Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is published by M13Win ("the Platform", "we", "us", "our") and governs the collection, use, storage, sharing, and protection of personal data relating to all individuals who register accounts, access, or otherwise interact with the m13win platform at https://m13win.cam ("the Website").

M13Win takes the privacy of its players seriously. We recognise that the personal data you share with us — including identity documents, financial information, and behavioural data — is sensitive and deserving of the highest standard of protection. This Policy explains our practices in plain terms so you can make an informed decision about your engagement with the Platform.

By registering an Account, depositing funds, or continuing to use the m13win Platform, you confirm that you have read, understood, and consent to the data practices described in this Privacy Policy. If you do not agree with any aspect of this Policy, you should refrain from using the Platform and may contact us to request Account closure.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

2 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably identify a natural person, directly or indirectly, including name, identification number, email address, phone number, IP address, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, alteration, and deletion.
• "Data Controller" means M13Win, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of M13Win, under documented contractual obligations.
• "Data Subject" means any identified or identifiable natural person whose Personal Data is processed by M13Win — in the context of the Platform, this principally means registered Players.
• "KYC Data" means identity verification documents and information submitted by Players to satisfy Know Your Customer requirements, including but not limited to government-issued identification documents, proof of address, and selfie photographs.
• "Cookies" means small data files placed on your device by the Platform for the purposes of session management, analytics, and personalisation.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a stated purpose.

3 Personal Data We Collect

M13Win collects Personal Data across several categories, as set out in the table below. We collect only the data necessary for the specific purposes identified and do not collect Personal Data speculatively.

M13Win does not knowingly collect special categories of sensitive personal data (e.g., health data, racial or ethnic origin, religious beliefs, political opinions) except where strictly required for responsible gambling purposes, such as self-exclusion programme administration.

4 How Personal Data Is Collected

M13Win collects Personal Data through the following channels:

• Direct submission: Information you provide voluntarily when registering an Account, completing KYC verification, making deposits or withdrawals, contacting support, or subscribing to communications.
• Automated technical collection: Data collected automatically when you access the Platform, including IP addresses, session cookies, device fingerprinting, and browsing behaviour analytics.
• Payment processors: Transaction confirmation data received from your payment service provider (e.g., Touch 'n Go eWallet, FPX gateway, Maybank, CIMB) when you initiate a deposit or withdrawal.
• Third-party identity verification providers: Where M13Win utilises an automated KYC provider to verify identity documents, data is exchanged with that provider under strict data processing agreements.
• Fraud detection and AML services: Risk scoring and transaction monitoring data received from third-party compliance technology providers in connection with our anti-money-laundering obligations.

5 Data Processing & Use

M13Win processes Personal Data for the following specific and legitimate purposes:

• Account Management: Creating, maintaining, and administering your Player Account, processing login authentication, and managing Account settings and preferences.
• KYC and Regulatory Compliance: Verifying your identity and age (21+ requirement), conducting anti-money-laundering checks, complying with our international gaming licence obligations, and reporting to regulatory authorities where legally required.
• Payment Processing: Processing deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, DuitNow, Maybank, CIMB, Public Bank, Boost, or cryptocurrency), reconciling transactions, and managing refunds.
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions for quality assurance.
• Responsible Gambling: Monitoring betting patterns to identify potential problem gambling behaviours, administering self-exclusion programmes, and enforcing deposit limits set by Players.
• Security and Fraud Prevention: Detecting and preventing unauthorised Account access, fraudulent transactions, bonus abuse, and money laundering activity.
• Platform Improvement: Analysing aggregated usage data to improve game performance, user interface design, and the overall player experience on m13win.
• Marketing Communications: Where you have opted in, sending personalised promotions, bonus notifications, and platform updates relevant to your interests and activity. You may withdraw this consent at any time.
• Legal Obligations: Retaining records as required by applicable laws and regulations, and disclosing data to competent authorities in response to lawful requests.

6 Legal Basis for Processing

M13Win processes Personal Data under the following legal bases, consistent with internationally recognised data protection frameworks:

• Contractual necessity: Processing required to perform the contract between m13win and the Player — including Account registration, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, gaming licence conditions, and regulatory reporting requirements.
• Legitimate interests: Processing necessary for the legitimate interests of M13Win, such as fraud prevention, security monitoring, and service improvement, where these interests are not overridden by the rights and interests of Data Subjects.
• Consent: Processing based on your specific, freely given consent — principally for marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7 Data Sharing & Third-Party Disclosure

M13Win does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We disclose Personal Data only in the following controlled circumstances:

• Service Providers (Data Processors): We engage carefully selected third-party processors — including payment gateway operators (Touch 'n Go, FPX, bank partners), KYC verification providers, cloud hosting providers, and customer support platform operators — who process data strictly on our behalf and under binding data processing agreements.
• Gaming Software Providers: Where you play a game provided by a third-party games studio, necessary session and account data is shared with that provider solely for the purpose of game delivery. These providers are contractually prohibited from using the data for any other purpose.
• Regulatory Authorities and Law Enforcement: We are required to disclose Personal Data in response to lawful requests from competent regulatory bodies, courts of law, or law enforcement agencies, including in the context of anti-money-laundering investigations or gaming licence audits.
• Fraud and AML Compliance Networks: Where required by our licensing obligations or AML programme, anonymised or pseudonymised data may be shared with industry fraud prevention networks to prevent cross-platform fraud and money laundering.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of M13Win's business, Personal Data may be transferred to the successor entity, subject to the same or equivalent privacy protections. Players will be notified of any such transfer.

8 Cookies & Tracking Technologies

M13Win uses cookies and similar tracking technologies to operate and improve the Platform. The cookies we use fall into the following categories:

Strictly necessary cookies cannot be disabled as they are essential to the operation of the Platform. Functional and analytics cookies may be managed through your browser settings. Note that disabling certain cookies may affect the functionality and performance of the Platform.

M13Win does not deploy advertising or retargeting cookies that track your behaviour across third-party websites.

9 Data Retention

M13Win retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to overriding legal and regulatory retention obligations. The following general retention periods apply:

• Active Account Data: Retained for the lifetime of your Account plus a minimum of 5 years following Account closure, in accordance with standard AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of 5 years from the date of verification, as required by anti-money-laundering regulations applicable under our international gaming licence.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction for accounting, tax, and regulatory audit purposes.
• Support Correspondence: Retained for 3 years from the date of each interaction, to support dispute resolution and quality assurance processes.
• Marketing Preferences and Consent Records: Retained for the duration of your Account plus 2 years following Account closure or withdrawal of consent, whichever is later.
• Analytics and Technical Data: Aggregated analytics data may be retained indefinitely in anonymised form. Individually identifiable technical data is retained for up to 24 months.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is technically constrained by backup systems, data will be isolated from active processing pending scheduled destruction.

10 Data Security

M13Win implements industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the m13win Platform is encrypted in transit using Transport Layer Security (TLS 1.2/1.3). The padlock in your browser confirms an active encrypted session.
• Encryption at Rest: Sensitive Personal Data, including KYC documents and financial data, is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Strict role-based access controls limit Personal Data access to authorised personnel on a need-to-know basis. All staff with access to Personal Data undergo background screening and data protection training.
• Two-Factor Authentication (2FA): Available for all Player Accounts and mandatory for M13Win staff accessing systems that contain Personal Data.
• Regular Security Audits: Our platform undergoes regular penetration testing and security audits by independent third-party cybersecurity specialists.
• Incident Response: In the event of a data breach that poses a risk to affected individuals, M13Win will take immediate containment action and notify affected Players and relevant regulatory authorities within the timeframes required by applicable law.

11 Your Data Rights (User Rights)

Subject to applicable law and any overriding obligations (including AML record-keeping requirements), you have the following rights with respect to the Personal Data M13Win holds about you:

• Right of Access: You have the right to request a copy of the Personal Data M13Win holds about you, together with information about how it is processed. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data. Where possible, you may update certain Account data directly through your Account Settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to overriding regulatory retention obligations (e.g., AML records).
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a structured, machine-readable copy of the Personal Data you have provided to us.
• Right to Object: You have the right to object to processing based on legitimate interests. You may also opt out of marketing communications at any time by contacting support or updating your Account preferences.
• Right to Withdraw Consent: Where processing is based on your consent (principally marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact us using the details in Section 15. We will verify your identity before processing any data rights request to protect against unauthorised requests on behalf of other individuals.

12 Minors & Age Protection

M13Win is strictly an adult platform. The minimum eligible age for all Players is 21 years. The Platform is not directed at, and does not knowingly collect Personal Data from, persons under the age of 21.

All Players are required to complete KYC identity verification, which includes age verification against a government-issued identification document. Any Account found to belong to a person under the age of 21 will be immediately and permanently suspended, all associated Personal Data will be flagged and handled in accordance with applicable child protection regulations, and all funds on the Account will be forfeited.

If you believe that a minor has registered on the Platform or that Personal Data of a minor has been collected, please contact us immediately via the details in Section 15. M13Win takes underage access extremely seriously and will act without delay upon receipt of any such report.

13 International Data Transfers

As an internationally operated platform, M13Win may transfer Personal Data to service providers and infrastructure systems located outside of Malaysia. Such transfers are necessary to operate the Platform and deliver services to Players. Where Personal Data is transferred internationally, M13Win ensures that appropriate safeguards are in place, including:

• Data processing agreements with all third-party processors incorporating data protection obligations equivalent to internationally recognised standards;
• Transfer only to jurisdictions that provide an adequate level of data protection, or under contractual mechanisms that ensure equivalent protections;
• Technical security controls (encryption, access controls) applied irrespective of the transfer destination.

By using the m13win Platform, you acknowledge that your Personal Data may be transferred, stored, and processed in jurisdictions outside of Malaysia. M13Win will only execute such transfers where the applicable standards are met and your data is protected to an equivalent standard.

14 Policy Amendments

M13Win reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, notify Players via their registered email address or a prominent notice on the Platform.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the amended terms. We encourage you to review this Policy periodically to remain informed of how your Personal Data is being handled.

If you have concerns about any amendment to this Policy, please contact our Data Protection contact as detailed in Section 15 before continuing to use the Platform.

15 Contact & Data Enquiries

For all questions, concerns, data rights requests, or formal complaints relating to this Privacy Policy or M13Win's handling of your Personal Data, please contact our Data Protection team using the following details:

We will acknowledge all formal data rights requests within 5 business days and aim to provide a substantive response within 30 calendar days. Where a request is complex or involves multiple data categories, we will notify you if an extension is required.

If you are dissatisfied with our handling of your Personal Data or our response to a data rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.