1. Introduction
Welcome to winxbox. This Privacy Policy ("Policy") explains how winxbox ("we", "our", "us", or "the Platform") collects, processes, uses, discloses, and safeguards your personal data when you access or use any of our services, including our website at winxbox.lat, our online sportsbook, live casino, slots, 4D lottery, and mix parlay betting services.
By registering an account, visiting our platform, or making use of any winxbox service, you acknowledge that you have read, understood, and agree to the terms described in this Policy. If you do not agree, please refrain from using our platform.
Important: winxbox services are strictly intended for users aged 21 years and above. We take age verification seriously as part of our responsible gaming obligations and applicable regulatory requirements.
2. Who We Are
winxbox is a premier online gambling and sports betting platform serving Malaysian players and an international audience. We operate under an internationally recognised gaming licence and are committed to maintaining the highest standards of player protection, fair play, and responsible gaming.
For the purposes of data protection law, winxbox acts as the data controller in respect of the personal information you provide to us. Our designated contact for data protection matters is reachable at the email address listed in the Contact section below.
3. Data We Collect
When you interact with winxbox, we may collect the following categories of personal data:
3.1 Identity & Registration Data
- Full legal name, date of birth, gender
- National identification number (MyKad / passport) for KYC verification
- Username and encrypted password
- Residential address (including city, state, postcode — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya)
- Email address and mobile phone number
3.2 Financial Data
- Bank account details (Maybank, CIMB, Public Bank, Hong Leong Bank, RHB) used for deposits and withdrawals
- E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay)
- Cryptocurrency wallet addresses (where applicable for USDT TRC20, Bitcoin, Ethereum, BNB transactions)
- Transaction history, deposit and withdrawal records
3.3 Technical & Usage Data
- IP address, device type, operating system, and browser version
- Login timestamps, session duration, and activity logs
- Pages visited, games played, betting history, and wagering patterns
- Referral source and marketing campaign attribution data
3.4 Communications Data
- Records of correspondence with our customer support team (live chat, email)
- Feedback, complaints, and dispute records
- Marketing preferences and opt-in or opt-out records
3.5 Verification Documents
- Copies of government-issued identity documents submitted for KYC and AML compliance
- Proof of address documents (e.g., utility bills, bank statements)
- Source-of-funds documentation where required by our compliance team
4. How We Use Your Data
winxbox uses the personal data we collect for the following clearly defined purposes:
- Account Management: To create, maintain, and secure your winxbox account, including identity verification and password recovery.
- Service Delivery: To process bets, deposits, and withdrawals; to provide access to our sportsbook, live casino, slots, 4D lottery, and mix parlay offerings.
- Regulatory Compliance: To meet our obligations under applicable anti-money laundering (AML), know-your-customer (KYC), and counter-terrorism financing (CTF) regulations.
- Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, and other prohibited activities on the platform.
- Responsible Gaming: To monitor betting behaviour and apply responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion where appropriate.
- Customer Support: To respond to your queries, resolve disputes, and provide multilingual assistance in English, Bahasa Melayu, and 中文.
- Marketing Communications: To send you promotional offers, bonuses, and platform updates — only where you have provided explicit consent and have not subsequently opted out.
- Platform Improvement: To analyse usage patterns, fix technical issues, and develop new features that improve your experience on winxbox.
Legal Basis: Depending on the nature of processing, our legal bases include performance of a contract with you, compliance with a legal obligation, our legitimate business interests, and your explicit consent where required.
5. Data Sharing & Disclosure
winxbox does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. However, we may share your information in the following limited circumstances:
5.1 Service Providers
We engage trusted third-party vendors to assist in delivering our services — including payment processors, KYC verification providers, cloud infrastructure partners, and fraud detection specialists. These parties are contractually bound to process your data only on our instructions and in accordance with applicable data protection standards.
5.2 Regulatory & Law Enforcement Authorities
We may disclose your personal data to regulatory bodies, law enforcement agencies, or courts where we are legally required to do so — for example, in response to a valid court order, regulatory investigation, or AML/CTF reporting obligation. We will only disclose the minimum information necessary to satisfy such requirements.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified prior to such a transfer taking effect and your rights under this Policy will continue to be honoured.
5.4 Group Companies
winxbox may share data with affiliated entities within our corporate group for internal administrative purposes, including consolidated reporting, shared IT infrastructure, and centralised compliance functions.
6. Data Retention
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. In practice, this means:
- Active account data is retained for the duration of your account plus a minimum of 5 years thereafter, in line with standard AML record-keeping requirements.
- Transaction and betting records are retained for a minimum of 7 years following each transaction, consistent with financial regulatory obligations.
- Identity verification documents are retained for the period required by our licensing authority and applicable law, typically 5–7 years following account closure.
- Marketing data is retained until you withdraw your consent or request erasure, whichever is earlier.
- Customer support communications are retained for 3 years from the date of resolution, unless a longer period is required for ongoing legal matters.
Once the applicable retention period expires, your data is securely deleted or irreversibly anonymised so that it can no longer be linked back to you.
7. Security Measures
winxbox implements a robust, multi-layered security framework to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our measures include:
- Transport Layer Security (TLS 1.3) for all data in transit between your browser and our servers
- AES-256 encryption for sensitive data stored at rest
- Multi-factor authentication (MFA) available on all player accounts
- Regular independent security audits and penetration testing by certified third-party specialists
- Access controls ensuring that only authorised personnel can access personal data on a strict need-to-know basis
- Intrusion detection systems, DDoS protection, and real-time anomaly monitoring
- Staff training on data protection and information security best practices
While we take every reasonable precaution, no digital platform can guarantee absolute security. We encourage you to use a strong, unique password for your winxbox account and to enable MFA for an additional layer of protection.
8. Cookies & Tracking Technologies
winxbox uses cookies and similar tracking technologies to improve your experience on our platform. A cookie is a small text file placed on your device when you visit our website. We use the following categories of cookies:
- Strictly Necessary Cookies: Required for core platform functionality such as session management, login state, and security. These cannot be disabled.
- Performance & Analytics Cookies: Help us understand how users interact with winxbox — for example, which games or betting markets are most popular — so we can optimise the platform accordingly.
- Functionality Cookies: Remember your preferences such as language selection, odds format, and interface settings.
- Marketing Cookies: Used to deliver relevant promotional content. These are only set with your consent and you may withdraw that consent at any time through your account settings.
You can manage your cookie preferences through your browser settings. Disabling certain cookies may limit some features of the winxbox platform.
9. Your Data Rights
As a winxbox member, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at the email address provided in Section 13.
- Right of Access: You may request a copy of all personal data we hold about you, free of charge, within 30 days of a verified request.
- Right to Rectification: You may ask us to correct any inaccurate or incomplete personal data held in your account.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data, subject to our legal retention obligations.
- Right to Restrict Processing: You may ask us to pause the processing of your data in certain circumstances, for example while a dispute is being resolved.
- Right to Data Portability: You may request your data in a structured, machine-readable format for transfer to another service provider.
- Right to Object: You may object to processing based on our legitimate interests, including direct marketing. We will honour all valid objections promptly.
- Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Response Timeframe: We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. Complex requests may take up to 60 days, in which case we will notify you of the extension.
10. Minors & Age Verification
winxbox services are strictly prohibited for individuals under the age of 21 years. We do not knowingly collect personal data from minors. Upon registration, all users are required to confirm their age and submit valid identification documents as part of our mandatory KYC process.
If we discover that personal data belonging to a person under 21 has been collected — whether through misrepresentation or any other means — we will immediately suspend the relevant account, void any associated transactions, and permanently delete the data in question. Any funds held in such an account will be dealt with in accordance with our Terms & Conditions and applicable regulatory requirements.
Parents or guardians who believe their child may have registered on winxbox are encouraged to contact us immediately at the address listed in Section 13.
11. International Data Transfers
winxbox operates on a global infrastructure. Your personal data may be processed and stored on servers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place — including standard contractual clauses approved by recognised data protection authorities — to protect your data to a standard equivalent to that required under applicable Malaysian law and international best practice.
By using winxbox, you consent to the transfer of your data to our infrastructure partners globally, subject to the safeguards described in this Policy.
12. Changes to This Policy
winxbox reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our business practices, applicable law, or regulatory requirements. When material changes are made, we will:
- Update the "Last Updated" date at the top of this page
- Display a prominent notice on the winxbox platform for a period of at least 14 days
- Send a notification to your registered email address where the changes are significant
Your continued use of winxbox following the effective date of any updated Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed.