Winlah Privacy Policy
This Privacy Policy explains what personal information Winlah collects from players — including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya and across Malaysia — how we use it, who we share it with, and the rights you hold over your own data.
Privacy at a Glance
Six Principles That Guide How We Handle Your Data
These cards summarise Winlah's data practices. The full legal clauses follow further down this page.
Minimal Collection
Winlah collects only the personal data needed to operate your account, process payments via DuitNow, FPX or Malaysian banks, and meet legal obligations. We do not hoover up information we have no use for.
Secure Storage
All personal data is encrypted at rest and in transit using industry-standard protocols. Access is restricted to authorised Winlah personnel with a documented operational need.
No Unauthorised Sale
Winlah does not sell, rent or trade your personal information to unrelated third parties for their own marketing or commercial purposes. Period.
Your Data Rights
You may request access to your data, ask for corrections, request deletion in eligible circumstances, or lodge an objection to specific processing. Contact our support team to exercise these rights.
Controlled Sharing
Data is shared only with service providers directly supporting Winlah operations — payment processors, identity verification services, fraud detection providers and hosting infrastructure — under binding data agreements.
Responsible Gambling Data
Self-exclusion requests, deposit limits and responsible gaming preferences are treated with heightened sensitivity and are never used for marketing targeting or shared with unrelated parties.
Introduction
Winlah ("we", "our", "us" or "the platform") operates the online gaming and sports betting website available at winlah.cam. We are committed to handling the personal information of our players — including those based in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru and other locations across Malaysia — with transparency, care and in accordance with internationally recognised data protection standards.
This Privacy Policy describes what personal data Winlah collects, the purposes for which it is used, the circumstances under which it may be shared, how long we keep it, and the rights available to you as an individual. It applies to all interactions with Winlah, including account registration, deposits, gameplay, withdrawals, customer support and use of our website.
By accessing Winlah or creating an account, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, you should not use the platform. This policy should be read alongside the Winlah Terms & Conditions and Responsible Gambling information.
This policy is written in English. In the event of any translation or interpretation dispute, the English-language version shall prevail.
Definitions
"Personal data" means any information relating to an identified or identifiable individual — including your name, contact details, payment information and online identifiers. "Processing" refers to any operation performed on personal data, including collection, storage, use, disclosure and deletion.
"Controller" means the entity that determines the purposes and means of processing personal data — in this case, Winlah. "Processor" means a third party that processes personal data on behalf of Winlah under a binding agreement. "Data subject" means the individual whose personal data is being processed — in most cases, you, the registered player.
"KYC" refers to know-your-customer identity verification. "Malaysian payment method" includes Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong Bank. "Cookies" are small data files placed on your device by a website to store preferences and support analytics.
Data We Collect
We collect personal data directly from you, automatically through your use of the platform, and from third-party verification providers. The categories of data we collect include:
| Category | Examples | When Collected |
|---|---|---|
| Identity data | Full legal name, date of birth, MyKad or passport number, selfie photograph | Registration and KYC verification |
| Contact data | Email address, Malaysian mobile number, residential address | Registration and account updates |
| Financial data | E-wallet IDs (Touch 'n Go, Boost, GrabPay), DuitNow details, bank account numbers, FPX references, transaction history | Deposits and withdrawal requests |
| Gaming data | Bet history, game sessions, live casino play, sports wagers, EPL / Liga Super Malaysia selections, win/loss records | Ongoing platform use |
| Technical data | IP address, browser type, device model, operating system, session timestamps | Automatically on every visit |
| Support data | Live chat transcripts, email correspondence, complaint records | When you contact support |
| Responsible gambling data | Deposit limits, loss limits, self-exclusion status, cooling-off preferences | When you apply tool settings |
We do not intentionally collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs or health information, except where directly relevant to a responsible gambling assessment and with your awareness.
Lawful Basis for Processing
Winlah processes personal data on the following grounds, depending on the specific activity:
- Contractual necessity: processing required to create and maintain your account, process deposits, settle wagers and facilitate withdrawals.
- Legal obligation: identity verification, fraud prevention, anti-money laundering checks and record-keeping obligations imposed by applicable regulations.
- Legitimate interests: security monitoring, fraud detection, platform improvement, responsible gambling interventions and internal analytics — provided these interests are not overridden by your rights.
- Consent: for optional marketing communications, personalised promotional offers or placement of non-essential cookies, where we have sought and received your explicit agreement.
Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
How We Use Your Data
We use personal data collected from Malaysian players and other users for the following purposes:
- Account management: creating, authenticating and administering your Winlah account, including password resets and security alerts.
- Payment processing: facilitating deposits and withdrawals through Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost and major bank transfers.
- Identity and age verification: confirming you are aged 21 or above and that your identity matches registration details, as required by our platform rules and licensing obligations.
- Gaming services: delivering casino games, sports betting markets (including football, EPL and Liga Super Malaysia), live dealer tables and related features.
- Fraud prevention and security: detecting suspicious login activity, unusual transaction patterns, account sharing and prohibited conduct.
- Responsible gambling: monitoring gaming activity for signs of potential harm, enforcing self-exclusion settings and communicating responsible gaming information.
- Customer support: handling queries submitted via live chat or email, investigating disputes and responding to complaints.
- Platform improvement: aggregated analysis of usage patterns to improve navigation, game performance, payment flows and promotional relevance.
- Legal and regulatory compliance: retaining records as required by applicable law, responding to lawful authority requests and enforcing the Terms & Conditions.
Data Sharing and Disclosure
Winlah does not sell or transfer your personal data to unrelated third parties for their independent commercial purposes. We may share data with the following categories of recipients, strictly to the extent necessary for the stated purpose:
- Payment service providers: entities facilitating your chosen payment method, including e-wallet operators, FPX infrastructure, DuitNow-connected banks and card-processing networks.
- Identity verification providers: third-party KYC and document-checking services that assist in confirming player identity and age.
- Fraud and compliance services: specialist providers supporting transaction monitoring, anti-money laundering screening and regulatory compliance obligations.
- Technology and hosting providers: cloud infrastructure, content delivery and database services that process data on Winlah's behalf under binding data processing agreements.
- Game studios and platform providers: where a specific casino game or live-dealer product requires transmission of minimal session data to the applicable supplier in order to function correctly.
- Regulatory and legal authorities: where disclosure is required by applicable law, court order, or a competent authority's lawful request.
- Professional advisers: lawyers, auditors and insurers acting in their professional capacity under confidentiality obligations.
All third-party processors are required to implement appropriate technical and organisational measures to protect your personal data.
Note: Winlah is not affiliated with Bank Negara Malaysia or any Malaysian government regulator. We do not share player data with Malaysian government entities unless required to do so by a valid legal obligation.
Cookies and Tracking Technologies
Winlah uses cookies and similar technologies to support the operation of the platform, remember your session preferences and help us understand how the site is used. The main categories of cookies we use are:
- Essential cookies: required for the site to function — including authentication tokens, session management and security features. These cannot be disabled without breaking core functionality.
- Performance and analytics cookies: help us understand page load times, error rates and navigation patterns in aggregate, without identifying individual users.
- Functional cookies: remember your preferences such as language setting, currency display and game view mode across sessions.
- Marketing cookies: used only where you have given consent, to help us understand the effectiveness of promotional campaigns. These do not enable third-party advertising on unrelated sites.
You may manage cookie preferences through your browser settings. Disabling non-essential cookies may limit certain platform features. We do not use persistent identifiers to track you across unrelated websites.
Data Retention Periods
We retain personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. In practice:
- Active account data is retained throughout the period your account is open and in good standing.
- Transaction and financial records may be retained for a minimum of five years after the transaction date to meet anti-money laundering and record-keeping requirements.
- KYC documents — including identity scans and verification outcomes — are typically retained for five years from account closure or the date of the relevant transaction, depending on applicable obligations.
- Support correspondence is retained for a period sufficient to resolve any related complaint, dispute or regulatory matter.
- Self-exclusion records are maintained for the full duration of the exclusion and a reasonable period thereafter, to prevent inadvertent re-registration.
When data is no longer required and no legal obligation mandates its retention, we apply secure deletion or anonymisation procedures.
Security Measures
Winlah employs technical and organisational security measures proportionate to the risk associated with the personal data we hold. These include:
- TLS/SSL encryption for all data transmitted between your device and the Winlah platform;
- encryption of sensitive data fields at rest within our databases;
- role-based access controls that restrict data access to authorised personnel with a documented operational need;
- automated monitoring for anomalous access patterns and potential security incidents;
- regular internal reviews of data security policies and technical safeguards;
- two-factor authentication options available to players to reduce unauthorised account access.
While Winlah takes these security steps seriously, no online platform can offer absolute protection against all possible threats. You also play an important role by keeping your password confidential, logging out from shared devices and notifying support promptly if you suspect any compromise of your account.
Your Data Rights
Subject to applicable law and our legitimate operational and legal constraints, you have the following rights regarding your personal data:
Right of Access
Request confirmation of whether we hold your personal data and obtain a copy of it.
Right to Rectification
Request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data where no overriding legal obligation requires its retention.
Right to Object
Object to processing carried out under our legitimate interests, including certain forms of direct marketing.
Right to Portability
Request a structured, machine-readable copy of data you provided to us, where technically feasible.
Right to Restriction
Request a temporary limitation on our processing of your data in certain circumstances.
To exercise any of these rights, contact our support team through in-platform live chat or by sending a plain-text email to [email protected]. We will acknowledge your request promptly and respond within a reasonable period. We may need to verify your identity before actioning a request.
Exercising your data rights will not result in any penalty to your account, provided the request is made in good faith and does not conflict with legal retention obligations.
Minors and Age Verification
Winlah is strictly for individuals aged 21 and above. We do not knowingly collect personal data from anyone below this age. Our registration process incorporates age checks, and KYC verification may require submission of a MyKad, passport or other age-confirming identity document before a withdrawal is processed.
If we become aware that personal data has been collected from a person below the minimum age, we will take steps to delete that data and close the associated account as promptly as reasonably possible. If you have reason to believe that an underage person has accessed Winlah using your details or independently, please contact our support team immediately.
21+ only. Winlah treats the protection of minors from online gambling as a non-negotiable obligation. Age enforcement is applied at registration and throughout the account lifecycle.
International Data Transfers
Winlah operates as an international gaming platform. This means that personal data may be processed in countries outside Malaysia, including locations where the data protection framework may differ from Malaysian law. Where such transfers occur, we take steps to ensure that appropriate safeguards are in place — for example, contractual clauses requiring the recipient to protect your data to a standard equivalent to the protections described in this policy.
By using Winlah, you acknowledge that your personal data may be transferred to, stored in or processed in a jurisdiction outside Malaysia. We will not make such transfers without measures reasonably designed to protect your data, consistent with the principles set out in this policy.
Changes to This Privacy Policy
Winlah may update this Privacy Policy to reflect changes in our data practices, applicable law, payment integrations or platform features. Where a material change is made, we will update the effective date displayed at the top of this page. We may also notify you through an in-platform message or email where the change significantly affects your rights or the way we handle your data.
Continued use of Winlah after a revised policy is published constitutes your acknowledgement of the updated terms. If you disagree with any update, you may request account closure by contacting our support team.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise a data right, or want to raise a concern about how Winlah has handled your personal information, please reach out through one of the following channels:
- 24/7 In-Platform Live Chat: available directly within the Winlah platform. Live chat responses are typically provided within three minutes.
- Email: send a plain-text message to [email protected]. Please include your registered username and a clear description of your query or request. Do not include your password in any written communication.
We aim to respond to all data-related requests within a reasonable period and will keep you informed of progress where a request requires additional time to process. Winlah's data contact email address is for privacy and support queries only and does not accept deposits, withdrawal requests or gameplay instructions.
For all data rights requests and privacy queries, please quote your Winlah account username in your correspondence. This helps our team locate the relevant records and respond accurately.
Your Privacy Is Protected at Winlah
We take data protection seriously so you can focus on enjoying Malaysia's most player-focused online gaming platform. Explore the homepage or read our responsible gambling guidelines. For players aged 21 and above only.