Privacy Policy RM Win — Personal Data Protection for Malaysian Members

Rm win ("we", "Platform", or "rm win") is committed to protecting the privacy and personal data of every user who accesses or uses our services. This Privacy Policy explains in detail how rm win collects, processes, stores, and protects your personal information.

This document is drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA), the primary legislation governing the processing of personal data in commercial transactions in Malaysia. We take every provision of this law seriously and ensure that all our data handling practices meet the requirements set out therein.

By registering and using the RM Win platform, you acknowledge that you have read and understood this Privacy Policy, and agree to how we collect and use your personal data as described herein. If you do not agree, please discontinue use of the RM Win platform.

Rm win collects several categories of information to enable us to provide services safely and effectively. Below is a summary of the data we collect based on its source:

RM Win not collect sensitive information such as medical data, religious beliefs, or political views. We only collect data that is strictly necessary for platform operations.

Rm win uses collected data for the following purposes, and we ensure each use has a valid legal basis:

• Account Management: Creating and managing your account, including identity verification (KYC) and account recovery.
• Transaction Processing: Processing deposits and withdrawals securely using your chosen payment method.
• Service Provision: Enabling access to all games and features within the rm win Platform.
• Platform Security: Detecting and preventing fraud, money laundering, and unauthorised use of the platform.
• Service Communications: Sending important notifications related to accounts, transactions, and policy updates.
• Marketing (with consent): Sending promotional information, exclusive offers, and the latest rm win news — only to members who have given their consent.
• Responsible Gaming: Monitoring gameplay patterns to identify and support members who may need responsible gaming assistance.
• Legal Compliance: Complying with legal obligations, including reporting requirements to relevant authorities.

Rm win does not sell your personal data to any third party. However, there are limited situations where we need to share certain information:

• Payment Service Providers: Required transaction information is shared with payment providers (DuitNow, FPX, Touch 'n Go, GrabPay, Boost) solely for the purpose of processing your transactions.
• Game Providers: Basic game data is shared with third-party game providers to enable access to the RM Win Game Lobby.
• KYC Services: Identity verification documents are shared with licensed KYC service providers for verification purposes only.
• Authority: rm win will disclose data when required by law, court order, or directive from a competent authority.
• Fraud Prevention: Certain information may be shared with industry fraud prevention agencies to protect all platform users.

All third parties that receive your data are required to comply with data protection standards equivalent to or exceeding rm win's standards. Such sharing is governed by legally binding confidentiality agreements.

Rm win invests significantly in security infrastructure to ensure your personal data remains protected at all times. The security measures we implement include:

• 256-bit SSL Encryption: All communications between you and the rm win Platform are encrypted using the latest TLS protocols.
• Stored Data Encryption: Sensitive data stored in our databases is encrypted using strong encryption algorithms.
• Layered Access Control: Only specific rm win staff with legitimate work requirements may access member personal data.
• Regular Security Audits: rm win undergoes regular security assessments and penetration testing conducted by independent cybersecurity firms.
• 24/7 Monitoring: Automated monitoring systems operate around the clock to detect any suspicious activity.
• Two-Factor Authentication: Two-step verification is available and encouraged for all member accounts as an additional layer of protection.

Rm win retains your personal data only for as long as necessary to fulfil the purpose of collection or to comply with applicable legal obligations:

• Active Account Data: Retained for as long as your account is active and in use.
• Financial Transaction Data: Retained for a minimum of 7 years after a transaction occurs, in line with Malaysia's financial legal requirements.
• KYC Documents: Retained for a minimum of 5 years after account closure, in accordance with anti-money laundering compliance requirements.
• Communication Data: Customer support records are retained for 3 years for quality management and dispute resolution purposes.
• Technical Data (Logs): System logs and technical data are retained for 90 days before being automatically deleted.
• Marketing Data: Retained until you withdraw consent to receive marketing communications.

Once the retention period expires and there is no legal requirement to retain the data, rm win will securely delete or anonymise your data.

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding personal data held by rm win:

To exercise any of the above rights, contact the rm win support team via live chat or email with proof of identity. We will process your request within 30 days of receipt.

Rm win uses cookies and similar tracking technologies to enhance user experience, ensure account security, and analyse platform performance. The following are the types of cookies we use:

You can control and manage cookies through your web browser settings. However, disabling certain cookies may affect the functionality of the RM Win platform.

In conducting global operations, RM Win may need to transfer your personal data outside Malaysia, particularly for international game provider services and cloud server infrastructure.

When your personal data is transferred outside Malaysia, RM Win ensures that:

• The recipient provides a level of data protection equivalent to or exceeding Malaysia's PDPA standards.
• Appropriate data transfer agreements are implemented before any transfer takes place.
• Transfers are only carried out for the purposes stated in this Privacy Policy.
• You will be informed of any significant transfers involving your data.

The rm win platform is a service exclusively for individuals who are of age 18 years and above. RM Win does not knowingly collect or process personal data from individuals under the age of 18.

If rm win determines that a child's personal data has been collected unintentionally, we will take immediate steps to delete that information and close the associated account.

Parents or guardians who discover that their child has registered on the rm win Platform are urged to contact our support team immediately so that appropriate action can be taken.

Rm win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, legal requirements, or new Platform features.

When significant changes are made, RM Win will:

• Updating the "Last Updated" date at the top of this document.
• Sending notifications to all members via their registered email.
• Displaying a clear notice on the Platform for at least 30 days before changes take effect.

Continued use of the rm win Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. You are advised to review this page periodically.

If you have any questions, concerns, or wish to exercise your privacy rights, the rm win team is ready to assist:

• Live Chat: Available 24/7 directly through the rm win Platform — the fastest way to get a response.
• Privacy Email: [email protected] — for specific enquiries related to privacy and data protection.
• Support Email: [email protected] — for general enquiries related to accounts and services.
• FAQ: Visit FAQ page for immediate answers to common questions.

For privacy rights requests (access, correction, deletion), please include the following in your email: registered full name, account email, type of request, and a copy of your ID for identity verification.