This Privacy Policy explains how Wimbox collects, processes, stores, and protects your personal data when you use our online casino and sports betting platform. We are committed to handling your information with transparency, security, and full respect for your privacy rights.
All personal and financial data is protected by 256-bit SSL encryption. We apply industry-standard security controls to safeguard your information at rest and in transit.
You have the right to access, correct, and request deletion of your personal data held by Wimbox. We honour all data subject requests promptly and transparently.
Wimbox does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. Your data is used solely to operate and improve our services.
Personal data is only shared with verified third-party processors — such as payment partners like Maybank, CIMB, and Touch 'n Go — strictly as required to deliver our services.
Wimbox ("we", "us", "our", or "the Company") operates the online gaming and sports betting platform accessible at https://wimbox.cam (the "Platform"). We are committed to protecting and respecting the privacy and personal data of all individuals who access or use our Platform, including registered players, prospective users, and visitors to our website.
This Privacy Policy ("Policy") sets out in detail what personal data we collect about you, how and why we collect it, how we use it, who we may share it with, how long we retain it, and what rights you have in relation to your personal data. This Policy applies to all services offered through the Wimbox Platform, including online casino games, live dealer games, sports betting, promotions, and customer support interactions.
By accessing the Wimbox Platform, registering a Player Account, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to this Policy, you must not access or use the Platform.
Scope: This Policy governs personal data processed in connection with the Wimbox Platform only. It does not apply to third-party websites, payment processors, or other services whose links may appear in connection with our Platform. We encourage you to read the privacy policies of any third-party services you interact with.
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, location data, or any factor specific to their identity. |
| "Processing" | Any operation performed on personal data, whether automated or manual, including collection, storage, use, disclosure, erasure, or destruction. |
| "Data Subject" | The identified or identifiable natural person to whom the personal data relates — i.e., you as a registered Player or Platform visitor. |
| "Data Controller" | Wimbox, as the entity that determines the purposes and means of processing your personal data. |
| "Data Processor" | A third party that processes personal data on behalf of Wimbox under a data processing agreement — e.g., payment service providers, KYC verification vendors, or IT infrastructure suppliers. |
| "Cookies" | Small text files placed on your device by a website to store information about your browsing session, preferences, and behaviour on the site. |
| "KYC" | Know Your Customer — the identity, age, and document verification process conducted prior to processing withdrawals or at Wimbox's request. |
Wimbox collects the following categories of personal data in connection with your use of the Platform:
When you register a Player Account, we collect your full legal name, date of birth, gender, nationality, and username. This data is used to create and manage your account and to verify your eligibility to use the Platform.
We collect your email address, mobile telephone number, and residential address (including city, state, and postcode). This data is used to communicate with you about your account, transactions, promotions, and service updates.
As part of our KYC process, we may collect copies of government-issued identification documents (such as your Malaysian MyKad or passport), proof of address documents (such as a recent utility bill or bank statement), and evidence of ownership of your payment method. These documents are processed solely for identity and age verification and compliance purposes.
We collect records of deposits, withdrawals, wagers, winnings, and bonus transactions conducted through your Player Account. We also collect information about the payment methods you use, including your e-wallet account identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay), bank account details (e.g., Maybank, CIMB, Public Bank, Hong Leong), and DuitNow or FPX reference identifiers. Full payment card numbers are not stored by Wimbox — these are processed directly by our PCI-compliant payment service providers.
We collect detailed records of your gaming and betting activity on the Platform, including games played, bet amounts, session duration, game outcomes, and sports betting selections (including Liga Super Malaysia, EPL, UFC, and other markets). This data is used to manage your account, detect problem gambling patterns, detect fraud, and comply with regulatory obligations.
We automatically collect information about the device and browser you use to access the Platform, including your IP address, device type, operating system, browser type and version, and geolocation data derived from your IP address. This data is used for security monitoring, fraud detection, and platform performance optimization.
We retain records of all communications between you and Wimbox's customer support team, including live chat transcripts, email correspondence, and support ticket records. These records are used to resolve disputes, improve service quality, and comply with regulatory retention obligations.
Wimbox collects personal data through the following channels and mechanisms:
Wimbox processes your personal data for the following specified purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and managing your Player Account, processing logins, and enforcing account security. |
| Service Delivery | Enabling you to play games, place bets, participate in promotions, and interact with the full suite of Wimbox services. |
| Payment Processing | Facilitating deposits and withdrawals in MYR via Malaysian payment channels, reconciling transactions, and managing payment disputes. |
| Identity Verification | Verifying your identity and age (21+) in compliance with KYC obligations and responsible gambling requirements. |
| Regulatory Compliance | Meeting our obligations under anti-money laundering (AML), counter-financing of terrorism (CFT), and gaming licensing regulations. |
| Fraud & Security | Detecting, investigating, and preventing fraudulent activity, bonus abuse, multi-accounting, and unauthorized access to the Platform. |
| Customer Support | Responding to your queries, resolving complaints, and maintaining support interaction records. |
| Responsible Gambling | Monitoring gaming patterns to identify problem gambling indicators, enforcing self-exclusion, and applying deposit and session limits. |
| Marketing Communications | Sending you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may withdraw this consent at any time. |
| Platform Improvement | Analysing aggregate, anonymised usage data to improve game performance, interface design, and overall user experience on the Wimbox Platform. |
Wimbox processes your personal data on the following legal bases, depending on the nature and purpose of the processing activity:
Wimbox does not sell your personal data to third parties. We may share your personal data with the following categories of recipients in the circumstances described below:
We share necessary transactional and identity data with our Malaysian payment partners — including FPX operators, DuitNow service providers, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank — solely to process your deposit and withdrawal transactions. These providers are subject to their own regulatory obligations and privacy commitments.
We share identity verification documents and personal data with contracted KYC verification service providers and AML/CFT compliance tools for the purpose of verifying your identity and conducting required regulatory checks. These processors operate under binding data processing agreements.
We share data with cloud hosting providers, IT infrastructure vendors, and cybersecurity service providers who process data on our behalf under strict contractual data processing agreements. These providers are authorised to process your data only as directed by Wimbox and for no independent purpose.
Your session and gaming activity data may be shared with our licensed game studio partners and sports betting data providers to the extent required to deliver the relevant game or betting service. These providers are prohibited from using your personal data for any purpose other than delivering their contracted service.
We may disclose personal data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where required to do so by applicable law, court order, or regulatory directive. We will endeavour to notify you of any such compelled disclosure where legally permitted.
In the event of a merger, acquisition, restructuring, or sale of all or part of the Wimbox business, your personal data may be transferred to the relevant acquiring or successor entity, subject to applicable data protection obligations. You will be notified of any such transfer by email prior to it taking effect.
Wimbox will never sell, rent, or disclose your personal data to advertising networks, data brokers, or commercial third parties for marketing purposes without your explicit prior consent.
Given the financial nature of the Wimbox Platform, the handling of payment data and identity verification documents is subject to additional protections and obligations.
Wimbox does not store full payment card numbers, CVV codes, or complete bank account credentials on our systems. All payment card processing is handled by PCI DSS-compliant third-party payment gateways. We retain only sufficient payment reference data to support transaction reconciliation and dispute resolution.
Identity verification documents submitted as part of the KYC process (e.g., copies of your Malaysian MyKad, passport, or proof of address) are transmitted via encrypted channels, stored in secure access-controlled environments, and accessed only by authorised Wimbox compliance personnel and contracted KYC service providers. These documents are retained for the minimum period required by applicable law and then securely destroyed.
In compliance with our AML/CFT obligations, Wimbox screens player identities and transactions against international sanctions databases, PEP lists, and adverse media sources. Where a match or concern is identified, we may be required to file regulatory reports. We are prohibited by law from disclosing to you that such reporting has occurred in certain circumstances.
The Wimbox Platform uses cookies and related tracking technologies to deliver and improve our services. The following categories of cookies are used:
You may control non-essential cookies via your browser settings or our cookie preference interface. Please note that disabling certain cookies may affect the functionality of the Platform.
Wimbox does not use third-party advertising cookies or behavioural advertising tracking technologies that share your data with advertising networks or external marketing platforms.
Wimbox retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Registration Data | Duration of account plus 5 years post-closure | Regulatory / AML compliance |
| KYC Documents | 5 years from verification date or account closure | Legal / AML/CFT obligation |
| Transaction Records | 7 years from transaction date | Financial regulatory obligation |
| Gaming Activity Logs | 3 years from last activity | Regulatory / dispute resolution |
| Support Communications | 3 years from interaction date | Dispute resolution / legitimate interest |
| Marketing Consent Records | Until withdrawal of consent plus 1 year | Legal compliance |
| Technical / Log Data | Up to 12 months | Security / fraud prevention |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.
Wimbox implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security programme includes the following controls:
While we implement robust security controls, no internet-based system can guarantee absolute security. You also bear responsibility for protecting your account credentials. If you suspect your account has been compromised, contact us immediately at [email protected].
Subject to applicable law and certain regulatory limitations, you have the following rights in relation to your personal data held by Wimbox. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":
You have the right to request a copy of the personal data we hold about you and to receive information about how it is being processed.
You have the right to request correction of inaccurate or incomplete personal data held about you. You may also update certain account details directly through your Player Account settings.
You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to our legal retention obligations — data required for AML/CFT compliance cannot be erased before the mandatory retention period expires.
You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data or while an objection is being assessed.
Where processing is based on your consent or on contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
You have the right to object to processing based on legitimate interests, including profiling. You have an unconditional right to object to processing for direct marketing purposes at any time, without providing justification.
Where you have consented to receive marketing communications from Wimbox, you may withdraw that consent at any time by using the unsubscribe link in any marketing email or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out before withdrawal.
We aim to respond to all data rights requests within 30 days of receipt. In complex or high-volume cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and reason within the initial 30-day window.
The Wimbox Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. If we become aware that personal data has been collected from an underage individual, we will take immediate steps to delete such data and close the associated account.
Age verification is conducted as part of our KYC process, and we reserve the right to request documentary proof of age at any point. If you have reason to believe that a minor has registered on the Wimbox Platform or that their personal data has been collected, please notify us immediately at [email protected] so that we can investigate and take appropriate remedial action.
Wimbox strictly enforces the 21+ minimum age requirement. Any account found to be held by a person under 21 years of age will be closed immediately, all personal data will be deleted, and any deposits or winnings will be handled in accordance with our Terms & Conditions and applicable law.
As an internationally operated online gaming platform, Wimbox may transfer your personal data to data processors and infrastructure providers located outside of Malaysia. In all cases where personal data is transferred internationally, Wimbox ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections afforded under applicable data protection law.
Appropriate transfer safeguards may include: contractual data processing agreements incorporating standard data protection clauses; transfer to jurisdictions recognized as providing an adequate level of data protection; or other lawful transfer mechanisms as permitted by applicable law.
Our primary data infrastructure is hosted within secure data centre facilities, and all international transfers are conducted over encrypted channels. For further information about the safeguards applied to international transfers of your personal data, please contact us at [email protected].
Wimbox reserves the right to amend this Privacy Policy at any time. Material changes to this Policy — particularly those that affect how we collect or use your personal data, or that alter your rights — will be communicated to registered Players by email to the address registered on your account, at least 14 days before the changes take effect.
We will also update the "Last Updated" date at the top of this Policy whenever a revision is made. We encourage you to review this Policy periodically to stay informed about how we are protecting your information. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.
The current effective version of this Privacy Policy is dated 1 January 2026. All previous versions of this Policy are superseded.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Wimbox, please contact our data protection team using the details below. All privacy-related enquiries are handled in confidence.
For information about our responsible gambling practices and player protection tools, please visit our Responsible Gambling page. For our full service terms, please refer to our Terms & Conditions.
All sensitive personal and financial data stored on Wimbox infrastructure is encrypted at rest. Database access is strictly role-controlled and fully audit-logged to prevent unauthorized access.
You can opt out of all Wimbox marketing communications at any time — by unsubscribing from emails, adjusting your account preferences, or contacting our support team. Opt-outs are actioned immediately.
Every third-party vendor that processes your personal data on Wimbox's behalf — payment gateways, KYC providers, IT infrastructure — operates under binding contractual data protection agreements.
Your personal data stays private. Your MYR transactions are secure. Your gaming experience is fully encrypted. Wimbox — for Malaysian players aged 21 and above only.
Questions about your data? Email us at [email protected] (plain text — not a link). Review our Terms & Conditions and Responsible Gambling policy. Gambling involves risk — please play responsibly. 21+ only.