Privacy Policy spin and go — Malaysian Member Data Protection

1 Information We Collect

When you register and use the Spin and Go platform, we collect several categories of personal information to ensure your experience is safe, seamless and compliant with applicable legal requirements in Malaysia. This information is collected directly from you or automatically through your use of our platform.

Information you provide directly:

• Full name as stated on your identity card or passport.
• Date of birth for age verification purposes (18 years and above).
• Active email address used as the login username.
• Mobile phone number registered in Malaysia.
• Current residential address, including state and postcode.
• Identity verification documents (KYC) such as copies of MyKad, passport or driving licence during the account verification process.
• Bank account or e-wallet details (FPX, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, ShopeePay) for deposit and withdrawal purposes.

Information collected automatically:

• IP address and approximate location data based on IP.
• Device type, operating system and web browser version used.
• Gaming activity history, including games played, total wagering amounts, and win/loss records.
• Complete financial transaction history within the platform.
• Cookie data and similar tracking technologies for analytics and security purposes.
• Login times, session duration, and overall platform usage patterns.

We never request sensitive information such as full credit card passwords, bank PIN numbers or information irrelevant to platform operations. If you receive any such request claiming to be from Spin and Go, please contact our support team immediately.

2 How We Use Your Information

Personal information collected by spin and go is used transparently and responsibly. Every use of data is based on a legitimate need and we do not use your data for any purpose outside the scope stated below:

For marketing communications, you may opt out of receiving promotional emails at any time by using the "unsubscribe" link in any email we send, or by contacting our support team directly. Please note that even if you opt out of marketing communications, you will still receive important transactional emails related to your account.

3 Data Sharing & Disclosure

Spin and go does not sell, rent, or trade members' personal information to any third party for their marketing purposes. However, in certain limited situations, we may need to share your information with the following parties:

• Payment service providers: Including FPX processors, e-wallet operators, and partner banks to enable your financial transactions to be processed securely and accurately.
• Third-party game providers: Gaming software companies that provide slots, Live Casino, and other games on our platform may receive session data required for game operation.
• Analytics and security providers: Third-party services that assist us in detecting fraud, analysing traffic and enhancing platform security, subject to strict confidentiality agreements.
• Relevant authorities: Law enforcement agencies, regulatory bodies or courts when we are legally required to do so.
• Business successors: In the event of any corporate restructuring, merger, or acquisition, your data may be transferred as part of the business assets, with prior notice given to you.

If you wish to learn more about which third parties may receive your data in the context of specific platform usage, you may contact our data protection team for further information.

4 Data Security & Encryption

Spin and go makes serious investments in technical and organisational security infrastructure to protect your personal data from unauthorised access, disclosure, alteration, or destruction. The following are the key security measures we implement:

• 256-bit SSL encryption: All data transmitted between your device and our servers is protected with 256-bit SSL/TLS encryption — the same security standard used by internationally accredited banking institutions. You can verify this by looking for the padlock icon and "https://" in your browser's address bar.
• Data-at-rest encryption: Sensitive data stored in our databases, including financial information and KYC documents, is encrypted using the robust AES-256 encryption algorithm.
• Two-factor authentication (2FA): Members are strongly encouraged to enable two-factor authentication to add an extra layer of protection to their account.
• Internal access controls: Only authorised personnel have access to members' personal data, and this access is strictly limited based on a rigorous least-privilege principle.
• 24/7 security monitoring: Our automated and manual monitoring systems operate around the clock to detect and respond to any suspicious activity or security threats.
• Regular penetration testing: We conduct regular security testing, including penetration testing by independent experts, to ensure our systems are resilient against the latest threats.

You also play an important role in keeping your account secure. Please ensure your password is strong and unique, do not share your login credentials with anyone, and always log out after using a public device. Contact our support team immediately if you suspect your account has been accessed without your authorisation.

5 Cookie Usage (Cookies)

The spin and go platform uses cookies and similar tracking technologies such as web beacons and pixels to enhance your experience, understand how our platform is used, and ensure the security of your session. Cookies are small text files stored on your device when you visit our website.

We use several categories of cookies:

• Essential cookies (required): These cookies are required for core platform functions such as login session management, security and basic navigation. The platform cannot function properly without these cookies and they cannot be disabled.
• Performance & analytics cookies: These cookies help us understand how members use the platform — which pages are most popular, how long sessions last and where users encounter issues. This information is used to improve the overall user experience.
• Functional cookies: These cookies allow the platform to remember your preferences such as preferred language, display settings and login details for a more convenient return experience.
• Security cookies: Used to detect suspicious activity, prevent fraud and protect the platform against automated bot attacks.

We do not use cookies to track your activity on other websites outside the Spin and Go platform. Our cookies are specific to the spinandgo.org domain and do not share data with third-party advertising networks without your consent.

6 Your Rights as a Member

Spin and go respects and upholds your rights regarding personal data. The following are the rights you hold as a member of our platform, and how to exercise them:

7 Data Storage & Deletion

Spin and go retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable laws and regulations.

• Active account data: For as long as your account remains active and you continue to use the spin and go platform.
• Data after account closure: Financial transaction records and KYC documents are retained for a minimum of 7 years after account closure to comply with anti-money laundering (AMLA) and financial reporting legal requirements.
• Security logs: System and security log data is retained for 2 years for the purpose of investigating potential security incidents.
• Customer support communications: Support conversation records are retained for 3 years for service reference and dispute resolution.
• Marketing data: Deleted within 90 days after you withdraw your marketing consent.

Once the specified retention period has lapsed and there is no legal requirement for us to retain it further, your data will be securely deleted or anonymised in a manner that prevents re-identification.

8 Privacy Policy Amendments

Spin and go reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to the data protection technologies we use.

When we make significant amendments to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Sending notifications to registered members via their registered email address.
• Displaying a clear notice on the platform's home page at least 14 days before the changes take effect.
• For amendments that require your renewed consent, we will request your explicit consent before those changes apply to your data.

Continued use of the spin and go platform after the effective date of any amendment will be deemed as your acceptance of the updated Privacy Policy. If you do not agree with any amendment, you have the right to close your account and request data deletion in accordance with the procedures outlined in Sections 6 and 7 above.

We encourage you to review this Privacy Policy periodically to ensure you are always informed of how we protect your information. A version history of our Privacy Policy is available for your reference upon request.