Privacy Policy 28win – Our Commitment to Protecting Your Personal Data

01 Information We Collect

28win collects several categories of personal information from our members across a variety of situations. We only collect what is genuinely necessary to deliver our services safely and efficiently. The types of information we collect are as follows:

1.1 Information You Provide Directly

When you register a 28win account, you provide the basic information required to set it up. This includes your full name, email address, an active Malaysian phone number, date of birth, and a password of your choosing. During the KYC (Know Your Customer) identity verification process, we will also require a copy of a valid identity document such as your MyKad or passport.

1.2 Financial & Transaction Information

To process deposits and withdrawals, 28win is required to retain records of your financial transaction information. This includes the payment methods used — whether Touch 'n Go eWallet, DuitNow, FPX via Maybank2u or CIMB Clicks, GrabPay, Boost, or ShopeePay — as well as your deposit and withdrawal transaction history. Please note that 28win does not store your PIN, digital wallet passwords, or internet banking login credentials.

1.3 Platform Activity Information

The 28win platform automatically records certain information when you use our services. This includes game history, betting records, session duration, games accessed, and interactions with platform features such as the customer support live chat. This information is used to ensure game integrity and to improve the overall user experience.

1.4 Technical & Device Information

The 28win system automatically collects certain technical information from the device you use to access the platform, including your IP address, web browser type, device operating system, unique device identifiers, and network information. This information is used for security purposes, fraud detection, and platform performance optimisation.

02 How We Use Your Personal Data

28win uses the personal information we collect for legitimate purposes to which you have given implied consent by using our services. We do not use your data for any purpose beyond the scope described below without first obtaining your explicit consent.

• Account Management: To create, maintain, and manage your 28win account — including the registration process, identity verification, password recovery, and profile information updates.
• Transaction Processing: To process deposits via your preferred Malaysian payment method and to handle withdrawal of winnings to your Malaysian digital wallet or bank account within the stipulated timeframe.
• Service Delivery: To provide access to all 28win games – including progressive jackpots, live baccarat, poker, roulette, e-sports, lottery, and more – as well as related platform features.
• Security & Fraud Prevention: To identify and prevent fraudulent activity, money laundering, multiple account abuse, and any attempts to manipulate the 28win system.
• Legal Compliance: To meet our regulatory obligations, KYC/AML (Anti-Money Laundering) reporting requirements, and directives from authorities with jurisdiction over our operations.
• Customer Support: To enable our 24/7 support team to help you resolve issues, answer enquiries, and handle complaints efficiently.
• Service Communications: To send you important notifications about your account, policy updates, transaction confirmations, and security information. These are not marketing communications – they are essential messages you need to receive in order to use the service safely.
• Platform Improvement: To analyse usage patterns in aggregate (not at an individual level), helping us understand how members use the platform and make better design decisions that improve the experience for all users.

03 Data Sharing with Third Parties

28win does not sell, rent, or trade members' personal information to any third party for their own commercial purposes. This is a foundational principle we will never compromise on. That said, in the course of our day-to-day platform operations, there are a limited number of situations where we need to share data with certain parties in order for 28win's services to function:

3.1 Payment Service Providers

To process deposit and withdrawal transactions, 28win needs to share relevant transaction information with approved payment service providers, including Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and Malaysian banks that support FPX. This data sharing is limited strictly to what is necessary to complete the transaction, and all such providers are bound by stringent data protection agreements.

3.2 Game & Software Providers

The 28win platform uses gaming software from approved third-party providers such as Pragmatic Play, Spadegaming, Habanero, Microgaming, and others. In some cases, limited information may be shared with these providers to enable a seamless gaming experience, manage progressive jackpots, and ensure game integrity. All such providers are bound by strict data confidentiality agreements.

3.3 Regulatory Authorities & Law Enforcement

28win may be required by law to disclose certain information to regulatory authorities, law enforcement agencies, or courts with valid jurisdiction. This includes mandatory KYC/AML reporting requirements and responses to lawful court orders. 28win will disclose only the minimum information necessary and strictly within the limits permitted by applicable law.

04 28win Data Security Measures

28win takes cybersecurity infrastructure seriously to protect members' personal data. We employ a combination of technical, organisational, and procedural controls to ensure your data remains secure at all times — in transit, during processing, and at rest.

• 256-bit SSL Encryption: All communications between your browser or app and 28win's servers are encrypted using Transport Layer Security (TLS) with a valid, up-to-date 256-bit SSL certificate. This prevents any third party from intercepting or reading your data in transit.
• Sensitive Data Encryption: Member passwords are never stored in plain text — they are stored as one-way cryptographic hashes that cannot be decrypted. Sensitive financial information is also encrypted at rest on our servers using robust data encryption standards.
• Two-Factor Authentication (2FA): 28win offers a 2FA option for all member accounts. Once enabled, logging in will require a one-time verification code sent to your Malaysian mobile number in addition to your regular password – making unauthorised access significantly more difficult even if your password is compromised.
• 24/7 Security Monitoring: 28win's automated monitoring system runs continuously to detect suspicious activity such as repeated failed login attempts, unusual profile changes, and anomalous transaction patterns. Any suspected activity will trigger additional verification or a notification to the member concerned.
• Internal Access Controls: Access to member data by 28win staff is governed by a "need-to-know" principle — only staff with a legitimate operational need may access specific information, and all access is recorded in an auditable log.
• Regular Security Audits: 28win conducts regular security audits and penetration testing through independent third parties to identify and address any security vulnerabilities before they can be exploited.

05 Use of Cookies on the 28win Platform

The 28win website and app use cookies – small text files stored on your device when you visit our platform. Cookies help us deliver a better experience and enable certain essential platform features to work properly. Below are the types of cookies used by 28win:

Cookies categorised as "Essential" are required for the 28win platform to function properly and cannot be disabled without affecting core functions such as login and session security. "Functional" and "Analytics" cookies can be managed through your web browser settings. Please note, however, that disabling certain cookies may affect your experience on the platform.

06 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and sound data protection principles, you as a 28win member have certain rights regarding the personal data we hold about you. 28win is committed to respecting and facilitating the exercise of these rights.

07 Data Retention Period

28win does not retain your personal data for longer than is necessary for the purposes stated in this Privacy Policy. Data retention periods are determined based on the processing purpose, as well as the legal and regulatory requirements applicable to our platform's operations.

Once your personal data is no longer needed for any of the purposes stated above and there is no legal requirement mandating its continued retention, 28win will securely delete or anonymise that data so it can no longer be associated with you. The deletion process follows industry-standard data sanitisation procedures to ensure the data cannot be recovered.

08 Protection of Children's Data

28win is an online casino entertainment platform intended exclusively for adults aged 18 and above. We do not knowingly collect, process, or store any personal data from individuals under the age of 18.

If we confirm that data we hold belongs to a minor, we will immediately take the following steps without delay:

• Immediate termination of the account in question.
• Permanently delete all related personal data from our systems.
• Forfeiting any remaining account balance in accordance with our compliance policy.
• Reporting the incident to the relevant authorities where deemed necessary.

Parents or guardians who have reason to believe that a child in their care has accessed or registered a 28win account are encouraged to contact us immediately at privacy@28win-jit.com. We will investigate and take appropriate action promptly.

09 Changes to This Privacy Policy

28win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, updated legal requirements, new platform features, or enhanced security technologies. Whenever this Privacy Policy is updated, the "Last Updated" date at the top of this document will be revised to reflect the date of the most recent changes.

For significant changes that may materially affect how we use your personal data, 28win will provide more prominent notice — including email notifications to all active members or a pop-up notice upon your first login after the changes take effect. This ensures you always have sufficient information to make informed decisions about using the 28win platform.

Continued use of the 28win platform after any changes to this Privacy Policy take effect will be considered acceptance of the updated privacy terms. If you do not agree with the changes, you have the right to close your account and request deletion of your personal data in accordance with the procedure set out in Section 6 above. 28win encourages you to revisit this Privacy Policy page periodically to stay informed about how we protect your information.

10 Contact the 28win Privacy Officer

28win has appointed a Data Protection Officer (Privacy Officer) responsible for ensuring our platform complies with all applicable data protection requirements and for handling privacy-related enquiries and complaints from our members.

If you have any questions or concerns, or wish to exercise any of your personal data rights as described in this Privacy Policy, you may contact the 28win Privacy Officer through the following channels:

When contacting the 28win Privacy Officer, please clearly state the following: your account number or full name, the type of enquiry or right you wish to exercise, and any details relevant to your request. This will help us process your request more quickly and accurately. All data rights requests are handled in strict confidence by trained and authorised staff only.

If you are not satisfied with our response to your privacy request or complaint, you have the right to refer the matter to the Personal Data Protection Commissioner of Malaysia or the relevant regulatory body in accordance with the procedures set out under PDPA 2010.