Nagawin Privacy Policy – How We Protect Malaysian Players' Personal Information

Nagawin ("we", "Platform", "company") is committed to protecting the privacy of every user who accesses our website, mobile app, and all services we provide. This document clearly explains the types of personal information we collect, why we need it, how we use it, and the steps we take to keep it secure at all times.

We understand that your trust in nagawin depends not only on the quality of games or speed of payouts, but also on the confidence that your personal information is handled with care and responsibility. That is why this Privacy Policy is written in plain, easy-to-understand English — so you know exactly what happens to your data, not just guessing.

This policy applies to all nagawin platform users without exception, including casual visitors browsing the website without registering, active registered members, and all parties interacting with our platform in any capacity.

Nagawin collects personal information through various means as you use our platform. Below is a detailed explanation of the types of information collected:

Please note that nagawin does not store full credit or debit card numbers in our systems. All sensitive payment processing is handled through accredited payment gateways that maintain their own PCI-DSS security standards.

The information we collect is used solely for legitimate operational purposes and to serve you. The following are the primary purposes for which your data is used:

• Account Management: Creating, verifying, and maintaining your nagawin account, including secure login processes and identity verification.
• Transaction Processing: Processing deposits and withdrawals securely, including AML (Anti-Money Laundering) compliance checks.
• Platform Security: Detecting and preventing fraudulent activity, unauthorised access, and platform abuse.
• Regulatory Compliance: Fulfilling legal obligations and reporting requirements to the relevant regulatory authorities.
• Service Improvement: Analysing usage patterns to improve platform performance, interface, and overall user experience.
• Customer Support: Providing technical assistance and resolving any issues or complaints you raise.
• Responsible Gaming: Monitoring gaming habits to identify players who may need responsible gaming assistance and support.
• Service Communications: Sending important notifications about your account, transactions, and policy changes — only necessary communications, not spam.

Nagawin processes your personal data on valid legal bases under Malaysia's Personal Data Protection Act 2010 (PDPA) and related regulations. These bases are:

• Contract Performance: Processing necessary to fulfil the service agreement between you and nagawin — such as processing deposits and managing your account.
• Legitimate Interests: Processing for legitimate business interests such as fraud prevention, ensuring platform security, and improving services.
• Legal Obligations: Processing required to comply with Malaysian legal requirements such as AML and KYC regulations.
• Consent: For optional processing such as marketing communications, we obtain your explicit consent beforehand.

Nagawin does not disclose your personal information to third parties except in the following clearly defined situations:

• Service Providers: Payment processing companies, cloud infrastructure providers, and data analytics services that help us operate the platform. All such providers are bound by strict confidentiality agreements and are only permitted to process your data under nagawin's instructions.
• Game Providers: Game studios providing content for the nagawin platform may receive the minimum technical data required to ensure games function correctly. No full identity information is shared without a clear and justified need.
• Regulatory Body: Where required by law or a valid court order, nagawin will disclose the necessary information to the relevant authorities.
• Identity Verification: Accredited third-party KYC service providers are used to verify member identities, subject to their own privacy policies that meet international standards.

The nagawin platform uses cookies and similar tracking technologies to enhance your experience. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as maintaining login sessions and security settings. These cookies cannot be disabled without affecting platform functionality.
• Preference Cookies: Saving your preferences such as language, display theme, and account settings so you do not have to reconfigure them each time.
• Analytics Cookies: Helping us understand how players use the platform so we can make meaningful improvements. This data is collected in aggregate form and does not identify individuals.
• Security Cookies: Used to detect suspicious activity and protect your account from unauthorised access.

You can manage your cookie settings through your browser; however, please note that disabling all cookies may affect certain features of the nagawin platform.

Nagawin continuously invests in security infrastructure to protect your personal data from unauthorised access, alteration, disclosure, or destruction. Key security measures we implement:

• 256-bit SSL Encryption: All data communications between your device and nagawin's servers are protected with TLS 1.3 encryption using AES-256-GCM cipher. This means your data remains unreadable even if intercepted.
• Stored Data Encryption: Sensitive information stored in our databases, including passwords and identity details, is encrypted using strong encryption algorithms.
• Strict Access Controls: Only nagawin staff with a legitimate business need who have undergone background checks are permitted to access members' personal data.
• Real-Time Threat Monitoring: Intrusion detection systems (IDS/IPS) operate 24/7 to detect and block any unauthorised access attempts.
• Periodic Security Audits: Independent security assessments are conducted periodically by accredited third parties to identify and remediate any vulnerabilities.
• Data Backup: Your data is automatically backed up to a separate location to ensure service continuity.

Nagawin does not retain your personal data longer than necessary. Retention periods vary depending on the type of data and legal requirements:

• Active Account Data: Retained for as long as your account remains active on the nagawin platform.
• Financial Records: Retained for a minimum of seven (7) years after the last transaction, in line with Malaysian legal requirements for financial records.
• KYC Documents: Retained for five (5) years after account closure, in accordance with applicable AML requirements.
• Communication Logs: Customer support transcripts are retained for two (2) years for reference and service improvement purposes.
• Technical Log Data: Access and activity logs are retained for ninety (90) days for security and fraud detection purposes.

Once the applicable retention period has expired, your data will be securely deleted or anonymised from our systems in accordance with our established deletion procedures.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal information held by nagawin:

To submit a request relating to any of the above rights, please contact our privacy team through the available support channels. We will respond within thirty (30) days of receiving your request. In complex cases, this period may be extended by up to sixty (60) days with prior notice to you.

In the course of operating its platform, nagawin may need to transfer personal data to servers located outside Malaysia — specifically to data centres in the Southeast Asia region used for our cloud infrastructure.

Any such transfer is carried out under the following conditions:

• The destination country or region has an adequate level of data protection.
• Appropriate data protection agreements have been established with overseas recipients.
• The transfer is necessary for the purpose of delivering services to you.

Nagawin ensures that all cross-border data transfers comply with the requirements of Malaysia's Personal Data Protection Act 2010 and are carried out with security safeguards equivalent to the standards applied within Malaysia.

Nagawin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. Any amendments will take effect upon publication of the updated Policy on our website.

For material amendments (significant changes that substantially affect how we process your data), we will provide you with clear notice via in-app notification or email at least thirty (30) days before the changes take effect.

We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this document will indicate when the most recent changes were made.

If you have any questions, concerns, or wish to submit a request regarding your personal data, our team is ready to assist through the following channels:

• Live Chat: The fastest channel — available on the nagawin app and website, 24 hours a day, 7 days a week.
• Privacy Email: [email protected] — dedicated to data protection enquiries, responded to within 5 business days.
• General Support Email: [email protected] — for general enquiries about your account.

When submitting a privacy rights request, please include sufficient information for us to verify your identity before processing the request. This is a security measure to protect your data from unauthorised access.