M2Win Privacy Policy – Malaysian Player Personal Data Protection

M2Win ("we", "Platform" or "M2Win") operates through the website m2win.onl and its associated mobile applications. This Privacy Policy describes our practices for collecting, using, storing and disclosing personal information of users who access or use our platform.

This policy applies to all individuals who register an account, browse the website, use the mobile app, or interact with any M2Win service. By using our platform, you agree that your personal data will be processed in accordance with this Privacy Policy.

We operate in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international regulatory requirements applicable to the online services industry. Our commitment to privacy is not merely a legal obligation — it is a core value that shapes how we design every feature of our platform.

M2Win collects several categories of data depending on how you interact with the platform. We only collect data that is strictly necessary for the stated purposes:

We do not collect sensitive data such as health information, religious beliefs, or sexual orientation. Our KYC process requires only the documents necessary to verify your identity and age in line with applicable legal requirements.

M2Win uses your personal data for the following purposes only. We do not use your data for any other purpose without notifying you in advance:

• Account Management: Creating, verifying and maintaining your account on the M2Win platform, including required KYC verification.
• Transaction Processing: Managing deposits, fund withdrawals, bonus payments and any financial transactions related to your account.
• Service Provision: Enabling you to access and use all games and features on the M2Win platform seamlessly.
• Security & Fraud Prevention: Monitoring account activity to detect and prevent fraud, money laundering and platform abuse.
• Legal Compliance: Fulfilling obligations under the PDPA, anti-money laundering (AML) laws and other applicable regulatory requirements.
• Service Communications: Sending important account notices, security updates and transaction alerts.
• Platform Enhancement: Analysing usage patterns in aggregate (not individually) to improve the user experience and platform functionality.
• Customer Support: Responding to enquiries, resolving complaints and providing the technical assistance you need.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), all personal data processing must have a valid legal basis. M2Win processes your data on the following bases:

• Consent: For activities such as sending promotions, marketing communications, and the use of optional cookies, we rely on your explicit consent, which can be withdrawn at any time.
• Contract Performance: Processing required to manage your account, process transactions and provide the services you registered for.
• Legal Obligations: Data processed to comply with KYC, AML, and PDPA requirements mandated by Malaysian law and relevant international regulations.
• Legitimate Interest: Processing for platform security purposes, fraud prevention and protection of M2Win's rights and those of other users — provided these interests do not override your fundamental privacy rights.

M2Win does not sell, rent or trade your personal data to any third party for marketing or commercial purposes. Your data is only shared in limited circumstances based on operational or legal necessity:

• Technical Service Providers: Cloud infrastructure providers, payment service providers and game providers that partner with M2Win to deliver the platform. All such third parties are bound by strict confidentiality agreements and are only permitted to process data for specified purposes.
• Regulatory Authorities: When required by law, court order, or directive from a relevant regulatory authority in Malaysia or other applicable jurisdictions.
• Fraud & Crime Prevention: Where there is a reasonable need to disclose information to prevent or investigate fraudulent activity, money laundering, or cybercrime involving your account.

M2Win implements multiple layers of technical and organisational security controls to protect your personal data from unauthorised access, disclosure, alteration or destruction:

• 256-bit SSL Encryption: All data transmitted between your device and m2win servers is protected with bank-grade SSL encryption. This ensures your sensitive information cannot be intercepted in transit.
• Data-at-Rest Encryption: Sensitive data stored in our databases — including financial details and identification information — is encrypted using the latest industry standards.
• Tiered Access Controls: Only staff who genuinely require access to specific data to carry out their job responsibilities are permitted to do so. This access is monitored and audited on a regular basis.
• Two-Factor Authentication (2FA): m2win's internal systems use 2FA for all staff access to user data. Players are also encouraged to enable 2FA on their accounts.
• Continuous Monitoring: An anomaly detection system operates around the clock to identify and respond to any suspicious activity in real time.
• Regular Security Audits: Independent security assessments are conducted periodically to ensure our data protection measures remain effective and up to date.

While we take all reasonable measures, no online system can guarantee absolute security. We encourage you to take protective steps on your end as well — including using a strong password, not sharing your login credentials, and logging out after each session on shared devices.

M2Win retains your personal data for as long as your account is active or as required to provide our services. After an account is closed, certain data may need to be kept for an additional period for the following purposes:

• Legal Requirement: Financial and transaction records are kept for the period required by Malaysia's taxation laws and financial reporting requirements.
• Dispute Resolution: Records related to any unresolved disputes will be retained until the dispute is fully settled.
• Fraud Prevention: Minimum information required to prevent reuse of identities previously associated with fraudulent activity.

Once the required retention period has expired, your data will be securely deleted or anonymised in accordance with established data disposal procedures.

M2Win uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. The cookies we use include:

• Essential Cookies: Required for the platform to function — including login session cookies and security settings. These cookies cannot be disabled without affecting core platform functionality.
• Functional Cookies: Saving your preferences such as preferred language and display settings so you do not need to reconfigure them each time you use the platform.
• Analytics Cookies: Collecting aggregated, anonymised usage data to help us understand how users interact with the platform and identify areas for improvement.

You can manage cookie settings through your browser. Please note that disabling essential cookies may affect your ability to log in or use certain features of the M2Win platform.

Under Malaysia's PDPA and our privacy policy, you have the following rights regarding your personal data. We aim to process every request within a reasonable timeframe:

As an online platform, your personal data may be stored or processed on servers located outside Malaysia — specifically for cloud infrastructure needs and the technical service providers we use.

In all such cases, M2Win ensures that protections equivalent to Malaysia's PDPA requirements and relevant international privacy standards are upheld. This is achieved through binding data processing agreements with all parties involved in cross-border data transfers.

The m2win platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors.

If you have any questions, concerns, or complaints regarding how M2Win handles your personal data, we encourage you to contact us first before filing a complaint with a regulatory authority.

The M2Win data protection team can be reached through:

• Email: [email protected]
• Live Chat: Available 24/7 via the m2win platform
• Website: m2win.onl

We are committed to responding to all privacy-related enquiries within a reasonable timeframe. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia or the relevant data protection authority in your jurisdiction.