hpwinn Privacy Policy

01 Scope and Data Controller

This Privacy Policy applies to all personal data collected by hpwinn ("hpwinn", "we", "us", "our") through the hpwinn.com platform, including its gaming products, account registration processes, payment facilities, customer support channels, and promotional communications. "Personal data" means any information that identifies or could reasonably be used to identify you as an individual.

hpwinn acts as the data controller in respect of personal data collected directly from Users of the Platform. Where hpwinn engages third-party service providers who process data on hpwinn's behalf (for example, payment processors and KYC verification providers), those parties act as data processors and are contractually bound to process data only in accordance with hpwinn's instructions and applicable data protection law.

This Policy does not apply to third-party websites or services that may be referenced or accessible from the Platform. hpwinn is not responsible for the privacy practices of any third-party platform. Users are encouraged to review the privacy policies of any third-party services they access independently.

02 Personal Data We Collect

hpwinn collects personal data from Users across several categories depending on how you interact with the Platform. The following table sets out the primary categories of data collected and the context in which collection occurs:

2.1 Sensitive Data

hpwinn does not intentionally collect sensitive categories of personal data (such as health data, racial or ethnic origin, political opinions, or biometric data) unless expressly required for compliance with responsible gaming obligations (for example, processing a self-exclusion request or a third-party exclusion application). Where sensitive data is processed for such purposes, hpwinn does so on the basis of substantial public interest and applicable regulatory requirements.

03 How hpwinn Uses Your Personal Data

hpwinn processes personal data for the following purposes:

• Account Management: To register your hpwinn Account, verify your identity, manage your Account settings, and process account-related communications including password resets, security alerts, and account status notifications;
• Service Delivery: To make the hpwinn gaming platform, sportsbook, live casino, slots, and lottery products available to you and to process your bets, wagers, and game sessions in accordance with the applicable game rules;
• Payment Processing: To process deposits and withdrawals via supported Malaysian payment methods including Touch n Go eWallet, Boost, Maybank, CIMB, and Public Bank, and to maintain accurate financial records of all transactions;
• KYC and Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity before processing withdrawal requests, in fulfilment of hpwinn's obligations under applicable international gaming authority licensing requirements;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, multi-accounting, bonus abuse, and other conduct that breaches hpwinn's Terms and Conditions or applicable law;
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling behaviour, to apply responsible gaming limits and self-exclusion requests set by the User, and to comply with any third-party exclusion orders received from regulatory authorities;
• Regulatory Compliance: To meet hpwinn's legal and regulatory obligations, including record-keeping requirements, suspicious activity reporting, and co-operation with lawful requests from competent authorities;
• Platform Improvement: To analyse aggregated usage data for the purpose of improving Platform performance, product design, and user experience;
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Users who have opted in to receive such communications. Marketing communications can be opted out of at any time via your Account settings.

04 Legal Bases for Processing

hpwinn processes personal data on one or more of the following legal bases depending on the purpose of processing:

• Contractual Necessity: Processing required to fulfil the contract between hpwinn and the User, including Account registration, service delivery, and payment processing;
• Legal Obligation: Processing required to comply with applicable law and regulatory requirements, including KYC, anti-money laundering checks, and regulatory reporting;
• Legitimate Interests: Processing necessary for hpwinn's legitimate interests where those interests are not overridden by the User's data protection rights, including fraud prevention, platform security, and service improvement through anonymised analytics;
• Consent: Where processing is based on consent (for example, marketing communications), Users may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of prior processing conducted on the basis of that consent.

05 Sharing and Disclosure of Personal Data

hpwinn does not sell User personal data to third parties. Personal data may be disclosed to the following categories of recipient where necessary and in accordance with this Policy:

• KYC and Identity Verification Providers: Third-party providers engaged to verify identity documents and confirm age eligibility as required under hpwinn's licensing obligations;
• Payment Processors: Banks, eWallet providers, and payment gateway operators (including those supporting Touch n Go, Boost, Maybank, CIMB, and Public Bank) required to facilitate deposits and withdrawals;
• Game Content Providers: Licensed game studios whose products are integrated into the hpwinn platform may receive anonymised session data necessary for game functionality, auditing, and jackpot processing;
• Technology and Infrastructure Providers: Cloud hosting, cybersecurity, and platform technology vendors operating under data processing agreements that bind them to hpwinn's privacy standards;
• Regulatory and Law Enforcement Authorities: Where required by law, court order, or lawful request from a competent regulatory body, hpwinn will disclose User data to the relevant authority. hpwinn will notify affected Users of such disclosures to the extent permitted by law;
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by hpwinn on a confidential basis where data access is necessary for the provision of professional services.

All third parties with whom personal data is shared are required to process that data lawfully, to implement appropriate technical and organisational security measures, and to use the data solely for the purposes for which it was provided.

06 Cookies and Tracking Technologies

The hpwinn Platform uses cookies and similar tracking technologies to enable Platform functionality, maintain user sessions, prevent fraud, and understand how Users interact with the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including session management, authentication, and security features. These cookies cannot be disabled without impairing core Platform functionality;
• Functional Cookies: Used to remember User preferences such as language settings, responsible gaming limit configurations, and last-accessed game categories;
• Analytical Cookies: Used to collect anonymised or aggregated data about how Users navigate the Platform, which pages are visited most frequently, and where users encounter difficulties. This data is used solely to improve Platform performance and user experience;
• Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, including the identification of Users who have been self-excluded or whose accounts have been suspended.

Users may manage cookie preferences through their browser settings. Blocking strictly necessary cookies will impair Platform functionality. hpwinn does not use cookies to serve third-party advertising or to track Users across external websites not operated by hpwinn.

07 Data Retention

hpwinn retains personal data for the period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or regulation. The following general retention principles apply:

• Account data and KYC documentation are retained for a minimum of five (5) years from the date of Account closure to meet anti-money laundering regulatory requirements;
• Financial transaction records are retained for a minimum of seven (7) years in accordance with standard financial record-keeping obligations;
• Gaming activity and responsible gaming records are retained for the period required under applicable gaming regulatory standards, which may extend beyond Account closure;
• Marketing opt-in records are retained for as long as the User's Account remains active or until the User withdraws their marketing consent, whichever is earlier;
• Support correspondence is retained for a period of three (3) years unless a longer period is required in connection with a pending dispute or regulatory inquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with hpwinn's data lifecycle management procedures.

08 Data Security

hpwinn implements industry-standard technical and organisational security measures to protect User personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• HTTPS encryption with TLS across all Platform pages, including the hpwinn login portal, deposit pages, and account settings;
• Encryption of sensitive data fields (including payment credentials and identity document numbers) at rest and in transit;
• Role-based access controls limiting internal access to personal data to personnel who require it for specific operational functions;
• Regular security assessments and penetration testing by qualified third-party security professionals;
• Incident response procedures governing the detection, containment, and notification of personal data breaches.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is entirely secure. hpwinn cannot guarantee absolute security but is committed to applying best-practice safeguards and responding promptly to any identified security incident. In the event of a data breach that poses a risk to User rights and interests, hpwinn will notify affected Users and relevant regulatory authorities in accordance with applicable breach notification requirements.

09 Your Data Protection Rights

Subject to applicable law and the limitations set out below, Users have the following rights in relation to their personal data held by hpwinn:

• Right of Access: You may request a copy of the personal data hpwinn holds about you and information about how it is processed;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Certain data (including your registered name and date of birth) can only be changed via the KYC re-verification process;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. Note that this right is subject to hpwinn's regulatory obligations to retain data for anti-money laundering and gaming regulatory purposes — erasure requests may be partially declined where retention is legally mandated;
• Right to Restriction: You may request that hpwinn restricts processing of your data in certain circumstances, including where you contest the accuracy of the data or object to processing on the basis of legitimate interests;
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your data in a commonly used, machine-readable format;
• Right to Object: You may object to processing based on hpwinn's legitimate interests, and you have an unconditional right to object to processing for direct marketing purposes;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact hpwinn's support team via the on-site live chat or email at [email protected]. hpwinn will respond to data rights requests within a reasonable period, typically within thirty (30) days, and will request identity verification before processing any request that involves disclosure or deletion of personal data.

10 Children's Privacy and Age Restriction

The hpwinn platform is strictly for adults aged 21 years and above. hpwinn does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the Account registration process, and KYC verification confirms age eligibility before withdrawal access is granted. If hpwinn becomes aware that personal data has been collected from a person under the minimum age, the Account will be immediately closed and the data deleted or withheld pending investigation and regulatory reporting as required. Parents or guardians who believe a minor has registered on hpwinn should contact the support team immediately via the on-site live chat.

11 International Data Transfers

hpwinn may transfer personal data to service providers and infrastructure partners operating in jurisdictions outside Malaysia. Where such transfers occur, hpwinn takes reasonable steps to ensure that an adequate level of protection is applied to the transferred data, including through the use of contractual data protection clauses, vendor security assessments, and limiting transfers to jurisdictions with recognised data protection frameworks. By using the hpwinn Platform, you acknowledge that your personal data may be processed in countries outside Malaysia. hpwinn does not transfer personal data to jurisdictions that do not provide adequate protections without implementing appropriate safeguards.

12 Changes to This Privacy Policy

hpwinn may update this Privacy Policy from time to time to reflect changes in the Platform, its services, applicable law, or regulatory requirements. Where a material change is made to the Policy, hpwinn will notify registered Users via their registered email address or a prominent on-Platform notification prior to the change taking effect. The "Effective" date at the top of this Policy reflects the date of the most recent revision. Continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Privacy Policy. If you do not accept a material revision, you should request Account closure before the revision takes effect.

13 Contact and Complaints

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data by hpwinn, please contact the hpwinn data team via:

• Live Chat: 24/7 live chat available on the hpwinn Platform (preferred channel for urgent queries);
• Email: [email protected] — Please mark your subject line with "Privacy Request" for routing to the appropriate team. Do not attach identity documents to unsecured emails; use the secure upload portal within your Account instead.

If you are not satisfied with hpwinn's response to a privacy-related complaint, you have the right to escalate the matter to the applicable data protection supervisory authority or to the dispute resolution mechanism provided by hpwinn's applicable international gaming authority licensing body. hpwinn is committed to resolving data-related concerns promptly and transparently.