Privacy Policy m2win – Malaysia Member Personal Data Protection

M2win (operating under the domain m2win.best) is an online entertainment and betting platform built specifically for Malaysian users. We understand that your trust in m2win depends greatly on your confidence that your personal information is handled responsibly, transparently, and securely.

This Privacy Policy ("Policy") describes m2win's privacy practices — including the types of data we collect from members, the purposes for which it is collected, how we use it, who it may be disclosed to, and the measures we take to protect it. This Policy applies to all registered members, visitors to the m2win website, and any individual who interacts with our platform through any channel, including the website, mobile app, LiveChat, email, and WhatsApp.

This Privacy Policy is to be read together with m2win's Terms & Conditions and our Responsible Gaming Policy, which together form the entire agreement between m2win and our members. Your continued use of the m2win platform after any changes to this Policy take effect will be deemed as your acceptance of those changes.

M2win collects several categories of personal data from members. Below is a comprehensive overview of the types of data we collect and how they are obtained:

M2win not collected sensitive data such as medical information, religious beliefs, trade union membership, or biometric data (unless specifically required for identity verification in certain circumstances). We also do not store your full credit card numbers or banking passwords — sensitive financial data is processed directly through authorised payment providers such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u, and CIMB Clicks.

M2win uses members' personal data for the following purposes, all of which are necessary for the delivery of a reliable and secure platform experience:

• Account management: Creating and maintaining your member account, verifying your identity, processing logins, and managing account settings.
• Financial transaction processing: Processing deposits via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u, and CIMB Clicks; processing withdrawals; and managing account balances and transaction history.
• Betting service delivery: Giving you full access to all game and betting categories available on m2win — Liga Super Malaysia and EPL football, jackpots, Live Casino, e-sports, virtual sports, and the VIP programme.
• Customer support: Responding to inquiries, resolving complaints, providing technical support, and communicating with you regarding your account or transactions.
• Security & fraud prevention: Detecting and investigating suspicious activity, preventing platform misuse, money laundering, and unauthorised access.
• Legal compliance: Fulfil obligations imposed by applicable Malaysian law, including anti-money laundering (AML) and know your customer (KYC) requirements.
• Platform improvements: Analysing usage patterns on an aggregated and anonymised basis to improve the user experience, enhance platform performance, and develop new features relevant to Malaysian members.
• Marketing communications: Sending you information about promotions, bonuses, and special offers — only where you have given consent to receive such communications.

M2win does not sell, rent, or disclose member personal data to third parties for their own marketing or business purposes. This is an absolute commitment from m2win — one we have never broken and will never break.

However, in the course of operating the platform, m2win may need to share certain data with the following parties under limited and controlled circumstances:

• Certified payment providers: DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u, and CIMB Clicks receive only the transaction information necessary to process your deposits and withdrawals. These providers maintain their own privacy policies and are subject to Malaysian data protection laws.
• Game software providers: Third-party game platform providers that supply slots, live casino, and other games within the m2win platform receive the game transaction data necessary to operate those games. No unnecessary personal identification data is shared with these parties.
• Technology service providers: Cloud infrastructure providers, analytics services, and security technology partners that support m2win's platform operations. All providers are bound by strict confidentiality agreements.
• Legal authorities: m2win will disclose personal data when legally required to do so by a court, Malaysian law enforcement agency, or relevant regulatory authority — and only to the extent required by the applicable request.

In all of the data-sharing scenarios above, m2win ensures that only the minimum data necessary for the relevant purpose is shared. All third parties that receive m2win member data are bound by confidentiality obligations equivalent to the standards we uphold ourselves.

M2win invests heavily in security infrastructure to protect member personal data from unauthorized access, disclosure, alteration, or destruction. The key security measures we have in place include:

• 256-bit SSL encryption: All communications between your browser or app and m2win's servers are encrypted using Transport Layer Security (TLS) with 256-bit keys — the same standard used by major Malaysian financial institutions.
• Layered access controls: Member data is accessible only to m2win staff who have been specifically authorised based on their job responsibilities. Access is controlled through multi-factor authentication and comprehensive audit logging.
• 24/7 security monitoring: Automated monitoring systems operate around the clock to detect any suspicious activity, intrusion attempts, or anomalies in data access patterns.
• Encryption of data at rest: Sensitive member data stored in the m2win database is encrypted to ensure it remains unreadable even in the event of an unexpected breach.
• Regular data backups: Member data is backed up regularly to a secure storage environment to ensure service continuity and protection against data loss.

While m2win takes all reasonable steps to protect your data, no security system is 100% foolproof. In the highly unlikely event of a security incident involving member data, m2win is committed to notifying affected members promptly in accordance with applicable legal requirements.

M2win uses cookies and similar tracking technologies to enhance the user experience on our platform. The following are the types of cookies we use:

• Essential cookies (required): Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled as they are essential for the platform to operate correctly.
• User preference cookies: Saving your preferences such as language, display settings, and game choices so you do not need to reconfigure them each time you log in.
• Analytics cookies: Helps us understand how members use the platform in aggregate and anonymised form — including the most frequently visited pages, time spent, and navigation patterns. This data is used to improve the platform.
• Performance cookies: Allows the m2win platform to run faster and more smoothly by temporarily storing frequently used elements.

You can manage cookie settings through your web browser preferences. Please note that disabling essential cookies may affect the functionality of the m2win platform — you may be unable to log in or use certain features. When you visit the m2win platform for the first time, a cookie notice will appear allowing you to make choices about non-essential cookies.

In the course of operating the m2win platform, some member personal data may be processed or stored on servers located outside Malaysia — for example, by cloud infrastructure providers or international gaming software providers that we use.

M2win ensures that any such cross-border data transfers are carried out with adequate safeguards in place. These include:

• Ensuring that data recipients outside Malaysia are subject to data protection laws or regulations that provide a level of protection equivalent to Malaysia's PDPA
• Binding data recipients to data processing agreements that contain strict security and confidentiality obligations
• Limiting data transfers to only the minimum information necessary for the relevant service

By using the m2win platform, you consent to the transfer of data as described above, to the extent permitted under applicable Malaysian law.

As an m2win member and an individual protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold about you:

To exercise any of the rights above, please contact m2win's support team via LiveChat or email at support@m2win.best, stating the type of request and providing the required identity verification information. m2win will respond to your request within 30 business days. Please note that certain requests may be limited by legal obligations, such as the requirement to retain financial records for a minimum period as stipulated under Malaysian law.

M2win retains member personal data for as long as the account remains active and for a specified period after account closure, depending on the type of data and applicable legal requirements. The following is a general guide to retention periods:

• Active account data: Retained for as long as your m2win account is active and in use.
• Financial transaction records: Retained for a minimum of 7 years after a transaction occurs, in line with Malaysian financial and tax regulatory requirements.
• Support communication records: Retained for 3 years after the date of communication, for reference and complaint resolution purposes.
• Activity and security logs: Retained for 2 years for security audit and fraud investigation purposes where required.
• Marketing data: Retained until you withdraw consent or request deletion, whichever comes first.

Once the relevant retention period has expired, m2win will securely delete or anonymise the data using methods that ensure it cannot be recovered. If you voluntarily close your m2win account, the data deletion process will begin after the minimum legally mandated retention period has passed.

The m2win platform is exclusively for individuals aged 18 and above. m2win does not knowingly collect, store, or process any personal data from individuals under the age of 18.

Should m2win discover that personal data belonging to a child or underage minor has been inadvertently collected through the registration process, we will take immediate steps to:

• Closing the relevant account immediately
• Delete all related personal data from our systems
• Refunding any funds that may have been deposited, where applicable

If you have reason to believe that a minor under the age of 18 has registered and is using the m2win platform, please notify us immediately at support@m2win.best so that prompt action can be taken.

M2win reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, Malaysian legal requirements, or relevant technological developments. We are committed to notifying members of any material changes through:

• A prominent notice on the m2win platform's main page
• Email to the registered email address on the member account (for important changes)
• A pop-up notice within the member's account upon first login after changes take effect

Changes will take effect 14 days after the announcement date unless otherwise stated. Your continued use of the m2win platform after the effective date of any changes constitutes your acceptance of the amended Privacy Policy.

We recommend reviewing this Privacy Policy periodically to ensure you always understand how we handle your personal data. The "Updated" date at the top of this document indicates when the last amendment was made.

If you have any questions, concerns, or complaints regarding how m2win handles your personal data, or if you wish to exercise any of your rights as outlined in Section 8, please contact us through the following channels:

When submitting a privacy enquiry or data access request, please provide your full name, m2win account number, the type of request you are making, and any other relevant details. This helps our team process your request more efficiently and accurately. We value the trust you place in m2win and will handle all privacy requests with the utmost seriousness and responsibility.