Privacy Policy Infiniwin

1 Information Collected

Infiniwin collects your personal information for the purpose of providing a secure, responsible, and legally compliant platform service. We only collect information that is strictly necessary for those purposes — nothing more.

Information you provide directly:

• Full name, date of birth, and identification number (MyKad / passport)
• Email address, phone number, and residential address
• Bank account or digital wallet details for payment processing
• KYC verification documents such as copies of your ID card, utility bills, or bank statements
• Game preferences and account settings that you have configured yourself

Information collected automatically:

• IP address, device type, operating system, and browser version
• Platform activity logs including login times, games played, and transactions made
• Technical performance data such as response times and error reports
• Approximate location information based on IP address for geographic region verification

2 How We Use Your Data

Collected data is used responsibly and only for legitimate purposes within the context of infiniwin platform operations. We do not use your data for purposes unrelated to the services you use.

• Identity verification and KYC: Ensuring all users meet the age and eligibility requirements set by law.
• Payment processing: Verifying deposit and withdrawal transactions securely and efficiently through your preferred payment method.
• Account security: Detecting and preventing unauthorised access, fraud, or suspicious activity on your account.
• Personalize your experience: Personalising game recommendations and promotions based on your preferences and usage patterns.
• Service communications: Sending important notifications regarding your account, transactions, system updates, and relevant promotional offers.
• Legal compliance: Fulfilling reporting obligations to relevant authorities under anti-money laundering (AML) laws and related regulations.
• Platform improvements: Analysing usage patterns in aggregate (without identifying individuals) to improve service quality.

We do not use your data to make automated decisions that could materially affect your rights without human involvement. Any significant decisions regarding your account will be subject to review by our team.

3 Information Sharing

Infiniwin takes a strictly controlled approach to user data sharing. We do not share, sell, or transfer your personal data to third parties without a legitimate and clearly defined reason.

Your data may be shared in the following limited circumstances:

• Trusted service providers: Technical partners such as payment gateway providers (DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost), KYC providers, and cloud infrastructure providers are bound by strict confidentiality agreements.
• Game providers: Minimum technical data required to operate third-party games available on our platform.
• Legal requirements: When required by court order, law enforcement agencies, or relevant regulatory authorities in Malaysia.
• Rights protection: To investigate, prevent, or take action against illegal activities, fraud, or security threats involving our platform.

4 Data Security

Infiniwin continuously invests in the latest security infrastructure to ensure your personal data remains protected at all times. Our security systems are built on a "defence-in-depth" approach — each layer provides additional protection should the previous one fail.

• Data in transit encryption: All communications between your device and our servers use TLS 1.3 protocol with 256-bit encryption.
• Data at rest encryption: Personal data and financial information stored in our databases are encrypted using AES-256 standards.
• Role-based access control: Staff may only access data required to perform their job duties — the principle of "least privilege" is strictly observed.
• 24/7 Monitoring: Our intrusion detection system continuously monitors platform activity and will issue immediate alerts upon detecting suspicious patterns.
• Regular security audits: Security assessments and penetration testing are conducted periodically by independent third parties.
• Two-Factor Authentication (2FA): We encourage all users to enable 2FA for an added layer of protection on their accounts.

While infiniwin takes all reasonable steps to protect your data, no system can guarantee 100% absolute security. We therefore encourage users to also take protective measures such as using strong passwords and not sharing their login credentials.

5 Cookies & Tracking

Infiniwin uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how our platform is used. The following are the types of cookies we use:

• Session cookies: Required to maintain your login session and ensure the platform functions correctly. These cookies are automatically deleted when you close your browser.
• Functional cookies: Saving your preferences such as language, display settings, and game preferences so you do not need to reconfigure them each time.
• Analytics cookies: Helping us understand how users interact with the platform — which pages are most popular, how much time is spent, and where users encounter difficulties. This data is processed in aggregate and does not identify individuals.
• Security cookies: Used to detect suspicious login attempts, prevent CSRF attacks, and protect your account from unauthorised access.

You can manage or block cookies through your browser settings. Please note, however, that blocking certain cookies may affect platform functionality and your user experience. Cookies required for security cannot be blocked without compromising our ability to protect your account.

6 User Rights

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding your personal data. infiniwin fully respects and facilitates the exercise of these rights.

To exercise any of the above rights, please contact our support team through the official in-platform channels. We may need to verify your identity before processing your request to ensure the security of your data.

7 Data Storage

Infiniwin retains your personal data for as long as your account is active or as long as necessary to provide services to you. After an account is closed, we may still be required to retain certain data for a period prescribed by law.

• Active account data: Retained for the duration your account remains active, plus the mandatory period under Malaysia's AML laws (minimum 6 years from account closure date).
• Financial transaction records: Retained for 7 years in line with Malaysia's accounting and financial legal requirements.
• Customer support communication logs: Retained for 3 years for reference and dispute resolution purposes.
• Security and audit logs: Retained for 2 years to enable security incident investigations if required.
• Aggregated analytics data: May be retained indefinitely as it contains no personally identifiable information.

Once the retention period expires, your personal data will be securely deleted or anonymized using methods that ensure the data cannot be recovered.

8 Data Transfers

In the course of platform operations, some data may be processed or stored outside Malaysia by trusted service partners. infiniwin ensures that all cross-border data transfers comply with applicable legal requirements.

• All data transfers outside Malaysia are carried out with adequate contractual protections through data transfer agreements that comply with international data protection standards.
• Partners that receive your data outside Malaysia are subject to periodic security audits by infiniwin.
• The most sensitive data, such as KYC documents, is prioritised for storage within Malaysia where practicable.

9 Children's Privacy

The infiniwin platform is intended for users aged 18 years and above only. We do not intentionally collect personal data from individuals under the age of 18.

If we discover that personal data of a child has been collected unintentionally, we will take immediate steps to:

• Closing the account in question immediately.
• Deleting all personal data associated with the account.
• Returning any deposited funds (where applicable) in accordance with established procedures.

If you believe that someone under the age of 18 has created an account on infiniwin, please notify our support team immediately so that appropriate action can be taken.

10 Policy Changes

Infiniwin reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. We are committed to being transparent about any changes made.

• Any material changes to this Privacy Policy will be communicated to users via their registered email at least 14 days before the changes take effect.
• The latest version of the Privacy Policy is always available on this page with a clear last-updated date.
• Continued use of the infiniwin platform after changes take effect will be considered acceptance of the updated terms.
• If you disagree with any changes made, you have the right to close your account before the changes take effect.

We recommend checking this page periodically to ensure you are always up to date on how we protect your privacy.

11 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, our team is ready to assist you.

• Support email: [email protected]
• Operating hours: 24 hours a day, 7 days a week
• Support languages: Malay and English
• Target response time: Within 1 working day for general inquiries; 5 working days for data rights requests.

For requests related to personal data rights (access, correction, deletion), please clearly state the type of request and include sufficient identity verification information to facilitate the process. All requests will be logged and processed in accordance with established procedures.