Privacy Policy SultanWin – Personal Data Protection for Malaysian Players

SultanWin ("we", "the platform") is the data controller responsible for personal data collected through our online casino platform at sultanwin.biz. As a platform serving players in Malaysia, we are fully bound by the Personal Data Protection Act 2010 (PDPA) and all its supplementary regulations.

This Privacy Policy transparently outlines: the types of personal data we collect from SultanWin platform users; the purposes and legal basis for each instance of data processing; the parties who may receive your data under certain circumstances; data retention periods; the security measures we take to protect your data; and your rights with respect to the personal data we hold.

We are committed to processing your personal data lawfully, fairly and transparently. Privacy is not merely a legal obligation for us — it is a core value that reflects our respect for every SultanWin player across Malaysia, from Kuala Lumpur, Penang and Johor Bahru to Kota Kinabalu and Kuching.

SultanWin collects various types of personal data when you register and use our platform. We only collect data that is strictly necessary for the stated purposes — a data minimisation principle that forms the foundation of our approach to privacy.

SultanWin uses your personal data only for legitimate purposes that were stated at the time of collection or that players would reasonably expect. The following are the primary purposes for which we process your data:

• Account Management: Creating, verifying and maintaining your SultanWin account, including the login process, OTP verification and password recovery;
• Processing of Financial Transactions: Processing deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX (Maybank2u, CIMB Clicks), as well as withdrawals of winnings to your account;
• Identity Verification (KYC): Complying with Know Your Customer (KYC) requirements to prevent fraud, money laundering and access by underage individuals;
• Provision of Gaming Services: Delivering a personalised gaming experience, storing game history, and managing account balances and winnings across slots, live baccarat, roulette, jackpot games, lottery, and Sports Betting;
• VIP Programme & Promotions: Determining your VIP tier, calculating and crediting cashback, and managing welcome bonuses and other relevant promotional offers;
• Customer Support: Handling enquiries, complaints and support requests via live chat, email or WhatsApp in Bahasa Melayu;
• Platform Security: Detecting and preventing fraudulent activity, multi-account usage, bonus abuse, and any breach of our Terms & Conditions;
• Legal Compliance: Fulfilling reporting obligations to the relevant Malaysian authorities when required by law;
• Platform Improvements: Analysing usage data (in anonymised form) to understand usage patterns and improve the user experience;
• Marketing Communications: Sending information about relevant promotions, bonuses and platform updates — only where you have consented to receive such communications.

SultanWin will not use your personal data for any purpose beyond those stated above without first obtaining your additional consent, unless required to do so by Malaysian law.

Under Malaysia's PDPA, every processing of personal data must have a valid legal basis. SultanWin relies on the following bases for data processing:

• Consent: For direct marketing communications and preference-based data processing – you may withdraw your consent at any time;
• Contract Performance: Processing necessary to provide the SultanWin services you signed up for, including payment processing and account management;
• Legal Obligations: Processing required to comply with Malaysian law, including anti-money laundering (AML) and KYC requirements;
• Legitimate Interests: Processing for the purposes of platform security, fraud prevention, and service improvement — where our legitimate interests do not override your fundamental rights.

SultanWin does not sell your personal data to any third party. However, in the course of operating the platform, we may need to share certain data with trusted parties under strictly controlled circumstances:

• Payment Providers: Approved Malaysian payment service providers such as Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX that process your financial transactions – only the data necessary for transaction processing is shared;
• Game Providers: International gaming software companies that supply slots, live baccarat, roulette, and other games to our platform – data is shared only to the extent technically required;
• Technology Service Providers: Cloud computing, cybersecurity and analytics service providers that help us operate and protect the platform;
• Malaysian Authorities: Government agencies, law enforcement bodies or courts when required by applicable Malaysian law;
• Professional Advisors: Lawyers, accountants, and auditors bound by strict professional confidentiality obligations.

All third parties who receive personal data from SultanWin players are bound by strict data protection agreements and must adhere to privacy standards that are equivalent to or exceed those of SultanWin. We are not responsible for the privacy practices of third parties outside our control, but we conduct thorough due diligence before engaging any service provider.

SultanWin applies multiple layers of technical and organisational security measures to protect players' personal data from unauthorised access, loss, alteration, or accidental disclosure.

The technical security measures we have in place include:

• Encryption of data in transit using the TLS 1.3 protocol with a 256-bit SSL certificate;
• Encryption of data stored in the database using AES-256;
• Two-factor authentication (2FA) available to all members and mandatory for VIP Platinum members and above;
• A 24/7 security monitoring system that automatically detects and responds to threats;
• Network segregation and system partitioning to limit the potential impact of any security incident;
• Regular penetration testing conducted by independent cybersecurity firms;
• Strict role-based access controls for SultanWin staff – only authorised personnel may access player data based on the requirements of their role.

On the organisational side, all SultanWin staff who handle players' personal data undergo rigorous privacy and security training on a regular basis. We also conduct periodic internal and external security reviews to ensure ongoing compliance with the latest security standards.

SultanWin retains your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy or to comply with legal obligations. The principle of data storage minimisation guides our decisions on how long each category of data is kept.

• Active Account Data: Retained for as long as your account remains active with SultanWin;
• Financial Transaction Data: Retained for a minimum of 7 years after the transaction to meet Malaysian financial and tax regulatory requirements;
• Game Data: Retained for 3 years after gameplay for dispute resolution and audit purposes;
• Support Communication Data: Retained for 2 years after the case is resolved;
• Technical & Log Data: Retained for 12 months for security and technical troubleshooting purposes;
• Marketing Data: Retained until you withdraw consent or request deletion;
• Inactive Accounts: After 12 months of inactivity, we will send a notice to your registered email address. If no response is received within 30 days, your data will be archived and subsequently deleted in accordance with this policy.

Once the retention period expires, data is securely deleted or anonymised using methods that ensure it cannot be recovered. We conduct regular data retention reviews to ensure that data no longer required is deleted promptly.

The SultanWin platform uses cookies and similar tracking technologies to enhance the user experience, maintain login sessions, and analyse platform usage patterns. The types of cookies we use are as follows:

• Essential Cookies (Required): Required for core platform operations — login, game sessions and security. These cookies cannot be disabled without affecting platform functionality;
• Preference Cookies: Storing your preferences such as language (Bahasa Melayu), display theme and game settings for a smoother experience on return visits;
• Analytics Cookies: Collecting anonymised information about how players use the platform to help us identify the most popular pages and improve navigation;
• Security Cookies: Used to detect suspicious activity, prevent fraud and protect player accounts from unauthorised access.

SultanWin does not use third-party advertising cookies that track your activity outside our platform. You can manage your cookie settings through your web browser preferences. However, disabling essential cookies may affect your ability to use the SultanWin platform fully.

The SultanWin platform is intended solely for individuals aged 18 and above. We do not knowingly collect or process personal data of anyone under the age of 18.

If we discover or become aware that we have collected personal data of an individual under the age of 18, we will take the following steps immediately:

• Suspending the account in question immediately;
• Deleting all related personal data from our systems;
• Reporting cases to the relevant authorities in accordance with Malaysia's child protection obligations;
• Refunding any identifiable deposits that have been made.

Parents or guardians who are concerned that their child may have registered or used the SultanWin platform are urged to contact us immediately at support@sultanwin.biz. We take all such reports seriously and will respond promptly.

While SultanWin takes all reasonable steps to protect players' personal data, we acknowledge that no security system can guarantee absolute protection under every circumstance. We therefore maintain a clear and robust data breach response procedure.

In the event of a data breach involving the personal data of SultanWin players, we are committed to:

• Identifying and containing the breach as quickly as possible after it is detected;
• Assessing the risk and impact of any breach on affected players;
• Reporting breaches to Malaysia's Personal Data Protection Commissioner within the timeframe prescribed by the PDPA, where the breach is likely to pose a risk to the rights and freedoms of individuals;
• Notifying players whose personal data may have been compromised via their registered email within 72 hours of becoming aware of a breach, including details about the nature of the breach, the data potentially affected, and steps players can take to protect themselves;
• Taking remedial steps to prevent a similar breach from occurring in the future.

SultanWin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, relevant changes in Malaysian law, the addition of new services, or applicable court or regulatory decisions.

When we make material changes to this Privacy Policy — meaning changes that significantly affect how we use your personal data or your rights — we will:

• Updating the "Last Updated" date at the top of this document;
• Sending a notification to your registered email address with a summary of the key changes;
• Displaying a prominent notice on the SultanWin homepage for a minimum period of 30 days;
• For significant changes, we may request your renewed consent.

It is your responsibility to review this Privacy Policy periodically. Continued use of the SultanWin platform after any amendment takes effect will be considered acceptance of the updated terms. If you do not agree with any changes, you have the right to close your account and request deletion of the relevant data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way SultanWin handles your personal data, our team is ready to assist via the following channels:

• Live Chat: Available at the bottom right corner of every SultanWin page — response within 2 minutes during operating hours;
• Email: support@sultanwin.biz – for written requests regarding privacy rights, please include "PDPA Privacy Request" in the subject line;
• WhatsApp (Platinum VIP Members and above): Through your dedicated personal account manager – 24/7.

We are committed to providing an initial response within 5 business days and resolving privacy rights requests within 14 business days from the date we receive a complete request. Should we require additional time to handle a complex request, we will notify you in advance.

If you are dissatisfied with how SultanWin has handled your privacy concern, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) in accordance with the procedures set out under Malaysian law.