Privacy Policy Bewin — Personal Data Protection for Malaysian Players

Bewin collects your personal data through several means — directly when you register or interact with the platform, and automatically through the use of standard tracking technologies. Below are the categories of data we collect:

Bewin does not collect credit or debit card details directly — all financial transactions are processed through PCI-DSS certified third-party payment processors. We also do not collect biometric data or any other sensitive data beyond what is required for standard identity verification.

Bewin uses collected data solely for legitimate and specific purposes. Below is a full list of the purposes for which Bewin uses your data, along with the applicable legal basis for each:

• Service provision: To process account registration, verify identity, and handle deposits and withdrawals via Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as to give you access to all games on the Bewin platform.
• Account security: To detect and prevent unauthorised access, fraud, money laundering, and platform abuse. This includes analysing unusual login patterns and suspicious betting activity.
• Customer support: To enable Bewin's support team to assist you effectively — previous interaction records help our agents understand the context of your issue without you having to explain everything from scratch each time.
• Legal compliance: To fulfil our obligations under the Personal Data Protection Act 2010, anti-money laundering regulations, and age verification requirements (players must be 21 years of age or older).
• Platform improvements: To analyse usage patterns in aggregate and anonymised form, helping us understand which games are most popular among Malaysian players, which parts of the platform are most frequently used, and where the user experience can be improved.
• Marketing communications: To send you relevant promotional offers and bonus information — but only where you have given explicit consent. You can opt out of marketing communications at any time through your profile settings.
• VIP & loyalty programme: To manage Bewin's VIP programme — monitoring eligibility for VIP tier upgrades, calculating reward points, and ensuring VIP benefits are accurately credited to qualifying players.

Bewin will not use your data to make automated decisions that materially affect you without human involvement — including during the KYC verification process and other significant account decisions.

Bewin does not sell your personal data to anyone. However, in the course of operating our services, there are certain situations where your data may be shared with selected and trusted third parties:

• Payment processors: When you make a deposit or withdrawal via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks), the required transaction details are shared with the relevant payment processor to complete the transaction. These processors are bound by strict data security agreements with Bewin.
• Game software providers: Providers such as PG Soft, Pragmatic Play, Evolution Gaming, and JILI Games may receive game session information required to run the games. This data is kept to the minimum necessary and does not include your full personal identity information.
• Identity verification service providers: For KYC purposes, Bewin uses approved third-party identity verification services to authenticate the documents you submit. This information is processed securely and is not retained beyond what is required for verification.
• Legal authorities: Bewin will disclose data to the relevant authorities when required to do so by law, court order, or a valid law enforcement investigation. In such cases, Bewin will endeavour to notify you in advance where permitted to do so.
• Analytics providers: Bewin uses analytics services to understand how the platform is used. Data shared for this purpose is aggregated and anonymised to the greatest extent possible.

Protecting player personal data is a responsibility we take very seriously. Bewin has implemented multiple layers of technical and operational safeguards to keep your data secure:

• Transmission encryption: All communication between your device and the Bewin platform is encrypted using TLS 1.3 — the latest encryption protocol, ensuring your data cannot be intercepted in transit.
• Storage encryption: Sensitive data stored in Bewin's databases — including identity information and financial records — is encrypted using AES-256 encryption at rest.
• Role-based access controls: Bewin staff can only access data relevant to their job responsibilities. A customer support manager, for example, cannot access detailed financial records unless it is necessary to resolve a specific support case.
• 24/7 security monitoring: Bewin's systems are continuously monitored to detect suspicious activity, intrusion attempts, or unusual access patterns. Any security incidents are promptly handled by our cybersecurity team.
• Regular security audits: Bewin undergoes periodic independent security assessments by qualified third parties to identify and address any vulnerabilities before they can be exploited.
• Two-factor authentication (2FA): Bewin supports two-factor authentication for player accounts. We encourage all players to enable this additional security feature in their profile settings.

While Bewin takes all reasonable steps to protect your data, no system can be 100% breach-proof. We therefore also ask for your cooperation in keeping your own password and account information secure.

Bewin retains your personal data for as long as necessary to fulfil the original purpose of collection or to meet our legal obligations, whichever is longer. The following are our data retention guidelines by category:

• Active account data: For as long as your account remains active with Bewin, your core account data will be retained in full to ensure you can use the platform without interruption.
• Financial and transaction data: Financial transaction records are retained for a minimum of 7 years after the transaction date — this is a legal compliance requirement in Malaysia relating to financial records and anti-money laundering.
• KYC and identity verification records: Identity verification documents are retained for the duration of the active account period plus 5 years after account closure to meet legal compliance requirements.
• Customer support records: Customer support conversation records are retained for 3 years to allow for reference should any dispute arise in the future.
• Marketing data: If you withdraw consent for marketing communications, your information will be removed from our marketing lists within 30 days.

Once data is no longer needed and there is no legal obligation to retain it, Bewin will delete or anonymise that data using secure, irreversible methods.

The Bewin platform uses cookies and similar tracking technologies to ensure the platform functions correctly and to deliver a better experience for you. Below are the types of cookies we use:

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the Bewin platform. For guidance on managing cookies in popular browsers such as Chrome, Firefox, or Safari, please refer to the respective browser's documentation.

Under Malaysia's Personal Data Protection Act 2010 and Bewin's internal policies, you have the following rights over the personal data we hold:

Bewin sends communications to members through several channels — email, app notifications, and WhatsApp. These communications fall into two categories:

• Service communications (non-opt-out): This includes deposit and withdrawal confirmations, account security notifications, important terms change notices, and critical information relating to your account. These communications are sent regardless of your marketing preferences as they form part of the service you use.
• Marketing communications (opt-out available): This includes new bonus offers, game promotions, the latest jackpot updates, and exclusive VIP offers. You will only receive these communications if you have given your consent — either during registration or at any time afterwards through your profile settings.

To stop receiving marketing communications:

• Click the "Unsubscribe" link at the bottom of any Bewin marketing email.
• Go to Profile Settings → Notifications → Uncheck the relevant marketing options.
• Contact the Bewin support team via live chat and request to be removed from the marketing list.

Bewin will process unsubscribe requests within 10 business days. Please note that you may still receive some marketing emails during that processing period.

Bewin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or changes in how the Bewin platform operates. The "Last updated" date at the top of this document will be revised whenever changes are made.

For material changes — that is, changes that significantly affect how we use your personal data — Bewin will endeavour to provide you with notice of at least 14 days before the changes take effect, via your registered email or a prominent notification within the platform.

Continued use of the Bewin platform after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree with the changes made, you have the right to stop using the platform and close your account by contacting the Bewin support team.

Bewin encourages you to review this Privacy Policy regularly — at least once every six months — to stay informed about how your personal data is managed.

If you have any questions, concerns, or complaints regarding how Bewin handles your personal data, please contact us through the following channels:

• Privacy Email: support@bewin.run (use the subject line "Data Privacy Enquiry" for priority handling)
• 24/7 Live Chat: Available directly from any page on the Bewin platform — average response time under 2 minutes
• WhatsApp: Available in your Bewin support profile information — average response time under 5 minutes

Bewin will acknowledge receipt of a privacy request within 2 business days and provide a full response within 30 business days. If your request is complex or requires additional time, we will notify you of the expected timeline.

If you are not satisfied with how Bewin has handled your privacy request, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.