Privacy Policy

This Privacy Policy ("Policy") describes how krwin ("krwin", "we", "us", "our") collects, processes, stores, and protects the personal data of players and visitors who access or use the krwin online gaming platform at krwin.cam and any associated services (collectively, the "Platform").

krwin is committed to handling your personal data with integrity and in compliance with applicable data protection principles. We serve players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and beyond — and we take our responsibility to protect your information seriously.

By registering for or using the Platform, you acknowledge that you have read this Policy and consent to the collection and use of your personal data as described herein. If you do not agree to this Policy, please do not use the Platform.

This Policy is supplemented by our Terms & Conditions and our Responsible Gambling Policy, all of which together govern your relationship with krwin.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, device identifiers, and behavioural data where these can be linked to an individual.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means krwin, being the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of krwin under our instruction and in accordance with a data processing agreement.
• "KYC" means Know Your Customer — the process by which krwin verifies the identity of players using official documentation such as a Malaysian MyKad or passport.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.
• "Cookies" means small text files stored on your device by your browser when you visit the Platform, used to recognise return visits, maintain sessions, and collect usage analytics.

krwin collects personal data that is necessary for the purposes described in this Policy. The categories of data we collect include:

krwin collects personal data through the following channels and mechanisms:

Direct Collection — Data You Provide

• Registration forms completed when you create your krwin account.
• KYC verification submissions including identity documents and selfies.
• Payment information entered during deposit and withdrawal transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency.
• Communications you initiate with our support team via live chat or email.
• Responses to surveys, promotions, or feedback forms where you voluntarily participate.

Automated Collection — Data Generated by Your Use

• Technical data collected automatically when you access the Platform, including IP address, browser identifiers, and device characteristics.
• Cookies and similar tracking technologies that record session activity, page visits, and feature usage.
• Betting and gaming activity logs generated as you play on the Platform.

Third-Party Sources

• Identity verification providers who assist with KYC checks by cross-referencing your submitted documents against official data sources.
• Fraud prevention and anti-money-laundering screening services that may provide risk scores or flagging information.
• Payment processors who relay transaction confirmation and status data relating to deposits and withdrawals in MYR.

krwin processes personal data on the following legal bases:

• Contractual Necessity: Processing is required to perform our contract with you — specifically to operate your account, process deposits and withdrawals, administer bets and game results, and provide customer support.
• Legal Obligation: Certain processing activities are mandated by applicable law, including KYC identity verification, anti-money-laundering screening, and retention of financial transaction records for statutory audit periods.
• Legitimate Interests: krwin processes data to pursue legitimate business interests including fraud detection, responsible gambling monitoring, platform security, analytics and product improvement — provided these interests are not overridden by your privacy rights.
• Consent: Where we rely on consent — for example, for optional marketing communications — we will obtain your explicit agreement beforehand. You may withdraw consent at any time without affecting the lawfulness of prior processing.

krwin uses the personal data we collect for the following specific purposes:

• Account Management: To create, maintain, and secure your krwin account; to authenticate your identity at login; and to apply account settings including responsible gambling preferences.
• Transaction Processing: To process MYR deposits via Touch 'n Go eWallet, DuitNow, Maybank, CIMB, FPX and other accepted methods; to execute withdrawal requests; and to maintain accurate financial records.
• KYC & Compliance: To verify your identity in satisfaction of applicable know-your-customer and anti-money-laundering requirements, and to comply with any regulatory reporting obligations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-account abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gambling: To monitor betting patterns for indicators of problem gambling and to administer self-exclusion, deposit limit, and session reminder requests.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions.
• Platform Improvement: To analyse usage patterns and technical performance data, inform product development decisions, and improve the overall quality of the krwin gaming experience.
• Marketing Communications (with Consent): To send promotional offers, bonus notifications, and platform updates to players who have consented to receive such communications. You may opt out at any time.

krwin does not sell your personal data to any third party. We may share your data with carefully selected third parties in the following limited circumstances:

• Payment Processors: To facilitate deposits and withdrawals through Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency processors. These entities receive only the data necessary to execute your transaction.
• Identity Verification Providers: To perform KYC and anti-money-laundering checks as required by applicable law. These providers operate under strict data processing agreements.
• Game Technology Providers: Game software providers may receive anonymised session data for the purpose of game performance optimisation. No directly identifiable personal data is shared with game providers for marketing purposes.
• Fraud Prevention Services: Specialist fraud screening and responsible gambling monitoring platforms that help krwin detect and prevent prohibited conduct.
• Legal & Regulatory Authorities: Where required by applicable law, court order, or regulatory directive, krwin may be obligated to disclose personal data to government bodies, law enforcement agencies, or financial intelligence units.
• Professional Advisors: Legal counsel, auditors, and insurance providers may access limited personal data as necessary in the performance of their professional services, subject to appropriate confidentiality obligations.

All third parties with whom krwin shares personal data are required to process it only for the purposes specified, in accordance with our instructions, and subject to contractual data protection obligations commensurate with the sensitivity of the data involved.

krwin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention framework is as follows:

• Account Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, to satisfy legal and regulatory record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years after the end of the customer relationship, in accordance with anti-money-laundering legislation.
• Transaction Records: Financial transaction data in MYR is retained for a minimum of seven (7) years for statutory accounting and audit purposes.
• Support Communications: Live chat logs and email correspondence are retained for a minimum of two (2) years for quality assurance and dispute resolution purposes.
• Technical Logs: Server and access logs are retained for up to twelve (12) months for security monitoring and fraud investigation.
• Marketing Consent Records: Records of consent to or withdrawal from marketing communications are retained indefinitely to document our compliance history.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to any individual.

krwin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and the krwin Platform is protected using TLS 1.2 or higher encryption protocols.
• Encryption at Rest: Sensitive personal data and financial records stored on our servers are encrypted using AES-256 encryption.
• Access Controls: Access to personal data systems is restricted to authorised personnel on a role-based, need-to-know basis. Administrative access requires multi-factor authentication.
• Regular Security Audits: Our Platform and data infrastructure undergo periodic security assessments and penetration testing by qualified security professionals.
• Firewall & Intrusion Detection: Network-level protections including firewalls, intrusion detection systems, and DDoS mitigation are in place across our infrastructure.
• Employee Training: All personnel with access to personal data receive regular data protection and security awareness training.

While we apply robust security measures, no internet transmission or electronic storage method is entirely free from risk. In the event that a security incident results in a breach of your personal data, krwin will notify affected individuals and, where required, relevant authorities, in accordance with applicable data breach notification obligations.

The krwin Platform uses cookies and similar tracking technologies to provide core functionality, improve user experience, and analyse Platform usage. We use the following categories of cookies:

• Essential Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state, security tokens, and load-balancing identifiers. These cannot be disabled without breaking core functionality.
• Functional Functional Cookies: Remember your preferences such as language settings, preferred payment methods, and responsible gambling tool configurations between sessions.
• Analytics Analytics Cookies: Collect anonymised data on how players navigate and interact with the Platform — page views, session durations, and feature usage — to help us improve the user experience.
• Marketing Marketing Cookies: Used, with your consent, to track your engagement with promotional content and to serve relevant offers based on your activity. You may opt out of marketing cookies at any time.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to use the Platform. Detailed cookie settings controls are available in our cookie management interface, accessible from the Platform footer.

As a krwin player and data subject, you hold the following rights with respect to your personal data. These rights are subject to applicable legal exemptions and may be balanced against our own legal obligations:

To exercise any of the above rights, please contact our Data Protection team by emailing [email protected] with the subject line "Privacy Rights Request". We will acknowledge your request within five (5) business days and respond in full within thirty (30) days, or notify you if an extension is required.

The krwin Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. During registration, players must confirm their date of birth and agree that they meet the minimum age requirement.

Where we have reason to believe that personal data has been submitted by or on behalf of a minor, we will:

• Immediately suspend the associated account pending investigation.
• Delete the minor's personal data from our systems as soon as reasonably practicable, except where retention is required by law.
• Refund any deposits made, subject to verification of the account holder's identity and age.

If you believe that a minor has registered an account or submitted personal data on the krwin Platform, please contact us immediately at [email protected] so that we can take appropriate action.

The krwin Platform serves the Malaysia market and the majority of data processing operations are conducted within or in proximity to that region. However, certain third-party service providers — including cloud infrastructure, game technology partners, and security service providers — may be located in other countries.

Where personal data is transferred to countries that may have different data protection standards, krwin ensures that appropriate safeguards are in place prior to any such transfer. These safeguards may include:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those set out in this Policy.
• Restricting the transfer to jurisdictions recognised as providing an adequate level of data protection by applicable standards.
• Obtaining explicit consent where required by applicable law prior to an international transfer.

If you would like further information about the international transfer mechanisms used by krwin, please contact us using the details in Section 15.

krwin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. The "Last Updated" date at the top of this page will be revised accordingly whenever material changes are made.

Where changes are material — meaning they significantly affect how we process your personal data or your rights as a data subject — we will notify you by:

• Displaying a prominent notification on the Platform for a reasonable period following the change;
• Sending an email notification to your registered krwin email address; and/or
• Requesting renewed consent where the change requires it under applicable data protection law.

Your continued use of the Platform after the effective date of any amendment to this Policy constitutes your acknowledgment and acceptance of the updated terms. We encourage you to review this Policy periodically.

If you have any questions, concerns, or complaints relating to this Privacy Policy or our handling of your personal data, please contact our Data Protection team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.

• Email: [email protected]  (plain text — not a clickable link)
• Subject Line: For data privacy enquiries, please use the subject "Privacy Policy Enquiry" or "Data Rights Request" to ensure expedited routing.
• Live Chat: Available 24/7 via the Platform for initial guidance and to initiate a formal privacy request.
• Response Commitment: We acknowledge all data protection enquiries within five (5) business days and provide a substantive response within thirty (30) days.