Privacy Policy

This Privacy Policy ("Policy") describes how GrabWin ("the Platform", "we", "us", "our") collects, processes, stores, shares, and protects personal data relating to individuals ("you", "your", "the User", "the Player") who access or use the GrabWin website, mobile platform, and all associated services available at grabwin.cam.

GrabWin is committed to handling all personal data with transparency, care, and respect for the privacy rights of our users — including players based across Malaysia in cities such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. This Policy sets out your rights and our obligations in relation to all personal data we process.

By registering an account on GrabWin, accessing any part of the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not accept this Policy, you must not use the GrabWin platform.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means GrabWin, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of GrabWin under a contractual data processing agreement.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, personalisation, and security.
• "KYC" means Know Your Customer verification procedures, including identity age, and address verification required under our compliance framework.

GrabWin collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we may collect include:

GrabWin collects personal data through the following channels:

• Direct interactions: Data you voluntarily provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or responding to surveys or promotions.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, log files, and analytics tools. This includes IP addresses, device identifiers, and session activity.
• Third-party sources: In limited circumstances, GrabWin may receive identity or address verification data from accredited KYC verification service providers to supplement information you have provided directly.
• Payment processors: Transaction confirmation and status data from payment processors handling your deposits and withdrawals via Malaysian payment channels.

GrabWin processes your personal data for the following purposes:

• Account creation and management: To register, maintain, and administer your GrabWin player account, including authentication and account security.
• Identity and age verification (KYC): To verify your identity, age (21+ requirement), and payment method ownership in accordance with our compliance and responsible gambling obligations.
• Payment processing: To facilitate deposits and withdrawals via your chosen Malaysian payment method, and to maintain accurate financial transaction records.
• Service delivery: To provide access to our games, sports betting markets, live dealer tables, promotions, and all other Platform features.
• Responsible gambling: To monitor gaming activity for indicators of problem gambling, apply self-exclusion requests, enforce deposit and loss limits, and comply with our responsible gaming obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account abuse, and other prohibited conduct.
• Customer support: To respond to your enquiries, process complaints, and provide technical assistance.
• Legal compliance: To comply with applicable laws, regulatory requirements, and lawful requests from competent authorities.
• Platform improvement: To analyse aggregated usage data, identify technical issues, and improve the overall performance and user experience of the Platform.
• Communications: To send you service-related notifications, transaction confirmations, promotional offers (where you have consented), and important policy updates.

GrabWin processes your personal data on the following legal bases, depending on the specific purpose for which data is processed:

• Contractual necessity: Processing required to perform the contract between you and GrabWin — including account registration, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC/AML obligations and responsible gambling requirements.
• Legitimate interests: Processing carried out in pursuit of GrabWin's legitimate business interests, including fraud prevention, platform security, and service improvement — where these interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given, specific, and informed consent — in particular, the sending of promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

GrabWin does not sell, rent, or trade your personal data. We may share personal data only in the following specific and limited circumstances:

• Payment service providers: Financial transaction data is shared with authorised Malaysian payment processors (including those facilitating Touch 'n Go eWallet, DuitNow, FPX, and bank transfers) solely for the purpose of executing your transactions.
• KYC and identity verification providers: Identity and document data may be shared with accredited third-party KYC service providers to perform verification checks on GrabWin's behalf.
• Game and software providers: Limited usage data may be shared with game providers whose products are integrated into the Platform, for game performance and integrity purposes.
• Regulatory and law enforcement authorities: GrabWin may disclose personal data to competent authorities where required by law or in response to a lawful request, court order, or regulatory investigation.
• Responsible gambling organisations: In the event that a self-exclusion request is made, relevant data may be shared with recognised responsible gambling programmes where applicable.
• Corporate transactions: In the event of a merger, acquisition, or sale of assets involving GrabWin, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

GrabWin uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you access the Platform. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function. These include session management, authentication, and security cookies. They cannot be disabled.
• Functional cookies: Enable personalisation features such as remembering your language preferences, display settings, and login status between visits.
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform — such as pages visited, session duration, and error events — to help us improve performance.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and suspicious login patterns.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. GrabWin does not use third-party advertising or tracking cookies.

GrabWin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Retained for the duration of your account relationship with GrabWin and for a minimum period following account closure as required by applicable regulations.
• KYC and identity verification records: Retained for a minimum of five (5) years following account closure, or longer where required by applicable anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of five (5) years following the transaction date for financial record-keeping and regulatory compliance purposes.
• Support and communications records: Retained for a minimum of two (2) years to support complaint resolution and quality assurance processes.
• Technical and security logs: Retained for up to twelve (12) months for fraud detection, security monitoring, and incident investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identified individual.

GrabWin implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmissions between your device and our servers.
• Encrypted storage of sensitive personal data at rest using industry-standard encryption protocols.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular security assessments and penetration testing of Platform infrastructure.
• Multi-factor authentication requirements for privileged internal systems access.
• Incident response procedures for the detection, investigation, and notification of personal data breaches where applicable.

Subject to applicable law and GrabWin's legitimate operational and legal obligations, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact GrabWin's support team via the contact details in Section 15. GrabWin will respond to all data rights requests within thirty (30) calendar days of receipt. Where a request is complex or there are a high volume of requests, this period may be extended by a further sixty (60) days, in which case you will be notified of the extension and the reasons for it.

The GrabWin platform is strictly intended for adults aged 21 years and above. GrabWin does not knowingly collect personal data from individuals under the age of 21. Registration by or on behalf of any person under 21 is prohibited and constitutes a breach of our Terms and Conditions.

Where GrabWin discovers or reasonably suspects that personal data has been collected from a person under the age of 21, that data will be deleted immediately and the relevant account will be suspended pending investigation. GrabWin enforces strict KYC age verification on all accounts and reserves the right to request proof of age at any time.

As GrabWin operates under international gaming licensing and uses globally distributed technology infrastructure, your personal data may be transferred to and processed in countries outside Malaysia. Such transfers may occur in the context of cloud hosting, third-party payment processing, KYC verification, or game platform infrastructure.

Where personal data is transferred internationally, GrabWin takes appropriate measures to ensure that such transfers are conducted with adequate safeguards in place, including contractual data protection clauses with receiving parties that require equivalent standards of data protection to those applied by GrabWin.

GrabWin may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the structure of our services. The "Last Updated" date at the top of this page will be revised accordingly whenever material changes are made.

Where changes are material, GrabWin will endeavour to notify registered users via their registered email address or a prominent notice on the Platform before the changes take effect. Your continued use of the Platform following any published update constitutes acceptance of the revised Privacy Policy.

We encourage you to review this Policy periodically to stay informed about how GrabWin protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or to GrabWin's handling of your personal data, please contact our Data Protection team through the following channel:

For questions about your account terms, please visit our Terms & Conditions page. For responsible gambling support and self-exclusion requests, please visit our Responsible Gambling page. For general platform questions, our FAQ section covers most common topics.