Privacy Policy —
How gdwon3 Protects Your Data

This Privacy Policy ("Policy") is issued by gdwon3 ("the Company", "we", "us", or "our") and applies to all personal data collected through the gdwon3 online gaming platform, accessible at https://gdwon3.cam ("the Platform"), and any related services, communications, or interactions between gdwon3 and its registered users ("Players" or "you").

gdwon3 is committed to protecting the privacy and personal data of every individual who uses our Platform. We handle all personal data in accordance with applicable data protection principles and international best practices, including purpose limitation, data minimisation, storage limitation, and data security.

By registering an Account on gdwon3, making a deposit, placing a wager, or otherwise using the Platform, you acknowledge that you have read, understood, and accepted the terms of this Privacy Policy. This Policy should be read in conjunction with our Terms & Conditions.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — gdwon3, being the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of gdwon3 under contractual obligations (e.g., payment processors, KYC verification providers, cloud hosting services).
• "KYC" — Know Your Customer identity verification process required under anti-money laundering regulations and responsible gambling obligations.
• "Cookie" — a small text file placed on your device when you visit a website, used to store preferences, session data, and analytics information.
• "Platform" — the gdwon3 website, mobile interface, and all associated services at https://gdwon3.cam.
• "Account" — a registered player profile on the Platform.

gdwon3 collects personal data that is necessary to provide, maintain, and improve our services, fulfil legal and regulatory obligations, and protect the security and integrity of the Platform. The categories of personal data we collect are set out below.

3.1 Registration Data

When you create an Account on gdwon3, we collect information you provide directly, including: full legal name; date of birth; residential address; email address; mobile phone number; and preferred username. This information is required to establish and maintain your Account.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations and responsible gambling requirements, we collect identity documents including: copies of your Malaysian MyKad (IC), Driver's License, or valid Passport; proof of residential address (utility bill, bank statement, or official correspondence dated within three months); and a selfie photograph holding your identification document.

3.3 Financial Data

We collect information related to your financial transactions on the Platform, including deposit and withdrawal history, preferred payment methods (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect), and transaction amounts in Malaysian Ringgit (MYR). We do not store full payment card numbers or complete banking credentials — these are handled by certified third-party payment processors.

3.4 Gaming & Betting Activity Data

We collect records of your gaming activity on the Platform, including game sessions, wager history, bet amounts and outcomes, bonus usage, and sports betting market selections. This data is used for account management, dispute resolution, bonus verification, and responsible gambling monitoring.

3.5 Technical & Device Data

When you access the Platform, we automatically collect technical information including: IP address; device type and operating system; browser type and version; session timestamps; pages visited and features accessed; and geolocation data (general region level only, derived from IP address).

3.6 Communication Data

We retain records of communications between you and our support team, including live chat transcripts, email correspondence, and any feedback or complaints submitted. These records are held for dispute resolution, quality assurance, and compliance purposes.

gdwon3 processes your personal data for the following clearly defined purposes. We do not use your data for any purpose incompatible with those listed below without your prior consent.

Where gdwon3 sends you promotional communications — such as bonus offers, reload notifications, or event announcements — this will only occur where you have opted in to receive such communications during registration or in your Account settings. You may withdraw consent for marketing communications at any time by updating your notification preferences or contacting support.

gdwon3 processes your personal data on one or more of the following lawful bases, depending on the specific purpose of processing:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC verification requirements, and regulatory reporting duties.
• Legitimate interests: Processing for purposes of fraud prevention, Platform security, responsible gambling monitoring, and service improvement, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and optional analytics features, conducted only where you have provided express, freely given, and informed consent. Consent may be withdrawn at any time.

gdwon3 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the limited circumstances described below, and always under appropriate contractual or legal protections.

6.1 Authorised Service Providers (Data Processors)

We engage trusted third-party service providers to perform specific functions on our behalf, including payment processing (e.g., handling Touch 'n Go eWallet, DuitNow, FPX, and bank transfer transactions), KYC and identity verification, cloud hosting and data storage, fraud detection and cybersecurity, and customer support technology. All third-party processors operate under binding data processing agreements that restrict their use of your data to the specific purpose for which it was shared.

6.2 Regulatory & Law Enforcement Authorities

gdwon3 may be required to disclose personal data to competent regulatory authorities, law enforcement agencies, financial intelligence units, or courts of competent jurisdiction where we are legally compelled to do so under applicable law. Such disclosures will be made only to the extent strictly required by the applicable legal obligation.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of gdwon3's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide reasonable advance notice of any such transfer that materially affects how your personal data is processed.

6.4 Consent-Based Disclosures

Outside of the categories above, we will share your personal data with third parties only with your prior express consent.

gdwon3 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Account registration data: Retained for the duration of the active Account relationship, plus a minimum of five (5) years following Account closure, in accordance with AML and regulatory record-keeping requirements.
• KYC verification documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law or ongoing regulatory proceedings.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications: Retained for three (3) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Gaming activity logs: Retained for three (3) years for responsible gambling monitoring and internal audit purposes.
• Marketing consent records: Retained for the duration of consent, and for one (1) year following withdrawal of consent, to evidence compliance.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised. Anonymised, aggregated data (which cannot identify any individual) may be retained indefinitely for statistical and analytical purposes.

gdwon3 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS encryption on all data transmissions between your device and our Platform — the same standard used by major financial institutions;
• Encryption at rest for all sensitive personal data and KYC documents stored on our servers;
• Access controls ensuring that only authorised personnel with a legitimate business need can access personal data, on a strictly need-to-know basis;
• Multi-factor authentication requirements for administrative access to systems holding personal data;
• Regular security audits and penetration testing conducted by qualified third-party security professionals;
• Secure, certified data centres with physical access restrictions, redundancy systems, and continuous monitoring.

While gdwon3 takes all reasonable steps to protect your personal data, no system is completely impenetrable. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable data breach notification obligations.

You are also responsible for maintaining the security of your Account credentials. Do not share your password with anyone. gdwon3 will never ask you for your password via live chat or email.

gdwon3 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit our website. They help us remember your preferences, maintain your session, and understand how the Platform is used.

9.1 Categories of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as login session management, security authentication, and payment processing flows. These cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how visitors navigate the Platform — pages visited, time spent, and error occurrences. This data helps us improve the user experience. Consent is obtained before these cookies are set.
• Functionality Cookies: Store your personalisation preferences such as language settings and display preferences, so you do not need to re-enter them on each visit.
• Marketing Cookies: Used, with your consent, to deliver relevant promotional content. If you opt out of marketing communications, associated marketing cookies will also be disabled.

9.2 Managing Your Cookie Preferences

You may adjust your cookie preferences at any time through your browser settings or the Platform's cookie preference centre. Please note that disabling strictly necessary cookies may impair your ability to use certain features of gdwon3. Most browsers allow you to view, delete, and block cookies through the browser settings menu.

As an internationally operating platform, gdwon3 may transfer your personal data to, or process it in, jurisdictions outside of Malaysia. This may occur in connection with cloud hosting services, payment processing infrastructure, or KYC verification providers based in other countries.

Where personal data is transferred outside of Malaysia, gdwon3 ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to that provided under this Policy. Such safeguards may include contractual clauses binding the recipient to data protection standards, or reliance on the recipient country having an adequate level of data protection as recognised by applicable standards.

By using the Platform, you acknowledge and consent to such international transfers, where necessary for the provision of the services described in this Policy.

Subject to applicable law and certain limited exceptions (such as where data must be retained to fulfil legal obligations), you have the following rights with respect to your personal data held by gdwon3. To exercise any of these rights, please contact us at the details provided in Section 14.

Requests to exercise your data rights will be processed within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by up to a further 30 days, in which case you will be notified. gdwon3 does not charge a fee for processing data rights requests unless they are manifestly unfounded or excessive in nature.

Please note that certain data rights may be subject to limitations where gdwon3 is required to retain data under AML regulations, licensing conditions, or other applicable legal obligations. In such cases, we will explain the applicable restriction clearly.

The gdwon3 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and any Account found to belong to an individual under 21 will be immediately suspended, with all associated data reviewed in accordance with our regulatory obligations.

If you are a parent or guardian and believe that a minor has registered on the Platform or provided personal data to gdwon3 without your knowledge or consent, please contact us immediately at the details in Section 14. We will take prompt action to investigate and, where confirmed, delete the relevant data and close the Account.

gdwon3 supports industry initiatives to prevent underage gambling and cooperates fully with applicable regulatory requirements relating to age verification and the protection of minors.

gdwon3 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The date of the most recent update is displayed at the top of this page.

Where amendments are material — meaning they significantly affect how we process your personal data or the rights available to you — we will provide advance notice through the Platform (via a notice on login or a banner on the homepage) and/or by email to your registered address. Minor or clarificatory amendments may be made without specific notification.

Continued use of the Platform following the effective date of any amendment to this Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must cease using the Platform and may request Account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by gdwon3, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the Platform. Recommended for urgent queries relating to account data or suspicious activity.
• Email: [email protected] — for formal data rights requests, privacy complaints, or detailed enquiries. Please include "Privacy Request" in the subject line for faster routing.
• Languages: Support is available in English and Bahasa Malaysia.
• Response Time: Data rights requests will receive a formal acknowledgement within 5 business days and a substantive response within 30 calendar days.

For data erasure, access, or portability requests, please provide sufficient information to verify your identity before we process the request. This is necessary to ensure that personal data is disclosed or deleted only at the direction of the data subject.