ddwin Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how ddwin ("we", "us", "our", "the Company"), operator of the online gaming platform at https://ddwin.bio ("the Platform"), collects, uses, stores, and protects the personal data of individuals ("you", "your", "the Player") who register, access, or use the Platform.

ddwin is committed to handling personal data responsibly, transparently, and in compliance with applicable data protection law and its international gaming authority licensing obligations. By registering an account with ddwin, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions, which are available at /terms-conditions. Capitalized terms used in this Policy that are not defined herein have the meaning given to them in the Terms & Conditions.

2. Data We Collect

2.1 Registration Data

When you create a ddwin account, we collect the following personal data necessary to establish and maintain your account:

• Full legal name (as it appears on your government-issued identity document);
• Date of birth (to verify the mandatory 21+ age requirement);
• Email address;
• Mobile phone number;
• Residential address;
• Chosen username;
• Preferred currency (MYR for Malaysian players).

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer ("KYC") obligations under international gaming authority licensing, we collect and process:

• Copies of government-issued identity documents (Malaysian MyKad, passport, or equivalent);
• Proof of residential address (utility bill, bank statement, or equivalent dated within 90 days);
• Proof of payment method ownership (where required for withdrawal processing);
• Source of funds documentation (in limited cases where enhanced due diligence is triggered).

2.3 Financial Transaction Data

ddwin processes and retains records of all financial transactions on your account, including:

• Deposit amounts, timestamps, and payment method references;
• Withdrawal requests, amounts, processing timestamps, and destination method references;
• Bonus credits, wagering activity, and bonus completion records;
• Account balance history.

2.4 Gameplay Activity Data

We maintain records of your gambling activity on the Platform, including game sessions, bet amounts, game outcomes, session duration, and responsible gaming tool usage. This data is used for account integrity, dispute resolution, and responsible gaming monitoring.

2.5 Technical & Device Data

When you access the Platform, we automatically collect technical data including your IP address, device type and operating system, browser type and version, referring URL, pages visited, session duration, and login timestamps. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

2.6 Communications Data

When you contact ddwin via Live Chat, email, or other channels, we retain records of those communications, including the content of messages and the resolution provided, for quality assurance, dispute resolution, and training purposes.

3. How We Use Your Data

ddwin uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and operating your ddwin account, including processing deposits, withdrawals, and gameplay;
• Identity verification and compliance: Fulfilling KYC, AML, and age-verification obligations under our international gaming authority licensing requirements;
• Fraud detection and prevention: Monitoring account activity for indicators of fraud, collusion, bonus abuse, money laundering, or other prohibited conduct;
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviour and to administer self-exclusion, deposit limit, and loss limit requests;
• Customer support: Responding to enquiries, resolving disputes, and providing account assistance;
• Security: Protecting the Platform against unauthorised access, cyberattacks, and data breaches;
• Marketing (with consent): Sending promotional communications about ddwin bonuses, promotions, and new features where you have opted in to receive such communications;
• Platform improvement: Analysing aggregate usage data to improve the design, performance, and game offering of the Platform;
• Legal compliance: Retaining records and responding to requests from regulatory or law enforcement authorities as required by applicable law.

4. Legal Basis for Processing

ddwin processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and ddwin (i.e., your account and these Terms), including account creation, deposit processing, gameplay, and withdrawals;
• Legal obligation: Processing required to comply with KYC, AML, age-verification, record-keeping, and regulatory reporting obligations under our gaming licence;
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, and platform improvement where our legitimate interests are not overridden by your rights;
• Consent: Processing for direct marketing communications, where your explicit opt-in consent has been obtained and can be withdrawn at any time.

5. Data Sharing

ddwin does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following limited circumstances:

• Payment processors: Transaction data is shared with the relevant payment service providers (Touch n Go, Boost, Maybank, CIMB, Public Bank, or crypto settlement services) solely to process your deposits and withdrawals;
• Game providers: Technical account identifiers may be passed to our licensed game providers to enable gameplay. No more personal data than necessary is shared;
• KYC/AML service providers: Identity documents may be processed by our third-party identity verification and AML screening providers operating under contractual data processing agreements;
• Regulatory and law enforcement authorities: We may disclose personal data where required by law, court order, or request from a competent regulatory or law enforcement authority;
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, player data may be transferred to the successor entity subject to the same data protection commitments.

All third parties with whom ddwin shares personal data are required to handle it in accordance with applicable data protection law and are prohibited from using it for any purpose beyond the specific service they provide to ddwin.

6. Cookies & Tracking Technologies

ddwin uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us maintain your session, remember your preferences, and analyse Platform usage.

6.1 Types of Cookies Used

• Essential cookies: Required for basic Platform functionality, including maintaining your login session and security tokens. These cannot be disabled without affecting Platform operation;
• Analytics cookies: Used to collect aggregate, anonymised data about how players navigate and use the Platform. This data helps us improve page performance and user experience;
• Preference cookies: Used to remember your settings and preferences (such as language and display preferences) between sessions;
• Security cookies: Used to detect and prevent fraudulent logins and unauthorised access attempts.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. ddwin does not use third-party advertising cookies or behavioural targeting cookies.

7. Data Retention

ddwin retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention periods driven by our licensing obligations:

• Account and KYC data: Retained for a minimum of 5 years from the date of account closure or the last transaction, as required by AML regulations;
• Transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Gameplay records: Retained for a minimum of 3 years;
• Support communications: Retained for 2 years from the date of the last communication;
• Marketing consent records: Retained until you withdraw consent, plus an additional 1 year for compliance documentation.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

ddwin implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage of sensitive personal data and identity documents at rest;
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need;
• Automated intrusion detection and security monitoring systems;
• Regular security audits and penetration testing of Platform infrastructure;
• Two-factor authentication available to all registered players for account login.

While ddwin takes all reasonable steps to protect your data, no system is completely impenetrable. In the event of a data breach affecting your personal data, ddwin will notify affected players and relevant regulatory authorities as required by applicable law.

9. Your Rights

Subject to applicable data protection law and our legitimate regulatory retention obligations, you have the following rights in relation to your personal data held by ddwin:

• Right of access: You may request a copy of the personal data ddwin holds about you;
• Right of rectification: You may request correction of inaccurate or incomplete personal data;
• Right of erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements;
• Right to restrict processing: You may request that ddwin restrict its processing of your data in certain circumstances;
• Right to data portability: You may request a machine-readable copy of data you have provided to ddwin, where technically feasible;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to object: You may object to processing based on legitimate interests where your rights and freedoms override those interests.

To exercise any of these rights, contact the ddwin Data Protection team via Live Chat or at [email protected]. We will respond within 30 days of receiving a valid request.

10. Children's Privacy

The ddwin Platform is strictly intended for individuals aged 21 and above. ddwin does not knowingly collect personal data from individuals under 21 years of age. If ddwin discovers that an account was registered by an individual under 21, the account will be immediately closed, all data will be deleted to the extent not required for legal compliance, and any deposited funds will be handled in accordance with applicable law.

If you are the parent or guardian of a minor and believe they have accessed the Platform, please contact ddwin support immediately via Live Chat.

11. International Data Transfers

ddwin's Platform is operated under an international gaming authority licence and certain data processing activities (including KYC verification, game server hosting, and payment processing) may involve the transfer of personal data to service providers located outside Malaysia. Where such transfers occur, ddwin ensures that appropriate safeguards are in place — such as contractual data processing agreements incorporating standard data protection clauses — to provide an adequate level of protection consistent with this Policy.

12. Changes to This Policy

ddwin may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. Where changes are material, we will notify registered players via the email address on file or via an in-platform notification prior to the changes taking effect. The date of the most recent revision is indicated at the top of this document. Continued use of the Platform following notification of any update constitutes acceptance of the revised Policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ddwin, please contact us through the following channels:

• Live Chat: Available 24/7 via the Platform website — the fastest way to reach the support team
• Email: [email protected]
• Support Hours: 8:00 AM – 12:00 AM MYT (Live Chat); Email monitored daily during business hours

ddwin aims to acknowledge all data-related requests within 5 business days and to respond substantively within 30 calendar days.