Privacy Policy — yes2win

1. About This Policy

1.1 This Privacy Policy ("Policy") describes how yes2win ("yes2win", "we", "us", "our") collects, uses, discloses, stores, and protects personal information relating to individuals ("Player", "User", "you") who visit or use the yes2win platform at yes2win.lat and any associated services.

1.2 By registering for a yes2win account or by continuing to use the yes2win Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and agree to the collection and use of your personal information as described herein.

1.3 This Policy forms part of the yes2win Terms & Conditions. Capitalised terms used but not defined in this Policy have the meaning given to them in the Terms & Conditions.

1.4 If you do not agree with this Policy, you should not create or continue to use a yes2win account.

2. Data Controller

2.1 For the purposes of applicable data protection legislation, yes2win is the data controller in respect of the personal data of players and visitors processed in connection with the yes2win Platform.

2.2 yes2win is responsible for establishing the purposes and means of processing personal data collected through the Platform, and for ensuring that such processing is conducted lawfully, fairly, and transparently in accordance with applicable privacy laws.

2.3 All data protection and privacy enquiries should be directed to yes2win's support team, contact details for which are set out in Section 15 of this Policy.

3. Personal Data We Collect

3.1 Registration and Account Data

When you create a yes2win account, we collect the following information:

• Full legal name as it appears on your government-issued identity document.
• Date of birth (to verify that you meet the 21+ age requirement).
• Email address (used as your primary account identifier and communication channel).
• Mobile phone number (used for account security verification and, where opted in, promotional notifications).
• Residential address.
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with applicable age verification and anti-money laundering obligations, yes2win will request and retain:

• A copy of a government-issued photo identity document (Malaysian MyKad, passport, or equivalent).
• Proof of address documentation (utility bill, bank statement, or equivalent issued within the last 3 months).
• Proof of payment method ownership where required (screenshot of e-wallet account, bank statement header).
• Selfie or video verification where required by yes2win's KYC process.

3.3 Financial Data

• Deposit and withdrawal transaction records including amount, date, time, payment method type, and transaction reference numbers.
• Account balance history.
• Bonus and promotional credit records.

yes2win does not store complete payment card numbers, full bank account details, or e-wallet PINs. Payment processing is handled by certified third-party payment processors who operate under their own data security frameworks.

3.4 Gaming and Betting Data

• Game and bet history, including game titles, bet amounts, outcomes, and session timestamps.
• Bonus wagering progress records.
• Self-imposed limits and responsible gaming preferences set by you.

3.5 Technical and Usage Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser version.
• Session start and end times and duration.
• Pages visited, features accessed, and in-Platform navigation patterns.
• Error logs and crash reports.

3.6 Communications Data

• Customer support chat transcripts and email correspondence.
• Records of complaints and their resolution.
• Responses to surveys or feedback requests where you choose to participate.

4. How We Collect Your Data

yes2win collects your personal data through the following means:

• Directly from you — when you register, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions.
• Automatically — through cookies, web beacons, log files, and similar technologies as you interact with the yes2win Platform. See Section 12 for full cookie details.
• From third-party service providers — payment processors may provide transaction confirmation data; identity verification service providers may return verification results; fraud detection services may provide risk signals associated with your device or payment method.
• From publicly available sources — yes2win may use publicly available information to supplement KYC data where necessary to meet regulatory compliance obligations.

5. How We Use Your Personal Data

yes2win processes your personal data for the following purposes:

• Account management: Creating, maintaining, and administering your yes2win account, including authentication and session management.
• Age and identity verification: Confirming that you meet the minimum age requirement of 21 years and that your identity matches the details provided during registration.
• Payment processing: Processing deposits, withdrawals, and any applicable refunds through our third-party payment processing partners.
• Legal and regulatory compliance: Fulfilling yes2win's obligations under applicable anti-money laundering regulations, licensing conditions, and applicable data protection law, including reporting obligations where required.
• Fraud prevention and security: Detecting and preventing fraudulent activity, money laundering, account takeover attempts, and other prohibited activities as described in the yes2win Terms & Conditions.
• Platform improvement: Analysing aggregated usage data to improve the yes2win Platform's features, performance, and user experience. This analysis uses anonymised or pseudonymised data where possible.
• Customer support: Responding to support requests, complaints, and account queries.
• Responsible gaming: Monitoring betting patterns where necessary to support responsible gambling obligations, including identifying players who may be exhibiting signs of problem gambling and contacting them in accordance with yes2win's responsible gaming policy.
• Marketing communications: Sending promotional emails, SMS, and in-Platform notifications about bonuses, new games, and Platform updates where you have opted in to receive such communications or where permitted under applicable law. You may opt out at any time.

6. Legal Basis for Processing

yes2win processes your personal data on the following legal bases:

• Performance of a contract: Processing necessary to fulfil yes2win's obligations under the Terms & Conditions, including account management, payment processing, and game service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including age verification, anti-money laundering checks, and regulatory reporting.
• Legitimate interests: Processing for the purposes of fraud prevention, platform security, and Platform improvement, where yes2win's legitimate interests are not overridden by your fundamental rights and freedoms.
• Consent: Marketing communications where consent is the applicable legal basis. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7. Data Sharing and Disclosure

7.1 yes2win does not sell, rent, or trade your personal data to third parties for their own marketing purposes.

7.2 yes2win may share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment processing partners: Touch n Go eWallet, Boost, and banking and card payment processors — to execute deposit and withdrawal transactions.
• Identity verification service providers: Third-party KYC and document verification platforms used to authenticate your identity and age.
• Fraud and risk management providers: Third-party services that help yes2win identify and mitigate fraudulent activity and security threats.
• Game providers: Game software providers may receive session-level data (player ID, bet/win amounts) necessary to operate the games accessed through yes2win. Game providers do not receive your full personal profile.
• Customer support platforms: Cloud-based support software used to manage and respond to player support tickets and live chat sessions.
• Regulatory and law enforcement authorities: yes2win may disclose personal data to licensing authorities, financial intelligence units, or law enforcement agencies where required by applicable law or court order.

7.3 All third-party service providers engaged by yes2win are contractually required to process personal data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection requirements.

8. International Data Transfers

8.1 yes2win's Platform and some of our third-party service providers operate infrastructure located outside Malaysia. As a result, your personal data may be transferred to, stored in, and processed in countries other than Malaysia.

8.2 Where personal data is transferred internationally, yes2win takes steps to ensure that appropriate safeguards are in place to protect your data, including contractual data protection obligations with the receiving party and, where applicable, data transfer mechanisms recognised under applicable law.

8.3 By using the yes2win Platform, you acknowledge and consent to the transfer of your personal data to yes2win's service providers in other jurisdictions for the purposes described in this Policy.

9. Data Security

9.1 yes2win implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and yes2win servers.
• Encryption of sensitive data fields (including passwords) at rest using industry-standard cryptographic hashing.
• Access controls restricting internal access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing of Platform infrastructure.
• Segregation of player funds from operational funds.
• Incident response procedures for detecting, investigating, and notifying affected parties of data security incidents.

9.2 Whilst yes2win takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the security of your yes2win login credentials. yes2win recommends enabling two-factor authentication on your account for additional protection.

9.3 In the event of a data security incident that may affect your rights and freedoms, yes2win will notify affected players without undue delay in accordance with applicable notification obligations.

10. Data Retention

10.1 yes2win retains personal data for as long as necessary to fulfil the purposes set out in this Policy and to comply with applicable legal, regulatory, and contractual obligations.

10.2 The following general retention periods apply:

• Account data and KYC records: Retained for the duration of your account plus a minimum of 5 years following account closure, in accordance with applicable anti-money laundering and gaming regulatory requirements.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Game and betting history: Retained for a minimum of 3 years from the date of the game session.
• Customer support records: Retained for 3 years from the date of the last communication.
• Technical and usage logs: Typically retained for 12 months unless required for longer retention for security or legal purposes.
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable period to evidence compliance.

10.3 On expiry of the applicable retention period, personal data is securely deleted or anonymised.

11. Your Data Rights

11.1 Subject to applicable law, you have the following rights in respect of the personal data yes2win holds about you:

• Right of access: Request a copy of the personal data yes2win holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where yes2win no longer has a lawful basis for processing it. Note that yes2win is required by law to retain certain data for specified periods — erasure requests that conflict with these obligations cannot be fulfilled in full.
• Right to restrict processing: Request that yes2win restricts processing of your data in certain circumstances, such as where you contest its accuracy or object to processing on legitimate interests grounds.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, request a copy of your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including profiling for direct marketing purposes. Yes2win will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

11.2 To exercise any of the above rights, contact yes2win support through the 24/7 live chat on yes2win.lat or via the email address in Section 15. yes2win will respond to all valid data rights requests within 30 days. Complex requests may require an extension, in which case yes2win will notify you of the extended timeframe.

11.3 yes2win may need to verify your identity before processing a data rights request to protect against unauthorised access to another person's data.

12. Cookies and Tracking Technologies

12.1 yes2win uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The following categories of cookies are used:

• Essential cookies: Required for the Platform to function, including session authentication, security tokens, and load balancing. These cookies cannot be disabled without disrupting Platform functionality.
• Performance cookies: Collect anonymised data about how players use the Platform to help us identify performance issues and improve user experience. No personally identifiable information is collected through performance cookies.
• Functional cookies: Remember your preferences such as language, currency display, and game lobby layout to provide a more personalised experience.
• Marketing cookies: Where you have consented, used to deliver relevant promotional content and track the effectiveness of yes2win's marketing campaigns. These cookies may be set by yes2win or by third-party marketing partners operating under data processing agreements with yes2win.

12.2 You can manage cookie preferences through your browser settings. Blocking essential cookies will impair the functionality of the yes2win Platform. Blocking non-essential cookies will not prevent you from using the Platform but may affect personalisation and some features.

13. Children's and Minors' Data

13.1 yes2win services are strictly for individuals aged 21 years and above. yes2win does not knowingly collect personal data from individuals under the age of 21.

13.2 If yes2win becomes aware that personal data has been collected from a person under the age of 21, the relevant account will be closed immediately, all associated data will be deleted (subject to any mandatory legal retention obligations), and any funds on the account will be returned to the source payment method after identity verification.

13.3 If you believe that a person under the age of 21 has created a yes2win account, please contact us immediately at the details in Section 15.

14. Changes to This Policy

14.1 yes2win reserves the right to update this Privacy Policy at any time. Material changes — those that significantly affect how your data is collected, used, or shared — will be notified to you by email to your registered address and/or by a prominent notice on the Platform, at least 14 days before the changes take effect.

14.2 Non-material changes (such as corrections to wording or administrative updates) may be made without advance notice. The date at the top of this Policy will always reflect when it was last updated.

14.3 Continued use of the yes2win Platform following notification of changes to this Policy constitutes acceptance of the revised Policy. If you do not agree with the revised Policy, you should close your account before the effective date of the changes.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to how yes2win processes your personal data, please contact our support team through:

• Live chat: Available 24/7 through any page on yes2win.lat.
• Email: [email protected]

yes2win will acknowledge all privacy-related enquiries within 2 business days and will endeavour to resolve them within 30 days. For formal data rights requests, the process described in Section 11 applies.