yes2win Privacy Policy

1Introduction

This Privacy Policy ("Policy") is published by yes2win ("we", "us", "our", "Platform") and describes how we collect, process, store, share, and protect the personal data of individuals ("User", "Player", "You") who access or use the yes2win website at yes2win.cam and all associated services, including account registration, game play, sports betting, payment processing, and customer support.

This Policy forms part of the overall agreement between you and yes2win, alongside our Terms & Conditions and Responsible Gambling Policy. By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

yes2win is committed to protecting your privacy in accordance with applicable data protection laws and internationally recognised best practices for personal data handling. We serve players across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and beyond, and we take our obligations to those players seriously.

2Definitions

For the purpose of this Policy, the following definitions apply:

3Data We Collect

yes2win collects and processes the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Account Registration Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (for age verification purposes — players must be 21 or above);
• Residential address in Malaysia;
• Email address and mobile phone number;
• Chosen username and encrypted password.

3.2 Identity Verification (KYC) Data

• Copy of a valid government-issued photo identification document (MyKad, Passport, or Driver's Licence);
• Proof of address document (utility bill or bank statement dated within 3 months);
• Facial image / selfie submitted for biometric identity matching purposes.

3.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts (in MYR), timestamps, and payment method references;
• E-wallet identifiers associated with Touch 'n Go eWallet, Boost, and GrabPay transactions;
• Bank account name and account number suffix used for DuitNow, FPX, or direct bank transfer transactions;
• Transaction reference numbers provided by payment service providers.

3.4 Platform Usage & Behavioural Data

• Login timestamps, session durations, and IP address records;
• Game play history, betting records, wager amounts, and game outcomes;
• Bonus claims, wagering progress, and promotional interactions;
• Customer support interaction logs, including live chat transcripts and email correspondence.

3.5 Technical & Device Data

• Device type, operating system, browser type, and version;
• IP address and approximate geographic location derived therefrom;
• Cookie identifiers, session tokens, and similar tracking technologies as described in Section 8.

4How We Collect Your Data

yes2win collects personal data through the following means:

• Directly from you: When you register an account, submit KYC documents, make a deposit or withdrawal request, contact our support team, or respond to a promotional offer.
• Automatically through the Platform: Via cookies, server logs, and tracking technologies that record your interaction with the Platform, as described in Section 8.
• From payment service providers: Transaction confirmation data provided by verified Malaysian payment partners (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and participating FPX banks including Maybank, CIMB, Public Bank, Hong Leong, and RHB).
• From identity verification services: Where we engage third-party KYC or anti-fraud service providers to assist in verifying the authenticity of documents submitted during account verification.
• From publicly available sources: Where permitted by applicable law, we may cross-reference publicly available information to detect fraud or verify identity in specific circumstances.

5Legal Basis for Processing

yes2win processes your personal data only where a valid legal basis exists. The primary bases on which we rely are as follows:

Where we rely on your consent as a legal basis, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent can be exercised through your account notification settings or by contacting our support team.

6How We Use Your Data

yes2win uses your personal data for the following specific purposes:

• Account Management: To create, administer, and maintain your yes2win account, including managing your balance, transaction history, and account preferences;
• Transaction Processing: To process deposits and withdrawals via your chosen Malaysian payment method, and to maintain accurate financial records;
• Identity Verification: To verify your identity and age as part of our KYC process, and to confirm that you meet the minimum age requirement of 21 years;
• Regulatory Compliance: To fulfil our anti-money laundering (AML) obligations, maintain statutory records, and respond to lawful requests from competent authorities;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, abuse of promotions, and other prohibited activities;
• Responsible Gambling: To monitor gameplay patterns that may indicate problem gambling behaviour, and to facilitate the operation of player protection tools including deposit limits and self-exclusion;
• Customer Support: To respond to your enquiries, resolve disputes, and maintain a record of our communications with you;
• Platform Improvement: To analyse usage data in aggregate form to improve Platform performance, game selection, and user experience;
• Marketing Communications: To send you relevant promotional offers, bonus notifications, and platform updates — but only where you have not opted out of such communications.

7Data Sharing & Disclosure

yes2win does not sell your personal data to any third party. We share your data only in the following limited circumstances:

• Payment Service Providers: We share transaction-level data with our verified Malaysian payment partners (including providers facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and direct bank transfers via Maybank, CIMB, Public Bank, Hong Leong, and RHB) solely for the purpose of processing your transactions.
• Identity Verification Providers: We may share KYC document data with accredited third-party identity verification services to facilitate the document review process. These providers are contractually bound to process data only for the specified purpose.
• Game & Technology Providers: Certain game studios and Platform technology providers may have access to anonymised or pseudonymised gameplay data for licensing and technical integration purposes. They are not permitted to use this data for any independent purpose.
• Regulatory & Law Enforcement Authorities: We will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or regulatory direction.
• Anti-Fraud Networks: In cases of suspected fraud or prohibited activity, we may share relevant account data with industry anti-fraud consortia to protect the integrity of the wider online gaming ecosystem.
• Group Companies: Where yes2win operates as part of a corporate group, data may be shared with group entities for internal administrative, compliance, or risk management purposes, subject to the same data protection standards described in this Policy.

In all cases where data is shared with third parties, yes2win requires that appropriate data processing agreements are in place and that third parties maintain data protection standards equivalent to those described in this Policy.

8Cookies & Tracking Technologies

yes2win uses cookies and similar tracking technologies to operate the Platform effectively, enhance user experience, and support security and analytics functions. The cookies we use fall into the following categories:

You may manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary or functional cookies may impair your ability to use certain features of the Platform. For analytics and marketing cookies, your consent can be withdrawn through the cookie preferences panel accessible via the Platform footer.

9Data Retention

yes2win retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention schedules are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised, such that it can no longer be attributed to an identifiable individual. You may request early deletion of your data (where no legal retention obligation applies) as described in Section 11.

10Data Security

yes2win implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and our servers uses TLS 1.2 or higher. Personal data and financial records are encrypted at rest using AES-256 standard encryption.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data undergo mandatory data protection and security training.
• Two-Factor Authentication: Account access is protected by two-factor authentication options available to all registered players.
• Intrusion Detection: Our infrastructure is monitored around the clock by automated intrusion detection systems and a dedicated security operations function.
• Penetration Testing: The Platform undergoes regular penetration testing and vulnerability assessments conducted by qualified independent security professionals.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and in accordance with applicable notification obligations.

11Your Rights

As a player and data subject, you hold the following rights in respect of your personal data processed by yes2win. You may exercise any of these rights by contacting our support team as described in Section 15.

To exercise any of the above rights, please contact our support team via live chat or the email address in Section 15. We may require you to verify your identity before processing any data subject request, to ensure we do not fulfil requests from unauthorised third parties.

12Minors & Age Verification

The yes2win Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from any individual below this age. The collection and processing of personal data from underage individuals is contrary to our Terms & Conditions and our fundamental responsible gambling commitments.

Where we have reasonable grounds to believe that an account is held by a person below the minimum age, we will immediately suspend the account pending age verification, retain any deposited funds in escrow, and initiate our KYC review process. Where underage use is confirmed, the account will be permanently closed and deposited funds returned to the verified payment source.

If you are a parent or guardian and believe that your child has created an account with yes2win, please contact us immediately via the channels listed in Section 15. We will treat all such reports as high priority and act on them without delay.

13International Data Transfers

yes2win primarily processes and stores personal data within secure facilities in the Asia-Pacific region. In certain circumstances — such as the use of cloud infrastructure providers or third-party game studios located outside Malaysia — your personal data may be transferred to and processed in jurisdictions other than Malaysia.

When we transfer personal data internationally, we take steps to ensure that an adequate level of protection is maintained, including:

• Transferring data only to countries or territories that offer a comparable level of data protection to Malaysia;
• Putting in place data processing agreements with standard contractual protections, where applicable; and
• Ensuring that any international data processor is assessed for compliance with our data protection standards prior to engagement.

By using the yes2win Platform, you acknowledge and consent to your personal data being transferred as described in this section.

14Policy Amendments

yes2win reserves the right to update, modify, or replace this Privacy Policy at any time. We will notify registered players of material changes via email to their registered address and/or through a prominent notice displayed on the Platform for a period of at least 7 days prior to the updated Policy taking effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically to remain informed of how we are protecting your data. Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement and acceptance of the updated terms.

Where any change to this Policy requires a new legal basis for processing, or where a change materially affects your rights, we will seek your explicit consent before processing your data under the new terms.

15Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by yes2win, please contact our Data Protection team through the following channels:

• Live Chat: Available daily from 8 AM to 12 AM Malaysian Time (MYT) via the chat widget on the Platform. For data protection matters, please request to speak with the Data Protection team.
• Email: [email protected] — Please include your registered username and clearly describe the nature of your request (e.g., "Subject Access Request", "Data Deletion Request"). We aim to respond to all data protection enquiries within 5 business days and to fulfil verified requests within 30 calendar days.

When submitting a data subject rights request, we will require you to verify your identity — typically by confirming details already held on your account — to protect against unauthorised requests from third parties.