Privacy Policy winmyapk — Our Commitment to Protecting Your Personal Data

Winmyapk takes user data protection seriously. This Policy covers all services provided through the website, mobile app, and any other channels under the winmyapk brand.

We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and all relevant supplementary regulations. As a platform serving users in Malaysia, we ensure that all our data handling practices are aligned with local legal requirements.

This Policy applies to all registered users, website visitors, and any individual who interacts with winmyapk through any channel — including customer support, official social media, and marketing communications.

Winmyapk collects information necessary to provide a secure service, comply with regulatory requirements, and deliver a personalized experience. The following are the categories of information we collect:

We do not collect information beyond what is required for the service. Sensitive information such as identity documents is collected solely for KYC purposes and stored in systems protected by strict access controls.

Winmyapk uses collected data for lawful and limited purposes. We do not use your data for purposes not stated in this Policy without prior notice.

The primary purposes of use are as follows:

• Account Operations: Verify identity, process registration, manage secure login, and ensure only the rightful account owner can gain access.
• Transaction Processing: Process deposits and withdrawals accurately and securely through certified payment providers.
• KYC & AML Compliance: Fulfil legal requirements relating to identity verification and anti-money laundering.
• Service Improvement: Analyse usage patterns (in aggregate and without personal identification) to improve the interface and user experience.
• Service Communications: Send important notifications relating to accounts, transactions, and security updates.
• Marketing (with consent): Send promotional information and offers only to users who have consented to receive them.

Winmyapk does not sell users' personal information to any third party. However, there are limited situations where we need to share information to ensure the platform operates safely and legally:

• Payment Providers: Information required to process transactions is shared with certified payment providers bound by strict confidentiality agreements.
• Game Providers: Game transaction data required to ensure game integrity is shared with licensed game providers.
• KYC Service Providers: For identity verification purposes, KYC documents are processed through a certified verification provider.
• Legal Authorities: Information will be disclosed to the relevant authorities when required by a valid court order or applicable law.

All third parties we work with are bound by comprehensive data protection agreements and must comply with security standards equal to or exceeding those of winmyapk.

Winmyapk continuously invests in security infrastructure to ensure user data is protected at the highest practicable level. Key technical measures we implement:

• 256-bit SSL/TLS Encryption: All communications between your device and winmyapk servers are fully encrypted using the latest SSL/TLS protocols.
• Data-at-Rest Encryption: Sensitive data is stored in encrypted format in our databases — even in the highly unlikely scenario where unauthorised access is obtained, the data remains unreadable.
• Two-Factor Authentication (2FA): Users are encouraged (and for high-value transactions, required) to enable 2FA for an additional layer of security.
• Strict Access Controls: Internal staff access to user data is restricted on a need-to-know basis, and all access is logged for audit purposes.
• 24/7 Monitoring: The Security Operations Centre (SOC) continuously monitors the winmyapk platform to detect and respond to security threats.

Winmyapk uses cookies and similar tracking technologies to ensure the platform functions correctly and to deliver a better experience for users. Cookies are small text files stored on your device when you visit our platform.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collect non-personally identifiable usage data to help us understand how users interact with the platform and identify areas for improvement.
• Preference Cookies: Save user preferences such as language and display settings so you do not need to reconfigure them each time you log in.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality and security of the platform.

Winmyapk retains personal data only for as long as it is needed for the stated purposes or as required by law. Our retention policy is as follows:

• Active Account: Data is retained for as long as your account is active and you are using winmyapk services.
• After Account Closure: Transaction records and KYC documents are retained for a minimum of 7 years after account closure in accordance with Malaysia's AML/KYC legal requirements.
• Security Log Data: Access logs and security logs are retained for 2 years for digital forensics and fraud detection purposes.
• Support Communications: Customer support conversation records are retained for 1 year for quality assurance and dispute resolution purposes.

When data is no longer needed, it is securely deleted using methods that ensure it cannot be recovered.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and winmyapk's internal policies, you have the following rights regarding your personal data:

Winmyapk is a platform strictly restricted to users aged 21 and above. We do not knowingly collect personal data from individuals below this age limit.

Our system performs age verification at the registration stage and during the KYC process. If we suspect that information has been provided by or relates to an underage individual, we will:

• Immediately suspend the account in question pending completion of the investigation.
• Delete all collected data relating to that individual once identity has been verified.
• Refund any deposits made, subject to the required verification process.

If you believe a child has registered or attempted to register on winmyapk, please report this to our support team immediately.

Winmyapk reserves the right to amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. Any material amendments will be communicated to users via:

• An in-platform notification upon your next login after the amendment takes effect.
• Email notification to your registered address for changes deemed significant.
• Update the "Updated" date at the top of this document.

Continued use of the winmyapk platform after notice of an amendment is considered your acceptance of the updated Privacy Policy. If you do not agree with the amendment, please discontinue use of the platform and contact us to close your account.

For any inquiries, requests, or complaints regarding privacy and the handling of your personal data by winmyapk, you may reach us through the following channels:

• Live Chat 24/7: The fastest option — in-platform support is available at all times.
• Telegram: Through the official winmyapk support channel on Telegram.
• Email: Send a written request to [email protected] with the subject line "Privacy Request" for prompt attention from our data protection team.

The winmyapk privacy team is committed to addressing every enquiry seriously and providing clear, helpful responses within the stipulated timeframe. We believe users who understand how their data is managed are more confident and satisfied users.