Privacy Policy – yestowin

1. Introduction and Scope

This Privacy Policy ("Policy") is published by yestowin ("yestowin", "we", "us", "our") and applies to all personal data collected through the yestowin website located at yestowin.org, the yestowin Platform, and all associated services including the online casino, sportsbook, and customer support functions (collectively, the "Platform").

yestowin is committed to protecting the privacy and personal data of all individuals who interact with the Platform, including registered players, prospective players who browse the site without registering, and individuals who contact us via support channels. This Policy sets out what data we collect, why we collect it, how we use and protect it, and what rights you have regarding your personal data.

By registering an account on the yestowin Platform or continuing to use the Platform after this Policy has been brought to your attention, you acknowledge that you have read and understood this Policy. This Policy should be read together with the yestowin Terms & Conditions.

2. Data Controller Identity

yestowin is the data controller responsible for the personal data collected and processed through the Platform. For all data protection enquiries, data subject access requests, or complaints regarding the handling of your personal data, please contact us at:

Email: [email protected] (plain text — not a clickable link)

We will respond to data protection enquiries within 30 days of receipt, in accordance with applicable data protection obligations.

3. Personal Data We Collect

3.1 Registration and Account Data

When you register an account on the yestowin Platform, we collect:

• Full legal name;
• Date of birth (for age verification — all players must be aged 21 or above);
• Residential address, including country and postcode;
• Email address;
• Mobile phone number;
• Username chosen at registration;
• Password (stored in hashed form — yestowin does not store or have access to your plaintext password).

3.2 Identity Verification (KYC) Data

To comply with international gaming authority requirements and anti-money laundering obligations, we may request:

• A copy of a government-issued photo identity document (e.g. Malaysian MyKad, passport);
• Proof of residential address (e.g. utility bill, bank statement dated within 3 months);
• Proof of payment method ownership (e.g. a screenshot of your Touch n Go eWallet, Boost account, or bank statement showing your name and account details);
• Source of funds documentation for high-value transactions where required by regulatory standards.

3.3 Transaction and Financial Data

We collect records of all deposits, withdrawals, bonuses credited, bets placed, and wins paid out. We do not store full payment card numbers. For eWallet and FPX transactions, we store only the reference identifiers necessary to process and reconcile transactions.

3.4 Technical and Usage Data

When you access the Platform, we automatically collect:

• IP address and approximate geolocation derived from IP;
• Browser type and version;
• Device type and operating system;
• Pages visited, session duration, and navigation patterns;
• Login timestamps and session activity logs.

3.5 Communications Data

We retain records of communications between you and the yestowin support team, including live chat transcripts and email correspondence, for quality assurance, compliance, and dispute resolution purposes.

4. How We Collect Your Data

yestowin collects personal data through the following channels:

• Directly from you: information you provide during registration, KYC verification, deposit and withdrawal requests, bonus opt-ins, and support interactions;
• Automatically: technical and usage data collected via server logs, cookies, and similar technologies when you access the Platform;
• From third parties: identity verification data from KYC service providers engaged by yestowin to support compliance obligations; fraud screening data from anti-fraud service providers; payment confirmation data from payment processors.

5. Legal Basis for Processing

yestowin processes your personal data on the following legal bases:

• Contract performance: processing necessary to operate your account, process transactions, and provide the gaming services you have requested;
• Legal obligation: processing necessary to comply with KYC, anti-money laundering, and responsible gaming obligations under applicable international gaming authority requirements;
• Legitimate interests: processing for fraud prevention, Platform security, internal analytics, and improvement of our services, where such interests are not overridden by your data protection rights;
• Consent: marketing communications and non-essential cookies, where we have obtained your explicit consent. You may withdraw consent at any time by contacting support or updating your account communication preferences.

6. How We Use Your Personal Data

yestowin uses the personal data we collect for the following purposes:

• To create, maintain, and manage your player account;
• To process deposits, withdrawals, and bet settlements in Malaysian Ringgit (MYR);
• To verify your identity and age (21+ requirement) in accordance with KYC obligations;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities;
• To administer bonuses and promotions and verify eligibility;
• To provide customer support and resolve disputes;
• To monitor gameplay for responsible gaming indicators and to apply account limits or restrictions where appropriate;
• To send service communications (account notifications, security alerts, transaction confirmations);
• To send marketing communications regarding yestowin promotions and products, where you have opted in;
• To comply with applicable legal and regulatory obligations;
• To analyse Platform usage and improve user experience.

7. Disclosure to Third Parties

yestowin does not sell, rent, or trade your personal data to any third party. We share personal data only in the following circumstances:

• Service providers: KYC identity verification providers, payment processors (including Touch n Go eWallet, Boost, and FPX banking partners such as Maybank, CIMB, and Public Bank), game software suppliers, fraud detection services, and IT infrastructure providers. All third-party processors are engaged under binding data processing agreements that restrict their use of your data to the specific purpose for which it is shared.
• Regulatory and legal authorities: where required by applicable law, gaming regulation, court order, or regulatory directive, yestowin will disclose personal data to the relevant authority. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: in the event of a merger, acquisition, or sale of all or substantially all of yestowin's assets, player data may be transferred to the acquiring entity, subject to the acquiring entity honouring this Policy or providing equivalent privacy protections.

8. International Data Transfers

yestowin may transfer personal data to jurisdictions outside Malaysia in connection with the use of service providers engaged to support Platform operations. Where such transfers occur, yestowin ensures that appropriate safeguards are in place, including contractual data protection obligations consistent with applicable international standards, to ensure your data receives an equivalent level of protection regardless of where it is processed.

9. Data Retention

yestowin retains personal data for as long as your account is active and for a minimum period of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements and gaming regulatory obligations.

Transaction records and KYC documentation are retained for a minimum of seven (7) years from the date of the relevant transaction or verification event.

Support communications are retained for a period of three (3) years from the date of the communication, or longer where the communication relates to an unresolved dispute or regulatory matter.

Technical log data (IP addresses, session logs) is retained for a maximum of 24 months from collection for security monitoring purposes, after which it is deleted or anonymised.

10. Cookies and Tracking Technologies

The yestowin Platform uses cookies and similar tracking technologies to support Platform functionality and, where consent is obtained, to analyse usage patterns.

Essential Cookies

Essential cookies are strictly necessary for the Platform to function. They include session management cookies that maintain your logged-in state, security cookies that help detect and prevent fraud, and cookies that remember your language and display preferences. These cookies do not require your consent as they are necessary to provide the service you have requested.

Analytical Cookies

With your consent, yestowin uses analytical cookies to understand aggregated patterns in how players navigate the Platform, which game categories are most visited, and where technical issues may be occurring. This data is used internally to improve the Platform. Analytical cookies are not used to build individual advertising profiles or to share data with advertising networks.

You may withdraw consent for analytical cookies at any time by contacting yestowin support. Essential cookies cannot be disabled without materially affecting Platform functionality.

11. Your Data Subject Rights

Subject to applicable law and regulatory constraints, you have the following rights regarding your personal data held by yestowin:

• Right of access: you may request a copy of the personal data yestowin holds about you;
• Right to rectification: you may request correction of inaccurate or incomplete personal data;
• Right to erasure: you may request deletion of your personal data, subject to yestowin's legal obligations to retain certain data for regulatory compliance purposes;
• Right to restriction of processing: you may request that yestowin restrict processing of your data in certain circumstances;
• Right to object: you may object to processing of your data for legitimate interests or direct marketing purposes;
• Right to withdraw consent: where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to yestowin support, including sufficient information to verify your identity. We will respond within 30 days of receiving a valid request.

12. Children and Underage Users

The yestowin Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If yestowin becomes aware that personal data has been collected from an underage individual, that account will be immediately suspended, the data deleted where legally permissible, and any funds held in the account dealt with in accordance with applicable regulatory procedures.

If you believe an underage person has registered on the yestowin Platform, please notify us immediately at [email protected].

13. Security Measures

yestowin implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure:

• All data in transit is encrypted using TLS (Transport Layer Security);
• Passwords are stored using industry-standard cryptographic hashing — plaintext passwords are never stored or accessible;
• Infrastructure access is restricted by role-based access controls and multi-factor authentication for all administrative systems;
• Servers and databases are monitored for unusual access patterns and potential intrusion;
• Regular penetration testing and security assessments are conducted by qualified external security professionals;
• Player data access by yestowin staff is logged and auditable.

Notwithstanding these measures, no data transmission or storage system can be guaranteed to be 100% secure. You play an important role in keeping your account secure by maintaining the confidentiality of your login credentials and notifying yestowin promptly of any suspected unauthorised access.

14. Changes to This Privacy Policy

yestowin may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via email to the address registered on their account and/or via prominent notice on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how yestowin handles your personal data.

15. Contact Information

For privacy-related enquiries, data subject access requests, or complaints regarding yestowin's handling of your personal data, please contact:

yestowin Data Protection
Email: [email protected] (plain text — not a clickable link)
Response time: within 30 days of receipt of a valid written request.

If you are not satisfied with yestowin's response to a data protection complaint, you may escalate the matter to the applicable regulatory or data protection authority in your jurisdiction.