Privacy Policy
How h5winbox Protects Your Data

Introduction

This Privacy Policy ("Policy") describes how h5winbox ("we", "our", "us", "the Platform") collects, processes, stores, and protects personal data relating to individuals ("Users", "Players", "you") who register for or otherwise interact with the h5winbox online gambling platform accessible at https://h5winbox.cam.

h5winbox is an online gambling and sports betting platform that serves players across Malaysia, including but not limited to Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and Bangsar. In providing our services — which include live casino gaming, sports betting on events such as the English Premier League (EPL) and Liga Super Malaysia, slot games, lottery products, and customer account management — we necessarily process personal data about our players and visitors.

We are committed to processing personal data lawfully, fairly, and transparently. This Policy is intended to clearly inform you of your rights and our obligations. By creating an account or using the h5winbox Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data held by h5winbox.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or destruction.
• "Data Controller" means h5winbox, being the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of h5winbox pursuant to a written data processing agreement.
• "Consent" means freely given, specific, informed, and unambiguous agreement to the processing of Personal Data for a stated purpose.
• "KYC Data" means identity verification documents and associated data collected for Know Your Customer purposes, including government-issued identification such as MyKad or passport copies.
• "Cookie" means a small text file placed on your device by the h5winbox Platform to enable functionality, analytics, or session management.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, as may be amended from time to time.

Personal Data We Collect

h5winbox collects the following categories of Personal Data from Players and visitors to the Platform:

3.1 Registration & Identity Data

• Full legal name as it appears on official identification
• Date of birth (to verify 21+ age eligibility)
• National identification number (MyKad number or passport number)
• Country and city of residence
• Username and password (password stored in hashed form only)

3.2 Contact Data

• Email address
• Mobile phone number
• Preferred communication language (English, Bahasa Melayu, or Mandarin)

3.3 Financial & Payment Data

• Malaysian bank account details (for Maybank, CIMB, Public Bank, Hong Leong transfers)
• E-wallet IDs (Touch 'n Go eWallet, Boost, GrabPay account identifiers)
• DuitNow and FPX reference identifiers
• Cryptocurrency wallet addresses (for BTC, ETH, USDT, LTC transactions)
• Transaction history, deposit amounts, and withdrawal records

3.4 KYC & Verification Data

• Copies of government-issued photo identification (MyKad front and back, or passport bio page)
• Selfie photographs submitted during identity verification
• Proof of payment method ownership documentation where requested

3.5 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Login timestamps and session durations
• Gameplay history, betting activity, and wagering records
• Customer support interaction logs

How We Collect Your Data

h5winbox collects Personal Data through the following means:

• Direct submission: Data you provide during account registration, KYC verification, deposit and withdrawal requests, customer support interactions, and promotional opt-ins.
• Automated collection: Technical data collected automatically when you access the Platform, including cookies, server logs, and device fingerprinting for fraud prevention purposes.
• Third-party sources: Data received from payment processors, identity verification service providers, and fraud prevention databases where necessary to fulfil our legal and compliance obligations.
• Inferred data: Data derived from your interactions with the Platform, including inferred preferences, risk profile assessments for responsible gambling purposes, and communications language preference.

How We Use Your Data

h5winbox processes your Personal Data for the following purposes:

Legal Basis for Processing

h5winbox processes Personal Data on the following legal grounds, as appropriate to the specific processing activity:

• Performance of a contract: Processing necessary to deliver the h5winbox services you have registered to use, including account management, game access, and payment processing.
• Compliance with a legal obligation: Processing required to fulfil our obligations under applicable law, including KYC / anti-money laundering (AML) verification, age verification, and regulatory reporting.
• Legitimate interests: Processing necessary for purposes we consider are not outweighed by your interests or rights, including fraud prevention, platform security, and improving the quality of our services.
• Consent: Processing carried out based on your explicit consent, including marketing communications and optional cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Data Sharing & Disclosure

h5winbox does not sell, rent, or trade your Personal Data. We may disclose Personal Data to the following categories of third parties solely to the extent necessary for the stated purpose:

• Payment processors and financial institutions: To facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency networks.
• Identity verification service providers: To perform KYC checks, document authentication, and age verification in compliance with our legal obligations.
• Fraud prevention and AML service providers: To screen transactions and account activity against fraud, money laundering, and sanctions databases.
• Technology infrastructure providers: Including cloud hosting, database management, and platform security service providers operating under binding data processing agreements.
• Regulatory and law enforcement authorities: Where we are required to do so by applicable law, court order, or regulatory directive. h5winbox will not disclose Player data to government authorities beyond the minimum legally required.
• Professional advisers: Including legal counsel, auditors, and compliance consultants bound by professional confidentiality obligations.

Data Retention

h5winbox retains Personal Data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable legal or regulatory obligations. As a general guide:

• Active account data: Retained for the duration of your active account and for a period of five (5) years following account closure, in compliance with financial record-keeping and AML obligations.
• KYC and identity verification data: Retained for a minimum of five (5) years from the date of last transaction, as required by anti-money laundering regulations.
• Transaction and payment records: Retained for seven (7) years to satisfy financial record-keeping requirements.
• Customer support records: Retained for two (2) years from the date of last interaction.
• Technical and server logs: Retained for up to twelve (12) months for security and fraud investigation purposes.
• Marketing consent records: Retained for the duration of your subscription to marketing communications and for a reasonable period thereafter as evidence of consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with h5winbox's data destruction procedures.

Data Security

h5winbox implements a multi-layered approach to data security, encompassing technical, organisational, and procedural measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the h5winbox Platform.
• Encryption at rest for sensitive Personal Data stored on h5winbox servers, including KYC documents and payment details.
• Password hashing using industry-standard cryptographic algorithms. We do not store your password in plain text.
• Two-factor authentication (2FA) available for all accounts to provide an additional layer of login security.
• Access controls limiting internal access to Personal Data on a strict need-to-know basis, with role-based permissions and audit logging.
• Regular security assessments and penetration testing conducted by qualified information security professionals.
• Incident response procedures to detect, contain, and report data security incidents in a timely manner.

While h5winbox employs robust security measures, no online platform can guarantee absolute security. You are also responsible for maintaining the security of your own account credentials. If you suspect unauthorised access to your account, contact our support team immediately via live chat.

Cookies & Tracking Technologies

h5winbox uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us deliver a better user experience and analyse Platform performance. We use the following categories of cookies:

• Strictly necessary cookies: Required for core Platform functionality including session management, login authentication, and security. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences, such as language selection and account settings, to personalise your experience on the Platform.
• Analytics cookies: Collect anonymised data about how visitors interact with the Platform, including pages visited and features used, to help us improve our services. This data is aggregated and does not identify individual users.
• Security and fraud prevention cookies: Used to detect suspicious activity, prevent abuse, and support our responsible gambling monitoring systems.

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some Platform features. h5winbox does not use cookies to serve third-party advertising.

Your Rights Over Your Personal Data

As a registered Player on h5winbox, you hold the following rights in respect of your Personal Data. To exercise any of these rights, please contact our Data Protection team via the contact details in Section 15 of this Policy.

• Right of Access: You may request a copy of the Personal Data h5winbox holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data held about you. You may also update certain data directly via your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract performance, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

h5winbox will respond to all rights requests within thirty (30) days of receipt. Where a request is complex or numerous, we may extend this period by a further thirty (30) days with written notice. We will not charge a fee for rights requests unless they are manifestly unfounded or excessive.

International Data Transfers

h5winbox may engage technology infrastructure partners and service providers located in countries outside Malaysia. Where Personal Data is transferred to countries that do not provide an equivalent level of data protection to that required under the PDPA, h5winbox will ensure that appropriate safeguards are in place prior to the transfer, including:

• Contractual clauses that impose obligations on the recipient equivalent to those applicable under the PDPA;
• Transfers to recipients in countries determined to provide adequate data protection by relevant regulatory authorities; or
• Other lawful transfer mechanisms as recognised under applicable data protection law.

You may request information about the specific safeguards in place for any international transfer of your Personal Data by contacting our support team.

Minors & Age Restriction

h5winbox is strictly an adult gambling platform. Access to and use of the Platform is prohibited for any individual under the age of 21. We do not knowingly collect Personal Data from individuals under 21 years of age.

If we become aware that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete all collected data, and where applicable, report the matter to the relevant authorities. If you believe a minor has registered on the Platform, please contact us immediately.

Policy Amendments

h5winbox reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the nature of the services we provide. When material changes are made, we will update the "Last Updated" date at the top of this document and, where practicable, notify registered Players via email or in-platform notification.

Your continued use of the h5winbox Platform after any amendment to this Privacy Policy takes effect constitutes your acknowledgement of the updated Policy. We encourage you to review this Privacy Policy periodically to stay informed of how we protect your information.

Contact Us & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by h5winbox, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 via the in-platform chat widget in English, Bahasa Melayu, and Mandarin. Live chat is the fastest route for urgent data-related queries.
• Email: [email protected] — mark your subject line "Data Protection Request" for priority routing.
• FAQ: Frequently asked questions about account data, KYC, and withdrawals are addressed on our FAQ page.

We aim to acknowledge all written data protection enquiries within 24 hours and to issue a substantive response within 30 days. For time-sensitive matters such as suspected unauthorised account access, please use live chat for immediate assistance.