gdwin28 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how gdwin28 ("gdwin28", "We", "Us", "Our") collects, uses, stores, processes, shares and protects the personal data of individuals ("User", "Player", "You") who access or use the gdwin28 platform, website and associated services available at https://gdwin28.cam.

gdwin28 is committed to handling personal data responsibly and in a manner that respects the privacy of every Malaysian adult player who interacts with the platform. This Policy is designed to help you understand what data gdwin28 collects, the purposes for which it is processed, the safeguards applied to protect it, and the rights available to you in relation to your personal data.

By registering a gdwin28 account, depositing funds, using any game or betting market, or otherwise interacting with the platform, you acknowledge that you have read this Policy and that your personal data will be processed in accordance with its terms. If you do not agree with any part of this Policy, please do not proceed with registration or use of the gdwin28 platform.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Controller" means gdwin28 as the entity that determines the purposes and means of processing personal data.
• "Data Subject" means the natural person to whom personal data relates — in this context, a registered gdwin28 Player or website visitor.
• "Personal Data" means any information relating to an identified or identifiable natural person, including name, contact details, identity documents, payment information and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, storage, use, disclosure, erasure and destruction.
• "Processor" means a third party that processes personal data on behalf of gdwin28 under contractual instruction.
• "Sensitive Data" means a subcategory of personal data that warrants enhanced protection, including national identity numbers, biometric data and financial account details.
• "Third Party" means any external entity other than gdwin28 and the Data Subject, including payment partners, identity verification providers and analytics service providers.

3. Data We Collect

gdwin28 collects personal data through multiple points of interaction with the platform. The categories of data collected, and the circumstances in which they are collected, are set out below.

3.1 Registration Data

When you create a gdwin28 account, we collect the information you provide during the registration process, which typically includes: full legal name, date of birth, residential address, email address, phone number, and your preferred Malaysian payment channel (such as Maybank, CIMB, DuitNow, FPX, Touch 'n Go eWallet, Boost or GrabPay).

3.2 Identity Verification Data

As part of our Know Your Customer (KYC) obligations, we collect copies of identity documents (Malaysian MyKad, driving licence or passport), proof of residential address (utility bill or bank statement issued within three months), and where required, a selfie photograph holding the submitted identity document. This data is used solely for the purpose of verifying player identity and satisfying anti-money-laundering obligations.

3.3 Financial and Transaction Data

We collect records of all MYR deposits, withdrawals, wagers, game outcomes, bonus transactions and payment-channel references associated with your gdwin28 account. This includes payment account identifiers provided during deposit and withdrawal processing through Malaysian banking and e-wallet channels.

3.4 Usage and Behavioural Data

When you navigate the gdwin28 platform, we automatically collect certain technical and behavioural data, including: IP address, device type, operating system, browser version, pages visited, session duration, game interactions and sports betting activity. This data supports platform performance monitoring, fraud detection and responsible gambling analysis.

3.5 Communications Data

If you contact gdwin28 support by email or live chat, we retain records of the communication, including the content of your messages, timestamps and the resolution of any queries or complaints. This data is used for quality assurance, dispute resolution and service improvement.

3.6 Voluntarily Provided Data

You may provide additional personal data voluntarily, for example when completing account preferences, responding to surveys or participating in promotional activities. Such data is processed in accordance with this Policy.

4. Data Processing

gdwin28 processes personal data for the following purposes. The table below maps each processing purpose to the relevant category of data involved.

5. Legal Basis for Processing

gdwin28 processes personal data on one or more of the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing required to perform the contract with you — for example, processing your MYR deposit, verifying your identity before a withdrawal, or managing your account in accordance with the gdwin28 Terms and Conditions.
• Legitimate Interests: Processing necessary for gdwin28's legitimate interests in operating a secure, compliant and commercially viable platform, including fraud prevention, platform security, responsible gambling monitoring and internal analytics — where such interests are not overridden by your privacy rights.
• Legal Obligation: Processing required to comply with applicable anti-money-laundering obligations, regulatory reporting requirements, identity verification mandates and other legal duties applicable to gdwin28 as a licensed operator.
• Consent: Where gdwin28 seeks your explicit consent for optional processing activities — for example, sending promotional communications or using non-essential cookies — we will request that consent clearly and separately. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Payment Data and Malaysian Payment Channels

gdwin28 processes MYR financial transactions through verified Malaysian payment channels. These include DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, Hong Leong Bank, Touch 'n Go eWallet, Boost and GrabPay. When you initiate a deposit or withdrawal, gdwin28 and its payment processing partners collect and use the financial account identifiers, transaction references and payment amounts associated with that transaction.

gdwin28 does not store full payment card numbers or full banking credentials on its own servers. Payment transactions are processed through the interfaces of approved payment partners, each of which applies its own data security standards. Players are encouraged to review the privacy notices of their chosen Malaysian payment channel provider.

7. Identity Verification (KYC) Data

Identity documents submitted as part of the gdwin28 KYC process are treated as sensitive personal data and are subject to enhanced protection measures. KYC documents are used exclusively for the purposes of verifying account holder identity, confirming minimum age (21 years and above), satisfying anti-money-laundering obligations and meeting applicable regulatory requirements.

KYC documents are not used for marketing purposes. Access to submitted identity documents is restricted to authorised gdwin28 personnel and regulated third-party verification providers involved in the KYC review process. Documents are retained for the period required by applicable anti-money-laundering legislation and thereafter securely deleted or anonymised.

Players submitting KYC documents should ensure they use only the secure, HTTPS-protected upload interface within their gdwin28 account. Documents should never be sent through unsecured messaging applications, public social media channels or unverified email addresses.

8. Data Sharing and Disclosure

gdwin28 does not sell, rent or trade personal data to third parties for commercial purposes. Personal data is shared only in the following circumstances:

8.1 Payment Processing Partners

Financial transaction data is shared with the Malaysian payment channel providers involved in processing your deposit or withdrawal. This sharing is limited to the data required to execute the specific transaction and comply with payment network rules. Partners include DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost and GrabPay.

8.2 Identity Verification Providers

Where gdwin28 uses a third-party provider to conduct KYC checks, relevant identity data is shared with that provider under a data processing agreement that restricts the provider's use of the data to the purposes specified by gdwin28.

8.3 Regulatory and Legal Authorities

gdwin28 may disclose personal data to competent regulatory authorities, law enforcement agencies or courts where required by applicable law, a valid legal order, or where disclosure is necessary to protect the legal rights or safety of gdwin28, its players or the public.

8.4 Service Providers and Processors

gdwin28 may engage third-party service providers to perform functions on its behalf, including platform hosting, security monitoring, analytics processing and customer support tooling. These providers act as data processors under binding agreements that require them to process personal data only on gdwin28's documented instructions and in accordance with applicable data protection standards.

8.5 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets involving gdwin28, personal data held by gdwin28 may be transferred to the relevant successor entity as part of that transaction, subject to the receiving entity maintaining equivalent data protection standards and the transfer being disclosed to affected players.

9. Data Retention

gdwin28 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, and to support the resolution of any disputes or enforcement of contractual rights. Specific retention periods vary by data category:

• Account registration and KYC data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial reporting and AML obligations.
• Communications and support records: Retained for up to three (3) years from the date of communication, unless a longer period is required for ongoing dispute resolution or regulatory purposes.
• Usage and technical data: Retained in identifiable form for up to twenty-four (24) months, after which time it may be aggregated, anonymised or deleted.
• Marketing preferences and consent records: Retained for the duration of the consent or until withdrawal, plus a reasonable period for demonstrating compliance.

At the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of individually identifiable records.

10. Data Security

gdwin28 implements technical and organisational measures appropriate to the risk associated with the personal data it processes. These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. Security measures applied by gdwin28 include, but are not limited to:

• Encryption of personal data in transit using TLS/HTTPS protocols across all player-facing interfaces.
• Access controls restricting staff access to personal data to those personnel whose role requires it, on a least-privilege basis.
• Audit logging of access to sensitive personal data, including KYC documents and financial records.
• Regular review of data security practices in response to evolving threats and operational changes.
• Contractual requirements binding third-party processors to maintain equivalent security standards.

While gdwin28 applies reasonable technical and organisational safeguards, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. Players are responsible for maintaining the confidentiality of their own account credentials and for notifying gdwin28 immediately upon discovering any unauthorised access to their account.

11. Cookies and Tracking Technologies

gdwin28 uses cookies and similar tracking technologies to support platform functionality, session management, fraud prevention and analytics. Cookies are small data files placed on your device by the gdwin28 website. The categories of cookies used by gdwin28 include:

• Strictly Necessary Cookies: Required for the platform to function, including session authentication, security tokens and navigation preferences. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Support player preferences, language settings and display customisation. These may be disabled, though some personalised features may be reduced.
• Analytics Cookies: Collect aggregated usage data to help gdwin28 understand how players interact with the platform and identify areas for improvement. Where possible, data is aggregated and anonymised before analysis.
• Security Cookies: Support fraud detection systems by recording device and session characteristics. These are essential for protecting player accounts and platform integrity.

Players may manage cookie preferences through their browser settings. Note that disabling certain cookies may affect the availability of some gdwin28 platform features.

12. Minors and Age Restriction

The gdwin28 platform is strictly for adults aged 21 years and above. gdwin28 does not knowingly collect personal data from persons under the age of 21. Age is verified as part of the account registration and KYC process.

If gdwin28 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted, the associated account closed, and any financial balances processed in accordance with gdwin28's minor account procedures.

If you have reason to believe that a minor has registered an account on the gdwin28 platform, please notify us immediately at [email protected] so that the matter can be investigated and appropriate action taken.

13. User Rights

Subject to applicable data protection law and any overriding legal retention obligations, gdwin28 players may exercise the following rights in relation to their personal data:

• Right of Access: You may request confirmation of whether gdwin28 holds personal data relating to you and a copy of that data, along with information about how it is used.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held about you. Where data inaccuracy may affect your account standing or transaction records, correction requests will be prioritised.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent was the legal basis), or where processing is unlawful — subject to gdwin28's right to retain data as required by law, regulation or legitimate interests.
• Right to Restriction: You may request that gdwin28 restrict processing of your personal data in certain circumstances — for example, while an accuracy dispute is being resolved or where you have objected to legitimate-interest processing pending verification of grounds.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing communications. Where an objection is upheld, gdwin28 will cease the relevant processing unless there are compelling grounds that override your interests.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your personal data in a structured, machine-readable format.

To exercise any of the above rights, please submit a request to [email protected]. gdwin28 will acknowledge requests within a reasonable period and respond substantively within the timeframe required by applicable law, subject to identity verification.

14. International Data Transfers

The gdwin28 platform operates within a licensing jurisdiction that may differ from Malaysia. Accordingly, personal data provided by Malaysian players may be transferred to, stored and processed in countries outside Malaysia. Where such transfers occur, gdwin28 ensures that appropriate safeguards are in place to protect your personal data, which may include contractual data transfer agreements requiring recipient entities to maintain data protection standards equivalent to those applied by gdwin28.

Personal data shared with Malaysian payment partners — including Maybank, CIMB, Public Bank, DuitNow and FPX — is processed primarily within Malaysia in accordance with the applicable rules governing those payment networks.

15. Changes to This Privacy Policy

gdwin28 reserves the right to update, modify or replace this Privacy Policy at any time to reflect changes in data processing practices, regulatory requirements or platform operations. The effective date at the top of this document will be updated to reflect the date of the most recent revision.

Where a material change is made to this Policy, gdwin28 will use reasonable efforts to notify registered players by email or by a prominent notice on the platform prior to the change taking effect. Continued use of the gdwin28 platform following the effective date of any revised Policy constitutes acceptance of the updated terms.

Players may request the current version of the Privacy Policy at any time by contacting [email protected]. Historical versions are retained internally and available upon written request where legally required.

16. Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by gdwin28, please contact our support team using the details below. All privacy-related communications must be submitted in English and should include your full account reference and a clear description of your request.

Data Controller: gdwin28
Support Email: [email protected]
(Plain text address — this is not a clickable link. Do not send sensitive documents via unsecured email communications.)

gdwin28 support is available 24 hours daily. Responses to privacy-related requests will be provided within the timeframe required by applicable data protection law from the date of receipt. Complex requests, including subject access requests, may require identity verification before processing can commence.

Additional information about how gdwin28 handles player data in the context of gambling participation is available on the Responsible Gambling page and in the Terms & Conditions.