Privacy Policy — EpicWin138

This Privacy Policy ("Policy") describes how EpicWin138 ("we", "us", "our", "the Platform") collects, uses, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the EpicWin138 website, mobile interface, and associated services available at epicwin138.cam.

EpicWin138 is committed to processing personal data in a manner that is lawful, fair, transparent, and consistent with applicable data protection legislation. This Policy is written in plain English to ensure that Malaysian players and other users can clearly understand how their information is handled.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overall agreement governing your use of EpicWin138.

The following terms, as used in this Privacy Policy, carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living natural person, directly or indirectly — including name, identification number, contact details, location data, or online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, EpicWin138.
• "Data Processor" means a third party that processes Personal Data on behalf of EpicWin138, under contractual instruction.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, security, and personalisation.
• "KYC" means Know Your Customer — the identity verification process required under applicable anti-money laundering and platform eligibility obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data.

EpicWin138 acts as the Data Controller in respect of all Personal Data collected from Players and visitors to the Platform. As Data Controller, EpicWin138 is responsible for ensuring that Personal Data is collected and processed lawfully, and that appropriate technical and organisational measures are in place to protect it.

Where EpicWin138 engages third-party service providers to assist in delivering Platform services — such as payment processors, fraud detection vendors, or customer support platforms — those providers act as Data Processors. Each Data Processor is bound by a written data processing agreement that prohibits the use of Personal Data for any purpose beyond those specified by EpicWin138.

For all data protection enquiries or to exercise your rights under this Policy, please contact our Data Protection team using the contact details provided in Section 15 of this document.

EpicWin138 collects Personal Data through the following means: directly from you during account registration and ongoing use of the Platform; automatically through your interaction with the Platform; and, in limited circumstances, from third-party verification and fraud-prevention services.

The categories of Personal Data we collect are set out in the table below:

EpicWin138 does not collect or process special categories of sensitive personal data — such as racial or ethnic origin, religious beliefs, health data, or biometric data — except where required by law or where you have provided such information voluntarily in a support context.

EpicWin138 processes your Personal Data only where a lawful basis exists under applicable data protection law. The primary purposes for which we process Personal Data, and the corresponding legal bases, are as follows:

• Account Creation & Management: Processing is necessary for the performance of the contract between you and EpicWin138 (i.e., provision of gaming and betting services).
• Identity Verification (KYC): Processing is required to comply with our legal obligations under anti-money laundering regulations and age verification requirements.
• Payment Processing: Processing is necessary for the performance of the contract, specifically to facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Maybank, CIMB, Public Bank, and other supported Malaysian payment channels.
• Fraud Prevention & Security: Processing is necessary for our legitimate interests in maintaining a secure and fair platform, and to protect Players from unauthorised account access.
• Responsible Gambling Compliance: Processing is necessary for compliance with legal obligations and to protect the vital interests of Players who may be at risk of gambling-related harm.
• Customer Support: Processing is necessary for the performance of the contract and for our legitimate interests in resolving disputes and improving service quality.
• Platform Analytics & Improvement: Processing is based on our legitimate interests in understanding how the Platform is used and improving its performance, security, and features.
• Marketing Communications: Where you have provided explicit consent, we may send you promotional offers, bonus notifications, and product updates. Consent may be withdrawn at any time via your Account settings or by contacting our support team.

All Personal Data collected by EpicWin138 is processed in accordance with the principles of data minimisation, purpose limitation, accuracy, storage limitation, integrity, and confidentiality. EpicWin138 processes data only to the extent necessary to fulfil the stated purposes and does not subject Personal Data to any automated decision-making process that produces legally significant effects without human review.

Where automated systems are used — for example, in fraud detection or unusual activity flagging — any output that results in an Account being restricted or suspended is subject to human review before action is finalised. Players have the right to request that any such automated assessment be reviewed by a member of our compliance team.

EpicWin138 does not sell, rent, or trade your Personal Data to any third party. Personal Data is shared only in the following circumstances, and only to the extent strictly necessary:

• Payment Processors: Financial transaction data is shared with payment service providers — including DuitNow, FPX, e-wallet operators, and banking partners — solely for the purpose of processing deposits and withdrawals;
• Identity Verification Providers: KYC documents may be processed by third-party identity verification services engaged by EpicWin138 under strict data processing agreements;
• Fraud Prevention Services: Technical and usage data may be shared with fraud detection and cybersecurity vendors to protect the Platform and its Players;
• Customer Support Platforms: Support ticket and communications data may be processed via third-party customer relationship management tools that operate on behalf of EpicWin138;
• Legal & Regulatory Authorities: EpicWin138 may disclose Personal Data to law enforcement agencies, courts, or regulatory bodies where required by law, court order, or in response to a lawful investigation;
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets, Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections and prior notification to affected Players.

EpicWin138's primary data infrastructure is maintained in accordance with the security standards applicable to online gaming platforms. Certain Data Processors engaged by EpicWin138 — particularly those providing cloud hosting, fraud prevention, and analytics services — may process Personal Data in jurisdictions outside Malaysia.

Where such transfers occur, EpicWin138 ensures that appropriate safeguards are in place, including contractual obligations on the receiving party to uphold a standard of data protection equivalent to that which applies in Malaysia. EpicWin138 does not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual or technical safeguards.

EpicWin138 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active Accounts: Personal Data associated with an active Account is retained for the duration of the Account's existence and for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping obligations;
• Transaction Records: Financial transaction data, including deposit and withdrawal records denominated in MYR, is retained for a minimum of five (5) years from the date of the transaction;
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following the end of the customer relationship or longer if required by applicable regulation;
• Support Communications: Customer support records are retained for a minimum of three (3) years from the date of the last interaction;
• Technical & Log Data: Server logs and access data are retained for a maximum of twelve (12) months, unless required to be retained longer in connection with an active investigation or legal proceeding;
• Marketing Data: Where consent to receive marketing communications has been withdrawn, associated Personal Data will be suppressed or deleted within 30 days of the withdrawal request.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in a manner that prevents re-identification.

EpicWin138 uses cookies and similar tracking technologies to ensure the proper functioning of the Platform, maintain session security, and understand how Players interact with our services. The categories of cookies deployed are as follows:

• Strictly Necessary Cookies: Required for the Platform to operate. These cookies manage user sessions, authentication tokens, and security parameters. They cannot be disabled without affecting Platform functionality;
• Functional Cookies: Enable personalisation features such as language preferences, saved game settings, and display options. These are set based on choices you make on the Platform;
• Analytical Cookies: Used to collect aggregated, anonymised data about how the Platform is used — including page visits, session duration, and feature interactions — to support ongoing improvements;
• Security Cookies: Used for fraud detection, bot identification, and the protection of Player accounts against unauthorised access attempts.

EpicWin138 does not deploy third-party advertising or behavioural tracking cookies. You may manage or disable non-essential cookies through your browser settings; however, doing so may impact the functionality of certain Platform features.

EpicWin138 implements a range of technical and organisational security measures designed to protect Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between Players and the Platform;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and payment records;
• Multi-factor authentication options for Player account access;
• Role-based access controls restricting staff access to Personal Data on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure;
• Intrusion detection systems and real-time monitoring for anomalous activity;
• Strict vetting and contractual obligations for all Data Processors with access to Personal Data.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. EpicWin138 will notify affected Players and relevant authorities in the event of a data breach that poses a material risk to individuals' rights, in accordance with applicable legal obligations.

Subject to applicable data protection law and any overriding legal obligations, you have the following rights in respect of your Personal Data held by EpicWin138:

• Right of Access: You may request a copy of the Personal Data that EpicWin138 holds about you, along with information about how it is processed;
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data. You may update certain Account details directly through your Account settings;
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to EpicWin138's legal retention obligations;
• Right to Restriction of Processing: You may request that EpicWin138 restricts the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested;
• Right to Data Portability: You may request that your Personal Data be provided to you in a structured, commonly used, and machine-readable format, where technically feasible;
• Right to Object: You may object to the processing of your Personal Data where it is based on legitimate interests. You may also withdraw consent for marketing communications at any time;
• Rights in Relation to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing that produces significant legal effects, without human review.

To exercise any of the above rights, please submit a written request to our support team through the live chat channel or at the email address provided in Section 15. Requests will be acknowledged within 72 hours and completed within 30 days, subject to identity verification and any applicable legal exemptions.

EpicWin138 does not knowingly collect or process the Personal Data of individuals under the age of 21. The Platform is strictly intended for adults aged 21 years and above. Age verification is conducted as part of the KYC process for all registered accounts.

Parents and guardians are encouraged to make use of parental control software to restrict access to online gambling services. EpicWin138 supports the responsible use of such tools as an additional safeguard alongside our own age verification processes.

EpicWin138 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data processing or change how data is shared — we will notify registered Players via email or an in-Platform notification prior to the changes taking effect.

The effective date of the current version of this Policy is displayed at the top of this page. We encourage Players to review this Policy periodically to remain informed about how EpicWin138 protects their Personal Data.

Continued use of EpicWin138 following the publication of an updated Policy constitutes acceptance of the revised terms. Previous versions of this Policy are available upon written request to our support team.

For all data protection enquiries, requests to exercise your rights, or to report a privacy concern, please contact EpicWin138 through the following channels:

• Live Chat: Available 24/7 in English, Bahasa Melayu, and Chinese via the Platform. Average response time: 3–5 minutes.
• Email (plain text — not a clickable link): [email protected]

When submitting a data rights request, please include your registered Account username, a clear description of your request, and a copy of a valid identity document so that we may verify your identity before processing the request. All requests are handled in strict confidence and in accordance with this Policy.

EpicWin138 aims to resolve all privacy-related enquiries within 30 days of receipt. Where a request is particularly complex or where a high volume of requests has been received, we may extend this period by a further 30 days, with notification provided to the requester.