Privacy Policy

1. Who We Are

ddwin ("we", "us", "our") operates the online casino and sports betting platform accessible at ddwin.vu. ddwin is the data controller responsible for personal data collected through the Platform. For the purposes of this Privacy Policy, "Platform" includes the website, mobile browser interfaces, and all associated services offered under the ddwin brand.

ddwin processes personal data in accordance with applicable data protection legislation and the requirements of its international gaming authority operating licence, which includes data governance obligations for licensed online gaming operators.

2. Personal Data We Collect

ddwin collects the following categories of personal data from Players and Platform visitors:

ddwin does not collect sensitive personal data (such as health information, religious beliefs, or biometric data) unless specifically required by its regulatory obligations and only with your explicit consent.

3. How We Collect Your Data

ddwin collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Cookies, web beacons, server logs, and analytics tools that collect technical and usage data as you interact with the Platform. See Section 9 for details on cookies.
• Third-party sources: Identity verification service providers, payment processors (Touch 'n Go, Boost, GrabPay, DuitNow, FPX networks), fraud prevention databases, and publicly available sources for due diligence purposes.
• Regulatory sources: Anti-money laundering (AML) screening databases and politically exposed persons (PEP) lists, accessed as required by ddwin's compliance obligations.

4. Purposes of Processing

ddwin processes your personal data for the following purposes:

• Account creation and management: To register, verify, and maintain your ddwin account, including KYC identity and age verification.
• Service delivery: To provide access to sports betting, casino games, slots, Plinko, and all other Platform services.
• Payment processing: To facilitate MYR deposits and withdrawals via your chosen payment method and maintain accurate transaction records.
• Legal and regulatory compliance: To fulfil ddwin's obligations under its operating licence, including AML, KYC, responsible gaming, and financial reporting requirements.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and Platform abuse.
• Customer support: To respond to your queries, complaints, and account-related requests.
• Responsible gaming: To enforce self-exclusion requests, monitor for problematic gambling patterns, and apply deposit limits in line with your instructions.
• Marketing communications: To send you relevant promotional offers and platform updates, where you have provided consent. You may withdraw marketing consent at any time via Account Settings or by contacting support.
• Platform improvement: To analyse usage patterns and technical data to improve the ddwin Platform's performance, design, and user experience.

5. Legal Basis for Processing

ddwin processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between ddwin and you — including account operation, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable law, including AML regulations, gaming licence conditions, and financial record-keeping obligations.
• Legitimate interests: Processing for fraud prevention, platform security, and internal analytics, where ddwin's legitimate interests are not overridden by your data protection rights.
• Consent: Marketing communications and non-essential cookies, where you have provided explicit consent. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

ddwin does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Payment service providers: Touch 'n Go, Boost, GrabPay, DuitNow, FPX-connected banks (Maybank, CIMB, Public Bank), and cryptocurrency processors — to process your financial transactions.
• KYC / identity verification providers: Third-party services that verify identity documents and cross-reference against regulatory watchlists.
• Game providers: Licensed studios (e.g., Pragmatic Play, PG Soft, Evolution) may receive pseudonymised session data required to operate their games on the Platform.
• Regulatory and law enforcement authorities: ddwin is legally required to report certain transactions and disclose account data to relevant authorities upon lawful request. This includes financial intelligence units and gaming regulators.
• IT and platform service providers: Hosting, cloud infrastructure, and cybersecurity vendors operating under strict data processing agreements with ddwin.
• Professional advisers: Legal, accounting, and auditing firms, under confidentiality obligations.

7. International Data Transfers

7.1 ddwin's platform infrastructure and some of its service providers operate across multiple jurisdictions. Your personal data may therefore be transferred to and processed in countries outside Malaysia.

7.2 Where such transfers occur, ddwin ensures that appropriate safeguards are in place, including: standard contractual clauses approved by relevant data protection authorities; binding corporate rules; or transfers to jurisdictions deemed to provide an adequate level of data protection.

7.3 By using the ddwin Platform, you acknowledge and consent to the international transfer of your personal data in accordance with this section.

8. Data Retention

ddwin retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and KYC data: Retained for a minimum of five (5) years from account closure, as required by anti-money laundering regulations.
• Transaction records: Retained for a minimum of seven (7) years from the date of the transaction for financial compliance purposes.
• Communications and support records: Retained for three (3) years from the date of the interaction.
• Technical and usage data: Retained for up to twenty-four (24) months from collection, unless required for longer by regulatory obligation.
• Self-exclusion records: Retained indefinitely to prevent re-registration during an active exclusion period and for regulatory reporting purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with ddwin's data destruction procedures.

9. Cookies & Tracking Technologies

9.1 ddwin uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device that allow the Platform to recognise your browser and remember certain information.

9.2 The following categories of cookies are used by ddwin:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in to your ddwin account. Cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, currency display, and last-visited game category. Can be disabled, but may affect Platform functionality.
• Analytics cookies: Collect pseudonymised usage data to help ddwin understand how Players interact with the Platform. Used to improve page performance and user experience.
• Marketing cookies: Used to deliver relevant promotional content on and off the ddwin Platform, where you have consented to marketing communications.

9.3 You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may impair the functionality of the ddwin Platform, including your ability to remain logged in.

10. Your Data Rights

Subject to applicable law and ddwin's regulatory obligations, you have the following rights in respect of your personal data:

• Right of access: Request a copy of the personal data ddwin holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where there is no longer a lawful basis for processing, subject to ddwin's legal retention obligations.
• Right to restriction: Request that ddwin restricts processing of your data in certain circumstances.
• Right to data portability: Receive a copy of data you have provided to ddwin in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Withdraw consent for consent-based processing (e.g., marketing emails) at any time without penalty.

Please note that certain rights may be limited where processing is required for compliance with legal obligations — for example, ddwin cannot erase transaction records during the mandatory seven-year AML retention period.

11. Children's Privacy

11.1 The ddwin Platform is strictly for adults aged 21 years and above. ddwin does not knowingly collect personal data from individuals under 21 years of age.

11.2 If ddwin discovers that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all deposits returned to the originating payment method, and the personal data deleted in accordance with ddwin's data destruction procedures.

11.3 If you believe a minor has registered or attempted to register on the ddwin Platform, please notify us immediately at the contact details in Section 15.

12. Security Measures

ddwin implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL / TLS encryption on all data transmitted between your browser and the ddwin Platform.
• Salted cryptographic hashing of all account passwords — ddwin employees do not have access to plain-text passwords.
• Role-based access controls limiting employee access to personal data to those with a genuine business need.
• Regular security audits and penetration testing of Platform infrastructure.
• Two-factor authentication (2FA) available to all Players on their ddwin accounts.
• Data breach detection and incident response procedures, with notification obligations in line with applicable regulatory requirements.

While ddwin takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are encouraged to use a strong, unique password for your ddwin account and to enable 2FA.

13. Third-Party Links

The ddwin Platform does not contain links to external third-party websites for general browsing purposes. Where third-party services (such as payment processors) are accessed during a transaction, those services operate under their own privacy policies. ddwin is not responsible for the data practices of third-party payment providers, and we encourage you to review their respective privacy policies when transacting through their platforms.

14. Changes to This Privacy Policy

14.1 ddwin reserves the right to update this Privacy Policy at any time. Any material changes — particularly those that affect how your personal data is used or your rights in respect of it — will be communicated to registered Players by email at least fourteen (14) days before taking effect.

14.2 The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the ddwin Platform following a Privacy Policy update constitutes your acceptance of the revised terms.

14.3 ddwin recommends that Players review this Privacy Policy periodically. Previous versions are available upon request from the ddwin support team.

15. Contact & Data Enquiries

For any privacy-related questions, data access requests, or complaints regarding ddwin's data handling practices, please contact us:

If you are not satisfied with ddwin's response to a privacy complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction.