Surewin Privacy Policy

This Privacy Policy ("Policy") is published by Surewin ("Surewin", "we", "us", "our"), the operator of the online gaming and sports betting platform located at https://surewin.casa (the "Platform"). This Policy applies to all individuals who access or use the Platform, whether as a registered player ("User", "Player", "you") or as a visitor browsing the Platform without registration.

Surewin is committed to protecting the privacy and security of the personal data entrusted to us by our users. This commitment is not merely a compliance obligation — it is central to the trust relationship between Surewin and every Malaysian player who chooses to engage with our platform, whether from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in Malaysia.

This Policy explains:

• What categories of personal data Surewin collects and processes;
• The purposes for which that data is collected and used;
• The legal basis on which we process your personal data;
• How long we retain your data and how we protect it;
• The circumstances in which we may share your data with third parties;
• Your rights in relation to your personal data and how to exercise them.

By registering an Account on the Platform or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and agree to the collection and use of your personal data as described herein.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

In this Privacy Policy, the following terms shall carry the meanings assigned to them below:

Surewin collects personal data through several channels in the course of operating the Platform and providing gaming and betting services to Malaysian players. The categories of data we collect include the following:

3.1 Registration Data

When you register an Account, we collect your full legal name, date of birth, email address, contact number, residential address, username, and password (stored in hashed, non-recoverable form). This data is essential for Account creation and cannot be withheld.

3.2 Identity Verification (KYC) Data

To comply with our regulatory obligations and to confirm that all players meet the minimum age requirement of 21 years, we collect and process copies of government-issued identity documents (Malaysian MyKad, Passport, or Driver's Licence), proof of residential address (such as a recent utility bill from TNB or Syabas, or a bank statement from Maybank, CIMB, or Public Bank), and a selfie photograph holding the identity document.

3.3 Financial Data

We collect transaction records associated with your Account, including deposit amounts, payment method details (such as masked e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, and DuitNow, or masked bank account references for FPX transactions), withdrawal requests, and bonus transaction history. Full payment credentials (e.g., card numbers, e-wallet PINs) are never stored by Surewin — these are handled exclusively by our licensed payment processing partners.

3.4 Gaming and Betting Activity Data

We record your gaming and betting activity on the Platform, including wagers placed, games played, session duration, betting history, sports betting selections (including Liga Super Malaysia, EPL, and other markets), and any Mix Parlay combinations. This data is used for account management, responsible gambling monitoring, and regulatory compliance.

3.5 Technical and Device Data

We automatically collect technical data when you access the Platform, including your IP address, browser type and version, device type and operating system, referring URL, and session activity logs. This data helps us maintain Platform security, detect fraud, and improve the user experience.

3.6 Communications Data

We retain records of your communications with our customer support team, including Live Chat transcripts, email correspondence, and any complaints or feedback submitted. These records are kept for quality assurance, dispute resolution, and training purposes.

Surewin processes your personal data for the following specific purposes:

Surewin does not use your personal data for any purpose not listed in this Policy without first obtaining your explicit consent or as required by law.

Surewin processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the services described in our Terms & Conditions — including Account management, payment processing, and delivery of gaming services — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal Obligation: Surewin is required by applicable law and our gaming licence to collect and retain certain categories of personal data, including KYC documentation, transaction records, and gaming history. Such processing is carried out on the basis of our legal obligations as a licensed gaming operator.
• Legitimate Interests: Certain processing activities — including fraud detection, Platform security monitoring, and responsible gambling analytics — are conducted on the basis of Surewin's legitimate interests in maintaining the security, integrity, and regulatory compliance of the Platform, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where Surewin processes your data for purposes beyond those described above — such as sending you marketing communications about new promotions, bonuses, or upcoming sporting events — we will obtain your explicit consent before doing so. You may withdraw this consent at any time by contacting our support team or updating your Account communication preferences.

Surewin does not sell, rent, or trade your personal data to third parties for commercial purposes. We may, however, share your personal data with the following categories of recipients under the circumstances described:

• Licensed Payment Processors: To facilitate deposits and withdrawals, we transmit necessary transaction details to our licensed payment processing partners, including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking gateways, and USDT processing networks. These partners process data only as required to complete your transactions and are bound by contractual obligations to handle your data securely.
• Identity Verification Service Providers: Surewin may engage third-party KYC verification providers to assist in processing identity documents and conducting age verification checks. All such providers operate under strict data processing agreements.
• Game Software Providers: The games available on Surewin are provided by third-party game studios. Limited technical data (such as Player ID and session tokens) may be shared with game providers as necessary to deliver game functionality. Game providers do not receive personally identifiable information beyond what is technically required.
• Regulatory and Law Enforcement Authorities: Surewin will disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where required by law, regulation, or valid legal process, including in connection with our AML and anti-fraud obligations.
• Professional Advisors: Surewin may share data with its legal advisors, auditors, and other professional service providers where necessary for the management of our legal and compliance obligations. Such sharing is subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of Surewin's assets, your personal data may be transferred to the relevant successor entity. We will provide reasonable notice of any such transfer.

Surewin retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations. The following general retention periods apply:

Upon the expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with Surewin's data disposal procedures. Anonymised data (which cannot be used to identify any individual) may be retained indefinitely for statistical and analytical purposes.

Surewin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption in Transit: All data transmitted between your device and the Surewin Platform is encrypted using industry-standard TLS 1.3 (Transport Layer Security). Our Platform operates exclusively over HTTPS, indicated by the padlock icon in your browser's address bar.
• Encryption at Rest: Personal data stored in Surewin's databases, including KYC documents and financial records, is encrypted using AES-256 symmetric encryption — the same standard used by major financial institutions worldwide.
• Access Controls: Access to personal data within Surewin's systems is strictly limited on a need-to-know basis. Employees and contractors are granted access only to the specific data categories required for their role, and all access is logged for audit purposes.
• Two-Factor Authentication: Surewin offers and encourages the use of two-factor authentication (2FA) for all Player Accounts to provide an additional layer of security against unauthorised account access.
• Security Monitoring: Our systems are monitored continuously for anomalous activity, including unusual login patterns, suspicious transaction activity, and potential intrusion attempts. Our security team responds to alerts around the clock.
• Penetration Testing: Surewin engages independent security specialists to conduct regular penetration testing and vulnerability assessments of our Platform and underlying infrastructure.

While Surewin takes all reasonable steps to protect your personal data, no data transmission over the Internet or data storage system can be guaranteed to be completely secure. In the event of a data security incident that is likely to result in a risk to your rights and freedoms, Surewin will notify affected users and relevant authorities as required by applicable law.

Surewin uses cookies and similar tracking technologies to enhance your experience on the Platform. The following categories of cookies may be set when you access Surewin:

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may impact the functionality of the Platform. Surewin does not use cookies to deliver third-party advertising or to track your activity across unrelated websites.

As a data subject whose personal data is processed by Surewin, you have the following rights in relation to your personal data. To exercise any of the rights described below, please contact our support team via Live Chat or by email at the address provided in Section 15.

Surewin will respond to all valid rights requests within thirty (30) days of receipt. In complex cases, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reasons for it. We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

The Surewin Platform is strictly for individuals aged 21 years and above. Surewin does not knowingly collect personal data from individuals under 21 years of age. All Account registrations are subject to mandatory age verification through our KYC process, which requires submission of a valid government-issued identity document confirming that the Account holder is at least 21 years old.

If Surewin discovers or is notified that personal data has been collected from an individual under the age of 21, we will take immediate steps to close the relevant Account, delete all associated personal data, and return any deposited funds in accordance with our AML obligations and applicable law.

Parents and guardians are encouraged to use parental control software to prevent underage individuals from accessing online gambling platforms. If you suspect that a minor in your care has accessed or attempted to access the Surewin Platform, please contact our support team immediately.

The Surewin Platform may integrate with or contain links to third-party service providers, including game studios, payment gateways, and identity verification services. Surewin has no control over the privacy practices or content of these third-party services once you navigate away from the Surewin Platform.

All third-party service providers engaged by Surewin to process personal data on our behalf are subject to rigorous due diligence and are required to enter into contractual data processing agreements that comply with applicable data protection laws and require them to implement appropriate security measures.

Surewin is not responsible for the privacy policies or practices of third-party providers or platforms to which links may be included on our Platform. We encourage you to review the privacy policies of any third-party service you interact with. This Policy covers only the personal data collected and processed directly by Surewin in connection with the Surewin Platform.

Surewin operates an international platform and may, in the course of providing services to Malaysian players, transfer personal data to countries or territories outside Malaysia where our licensed service providers, data processors, or group companies are located.

Where personal data is transferred to a country that does not provide an equivalent level of data protection to that available in Malaysia, Surewin will take appropriate safeguards to ensure that such transfers are conducted lawfully and that your data remains protected in accordance with the standards set out in this Policy. Such safeguards may include the implementation of standard contractual clauses, transfer impact assessments, or reliance on applicable adequacy decisions.

If you wish to obtain further information about the specific international transfers applicable to your personal data or the safeguards in place, please contact our Data Protection team at the address provided in Section 15.

Surewin reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our processing activities, or the services we provide. Material changes — those that significantly affect your rights or how we process your personal data — will be communicated to registered users via a prominent notice on the Platform and, where we hold a verified email address for your Account, by email notification.

The effective date at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically to stay informed of how Surewin protects your personal data. The most current version of this Policy is always available at https://surewin.casa/privacy-policy.

Your continued use of the Platform following any material amendment to this Policy will constitute your acceptance of the revised terms. If you do not agree with any amendment, you should cease using the Platform and contact our support team to discuss your Account options.

For any queries, concerns, or requests relating to this Privacy Policy or to the exercise of your data protection rights, please contact Surewin through the following channels:

• Data Protection Enquiries — Email: [email protected]. Please include "Data Privacy Request" in the subject line of your email to ensure your query is routed to our Data Protection team. Allow up to 5 business days for a response to data protection enquiries.
• Live Chat: Available 24/7 on the Surewin Platform for general Account and privacy queries. Average response time is 3–5 minutes. Our Live Chat agents can escalate formal data protection requests to the appropriate team.

Surewin's customer support team is multilingual and serves Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — with support available in English, Bahasa Melayu, and Mandarin.