17 Win Privacy Policy – Our Commitment to Protecting the Personal Data of Malaysian Members

17 Win takes the privacy of every individual who interacts with our platform seriously. This Privacy Policy is designed to give you a clear and honest picture of how we manage your personal information — from how it is collected, used, and stored, to how it is protected against unauthorised access.

This document applies to all users of the 17 Win, including registered members, unregistered site visitors, and anyone who interacts with our services through any channel. "Personal data" in the context of this policy means any information that can be used to identify you directly or indirectly as an individual.

We are committed to complying with Malaysia's Personal Data Protection Act (PDPA) 2010 and all applicable related legislation. This commitment goes beyond legal formality — it is part of the core values of 17 Win who believes that member trust is our most valuable asset. Over 850,000 registered members across Malaysia have entrusted us with their personal information, and we do not take this responsibility lightly.

17 Win collects members' personal data only when it is genuinely necessary to provide a safe, efficient, and high-quality service. Below are the categories of data we collect and the purposes for which they are collected:

We do not collect sensitive personal data such as health information, religious beliefs, or sexual orientation under any circumstances. Data collection is limited strictly to what is necessary for platform operations — a principle known as "data minimisation" in modern data protection practice.

Personal information collected by 17 Win used solely for the following legitimate and clearly stated purposes. We do not use your data for anything unrelated to the provision of platform services without your explicit consent:

• Account Management: Creating, verifying, and managing your member account on the 17 Win platform. This includes the identity verification (KYC) process required to comply with anti-money laundering regulations.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX Maybank2u or CIMB Clicks, as well as withdrawals of winnings to the registered account. Financial data is used solely to facilitate these transactions.
• Provision of Betting Services: Enabling you to access and use all betting products offered by 17 Win, including Malaysia Super League and EPL Sports Betting, Live Casino, blackjack, baccarat, cricket, e-sports, and all other games.
• Customer Support: Handling enquiries, complaints and support requests efficiently. Support communication records are retained for training and service improvement purposes.
• Security and Fraud Prevention: To detect and prevent unauthorised access, fraud, bonus abuse, and other suspicious activities that could harm the platform or other members.
• Legal Compliance: Fulfilling legal obligations relating to anti-money laundering, identity verification and reporting requirements as prescribed by Malaysian authorities.
• Platform Improvements: Analysing aggregated usage data (not at the individual level) to understand how the platform is used and to make meaningful improvements to the member experience.
• Service Communications: To send you important notices regarding policy changes, promotions you are eligible for, and service updates. You may opt out of marketing communications at any time.

17 Win does not sell, rent, or disclose members' personal information to third parties for marketing or commercial purposes. This is an absolute and unwavering position. However, there are limited situations where your data may be shared, and all of these are solely to enable the platform to operate properly or to comply with the law:

• Payment Providers: Required transaction information is shared with payment service providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and FPX-participating banks that provide payment processing services to 17 Win. This sharing is strictly limited to the information necessary to process the transaction only.
• Security Technology Provider: Certain data is shared with third-party security and fraud detection technology providers who help us protect the platform from unlawful activity. These providers are bound by strict confidentiality agreements.
• Game Providers: For Live Casino games and certain games provided by third parties, minimal account information may be shared with the relevant game provider strictly for operational purposes.
• Legal Authorities: 17 Win will disclose the necessary information to Malaysian authorities — including the police, courts or regulatory bodies — when required to do so by law or a valid court order. We are not in a position to decline such requests.

All third parties that receive member data 17 Win bound by strict confidentiality and data protection agreements. They are not permitted to use that data for any purpose other than what is specified in those agreements.

17 Win continuously invests in data security infrastructure to ensure our members' personal and financial information remains protected at all times. The following are the security layers we employ:

• Data Encryption in Transit: All communications between your browser/app and 17 Win's servers are encrypted using Transport Layer Security (TLS 1.3) with a 256-bit SSL certificate. This means anyone who intercepts your network traffic will be unable to read the data being transmitted.
• Stored Data Encryption: Sensitive data such as member passwords is never stored in plain text — it undergoes strong one-way cryptographic hashing before being saved. Payment account details are stored in encrypted format in accordance with industry standards.
• Strict Access Controls: Access to member data within internal systems 17 Win is restricted to staff who require such access to perform their duties only (the "least privilege" principle). All access is logged and monitored.
• Two-Factor Authentication (2FA): The 17 Win platform offers OTP verification via SMS for every new login from an unrecognised device and every withdrawal request, ensuring that only you can access your account even if your password is compromised.
• Real-Time Threat Monitoring: Our security monitoring system operates 24/7 to detect unusual activity, intrusion attempts, and other cyber threats. Immediate alerts are sent to the security team whenever an anomaly is detected.
• Independent Security Audit: Our technology infrastructure undergoes regular independent security assessments to identify and address any vulnerabilities before they can be exploited.
• Disaster Recovery: Member data is regularly backed up to secure, geographically separate locations to ensure full recovery in the event of a technical failure or disaster.

17 Win only retains members' personal data for as long as it is needed for the purposes stated in this policy, or as required by Malaysian law. The following are general retention guidelines for different categories of data:

• Active Account Data: For as long as your account remains active on the 17 Win platform. You may request account closure at any time, after which your personal data will be deleted or anonymised within a reasonable period.
• Financial Transaction Records: Retained for seven (7) years from the date of the transaction, in accordance with Malaysian legal requirements relating to financial records and AMLA (Anti-Money Laundering Act) compliance.
• Identity Verification Records (KYC): Retained for five (5) years after account closure or the date of the last transaction, in accordance with AMLA requirements.
• Activity and Security Logs: Typically retained for one (1) to two (2) years for security purposes and to facilitate the investigation of any issues that may arise.
• Support Communication Records: Retained for two (2) years from the date of last communication for reference and quality training purposes.

Once the retention period has lapsed or the data is no longer required, 17 Win will either securely delete that data or anonymise it so that it can no longer be linked to any specific individual.

Platform 17 Win uses cookies and similar tracking technologies to enhance the user experience, maintain the security of login sessions, and understand how the platform is used. Below is an explanation of the types of cookies we use:

• Session Cookies (Required): These cookies are essential for the platform's core functionality — they allow the system to recognise your active login session and keep you logged in while using the platform. Without them, the platform cannot function properly. These cookies are automatically deleted when you close your browser.
• Preference Cookies: Saves your preferences such as language, preferred odds format, and other display settings so you do not need to reconfigure them on every visit. This data remains on your device and is not transmitted to our servers.
• Security Cookies: Used to detect unusual login activity, unauthorised access attempts and suspicious behavioural patterns in order to protect your account.
• Analytics Cookies: Aggregated usage data (with no personally identifiable information) is collected to help us understand which pages receive the most visits, how users navigate the platform, and where there are opportunities for improvement. This data is not linked to individual accounts.

You can manage cookies through your browser settings. However, disabling essential cookies may affect the functionality of the platform. 17 Win. For the best experience, we recommend allowing at least the required cookies.

Under Malaysia's Personal Data Protection Act (PDPA) 2010 and the internal policies of 17 Win, you have the following rights regarding your personal data:

• Right to Access: You have the right to know what personal data we hold about you and to obtain a copy of it. Submit a written request to support@17win.my and we will respond within 14 business days.
• Right to Rectification: If you find that the personal data we hold about you is inaccurate or out of date, you have the right to request a correction. You may also update certain profile information directly within your account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data. Please note that this right is not absolute — we may be required to retain certain data to fulfil legal obligations (such as financial transaction records) even after receiving a deletion request.
• Right to Withdraw Consent: You may withdraw your consent to receive marketing communications at any time via the "unsubscribe" link in our emails or by contacting support. Withdrawing your consent does not affect the validity of any data processing that took place prior to the withdrawal.
• Right to Complain: If you are not satisfied with how 17 Win managing your personal data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant authority.

To exercise any of the above rights, please contact our privacy team 17 Win via email at support@17win.my, clearly stating the right you wish to exercise and any relevant information. We are committed to processing all data rights requests fairly and within a reasonable timeframe.

Platform 17 Win is exclusively for individuals aged 18 and above. We do not knowingly collect or retain any personal data relating to individuals under the age of 18.

If we discover that personal data belonging to an individual under the age of 18 has been collected — whether through a dishonest account registration or by any other means — we will promptly take the following steps:

• Delete all personal data belonging to that individual from our systems.
• Immediate closure of the associated account.
• Report the incident to the relevant authorities if required by law.

If you are a parent or guardian and you believe your underage child has registered for or used the platform, 17 Win, please contact us immediately at support@17win.my. We will take prompt action to resolve the situation and delete all related data.

17 Win reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, new legal requirements or technological developments. For significant changes that affect member rights, we will notify the relevant members via their registered email address or an in-platform notice at least seven (7) days before the changes take effect.

Continued use of the platform 17 Win after the updated Privacy Policy takes effect will be considered as acceptance of the revised terms. The date of the most recent update is always displayed at the top of this document for your reference.

We encourage you to review this Privacy Policy periodically to stay informed about how 17 Win protect your information. The latest version displayed on this website is the version currently in force.

For any queries, concerns, or requests relating to your privacy and personal data, please contact our Privacy Officer 17 Win via:

• Email: support@17win.my (response within 2 business hours)
• Live Chat: Available 24/7 on the platform via the chat icon at the bottom right corner

Last updated date of this Privacy Policy: January 2026.