mwin Privacy Policy

Last Updated: January 2026
Effective Date: January 2026
Version: 2.4

1. Introduction and Controller Information

This Privacy Policy applies to all personal data collected and processed by mwin in connection with the operation of our online betting platform, accessible at mwin.cam and any associated mobile applications. By creating an account, depositing funds, or using any services on the mwin platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal information as described herein.

Data Controller: mwin operates as the data controller for all personal information collected through the platform. We determine the purposes and means of processing your data and are responsible for ensuring compliance with applicable data protection laws.

Contact for Privacy Matters: For questions, concerns, or requests related to your privacy and personal data, please contact our Data Protection Officer via the contact channels listed in Section 11 of this policy.

2. Information We Collect

mwin collects several categories of personal information to provide, maintain, and improve our services. The types of data we collect include:

2.1 Information You Provide Directly

• Account Registration Data: Full legal name, date of birth, gender, residential address (street, city, postal code, province), email address, phone number, and chosen username.
• Identity Verification (KYC) Documents: Government-issued photo identification (Indonesian KTP, passport, driver's license), selfie photograph holding your ID document, proof of address documents (utility bills, bank statements, government correspondence dated within the last three months).
• Financial Information: Bank account details (bank name, account number, account holder name), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja phone numbers or account IDs), transaction history including deposits, withdrawals, bet placements, and payouts.
• Communications: Customer support inquiries, live chat transcripts, email correspondence, feedback forms, and any other communications you send to mwin.
• Marketing Preferences: Your consent choices regarding promotional emails, SMS notifications, and in-platform marketing messages.

2.2 Information Collected Automatically

• Device Information: Device type (mobile phone, tablet, desktop computer), operating system (Windows, macOS, iOS, Android, Linux), browser type and version, screen resolution, device manufacturer and model.
• Connection and Usage Data: IP address, geographic location (derived from IP address to country/city level, not precise GPS coordinates), internet service provider, date and time of platform access, pages visited, buttons clicked, games played, bet history, session duration.
• Cookies and Tracking Technologies: Session cookies (required for login and platform functionality), analytics cookies (Google Analytics, to measure traffic and user behaviour), and preference cookies (to remember language, timezone, display settings). You can manage cookie preferences via your browser settings, but disabling essential cookies may impair platform functionality.
• Performance Data: Error logs, crash reports, loading times, and technical diagnostics used to improve platform stability and performance.

2.3 Information from Third Parties

• Payment Processors: Confirmation of successful deposits and withdrawals, transaction reference numbers, and payment method verification from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Fraud Prevention Services: Risk scores, device fingerprints, and behavioural analytics from third-party anti-fraud and anti-money laundering (AML) service providers used to detect suspicious activity and protect users.
• Game Providers: Game session logs, RTP (Return to Player) statistics, and gameplay data from our integrated casino and slot game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, Pocket Games Soft).

3. How We Use Your Information

mwin processes your personal data for the following purposes, each supported by a lawful basis under applicable data protection regulations:

3.1 Service Provision and Account Management

Lawful Basis: Contract performance (necessary to provide the services you requested) and legitimate interests (maintaining platform security and functionality).

• Creating and maintaining your user account
• Processing deposits, withdrawals, and bet placements
• Verifying your identity and age (21+ requirement) through KYC processes
• Providing customer support and responding to inquiries
• Delivering platform features including game access, bonus claims, and responsible gaming tools
• Maintaining accurate transaction records and betting history

3.2 Legal and Regulatory Compliance

Lawful Basis: Legal obligation (required by international gaming licenses, anti-money laundering laws, and financial regulations).

• Conducting Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence
• Reporting suspicious transactions to relevant authorities as required by law
• Maintaining records for tax reporting and financial audits
• Responding to lawful requests from law enforcement and regulatory bodies
• Enforcing our Terms & Conditions and investigating violations

3.3 Security and Fraud Prevention

Lawful Basis: Legitimate interests (protecting the platform, users, and business operations from fraud, abuse, and security threats).

• Detecting and preventing fraud, collusion, bonus abuse, and multi-accounting
• Monitoring for suspicious betting patterns, match-fixing indicators, and arbitrage activity
• Protecting against unauthorized access, account takeover attempts, and data breaches
• Implementing security measures including two-factor authentication, login anomaly detection, and IP blocking
• Investigating disputes, complaints, and chargebacks

3.4 Marketing and Communications

Lawful Basis: Consent (for promotional communications) and legitimate interests (for transactional and service-related messages).

• Sending promotional emails about bonuses, special offers, and platform updates (only with your consent; you may opt out at any time)
• Delivering in-platform notifications about new games, tournaments, and promotions
• Sending transactional messages including deposit confirmations, withdrawal status updates, and security alerts (these are essential communications and cannot be opted out)
• Conducting user surveys and collecting feedback to improve services

3.5 Analytics and Platform Improvement

Lawful Basis: Legitimate interests (improving user experience, optimizing platform performance, and developing new features).

• Analyzing user behaviour, popular games, and betting trends to optimize content and features
• Testing new platform features, user interface changes, and game integrations
• Generating aggregated, anonymized statistical reports on platform usage (these do not contain personally identifiable information)
• Monitoring platform performance, loading times, error rates, and uptime

4. Data Sharing and Third-Party Disclosures

mwin does not sell, rent, or trade your personal information to third parties for marketing purposes. We only share your data in the limited circumstances described below:

4.1 Service Providers and Business Partners

We share personal information with trusted third-party service providers who perform essential functions on our behalf, including:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive your financial information only to the extent necessary to process deposits and withdrawals.
• Game Providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Ezugi, Spribe, and Pocket Games Soft receive limited session data (username, bet amounts, game results) to deliver casino and slot games. They do not receive your full name, address, or identification documents.
• Identity Verification Services: Third-party KYC and AML compliance providers analyze your identification documents to verify your identity, age, and address. These providers are bound by strict confidentiality agreements.
• Hosting and Infrastructure Providers: Cloud hosting services and content delivery networks (CDNs) store and deliver platform content. These providers have access to data only to the extent necessary to maintain server infrastructure and do not process your data for their own purposes.
• Customer Support Tools: Live chat and ticketing systems used by our support team to manage customer inquiries. Support agents can access your account information and betting history to provide assistance.

All third-party service providers are contractually required to protect your data, use it only for specified purposes, and comply with applicable data protection laws.

4.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement, regulatory agencies, courts, or government authorities when:

• Required by law, court order, subpoena, or other legal process
• Necessary to comply with anti-money laundering (AML) or counter-terrorism financing (CTF) reporting obligations
• Requested by gaming regulators or licensing authorities as part of compliance audits
• Necessary to protect the rights, property, or safety of mwin, our users, or the public

4.3 Business Transfers

In the event that mwin is acquired by another company, merges with another entity, or undergoes a corporate restructuring, your personal information may be transferred to the acquiring or successor entity. You will be notified via email and/or prominent notice on the platform before any such transfer, and the new entity will remain bound by this Privacy Policy unless you are provided with a new policy and given an opportunity to opt out.

5. Data Security and Protection Measures

mwin implements industry-standard technical and organizational security measures to protect your personal data from unauthorized access, accidental loss, alteration, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using 256-bit Transport Layer Security (TLS) encryption. Sensitive data at rest (identification documents, financial records) is encrypted using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorized employees and contractors who require access to perform their job duties. Access is logged and audited regularly.
• Two-Factor Authentication (2FA): We strongly encourage all users to enable 2FA on their accounts. This adds an extra layer of security by requiring a one-time code (SMS or authenticator app) in addition to your password.
• Regular Security Audits: Our systems undergo periodic security assessments, penetration testing, and vulnerability scans conducted by independent third-party security firms.
• Employee Training: All mwin staff receive mandatory training on data protection, confidentiality, and security best practices.
• Incident Response: We maintain a data breach response plan to detect, contain, and remediate security incidents. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable data breach notification laws.

While we take extensive precautions to protect your data, no method of transmission over the internet or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account.

6. Data Retention Periods

mwin retains your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

Data Category	Retention Period	Reason
Account Registration Data	7 years after account closure	Legal obligation (AML/CTF regulations)
KYC Documents	7 years after account closure	Legal obligation (financial regulations)
Transaction History	7 years after transaction date	Legal obligation (tax and audit requirements)
Betting History	7 years after account closure	Legal obligation (gaming license requirements)
Marketing Consents	Until withdrawn, then deleted immediately	Compliance with consent requirements
Support Communications	3 years after last interaction	Legitimate interest (dispute resolution)
Device and Usage Data	2 years after collection	Legitimate interest (fraud prevention, analytics)

At the end of the applicable retention period, your personal data is securely deleted or anonymized such that it can no longer identify you. Aggregated, anonymized data may be retained indefinitely for statistical and research purposes.

7. Your Rights and Choices

Under applicable data protection laws, you have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of the personal data we hold about you. You can view your account information, transaction history, and betting history at any time by logging into your account. For a comprehensive data export, contact our Data Protection Officer.

7.2 Right to Rectification

If any of your personal information is inaccurate or incomplete, you have the right to request correction. You can update your email address, phone number, and residential address directly via your account settings. For changes to your legal name or date of birth, contact customer support with supporting documentation.

7.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw consent. However, we may be required to retain certain data to comply with legal obligations (e.g., AML/CTF record-keeping requirements). Requests for erasure are evaluated on a case-by-case basis.

7.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or when you believe the processing is unlawful but do not want the data erased.

7.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and to transmit that data to another service provider. This right applies to data you provided to us with your consent or under a contract.

7.6 Right to Object

You have the right to object to processing of your personal data when we rely on legitimate interests as the lawful basis (e.g., direct marketing, analytics). You can opt out of marketing communications at any time via your account settings or by clicking the "unsubscribe" link in promotional emails.

7.7 Right to Withdraw Consent

Where we process your data based on consent (e.g., promotional emails), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

7.8 Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority in your jurisdiction. Indonesian residents may contact the Ministry of Communication and Information Technology (Kominfo). International residents should contact the data protection authority in their country.

Exercising Your Rights: To exercise any of the above rights, please contact our Data Protection Officer using the contact details in Section 11. We will respond to your request within 30 days. In some cases, we may require additional information to verify your identity before processing your request.

8. International Data Transfers

mwin is an internationally licensed platform. Your personal data may be stored and processed on servers located outside Indonesia, including in jurisdictions that may not offer the same level of data protection as Indonesian law. When we transfer data internationally, we implement appropriate safeguards to protect your information, including:

• Standard Contractual Clauses (SCCs) approved by data protection authorities
• Binding Corporate Rules (BCRs) for intra-group transfers
• Data Processing Agreements (DPAs) with all third-party processors requiring them to comply with data protection standards equivalent to those in the European Union

By using the mwin platform, you acknowledge and consent to the international transfer of your personal data as described in this policy.

9. Children's Privacy

mwin strictly prohibits use of the platform by individuals under 21 years of age. We do not knowingly collect personal information from minors. If we become aware that a user is under 21, we will immediately suspend the account, void all bets, forfeit any winnings, and delete the user's personal data. Parents or guardians who believe their child has created an account on mwin should contact us immediately via customer support.

10. Changes to This Privacy Policy

mwin reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will notify you via:

• Email notification to your registered email address
• Prominent in-platform notification upon your next login
• Update to the "Last Updated" date at the top of this policy

Continued use of the platform after receiving notice of changes constitutes acceptance of the updated policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

11. Contact Information and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer through the following channels:

• Email Support: Use the contact form or email address displayed in the Help Centre (accessible after login). Mark your inquiry "Attention: Data Protection Officer" for privacy-related matters.
• Live Chat: Available 24/7 via the in-platform chat widget. Select "Privacy & Data Protection" as your inquiry category.
• Written Correspondence: For formal data access requests or complaints, submit a written request via customer support including your full name, account username, and detailed description of your request.

We aim to respond to all privacy inquiries within 5 business days and to complete data access or deletion requests within 30 days as required by law.