Privacy Policy

1. Introduction

This Privacy Policy ("Policy") issued by Maxwin ("we", "us", "our", "the Company", "the Platform") and governs the collection, use, storage, and disclosure of personal data obtained from users ("Player", "User", "you") of the online casino and sports betting platform accessible atmaxwin.casa and all associated subdomains or mobile-optimised versions thereof.

Maxwin is committed to handling your personal data responsibly, transparently, and in accordance with applicable international data protection principles. We operate under an international gaming licence (Curaçao jurisdiction) which imposes data handling obligations as part of its licensing conditions.

By registering an Account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. This Policy should be read in conjunction with our Terms and Conditions and our Responsible Gambling Policy, both of which are incorporated by reference.

Malaysian players should note that this Policy reflects international data protection best practices. While Malaysia's Personal Data Protection Act 2010 (PDPA) primarily applies to data processors operating within Malaysia, we voluntarily align our practices with those principles as a standard of good conduct.

2. Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, Maxwin.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of the Data Controller under a contractual arrangement.
• "KYC Data" means identity and age-verification documentation submitted by a Player in connection with the Know Your Customer verification process.
• "Cookies" means small text files placed on a Player's device by the Platform to track session information, preferences, and usage behaviour.
• "Third Party" means any entity other than the Player and Maxwin, including payment processors, analytics providers, and regulatory bodies.

3. Data We Collect

3.1 Registration Data

When you create an Account on Maxwin, we collect the following information which you provide directly:

• Full legal name as it appears on government-issued identification.
• Date of birth (to verify the21+ age requirement).
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or Shah Alam) and postcode.
• Email address and Malaysian mobile phone number.
• Username and encrypted password credential.
• Preferred currency (Malaysian Ringgit / MYR is the default).

3.2 KYC and Identity Verification Data

Prior to processing your first withdrawal, we are required to collect and verify identity documentation, which may include:

• Copy of your Malaysian National Identity Card (MyKad) or passport.
• Proof of residential address (utility bill, bank statement, or equivalent) issued within the last three months.
• Selfie photograph for biometric identity matching, where required by our compliance team.
• Source of funds documentation in cases flaged by our anti-money laundering procedures.

3.3 Financial Transaction Data

We collect transactional data associated with all deposits and withdrawals, including:

• Payment method type (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Visa, Mastercard, BTC, USDT).
• Transaction amount in MYR or equivalent cryptocurrency value.
• Transaction reference numbers and timestamps.
• Masked payment account identifiers (e.g., partial bank account numbers, e-wallet IDs).

3.4 Gameplay and Behavioural Data

We automatically collect gameplay activity data including: games played, bet amounts, win/loss records, session duration, active time stamps, and bonus participation history. This data is used for account management, responsible gambling monitoring, and improving the Platform experience.

3.5 Technical and Device Data

When you access the Platform, our systems automatically log technical information including: IP address, device type and model, operating system, browser version, referring URL, and session cookie identifiers. This data is used for security, fraud prevention, and Platform performance optimisation.

3.6 Communications Data

If you contact our support team via Live Chat, WhatsApp, or email, we retain records of those communications for quality assurance, training, and dispute resolution purposes.

4. Data Processing & Purpose

Maxwin processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and administering your Player Account, including password recovery and account security.
• Age and Identity Verification: Confirming that all Players meet the 21+ age requirement and that Account details correspond to verified identity documentation.
• Payment Processing: Facilitating deposits and withdrawals via your chosen payment method, including liaison with third-party payment processors such as FPX gateway operators, e-wallet providers, and cryptocurrency networks.
• Anti-Money Laundering (AML) Compliance: Monitoring transactions for suspicious patterns, conducting source-of-funds checks where required, and fulfilling our reporting obligations under our licensing conditions.
• Responsible Gambling Monitoring: Analysing gameplay patterns to identify potential problem gambling behaviour, applying deposit limits and self-exclusion flags, and contacting Players where welfare concerns are identified.
• Customer Support: Responding to enquiries, resolving complaints, and maintaining communication records for quality assurance.
• Marketing Communications: Sending promotional materials, seasonal campaigns (including Deepavali specials, Chinese New Year offers, and Liga Super Malaysia betting promotions), and personalised bonus offers — subject to your consent and applicable opt-out preferences.
• Platform Security: Detecting and preventing fraud, unauthorised access, multiple-account abuse, and bot activity.
• Analytics and Improvement: Understanding how Players use the Platform in aggregate to improve features, game selection, and user experience.
• Legal and Regulatory Compliance: Fulfilling our obligations under our international gaming licence and any applicable legal requirements, including responding to lawful requests from regulatory or law enforcement authorities.

5. Legal Basis for Processing

Maxwin processes your Personal Data on the following legal grounds, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform the contract between Maxwin and the Player — including Account registration, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with our licensing conditions, AML obligations, and any lawful orders from regulatory or governmental authorities.
• Legitimate Interests: Processing necessary for fraud prevention, Platform security, and responsible gambling monitoring, where our legitimate interests do not override your fundamental rights.
• Consent: Processing for direct marketing communications and certain analytics activities, where we rely on your explicit consent. You may withdraw consent at any time by contacting our support team.

6. Data Sharing & Disclosure

6.1 We Do Not Sell Your Data

Maxwin does not sell, rent, or otherwise commercially transfer your Personal Data to any third party for their own marketing or commercial purposes. This is an unconditional commitment and applies regardless of the circumstances.

6.2 Authorised Third-Party Processors

We engage carefully selected third-party service providers who process your data strictly on our behalf and under binding data processing agreements. These include:

• Payment processors: Including FPX gateway operators, e-wallet service providers (Touch 'n Go, Boost, GrabPay), banking partners (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency network facilitators — solely for the purpose of processing your transactions.
• KYC and identity verification providers: Third-party verification platforms used to authenticate identity documents and conduct biometric checks.
• Customer support platforms: Live Chat and communication tools used to deliver our24/7 multilingual support in English, Bahasa Melayu, and Chinese.
• Analytics providers: Aggregated, anonymised usage analytics platforms used to understand Platform performance — configured to minimise personal data exposure.
• Cybersecurity and fraud prevention services: Providers that monitor for suspicious activity, DoS attacks, and account compromise attempts.

6.3 Regulatory and Legal Disclosure

We may be required to disclose your Personal Data to our licensing authority, law enforcement agencies, or other governmental bodies where we are under a legal obligation to do so. We will notify affected Players of any such disclosure to the extent permitted by law.

7. Cookies & Tracking Technologies

7.1 What Are Cookies

Cookies are small data files placed on your device when you visit the Platform. They allow the Platform to recognise your browser, maintain your session, and remember certain preferences between visits.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential to the operation of the Platform. These enable core functionality such as session authentication, Account access, and security checks. They cannot be disabled without rendering the Platform unusable.
• Functional Cookies: Remember your preferences such as language selection, display settings, and preferred payment method to provide a more personalised experience on return visits.
• Analytics Cookies:
• Security Cookies: Used to detect fraudulent activity, bot behaviour, and unauthorised login attempts. These are an important layer of our account protection infrastructure.

7.3 Cookie Management

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality and performance of the Platform. Most modern browsers provide cookie management tools within their privacy or settings menus.

8. Data Retention

Maxwin retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations and applicable legal frameworks. The following indicative retention periods apply:

• Active Account Data: Retained for the duration of the Account's active status plus a period of five years following Account closure, to satisfy anti-money laundering record-keeping requirements.
• Transaction Records: Retained for a minimum of five years from the date of each transaction, in compliance with our licensing and AML obligations.
• KYC Documentation: Retained for a minimum of five years following Account closure or the conclusion of any investigation that relies on that documentation.
• Communications Records (Live Chat, Email): Retained for a period of two years for quality assurance and dispute resolution purposes.
• Analytics Data: Aggregated and anonymised analytics data may be retained indefinitely as it contains no personally identifiable information.

Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised in accordance with our internal data disposal procedures.

9. Data Security

Maxwin employs a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• 256-bit TLS/SSL Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard Transport Layer Security protocols.
• Encrypted Data Storage: Sensitive data, including KYC documents and financial records, is encrypted at rest using AES-256 encryption in our secure server infrastructure.
• Access Controls: Internal access to Player Personal Data is restricted on a strict need-to-know basis, with role-based permissions, multi-factor authentication for staff, and comprehensive access audit logging.
• Penetration Testing: Our systems undergo regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response protocol. In the event of a confirmed breach involving your Personal Data, affected Players will be notified without undue delay in accordance with applicable obligations.

While we implement all reasonable technical and organisational security measures, no transmission of data over the internet or system of electronic storage is entirely without risk. Players are encouraged to maintain strong, unique passwords and to enable any two-factor authentication options offered within their Account settings.

10. Your Rights

Subject to applicable law and our licensing obligations, you hold the following rights with respect to your Personal Data held by Maxwin. To exercise any of these rights, please contact our support team as described in Section 14.