yes2win Privacy Policy

1. Introduction & Data Controller

This Privacy Policy ("Policy") is issued by yes2win ("yes2win", "we", "us", "our"), the operator of the online gaming platform accessible at yes2win.one and its associated subdomains, mobile interfaces, and related digital services (collectively, the "Platform").

yes2win acts as the data controller in respect of all personal data processed in connection with your use of the Platform. As data controller, yes2win determines the purposes for which and the means by which personal data is processed, and bears primary responsibility for that processing under applicable data protection law.

This Policy applies to all current and former registered players of the yes2win Platform, visitors to the yes2win website, and any individual whose personal data yes2win processes in connection with the operation of the Platform. It applies regardless of the device or method of access used.

By registering on yes2win, using the Platform, or providing personal data to yes2win by any means, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you should not register on or use the yes2win Platform.

2. Personal Data We Collect

yes2win collects the following categories of personal data in connection with the operation of the Platform and the provision of gaming services:

2.1 Identity Data

• Full legal name as it appears on government-issued identification;
• Date of birth and nationality;
• Malaysian MyKad number or passport number (for KYC verification purposes);
• Photographic image where submitted as part of KYC documentation.

2.2 Contact Data

• Email address (used as the primary account identifier and communication channel);
• Malaysian mobile number where provided for 2FA or account recovery purposes;
• Residential address as submitted during KYC verification.

2.3 Financial Data

• Payment method identifiers (e.g., Touch n Go eWallet account reference, Boost account reference, Maybank or CIMB account number partial, GrabPay identifier);
• Transaction records including deposit amounts, dates, and method; withdrawal amounts, dates, method, and processing status;
• Source of funds declarations where required by yes2win's AML compliance procedures.

2.4 Gaming Activity Data

• Full bet history including game titles, stake amounts, outcomes, and timestamps;
• Session data including login times, session duration, and activity during each session;
• Bonus and promotional activity including offers accepted, wagering progress, and outcomes;
• Responsible gaming settings including deposit limits, session limits, and self-exclusion history.

2.5 Technical & Device Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, browser type and version;
• Cookies and similar tracking technologies as described in Section 6;
• Access logs and error logs generated during use of the Platform.

2.6 Communications Data

• Records of all communications between you and yes2win's customer support team, including live chat transcripts, email correspondence, and support ticket content;
• Your stated preferences regarding marketing communications.

3. How We Collect Your Data

yes2win collects personal data through the following means:

3.1 Directly from You

The majority of personal data yes2win processes is provided directly by you during the account registration process, through KYC document submission, when you make deposits or withdrawals via the cashier, when you contact yes2win customer support, or when you update your account profile or responsible gaming settings.

3.2 Automatically Through Platform Use

When you access and use the yes2win Platform, certain technical and activity data is collected automatically through server logs, cookies, and similar technologies. This includes your IP address, device information, and detailed records of all gaming activity on your account.

3.3 From Third-Party Service Providers

yes2win may receive personal data from regulated third-party service providers engaged to assist with identity verification, fraud prevention, and AML compliance. For example, yes2win's KYC verification provider may return identity confirmation or risk-scoring data in connection with your account registration. yes2win's payment processors provide transaction confirmation and payment method verification data.

4. Purposes & Legal Basis for Processing

yes2win processes personal data only where a lawful basis for processing exists. The table below summarises the primary processing purposes and the corresponding legal basis for each:

5. Data Sharing & Third Parties

yes2win does not sell personal data. Personal data is shared only with the following categories of third parties, and only to the extent strictly necessary for the stated purpose:

5.1 Regulated Service Providers

• Payment processors — Touch n Go eWallet, Boost, Maybank, CIMB, GrabPay, and USDT network providers receive transaction data necessary to process deposits and withdrawals;
• KYC / identity verification providers — regulated identity verification partners receive submitted KYC documents and return verification outcomes;
• Fraud prevention providers — specialist fraud and AML screening services receive account and transaction data for risk assessment;
• Game content providers — game studios such as Evolution Gaming, Pragmatic Play, PG Soft, and others receive session data necessary for game delivery and outcome certification;
• Cloud infrastructure providers — yes2win's hosting and cloud infrastructure partners process data in the course of providing secure platform hosting services.

5.2 Regulatory & Legal Disclosure

yes2win will disclose personal data to gaming regulators, law enforcement authorities, financial intelligence units, or other governmental bodies where required to do so by applicable law, court order, or regulatory direction. yes2win will, where legally permitted, notify affected players of such disclosures.

5.3 No Sale of Data

yes2win does not sell, rent, or otherwise commercialise personal data to any third party for marketing, advertising, data brokerage, or profiling purposes. Third parties engaged by yes2win as data processors are contractually prohibited from using yes2win player data for any purpose other than the specific service for which they are engaged.

6. Cookies & Tracking Technologies

yes2win uses cookies and similar technologies on the Platform for the purposes of session management, security, platform analytics, and the delivery of personalised gaming experiences. The following categories of cookies are used:

• Strictly Necessary Cookies — required for the Platform to function. These include session cookies that maintain your logged-in state and security cookies used for fraud prevention. These cannot be disabled.
• Functional Cookies — remember your preferences such as language settings and responsible gaming configurations. These can be disabled, but doing so may affect Platform functionality.
• Analytics Cookies — used to understand how players use the Platform, which pages are visited most frequently, and where technical errors occur. Analytics data is aggregated and does not identify individual users. These can be disabled via your browser settings.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may impact your ability to use features of the yes2win Platform. yes2win does not use cross-site tracking cookies or share cookie data with third-party advertising networks.

7. Data Retention

yes2win retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to mandatory minimum retention periods imposed by applicable gaming licensing regulations and financial crime prevention laws.

As a general guide: account and KYC data is retained for a minimum of 5 years following account closure; transaction records are retained for a minimum of 5 years; gaming activity records are retained for the duration of account operation plus 5 years. Communications records are retained for 2 years from the date of communication. Where data is retained solely to comply with legal obligations, it is not used for any other purpose during the retention period.

At the end of the applicable retention period, yes2win securely deletes or anonymises personal data in a manner that prevents reconstruction of the original data.

8. Data Security

yes2win implements a comprehensive information security programme designed to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction. Security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the yes2win Platform;
• Encryption of sensitive data at rest, including financial data and identity documents;
• Role-based access controls ensuring yes2win staff access personal data only where necessary for their specific role;
• Multi-factor authentication required for all yes2win staff accessing systems containing personal data;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Security incident response procedures including notification protocols for data breaches where required by applicable law.

9. Your Rights as a Data Subject

Subject to applicable data protection law and yes2win's regulatory obligations, you have the following rights in respect of your personal data:

• Right of Access — you may request a copy of the personal data yes2win holds about you;
• Right to Rectification — you may request correction of inaccurate or incomplete personal data;
• Right to Erasure — you may request deletion of personal data where yes2win no longer has a lawful basis for retaining it. Note that yes2win's regulatory retention obligations may limit the scope of erasure requests;
• Right to Restriction — you may request that yes2win restrict processing of your personal data in certain circumstances;
• Right to Portability — you may request that yes2win provide your personal data in a structured, commonly used, machine-readable format;
• Right to Object — you may object to processing based on legitimate interests, including direct marketing;
• Right to Withdraw Consent — where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact yes2win's data protection team at [email protected]. yes2win will respond to valid requests within 30 days. Identity verification will be required before yes2win acts on a data subject request.

10. Children & Age Verification

The yes2win Platform is strictly intended for individuals aged 21 years and above. yes2win does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process for all registered accounts.

If yes2win becomes aware that personal data has been collected from an individual under the age of 21, yes2win will immediately close the associated account, delete the personal data, and return any deposited funds to their source. If you have reason to believe that an individual under 21 has registered on the yes2win Platform, please contact yes2win support immediately.

11. International Data Transfers

yes2win operates under international gaming authority licensing and uses cloud infrastructure and third-party service providers that may process personal data in locations outside Malaysia. Where personal data is transferred internationally, yes2win ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under yes2win's applicable data protection obligations.

Safeguards may include: contractual data protection clauses binding the recipient to appropriate data protection standards; transfers to jurisdictions that have received a data protection adequacy determination; or other legally recognised transfer mechanisms. By using the yes2win Platform, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia for the purposes described in this Policy.

12. Changes to This Policy & Contact

yes2win reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered players via the Platform notification system or registered email address, with a minimum of 7 days' notice before taking effect where practicable. The current version of this Policy, with its effective date and version number, is always available on this page.

For all privacy-related enquiries, data subject requests, or concerns about how yes2win handles your personal data, please contact yes2win's data protection team:

• Via live chat within the yes2win Platform (available 24/7)
• By email: [email protected]

yes2win aims to acknowledge all privacy enquiries within 48 hours and resolve them within 30 days. Where you remain unsatisfied with yes2win's handling of a privacy concern, you may escalate the matter to the applicable regulatory authority under yes2win's gaming licence.