within 21 business days of receiving your request.
• Right to Rectification: If you find that any personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. We encourage members to keep their profile information up to date through their account settings.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data from our systems. However, this right may be limited where we are required to retain the data for legal compliance purposes.
• Right to Restrict Processing: You may request that we restrict how we process your data in certain circumstances, such as when you are disputing the accuracy of that data.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time, and we will stop such processing immediately.
• Right to Unsubscribe from Communications: You may opt out of receiving marketing and promotional emails from Winbox 2 at any time by clicking the "unsubscribe" link in any email we send.

We are committed to processing all data rights requests within a reasonable timeframe. If we are unable to fulfill your request for any reason (for example, a legal compliance requirement), we will clearly explain why.

Winbox 2 is an adult entertainment platform intended solely for individuals aged 18 and above. Our platform is not directed at children or minors below this age, and we do not knowingly collect or process personal data from individuals under 18.

All new registrants are required to confirm that they are at least 18 years of age during the registration process. Winbox 2 also conducts age verification through identity documents as part of the KYC process. Should we discover that personal data belonging to an individual under the age of 18 has been collected inadvertently, we will take the following steps immediately:

• Immediately suspending the account in question.
• Permanently deleting all associated personal data from our systems.
• Returning any remaining account balance via an appropriate method.
• Reporting cases to the relevant authorities when required.

If you are a parent or guardian and suspect that your underage child has registered an account on winbox 2, please contact our support team immediately at support@winbox2.asia. We will investigate and take appropriate action without delay.

Platform Winbox 2 integrates third-party services to enable certain features. These third-party services operate under their own privacy policies, which are separate from Winbox 2's. Below is information on the categories of third parties involved and how data is shared:

• Payment providers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX): When you make a deposit or withdrawal, you interact directly with their payment platform. Their privacy and security practices are governed by their respective privacy policies, which you can review on their websites.
• Game providers (Pragmatic Play, Evolution Gaming, PG Soft, Spribe, and others): Games are loaded from the provider's servers. Providers may receive limited technical data such as session identifiers, without any personally identifiable information, solely to enable the games to function.
• Customer support services: The live chat platform may use third-party solutions that comply with international data protection standards.

The Winbox 2 platform may contain information or references to third-party services, but this does not imply that Winbox 2 endorses or is responsible for the content or privacy practices of those third parties.

Winbox 2 reserves the right to amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or platform developments. Members will be notified of any material amendments via:

• A prominent in-platform notification upon your next login.
• An email to the address registered with your account.
• An update to this page with a new "Updated" date.

Continued use of the platform after an amendment notice is considered acceptance of the revised policy. The last updated date of this Privacy Policy: January 2026.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us through the following channels:

• Email: support@winbox2.asia (please state "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24 hours a day, 7 days a week through the winbox 2 platform
• Frequently Asked Questions: Visit the page FAQ us for answers to general privacy-related questions