nakwin Privacy Policy

nakwin ("nakwin", "we", "us", "our") operates the online gaming platform accessible at nakwin.net (the "Platform"). We are committed to safeguarding the privacy and personal data of all registered members, visitors, and users who interact with the nakwin Platform (collectively referred to as "you", "your", or "Member").

This Privacy Policy explains in plain terms what personal data we collect from you, why we collect it, how it is processed and stored, with whom it may be shared, and what rights you have in respect of that data. This Policy should be read alongside nakwin's Terms and Conditions, which govern your overall use of the Platform.

By registering a nakwin account, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact us to request account closure.

2.1 Registration Data. When you create a nakwin account, we collect your full legal name, date of birth, email address, Malaysian phone number, and residential address. This information is required to establish and maintain your account and to comply with our Know Your Customer (KYC) and anti-money laundering (AML) obligations.

2.2 Identity Verification Documents. To comply with our licensing obligations, we may collect and process copies of your Malaysian MyKad, passport, utility bills, or bank statements as part of the KYC verification process. These documents are handled with the highest level of security and access is restricted to authorised compliance personnel.

2.3 Financial Data. We collect transactional data including deposit amounts, withdrawal requests, payment method identifiers (such as masked bank account numbers or e-wallet reference IDs from Touch n Go or Boost), and transaction timestamps. Full payment card numbers are never stored by nakwin — card processing is handled entirely by PCI-DSS certified third-party payment processors.

2.4 Usage and Technical Data. We automatically collect technical data when you access the Platform, including your IP address, device type, operating system, browser type and version, session duration, pages visited, games played, bet history, and referring URL. This data is used for security monitoring, fraud prevention, and platform improvement.

2.5 Communications Data. If you contact nakwin's customer support team via live chat or email, we retain records of those communications for quality assurance, dispute resolution, and regulatory compliance purposes.

2.6 Responsible Gaming Data. Where you use nakwin's responsible gaming tools — such as setting deposit limits, requesting a cooling-off period, or initiating self-exclusion — we record those instructions and the dates they were applied. This data is retained to ensure compliance with your requests and to support any future responsible gaming review.

nakwin uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your nakwin account, including processing nakwin login sessions, verifying your identity, and managing your account preferences.
• Transaction Processing: To process deposits and withdrawals via supported Malaysian payment channels including Touch n Go eWallet, Boost, Maybank, CIMB, and Public Bank.
• Regulatory Compliance: To fulfil our KYC, AML, and licensing obligations, including verifying that members are aged 21 or older and are legally permitted to access the Platform from their jurisdiction.
• Fraud Prevention and Security: To detect and prevent unauthorised access, account takeover, collusion, bonus abuse, and money laundering. This includes behavioural analysis, device fingerprinting, and IP geolocation.
• Customer Support: To respond to your queries, investigate disputes, and provide technical assistance related to your nakwin account.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the nakwin Platform, optimise the user interface, and enhance game and product offerings.
• Marketing Communications: Where you have provided consent, to send you promotional offers, bonus notifications, and product updates relevant to your nakwin membership. You may withdraw consent for marketing at any time through your account settings.
• Responsible Gaming: To monitor for signs of problematic gambling behaviour and to apply responsible gaming tools in accordance with your instructions or our regulatory obligations.

nakwin processes your personal data on the following legal bases:

4.1 Contractual Necessity. The majority of personal data processing by nakwin is necessary for the performance of the contract between you and nakwin as established by the Terms and Conditions. This includes processing data for account management, transaction processing, and customer support.

4.2 Legal Obligation. nakwin is subject to various legal and regulatory obligations under its international gaming authority licensing conditions, applicable anti-money laundering legislation, and Malaysian data protection requirements. Processing for KYC, AML, and age verification is carried out on this basis.

4.3 Legitimate Interests. nakwin processes certain data on the basis of legitimate interests, including fraud prevention, security monitoring, and the improvement of Platform functionality. These interests are balanced against your rights and freedoms and do not override your fundamental privacy interests.

4.4 Consent. Where processing is based on consent — in particular, the sending of direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

nakwin does not sell, rent, or trade your personal data. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment Processors: To process deposits and withdrawals, we share transaction data with our certified payment processing partners. These partners are bound by strict data processing agreements and PCI-DSS compliance requirements.
• KYC Verification Providers: Identity documents submitted for KYC are processed by specialist third-party verification providers operating under data processing agreements with nakwin.
• Game Suppliers: Live casino and slots game providers may receive anonymised session data for technical integration and game performance monitoring purposes. No personally identifiable information is shared with game suppliers beyond what is technically necessary for game delivery.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to competent authorities where required by applicable law, court order, or regulatory instruction. nakwin will not disclose data beyond what is specifically requested and will notify affected members where legally permitted to do so.
• Fraud Prevention Networks: In cases of suspected fraud or AML concern, nakwin may share relevant data with industry fraud prevention networks and blacklist databases as permitted by applicable law.

All third parties with whom nakwin shares personal data are required to maintain appropriate security standards and are prohibited from using that data for any purpose other than the specific purpose for which it was shared.

6.1 What Are Cookies. Cookies are small text files stored on your device by your browser when you visit a website. nakwin uses cookies and similar tracking technologies to operate the Platform securely and effectively.

6.2 Types of Cookies Used by nakwin.

• Essential Cookies: Required for the Platform to function. These include session authentication cookies that maintain your nakwin login state, CSRF protection tokens, and load balancing cookies. These cannot be disabled without preventing use of the Platform.
• Analytics Cookies: Used to collect aggregated, anonymised data about how members interact with the Platform. This helps nakwin understand which features are most used and where the experience can be improved.
• Fraud Prevention Cookies: Used to identify unusual patterns of behaviour that may indicate account takeover, bot activity, or coordinated abuse.

6.3 Managing Cookies. You may control cookies through your browser settings. Disabling essential cookies will prevent you from using the nakwin Platform. Disabling analytics cookies will not affect your ability to use nakwin but will limit our ability to improve the Platform based on real usage data.

nakwin retains personal data for as long as your account is active and for a minimum period of five years after account closure, in accordance with our licensing obligations and applicable Malaysian financial regulations. Specific retention periods by data type are as follows:

• Account Registration Data: Retained for the lifetime of the account plus five years following closure.
• Transaction Records: Retained for a minimum of seven years to comply with AML record-keeping requirements.
• KYC Documents: Retained for five years after the end of the business relationship, or longer if required by a specific regulatory instruction.
• Customer Support Communications: Retained for three years from the date of the communication.
• Marketing Consent Records: Retained for the duration of your membership and for two years after withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised, aggregated data that cannot be linked to any individual may be retained indefinitely for statistical and analytical purposes.

nakwin implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• AES-256 encryption for all data stored at rest;
• TLS 1.2 or higher for all data transmitted between your device and nakwin servers;
• Role-based access controls ensuring that only authorised personnel can access personal data, strictly on a need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Real-time intrusion detection and 24/7 security monitoring of all Platform infrastructure;
• Two-factor authentication (2FA) options for member accounts to reduce the risk of unauthorised nakwin login;
• Segregation of member funds from operational accounts.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, nakwin will notify affected members and relevant authorities within the timeframes required by applicable law.

As a nakwin member whose personal data we process, you have the following rights, subject to applicable legal limitations:

• Right of Access: You may request a copy of the personal data nakwin holds about you at any time.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request correction. Minor corrections (such as email address updates) can be made directly from your nakwin account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to nakwin's legal retention obligations. Data required for AML or regulatory compliance cannot be erased on demand.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time via your nakwin account preferences or by contacting support.
• Right to Object: You may object to processing based on legitimate interests. nakwin will assess the objection and cease processing unless compelling legitimate grounds override your interests.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transmission to another controller, where technically feasible.

To exercise any of these rights, contact nakwin's Data Protection team via the live chat on-site or by email at [email protected]. Requests will be acknowledged within five business days and completed within fourteen business days, subject to identity verification.

The nakwin Platform is strictly for adults aged 21 years or older. nakwin does not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been submitted by or on behalf of a person under the age of 21, that data will be deleted immediately and the associated account closed without compensation.

Members are responsible for ensuring that no person under the age of 21 in their household is able to access their nakwin account or credentials. If you believe that a minor has accessed your account, you must contact nakwin support immediately via live chat.

nakwin reserves the right to update this Privacy Policy at any time. Material changes — particularly those that affect how your personal data is processed or your rights as a member — will be communicated to registered members via email notification and/or a prominent notice on the nakwin Platform at least seven days before the changes take effect, unless a shorter notice period is required for regulatory compliance.

We encourage all nakwin members to review this Privacy Policy periodically to stay informed about how we protect your personal data. The "Last Updated" date at the top of this document reflects the date of the most recent revision.

If you have any questions, concerns, or requests relating to this Privacy Policy or nakwin's handling of your personal data, please contact us through one of the following channels:

• Live Chat: Available 24/7 via the nakwin website — the fastest way to reach the support and data protection team.
• Email: [email protected] — for written data subject requests or formal privacy enquiries. Please include your registered username and a brief description of your request.

All privacy-related correspondence is treated as confidential and handled by nakwin's designated data protection personnel. We aim to acknowledge all written enquiries within five business days and to fully resolve requests within fourteen business days.