Privacy Policy 60win — Our Commitment to Protecting Malaysian Players' Data

This Privacy Policy ("Policy") is published by 60win and applies to all players, visitors, and users of the 60win platform — including the website, mobile app, and all related services operated by us.

This document outlines the types of personal data we collect, the purposes for which it is collected, how it is used and protected, how long it is retained, and your rights as a data subject. This Policy is developed in accordance with the Malaysia Personal Data Protection Act 2010 (PDPA) and international best practices in data privacy.

We take our responsibilities as a data controller seriously. Every decision regarding data handling at 60win through internal privacy reviews to ensure the rights of our Malaysian users are fully upheld.

60win collects personal data through several channels — directly from you during registration and platform use, automatically via tracking technologies, and in certain cases, from legitimate third-party sources.

2.1 Data You Provide Directly

2.2 Automatically Collected Data

When you visit the 60win, our systems automatically record technical information such as your IP address, device and browser type, operating system, pages visited, session duration, and other usage data required for the proper operation of the platform.

2.3 Data from Third-Party Sources

In certain circumstances, 60win may receive data from legitimate third parties — for example, identity verification agencies for KYC/AML purposes, or payment providers such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, Maybank2u, and CIMB Clicks to process your financial transactions. This data is used solely for the stated purposes.

Personal data collected by 60win used solely for lawful and transparent purposes. We do not use your data beyond the scope stated below without first obtaining your additional consent.

• Account Operations & Services: Creating and managing your account, processing deposits and withdrawals via local Malaysian payment methods, and providing access to all 60win games and services.
• Legal Compliance (KYC/AML): Verifying your identity in accordance with the Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements mandated by law. This includes an age verification check to confirm that you are 21 years of age or older.
• Security & Fraud Prevention: Detecting suspicious activity, protecting your account from unauthorised access, and preventing fraud and money laundering on the platform.
• Service Communications: Sending you important notifications related to your account, security updates, transaction confirmations, and necessary technical information.
• Marketing (with Consent): Sending promotional information, bonus offers, and the latest 60win news — only if you have given consent to receive marketing communications at registration or at a later date.
• Platform Enhancement: Analysing usage patterns in aggregate and anonymised form to improve the design, performance, and user experience of the 60win platform.

60win reaffirms our commitment: we does not sell your personal data to any third party for commercial purposes. However, in the limited circumstances described below, data sharing may occur:

4.1 Trusted Service Providers

60win works with carefully selected third-party service providers to operate the platform — including payment providers (Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, Maybank2u via FPX, and CIMB Clicks), cloud services, and analytics tools. All such providers are bound by strict data protection agreements and are only permitted to process your data in accordance with specific instructions from 60win.

4.2 Legal Obligations

60win may be required to disclose certain data to Malaysian authorities (such as Bank Negara Malaysia, the Royal Malaysia Police, or the courts) upon receipt of a valid directive or court order. In such circumstances, we will comply with all legal requirements while protecting your rights to the fullest extent permitted.

Protecting your personal data is the highest technical priority at 60win. We continually invest in security infrastructure built on the latest technology:

• 256-bit SSL/TLS Encryption: All communications between your browser or app and 60win's servers are encrypted to the highest industry standard.
• Data-at-Rest Encryption: Sensitive data stored in 60win's databases — including financial information and passwords — is encrypted using AES-256 encryption.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA for an additional layer of security on their accounts.
• 24/7 Monitoring: The 60win cybersecurity team continuously monitors systems to detect and respond to threats in real time.
• Regular Security Audits: The 60win platform undergoes periodic independent security audits by certified cybersecurity firms to identify and remediate any vulnerabilities.
• Internal Access Controls: Access to players' personal data within the 60win organisation is restricted to staff who require it to perform their duties, based on the principle of least privilege.

60win uses cookies and similar tracking technologies to ensure the platform operates smoothly and to deliver a personalised experience for you.

6.1 Types of Cookies Used

You can manage your cookie settings through your web browser settings. However, disabling essential cookies may affect the functionality of the platform. 60win. We do not use third-party cookies for targeted advertising purposes.

60win retains your personal data only for as long as necessary to fulfil the original purpose of collection or to comply with legal obligations. The following outlines our general data retention policy:

• Active account data: Retained for the duration your account remains active
• Financial transaction data: Retained for 7 years after the transaction date, in compliance with Malaysian legal requirements governing financial records
• Communication logs: Retained for 2 years for customer support and dispute resolution purposes
• Closed account data: Personal identification data is deleted within 90 days of account closure, except where retention is required for legal compliance
• Marketing data: Deleted immediately upon unsubscription or deletion request

Once the retention period expires, data will be securely deleted using methods that ensure it cannot be recovered or accessed again.

As a player 60win and data subjects under Malaysia's PDPA, you have the following rights regarding your personal data:

To exercise any of the above rights, contact the privacy team 60win via email at privacy@60win-khelo.com or through the in-platform live chat. Requests will be acknowledged within 2 business days and resolved within 14 business days.

60win is an entertainment platform for adults aged Age 21 and above only. We do not knowingly collect or process personal data of individuals under the age of 21.

60win's systems apply a strict age verification process at registration and at the time of the first withdrawal. If we determine that a user under the age of 21 has registered an account, the account will be closed immediately and all associated data will be deleted as soon as possible in accordance with applicable law.

In the course of operating the platform, 60win may transfer your personal data to servers or service providers operating outside Malaysia. When such transfers occur, we ensure protection equivalent to Malaysian PDPA standards through:

• Binding data processing agreements with all international service providers
• Use of recognised transfer mechanisms such as Standard Contractual Clauses
• Use of providers holding recognised data protection certifications
• Data protection impact assessments prior to any new transfer commencing

Core infrastructure 60win hosted in data centres that comply with the international ISO 27001 security standard, ensuring your data is protected regardless of the physical server location.

60win reserves the right to amend this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or to enhance transparency for our players.

For material changes, we will notify you via in-platform notifications and/or email to the address registered to your account at least 14 days before the amendment takes effect. For minor changes that do not affect your fundamental rights, we will update this page with the new amendment date.

Continued use of the platform 60win after an amendment takes effect will be considered acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

Effective date: 1 January 2026 | Version: 2.4 | Language: Bahasa Melayu (ms-MY) | Compliant with: Malaysia PDPA 2010

For any questions, concerns, or requests regarding your privacy and personal data on the 60win, you may reach our privacy team through the following channels:

• Privacy Email: privacy@60win-khelo.com — dedicated to privacy-related enquiries
• General Support Email: support@60win-khelo.com
• Live Chat 24/7: Available on the platform after logging into your account
• WhatsApp Support: Number available in the "Contact Us" section after logging in

Our privacy team will acknowledge your request within 2 business days and will provide a full response within 14 business days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.