Privacy Policy HokiWin – Personal Data Protection for Malaysia Members

📋 1. Introduction & Scope of This Policy

This Privacy Policy ("Policy") is published by HokiWin ("we", "Company" or "platform") and applies to all users, prospective users and registered members of the hokiwin.my website and all related services. This Policy describes our privacy practices and how we manage your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

By registering an account, accessing the platform, or using any HokiWin service, you acknowledge that you have read, understood, and agreed to the collection and use of your personal data as described in this Policy. If you do not agree, please discontinue use of our platform.

📊 2. Personal Data We Collect

HokiWin collects your personal data through several channels throughout your relationship with our platform. The data collected is the minimum necessary to provide you with a secure, compliant, and high-quality service.

Data you provide directly:

• During account registration – full name, email address, Malaysian phone number, password and date of birth.
• During the identity verification (KYC) process – Malaysian identity card number (MyKad), copies of identification documents, and in certain cases, a verification selfie.
• When making a deposit or withdrawal — payment method details including the e-wallet account holder's name (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) or the FPX internet banking account name (Maybank2u, CIMB Clicks).
• When contacting customer support – the content of live chat and email communications.
• When completing feedback forms, surveys, or promotions – your opinions and preferences.

Automatically collected data:

• Device technical information — device type, operating system, phone model, screen resolution.
• Network data – IP address, approximate location (state/city), internet service provider name.
• Platform activity data – pages visited, games played, bets placed, session duration, buttons clicked.
• Cookie data and similar tracking technologies – please refer to Section 6 for full details.

🎯 3. How We Use Your Personal Data

HokiWin uses your personal data only for lawful purposes that have been made known to you. The primary purposes are as follows:

• Service provision: To create and manage your account, process deposits and withdrawals via e-wallet and FPX Malaysia, and ensure you have full access to all games and Sports Betting markets on HokiWin.
• Identity verification and legal compliance: To fulfil KYC requirements, verify that you are 18 years of age or older, and comply with applicable anti-money laundering (AML) laws in Malaysia.
• Security and fraud prevention: To identify, investigate and prevent fraudulent activity, money laundering, bonus abuse, duplicate accounts and other security threats to our platform and members.
• Customer support: To respond to your enquiries, resolve complaints and ensure your gaming experience on HokiWin runs smoothly.
• Service communications: To send important account-related notices such as deposit confirmations, security alerts, policy updates, and promotional information you have consented to receive.
• Platform improvement: To analyse aggregate usage patterns for the purpose of improving HokiWin platform performance, interface, and user experience.
• Responsible gaming: To monitor gaming patterns and identify members who may require assistance or a Responsible Gaming intervention.

🤝 4. Data Sharing with Third Parties

HokiWin does not sell, rent or trade your personal data to any third party for their own marketing purposes. However, we may share your personal data with the following categories of third parties under limited and controlled circumstances:

• Gaming service providers: Companies such as Evolution Gaming and Pragmatic Play, which provide live casino software, may receive the session data required for game operations. All such providers are bound by strict data protection agreements.
• Payment processors: E-wallet operators (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) and FPX banks (Maybank2u, CIMB Clicks) receive the transaction information required to process your payments. They maintain their own privacy policies that govern data processing on their end.
• Regulatory authorities and law enforcement: HokiWin may be required to disclose data to Malaysian authorities such as the police, courts or regulatory bodies if compelled by law or a valid court order.
• Technology service providers: Companies providing IT infrastructure, cybersecurity, analytics and hosting services that we use to operate the HokiWin platform. All are bound by confidentiality agreements.
• Corporate events: In the event of a company merger, acquisition, or asset sale, member personal data may be transferred to the new entity, with appropriate notice provided to members.

🛡️ 5. Data Storage, Security & Retention Period

HokiWin employs comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction, or accidental disclosure.

Technical security measures we have in place:

• 256-bit SSL/TLS encryption for all data transmitted between your device and HokiWin's servers.
• At-rest encryption for all databases storing members' personal data.
• Multi-tiered access controls – only authorised personnel with a legitimate need to access specific data are permitted to do so.
• Two-factor authentication (2FA) for all internal systems containing member data.
• Regular security audits conducted by independent cybersecurity firms.
• 24/7 threat monitoring with documented incident response procedures.

Data retention period: HokiWin retains member personal data for as long as necessary to fulfil the purpose of collection and to meet applicable legal requirements. As a general rule, active account data is retained for the duration the account remains active. Financial transaction data is retained for a minimum of seven (7) years in accordance with Malaysian legal requirements. Closed account data is retained for five (5) years following closure before being securely deleted.

🍪 6. Cookies & Tracking Technologies

HokiWin uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our platform. We use three main categories of cookies:

You can manage your cookie preferences through your browser settings. However, disabling essential cookies may affect your ability to log in or complete transactions on the HokiWin platform.

✋ 7. Your Privacy Rights as a HokiWin Member

Under Malaysia's PDPA 2010, every HokiWin member has the following rights regarding their personal data. You may exercise these rights by contacting us through the channels stated in Section 13:

• Right of access: You have the right to request and receive a copy of the personal data we hold about you.
• Right to rectification: You have the right to request correction of any personal data that is inaccurate, incomplete or outdated.
• Right to opt out of direct marketing: You may withdraw your consent to receive marketing communications at any time by clicking the unsubscribe link in any promotional email or by contacting our support team.
• Right to object to processing: In certain circumstances, you may object to the processing of your personal data for our legitimate interest purposes, subject to applicable legal and contractual requirements.
• Right to erasure (right to be forgotten): You may request deletion of your personal data when it is no longer required, subject to our legal retention obligations.
• Right to lodge a complaint: If you believe HokiWin has processed your personal data in a manner that violates PDPA 2010, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

HokiWin will respond to privacy rights requests within 30 business days of receipt. In complex cases, this period may be extended, and you will be notified accordingly.

👶 8. Protection of Children's Data

The HokiWin platform is strictly for individuals aged 18 and above. We do not knowingly collect, process, or store the personal data of individuals under the age of 18.

If we discover that we have inadvertently collected personal data from individuals under the age of 18, we will take immediate steps to delete that data and terminate the associated account. Parents or guardians who have reason to believe their child has registered with HokiWin without authorisation are urged to contact us immediately at support@hokiwin.my.

🌐 9. Cross-Border Data Transfers

In the course of its operations, HokiWin may need to transfer your personal data to servers or processing facilities located outside Malaysia, primarily for platform hosting, disaster recovery and the provision of services by international casino providers.

All cross-border data transfers carried out by HokiWin are conducted in compliance with Malaysia's PDPA 2010. We ensure that the recipient country provides an adequate level of data protection, or that appropriate contractual safeguards are in place before any transfer takes place.

If you have concerns about cross-border data transfers relating to your personal data, you may contact our Privacy Officer as detailed in Section 13.

🔗 10. Links to Third-Party Platforms

The HokiWin platform may contain links to third-party websites or services that operate independently of us, such as game providers, social media channels or sports news sites. HokiWin's Privacy Policy does not apply to these third-party platforms.

We encourage you to read the privacy policy of any third-party platform you visit via links from HokiWin. HokiWin is not responsible for the privacy practices or content of any third-party websites.

🚨 11. Data Breach Response

HokiWin has a documented incident response procedure in place to address any data breaches that may occur. This procedure is designed to minimise potential harm to members in the event of an unexpected security incident.

In the event of a data breach that may pose a risk to the rights and freedoms of affected members, HokiWin is committed to:

• Identifying and containing the breach as quickly as possible once it is detected.
• Notifying affected members within a reasonable timeframe with clear information about what occurred, the data involved, and the steps they should take to protect themselves.
• Reporting the breach to the Personal Data Protection Commissioner of Malaysia where required under PDPA 2010.
• Taking appropriate remedial steps to prevent similar breaches from occurring in the future.

📢 12. Amendments to This Privacy Policy

HokiWin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. The latest version will always be available on this page, with the updated date shown at the top.

For material amendments that significantly affect how we handle your personal data, HokiWin will provide advance notice via a prominent notice on the platform and/or an email to the address registered to your account. Continued use of the platform after an amendment takes effect will be considered your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how HokiWin protects your personal data.

📧 13. Contact HokiWin's Privacy Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or how HokiWin handles your personal data, please contact our Privacy Officer through the following channels:

• Email: support@hokiwin.my – please include "Privacy Enquiry" in the subject line for priority handling.
• Live Chat: Available 24 hours a day, 7 days a week directly within the HokiWin platform — select the "Privacy & Data" category when starting a session.

We are committed to responding to all privacy-related enquiries within 14 business days. For complex requests such as full data access applications or data deletion, processing may take up to 30 business days.