Privacy Policy

Introduction

This Privacy Policy ("Policy") issued by EpicWin ("EpicWin", "we", "us", "our"), the operator of the online gaming platform accessible at epicwin.cam ("Platform"). This Policy describes how EpicWin collects, uses, stores, shares, and protects the personal data of individuals ("you", "UserPlayer") who register for an account, visit the Platform, or otherwise interact with our services.

EpicWin is committed to handling personal data in a responsible, transparent, and secure manner that aligns with internationally recognised data protection principles, including those reflected in frameworks such as the General Data Protection Regulation (GDPR) and Malaysia's Personal Data Protection Act 2010 (PDPA). Where applicable laws differ, EpicWin applies the higher standard of protection.

By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree to this Policy, you should not create an account or use our services.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, disclosure, or deletion.
• "Data Controller" means EpicWin, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of EpicWin under a written data processing agreement.
• "Sensitive Personal Data" means a subset of personal data that warants heightened protection, including government-issued identification numbers (e.g. MyKad), financial account details, and biometric data used for KYC verification.
• "Cookies" means small text files placed on your device by the Platform to store session information, preferences, and analytics data.
• "KYC" means Know Your Customer — the identity and age verification process required under EpicWin's AML obligations and these Terms.
• "Account" means the registered user profile created by a Player on the Platform, including all associated balance, preferences, and activity history.

Personal Data We Collect

EpicWin collects personal data through several channels: directly from you during registration and account management; automatically through your use of the Platform; and, in limited circumstances, from trusted third-party sources for the purpose of identity verification or fraud prevention. The categories of personal data we collect are set out in the table below.

EpicWin does not knowingly collect special category personal data (such as racial or ethnic origin, religious beliefs, or health data) unless it is voluntarily provided by the user in the context of a responsible gambling self-assessment or support request, in which case it is handled with the highest level of confidentiality.

Purpose of Processing & Legal Basis

EpicWin processes your personal data only for defined, lawful purposes. The primary purposes for which we process your data, together with the corresponding legal basis, are as follows:

• Account Registration and Management: To create and maintain your EpicWin account, verify your identity, manage your balance in MYR, and provide access to all platform features. Legal basis: performance of a contract.
• Payment Processing: To facilitate deposits and withdrawals via Malaysian payment methods including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, and Public Bank Online, as well as cryptocurrency transactions. Legal basis: performance of a contract.
• Age and Identity Verification (KYC): To verify that all players are aged 21 or above and to confirm the identity of account holders before processing withdrawals, in compliance with our AML obligations. Legal basis: legal obligation; legitimate interests.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and abuse of promotional systems. Legal basis: legitimate interests; legal obligation.
• Responsible Gambling: To monitor gaming activity for indicators of problem gambling behaviour, enforce deposit limits and self-exclusion requests, and comply with responsible gambling programme obligations. Legal basis: legitimate interests; legal obligation.
• Customer Support: To respond to your enquiries, complaints, and requests submitted via live chat or email. Legal basis: performance of a contract; legitimate interests.
• Marketing Communications (opt-in only): To send you promotional offers, bonus notifications, and platform updates where you have provided explicit consent. Legal basis: consent.
• Platform Analytics and Improvement: To analyse how users interact with the Platform in order to improve product features, user experience, and performance. Legal basis: legitimate interests.
• Legal and Regulatory Compliance: To comply with applicable laws, regulatory requirements, court orders, and requests from competent authorities. Legal basis: legal obligation.

Data Sharing & Disclosure

EpicWin does not sell, rent, or trade your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: We share transaction data with payment processors (including e-wallet operators and bank transfer facilitators) to execute deposits and withdrawals. These providers are contractually bound to use your data solely for payment execution.
• Identity Verification Providers: We engage third-party KYC service providers to assist with document verification and age confirmation. These providers act as Data Processors under written agreements that prohibit any secondary use of your data.
• Game Technology Providers: Live casino and slot game providers receive session data necessary to operate their games within our Platform. They do not receive your identity or financial data beyond what is necessary for technical integration.
• Fraud Detection and AML Services: We use specialist analytics services to identify and investigate suspicious transaction patterns. Data shared with these services is used exclusively for fraud and money laundering prevention purposes.
• Legal and Regulatory Authorities: EpicWin may be required to disclose personal data to law enforcement agencies, regulators, or courts in response to lawful requests, court orders, or mandatory reporting obligations under AML regulations. We will notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of EpicWin's business, personal data may be transferred to the acquiring entity as part of the transaction. We will notify affected users before any such transfer takes effect.

Cookies & Tracking Technologies

EpicWin uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we deploy are described below:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session authentication, shopping cart functionality, and security token management. These cannot be disabled without impairing core platform functionality.
• Functional Cookies: Used to remember your preferences, such as your chosen language, display settings, and previously entered deposit amounts, so that you do not need to re-enter them on every visit.
• Analytics Cookies: Used to collect anonymised statistical data about how users interact with the Platform — including pages visited, session duration, and navigation patterns. This data helps us identify areas for improvement.
• Fraud Prevention Cookies: Used to identify unusual device or behavioural patterns that may indicate fraudulent activity, account takeover attempts, or use of automated systems.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. EpicWin does not use third-party advertising cookies or cross-site tracking pixels.

Data Retention

EpicWin retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as general guide:

• Active Account Data: Retained for the full duration of your account's active status.
• Financial Transaction Records: Retained for a minimum of six (6) years from the date of the transaction, in compliance with AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of account closure or the last transaction, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Gaming Activity Logs: Retained for two (2) years from the date of the activity, unless required for longer by a dispute, investigation, or regulatory requirement.
• Marketing Preference Records: Retained for the duration of your account's active status, and for two (2) years following account closure or opt-out, as evidence of consent management.

Upon expiry of the applicable retention period, personal data is either permanently deleted or anonymised so that it can no longer be linked to an identifiable individual.

Data Security

EpicWin implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes the following measures:

• Encryption in Transit: All data transmitted between your browser and EpicWin's servers is encrypted using TLS 1.2 or higher with256-bit SSL certificates.
• Encryption at Rest: Sensitive personal data — including identity documents and financial information — is encrypted at rest using AES-256 encryption in our database infrastructure.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff who require access to your data are subject to confidentiality obligations and receive regular data protection training.
• Two-Factor Authentication: EpicWin supports and encourages the use of two-factor authentication (2FA) for all player accounts to reduce the risk of unauthorised access.
• Penetration Testing: Our platform infrastructure undergoes periodic independent security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response: EpicWin maintains a documented data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected users as required by applicable data protection law.

While EpicWin takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is entirely infallible. We cannot guarantee absolute security, and you use the Platform at your own risk in this respect.

Your Data Protection Rights

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your personal data held by EpicWin:

• Right of Access: You may request a copy of the personal data EpicWin holds about you, together with information about how it is used and shared.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. Some data — particularly identity data confirmed through KYC — may require supporting documentation to amend.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right does not override EpicWin's legal obligations to retain certain records.
• Right to Restrict Processing: You may request that EpicWin temporarily restrict the processing of your data while a rectification or objection request is under review.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request that EpicWin provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing based on EpicWin's legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact EpicWin's Data Protection team by email at [email protected] with the subject line "Data Protection Request". We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. Complex requests may take up to 60 days, in which case we will notify you of the extension and the reason for it.

Protection of Minors

EpicWin's services are strictly available to individuals who are 21 years of age or older. We do not knowingly collect or process personal data from persons under the age of 21. Age verification is a mandatory step in our KYC process, and registration is designed to prevent access by individuals who do not meet this threshold.

If EpicWin becomes aware that personal data has been collected from a person under the age of 21, we will immediately close the associated account, delete all collected data to the extent not required for AML reporting, and — where applicable — withold any associated balances pending regulatory review.

International Data Transfers

EpicWin's platform infrastructure and certain third-party service providers may be located outside of Malaysia. As a result, your personal data may be transferred to stored in, or processed in jurisdictions other than your country of residence, including countries that may not have data protection laws equivalent to those in Malaysia.

Where such international transfers occur, EpicWin ensures that appropriate safeguards are in place to protect your personal data, including:

• Executing Standard Contractual Clauses (SCs) or equivalent data transfer agreements with third-party processors in other jurisdictions.
• Transfering data only to processors who have demonstrated compliance with internationally recognised information security standards.
• Conducting transfer impact assessments where required by applicable data protection law.

By using EpicWin's services, you acknowledge and consent to the transfer of your personal data across international borders as described in this section, subject to the safeguards stated above.

Third-Party Links & Services

The EpicWin Platform may contain references to third-party services — including game providers, payment facilitators, and responsible gambling support organisations. These references are provided for informational and operational purposes only. EpicWin is not responsible for the privacy practices, content, or data handling of any third-party service.

We strongly encourage you to review the privacy policies of any third-party services you interact with through or in connection with EpicWin. EpicWin has no control over, and assumes no responsibility for, the data practices of external entities.

Amendments to This Privacy Policy

EpicWin reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. The date of the most recent revision is displayed at the top of this document.

When material changes are made to this Policy, EpicWin will notify registered users by email to the address on file and/or by posting a prominent notice on the Platform. Your continued use of the Platform following publication of the updated Policy constitutes your acceptance of the revised terms. If you do not agree to any revision, you should close your account and cease using the Platform.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact EpicWin through the following channels:

• Data Protection Enquiries (Email): [email protected] — subject line: "Privacy Policy Enquiry" or "Data Protection Request"
• Live Chat: Available24/7 on the Platform. For data protection requests, please ask to be connected to our compliance team. Peak support hours are 8PM – 2 AM MYT.

We are committed to responding to all data protection enquiries within 5 business days of receipt. Please note that some requests — particularly erasure or portability requests — may require identity verification before they can be actioned, to ensure your data is not disclosed to or deleted at the request of an unauthorised third party.