Privacy Policy

This Privacy Policy ("Policy") sets out the basis on which Winjaya ("Company", "we", "us", "our"), operator of the online gaming platform accessible at winjaya.cam ("Platform"), collects, processes, stores, and discloses personal data relating to registered members, prospective users, and visitors to the Platform ("you", "User", "Data Subject").

Winjaya takes the privacy of its users seriously. We process personal data only to the extent necessary for the lawful operation of the Platform, fulfilment of our contractual obligations to you, compliance with applicable legal and regulatory requirements — including Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations — and the pursuit of our legitimate business interests where these do not override your fundamental rights.

By registering an account, accessing the Platform, or otherwise interacting with Winjaya's services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

The following terms carry the meanings set out below wherever they appear in this Policy:

Winjaya acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, we are responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection legislation and this Policy.

All data protection inquiries, subject access requests, and complaints should be directed to our designated Data Protection contact. Contact details are set out in Section 16 of this Policy. We will acknowledge all written data protection requests within 5 business days and aim to resolve them within 30 calendar days of receipt.

Winjaya collects personal data through several channels: directly from you during registration and account use; automatically through your interaction with the Platform; and from third-party service providers involved in payment processing and identity verification. The categories of data we collect are set out below.

4.1 Registration & Account Data

• Identity Information: Full legal name, date of birth, gender, and nationality as provided during registration or KYC verification.
• Contact Information: Email address, mobile phone number, and residential address.
• Login Credentials: Username and encrypted password. We do not store passwords in plain text.
• Government Identification: MyKad number, passport number, or other government-issued identification number provided for KYC purposes.

4.2 Financial & Transaction Data

• Payment Method Details: Masked card numbers, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), bank account references (Maybank, CIMB, Public Bank, Hong Leong, RHB), and cryptocurrency wallet addresses where applicable.
• Transaction History: Deposit amounts, withdrawal requests, bonus credits, wagering activity, and account balance movements.
• Source of Funds: Documentation provided to satisfy AML requirements, which may include payslips, bank statements, or statutory declarations.

4.3 Technical & Usage Data

• Device Information: IP address, device type, operating system, browser type and version, and unique device identifiers.
• Usage Data: Pages visited, games played, session duration, click patterns, search queries within the Platform, and betting history.
• Location Data: Approximate geolocation derived from IP address for fraud prevention and jurisdictional compliance purposes only.
• Cookie Data: Information stored in session and persistent cookies as described in Section 8 of this Policy.

4.4 Communications Data

• Records of live chat conversations, email correspondence, and support ticket exchanges with the Winjaya support team.
• Feedback, survey responses, and promotional opt-in/opt-out preferences.

Winjaya processes personal data only where a valid legal basis exists for doing so. The table below summarises the primary processing activities and the legal basis applicable to each:

Personal data collected by Winjaya is used solely for the purposes described in this Policy. We do not use your data for purposes incompatible with those stated below without obtaining your prior consent.

• Account Administration: Creating and maintaining your Winjaya account, verifying your identity, processing deposits and withdrawals in Malaysian Ringgit, and managing your account settings and preferences.
• Service Delivery: Providing access to gaming services, calculating and crediting winnings, processing bonus entitlements, and maintaining accurate transaction records.
• Regulatory Compliance: Meeting KYC and AML obligations, verifying that players are aged 21 or over, monitoring for suspicious financial activity, and responding to lawful requests from regulatory or law enforcement bodies.
• Fraud Prevention & Security: Detecting and preventing fraudulent account activity, unauthorised access, multi-accounting, and technical exploits that could compromise the integrity of the Platform.
• Responsible Gambling: Monitoring betting patterns for signs of problem gambling behaviour, enforcing self-exclusion requests, and applying deposit or session limits set by the User.
• Customer Support: Responding to inquiries submitted via live chat, email, or support tickets, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Marketing Communications: Sending promotional offers, loyalty programme updates, and festival campaign notifications to Users who have expressly opted in to receive such communications. You may withdraw consent at any time.
• Platform Improvement: Analysing aggregated usage data to identify performance issues, improve the user interface, and develop new features relevant to Malaysian players.

Winjaya does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only with the categories of recipients described below, and only to the extent necessary for the stated purpose.

• Payment Service Providers: Financial institutions and e-wallet operators — including the processors behind Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks — receive the minimum data necessary to process your transactions securely.
• Identity Verification Partners: Third-party KYC service providers engaged to verify the identity and age of registered Users. These providers are contractually bound to process data solely for verification purposes.
• Game Technology Providers: Software providers that supply gaming engines and live dealer studios to the Platform receive anonymised session data for RNG auditing and performance reporting purposes only.
• Regulatory & Law Enforcement Authorities: We will disclose personal data to competent governmental, regulatory, judicial, or law enforcement authorities where required by law or pursuant to a valid legal order.
• Professional Advisors: Legal counsel, accountants, and auditors engaged by Winjaya where such disclosure is necessary for the provision of professional services, subject to obligations of confidentiality.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, User data may be transferred to the acquiring entity as part of that transaction. Affected Users will be notified in advance of any such transfer.

Winjaya uses cookies and similar tracking technologies to enable core Platform functionality, remember your preferences, maintain your authenticated session, and collect anonymised analytics data that helps us improve the Platform experience.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Platform. These enable login sessions, security functions, and basic navigation. They cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings and interface customisations so you do not need to reconfigure them on each visit.
• Analytics Cookies: Collect aggregated, anonymised data about how Users interact with the Platform — pages visited, time spent, and error events — which we use to identify and resolve performance issues.
• Session Integrity Cookies: Maintain the integrity of your gaming session, preventing session hijacking and ensuring that bet submissions are correctly attributed to your authenticated account.

You may configure your browser to block or delete cookies. Please be aware that blocking strictly necessary cookies will prevent you from logging in or using core Platform features. Analytics and functional cookies can be disabled without affecting your ability to access and play on the Platform.

Winjaya retains personal data for the minimum period necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and audit obligations. Specific retention periods are as follows:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with Winjaya's data destruction procedures. Anonymised data, which cannot be used to identify any individual, may be retained indefinitely for statistical and research purposes.

Winjaya implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and the Platform is protected by TLS (Transport Layer Security) encryption, ensuring that your session data, login credentials, and financial information cannot be intercepted in transit.
• Encryption at Rest: Sensitive personal and financial data stored on Winjaya servers is encrypted at rest using industry-standard AES-256 encryption.
• Access Controls: Access to personal data is restricted to Winjaya personnel and authorised third-party processors who require it for a specific, documented business purpose. All access is logged and subject to regular review.
• Two-Factor Authentication: Available to all registered Users and required for administrative access to internal systems.
• Penetration Testing: The Platform undergoes regular third-party security assessments and vulnerability testing to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: Winjaya maintains a documented data breach response procedure. In the event of a breach likely to result in a high risk to your rights and freedoms, we will notify affected Users without undue delay.

While Winjaya takes all reasonable precautions to protect your data, no internet transmission is entirely secure. You are responsible for maintaining the confidentiality of your account login credentials and for ensuring that your device is protected by up-to-date security software.

As a Data Subject, you hold the following rights in respect of the personal data Winjaya processes about you. To exercise any of these rights, please contact us using the details in Section 16. We will respond to all valid requests within 30 calendar days and will not charge a fee for responding to reasonable requests.

In the course of providing its services, Winjaya may transfer personal data to servers or service providers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that which applies within Malaysia.

Safeguards used for international transfers include contractual clauses that require the recipient to protect the data to the same standard as required under this Policy, and assessments of the recipient's jurisdiction to confirm that adequate data protection standards apply. We do not transfer personal data to jurisdictions that we consider to offer inadequate data protection without implementing compensating controls.

The Winjaya Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and we require all new registrants to provide documentary proof of age before making their first deposit or placing any bet.

If Winjaya becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant account, return any deposited funds (where compliant with AML obligations), and securely delete the personal data associated with that account without undue delay.

The Platform may contain references to services or functionality provided by third parties, including payment processors, game studios, and analytics providers. Winjaya is not responsible for the privacy practices of third-party services operating outside the scope of this Policy or the agreements we hold with them as Data Processors.

All third-party Data Processors engaged by Winjaya are subject to written Data Processing Agreements that require them to: process data only on our documented instructions; implement appropriate technical and organisational security measures; not engage further sub-processors without our prior written consent; and assist us in fulfilling our obligations to Data Subjects under applicable data protection law.

Winjaya reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we provide. Where changes are material — meaning they affect the basis on which we process your data or the rights available to you — we will provide advance notice by email or by posting a prominent notification on the Platform before the updated Policy takes effect.

The "Last Updated" date at the top of this Policy indicates when the most recent version was published. We encourage you to review this page periodically. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

To exercise any of your data rights, raise a data protection concern, or submit a formal complaint regarding Winjaya's processing of your personal data, please contact our Data Protection team using the details below. All communications will be acknowledged within 5 business days.

If you are not satisfied with Winjaya's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction of residence. We will always cooperate fully with any regulatory inquiry relating to our data processing activities.