All data transmitted between your device and the 28win Platform is encrypted with 256-bit SSL. Your login credentials, payment details, and personal information are never exposed in transit.
28win does not sell, rent, or commercially transfer your personal data to any third party for marketing or profiling purposes. Your data is used solely to operate your account and improve your experience.
Payment data processed via Maybank, CIMB, Touch 'n Go eWallet, Boost, and FPX is handled through tokenised gateways. We never store your full bank account number or card details on our servers.
You may request access to, correction of, or deletion of your personal data at any time by contacting our support team. We will action all verified requests within the timeframes stated in this Policy.
Access to player data within 28win is restricted to authorised personnel on a strict need-to-know basis. KYC documents are subject to additional access controls and are reviewed only by trained compliance staff.
28win reviews this Privacy Policy at least annually. When changes are made, we notify active players via email or a prominent platform notice before the updated version takes effect.
Table of Contents
1Introduction
This Privacy Policy (the "Policy") is published by 28win (the "Company", "We", "Us", or "Our"), the operator of the online gambling and sports betting platform located at https://28win.cam (the "Platform"). This Policy sets out, in clear and transparent terms, how we collect, process, store, share, and protect the personal data of individuals who register and interact with our Platform, with particular reference to our users based in Malaysia.
28win is committed to protecting the privacy and personal data of all Platform users. This commitment is reflected in our internal data governance practices, our use of industry-standard security technologies, and our adherence to applicable data protection principles. We collect only the data we need to operate the Platform effectively and to comply with our legal and regulatory obligations.
By registering an account on the 28win Platform, depositing funds, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should cease using the Platform and contact our support team to request account closure.
Scope: This Policy applies to all personal data collected by 28win through the Platform, including data collected via account registration, payment processing, KYC verification, and your ongoing use of Platform features. It does not apply to third-party websites that may be linked from the Platform.
2Definitions
For the purposes of this Privacy Policy, the following defined terms shall apply:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, contact details, payment information, and device identifiers. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, deletion, or destruction. |
| "Data Subject" | The individual to whom the personal data relates — in the context of this Policy, this means you, the registered player or Platform visitor. |
| "Data Controller" | 28win, as the entity that determines the purposes and means of processing personal data collected through the Platform. |
| "Third-Party Processor" | Any external organisation engaged by 28win to process personal data on the Company's behalf, including payment gateway providers, identity verification services, and customer support platforms. |
| "KYC" | Know Your Customer — the identity and age verification process conducted by 28win prior to enabling full withdrawal rights on a player's account. |
| "Cookies" | Small data files placed on your device by the Platform's web server to store session information, preferences, and anonymised analytics data. |
3Data We Collect
28win collects the following categories of personal data from Platform users. We collect only the data that is necessary for the stated purpose and do not retain data beyond the periods described in Section 8.
- Full legal name
- Date of birth
- Malaysian MyKad / passport number
- Nationality and residential address
- Profile photograph (KYC)
- Email address
- Mobile phone number
- Residential city and postcode
- Preferred language
- Bank account name and masked number
- E-wallet identifiers (TnG, Boost, GrabPay)
- Cryptocurrency wallet addresses
- Transaction history (deposits and withdrawals)
- Source of funds declarations
- Wager history and settled bet records
- Preferred markets (e.g., EPL, Liga Super Malaysia)
- Bonus usage and wagering progress
- Session durations and frequency
- VIP tier and loyalty points balance
- IP address and geolocation (city-level)
- Device type, OS, and browser
- Session timestamps and login history
- Referral source and UTM parameters
- Live chat transcripts
- Email correspondence with support
- Feedback and complaint records
- Promotional opt-in preferences
4How We Collect Your Data
28win collects personal data through the following means:
4.1 Direct Collection
You provide data directly to us when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or respond to a promotional communication. This constitutes the primary source of the personal data we hold about you.
4.2 Automated Collection
When you access the Platform, our servers automatically record technical data including your IP address, device fingerprint, browser type, and session activity. This data is collected through server logs, cookies, and analytics tools as described in Section 9, and is used primarily for fraud prevention, security monitoring, and platform performance optimisation.
4.3 Third-Party Sources
In certain circumstances, 28win may receive data about you from third parties where we have a legitimate basis to do so. This may include identity verification responses from KYC service providers, fraud screening signals from payment processors, and responsible gambling flag notifications from self-exclusion registries. We do not purchase data lists or receive marketing data from external brokers.
5Data Processing
28win processes your personal data for the following specific purposes:
| Purpose | Data Used | Basis |
|---|---|---|
| Account registration and management | Identity, contact data | Contract performance |
| Age and identity verification (KYC) | Identity, document scans | Legal obligation |
| Processing deposits and withdrawals | Financial, identity data | Contract performance |
| Fraud and money laundering detection (AML) | Financial, technical data | Legal obligation / Legitimate interest |
| Responsible gambling monitoring | Betting activity, session data | Legal obligation / Legitimate interest |
| Customer support and dispute resolution | Communications, account data | Contract performance |
| Bonus eligibility and VIP tier management | Betting activity, financial data | Contract performance |
| Platform security and technical maintenance | Technical, device data | Legitimate interest |
| Promotional communications (where opted in) | Contact, preferences data | Consent |
Minimal Processing Principle: 28win processes only the data that is strictly necessary for each stated purpose. We do not use your personal data for automated decision-making that produces significant legal effects without human review.
6Legal Basis for Processing
28win processes personal data in reliance on one or more of the following legal bases, as applicable to each processing activity:
- Contract Performance: Processing that is necessary to deliver the services you have contracted with us to receive — including operating your account, processing payments, and managing bonuses.
- Legal Obligation: Processing required to comply with applicable law, including Know Your Customer (KYC) requirements, Anti-Money Laundering (AML) regulations, responsible gambling obligations, and reporting requirements.
- Legitimate Interest: Processing that serves a genuine and proportionate business interest of 28win or a third party, where that interest is not overridden by your rights — including fraud detection, platform security, and service improvement analytics.
- Consent: Processing for purposes such as sending you promotional communications, where you have provided explicit and freely given consent at the time of registration or account management. You may withdraw this consent at any time by updating your marketing preferences or by contacting our support team.
7Data Sharing
28win does not sell, rent, or transfer your personal data to third parties for their own commercial purposes. We may share your data with the following categories of recipients strictly in furtherance of the processing purposes set out in Section 5:
7.1 Payment Processors
When you deposit or withdraw funds using FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or cryptocurrency networks, the necessary transaction data is shared with the relevant payment service providers to process and settle the transaction. These providers process data only as required to execute the payment instruction.
7.2 Identity Verification Services
During KYC verification, your identity documents and personal details may be transmitted to a contracted identity verification service provider. This provider processes the data solely on our behalf and under our instructions, for the purpose of confirming your identity and age. Your MyKad or passport data is not retained by the verification provider beyond the scope of the individual verification event.
7.3 Regulatory and Law Enforcement Authorities
Where required by applicable law, court order, or regulatory mandate, 28win may be required to disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies. We will disclose only the minimum data required to satisfy the legal obligation and will notify affected players where disclosure is not prohibited by law.
7.4 Professional Advisers
28win's legal, financial, and security advisers may access personal data on a strictly confidential and need-to-know basis where required to provide their professional services to the Company. All such parties are bound by confidentiality obligations.
No Unauthorised Disclosure: 28win will not disclose your personal data to any third party not described in this Policy without your prior explicit consent, except where required by law. If you become aware of any suspicious request for your 28win account data from a third party claiming to represent 28win, do not comply and contact our support team immediately.
8Data Retention
28win retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal / AML obligations |
| KYC documents (MyKad / Passport) | 5 years from date of verification | Regulatory obligation |
| Transaction and financial records | 7 years from transaction date | AML / financial reporting obligations |
| Betting history and wagering records | 5 years from bet settlement date | Dispute resolution / legal obligation |
| Customer support communications | 3 years from last interaction | Legitimate interest / dispute resolution |
| Technical and device logs | 90 days (rolling) | Security monitoring |
| Marketing consent records | Until consent is withdrawn + 1 year | Consent accountability |
At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the data subject. Anonymised and aggregated data may be retained indefinitely for statistical analysis and platform improvement purposes.
9Cookies & Tracking Technologies
28win uses cookies and similar tracking technologies to operate the Platform, maintain session security, and understand how players interact with our services. The following categories of cookies are deployed on the Platform:
9.1 Strictly Necessary Cookies
These cookies are essential to the operation of the Platform and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and cookies required to maintain your login state during an active session. Without these cookies, the Platform cannot function correctly.
9.2 Performance and Analytics Cookies
These cookies collect anonymised data about how visitors use the Platform — including page load times, navigation paths, and error events. The data is used solely to improve Platform performance and user experience. No personally identifiable information is transmitted through these cookies.
9.3 Fraud Prevention Cookies
28win deploys device fingerprinting and risk-scoring cookies as part of its fraud prevention and account security framework. These cookies help identify suspicious login attempts, duplicate account registrations, and bot activity. They do not collect data for advertising purposes.
9.4 Managing Cookies
You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to the Platform. Instructions for managing cookies are available in the help documentation of all major browsers including Chrome, Firefox, Safari, and Edge.
10Data Security
28win implements and maintains a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These measures include:
- Transport Encryption: All data transmitted between your browser and the 28win Platform is encrypted using TLS 1.3 / SSL-256 technology. This applies to all pages of the Platform including registration, login, and payment pages.
- Data-at-Rest Encryption: Sensitive data fields stored in our databases — including national identity numbers and payment identifiers — are encrypted at rest using AES-256 encryption.
- Access Controls: Employee and contractor access to production systems containing personal data is governed by role-based access controls (RBAC). Access is granted on a need-to-know basis only, and all privileged access events are logged and audited.
- Payment Tokenisation: Payment instrument details (bank account numbers, e-wallet tokens) are processed through third-party payment gateways that maintain their own industry-standard security certifications. Raw payment credentials are never stored in 28win's own systems.
- Intrusion Detection: 28win operates continuous network monitoring and intrusion detection systems. Anomalous access patterns trigger automated alerts and human review.
- Security Incident Response: In the event of a data breach that materially affects your personal data, 28win will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.
Your Responsibility: While 28win takes all reasonable steps to secure your data on our side, you are responsible for maintaining the confidentiality of your account password and for ensuring that your device and network are reasonably secure. Never share your 28win login credentials with any third party. 28win support staff will never ask you for your password.
11Your Rights as a Data Subject
As a data subject whose personal data is processed by 28win, you are entitled to exercise the following rights. Requests may be submitted to our support team via live chat or by writing to [email protected]. We will verify your identity before processing any data subject request and will respond within 30 calendar days.
Right of Access
You may request a copy of all personal data we hold about you. We will provide this in a structured, readable format within 30 days of a verified request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you may request correction. Identity data changes may require documentary evidence.
Right to Erasure
You may request deletion of your personal data where it is no longer required for any legitimate purpose. This right is subject to overriding legal retention obligations as described in Section 8.
Right to Restrict Processing
In certain circumstances, you may request that we temporarily restrict the processing of your data while a rectification or objection request is under review.
Right to Data Portability
Where processing is based on your consent or a contract, you may request your data in a machine-readable format (e.g., JSON or CSV) for transfer to another service provider.
Right to Object
You may object to processing based on legitimate interest, including direct marketing. Where you object to marketing, your opt-out will be actioned within 48 hours of a verified request.
12Minors
The 28win Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from persons under the age of 21. Age verification is conducted as a mandatory component of the KYC process, and accounts identified as belonging to under-age individuals are suspended immediately. All data associated with such accounts is deleted or anonymised as soon as practicable following the suspension.
If you have reason to believe that a minor has registered on the 28win Platform or that personal data belonging to a minor has been collected, please notify us immediately at [email protected]. We will investigate all such reports and take appropriate action within 48 hours.
Parents and guardians are encouraged to make use of parental control and device management tools to prevent minors from accessing online gambling platforms. 28win is not responsible for the circumvention of age restrictions through the use of another person's account or false identity documentation.
13Changes to This Policy
28win reserves the right to update or amend this Privacy Policy at any time. Material changes — that is, changes that affect how your personal data is collected, used, or shared in a way that is meaningfully different from the current version — will be communicated to active players via email and/or a prominent notice on the Platform at least 14 days before the changes take effect.
The effective date and version number at the top of this Policy will be updated each time a new version is published. It is your responsibility to review this Policy periodically. Continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must cease use of the Platform and may request account closure in accordance with the Terms & Conditions.
14Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way 28win handles your personal data, please contact our Data Support team through the following channels. We aim to respond to all privacy-related enquiries within 5 working days.
Available 24 hours a day, 7 days a week via the 28win Platform. For urgent data security concerns, including suspected unauthorised account access, live chat is the fastest channel to reach our team.
Send data subject access requests, rectification requests, erasure requests, and privacy policy enquiries to [email protected]. Please include your registered username and a description of your request.
For information about our bonus terms and account rules, please refer to our Terms & Conditions. For responsible gambling support tools and resources, please visit our Responsible Gambling page. Common questions are answered on our FAQ page.
Questions About Your Data?
Our support team is available 24/7 to answer privacy questions, process data subject requests, and help you manage your account preferences.
For players aged 21 and above only. 28win is committed to protecting your privacy. This Policy is subject to periodic review and may be updated.