Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how MambaWin ("MambaWin", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "Member", "User") who access, register on, or otherwise interact with the MambaWin online casino and sports betting platform, accessible at https://mambawin.cam and any associated subdomains or interfaces.

MambaWin is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection legislation. This Policy applies to all Members, regardless of where they are located, including players based across Malaysia — in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions.

By registering an account on MambaWin, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent, you must not register an account or continue to use the MambaWin platform.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, location data, email address, financial account details, or any combination of data that could be used to identify an individual.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means MambaWin, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party engaged by MambaWin to process Personal Data on our behalf, including payment processors, identity verification providers, and cloud infrastructure providers.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or financial information, which is afforded enhanced protection under this Policy.
• "KYC" means Know Your Customer — the identity and age verification process required from Members before certain platform activities are permitted.
• "Cookies" means small text files placed on your device by the MambaWin platform for operational, analytical, or preference-management purposes.

3. Data Controller Identity

MambaWin acts as the Data Controller in respect of all personal data collected through the platform. As Data Controller, MambaWin determines the purposes and means by which your personal data is processed.

For all privacy-related enquiries, data subject access requests, or complaints, please contact MambaWin's privacy team at:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Enquiry" or "Data Subject Request"
• Response Time: Within 30 days of receipt of your written request

4. Personal Data We Collect

MambaWin collects personal data through several channels: at account registration, through ongoing use of the platform, via KYC verification submissions, through payment transactions, and through your interactions with our customer support team. The categories of personal data we collect are detailed in the table below.

4.1 Data Collected Automatically

When you access the MambaWin platform, certain technical data is collected automatically, including your IP address, device identifiers, browser type, and pages visited. This data is used for platform security, fraud detection, and to improve the overall user experience. This collection is a standard feature of web-based platforms and does not require explicit action on your part.

4.2 Data from Third Parties

In certain circumstances, MambaWin may receive personal data about you from third parties, including identity verification agencies engaged for KYC purposes, payment processors who provide transaction confirmation data, and fraud prevention databases. Any data received from third parties is handled with the same level of care as data collected directly from you.

5. Legal Basis for Processing

MambaWin processes your personal data on the following legal bases, depending on the processing activity in question:

• Contractual Necessity: Processing that is necessary to perform our obligations under the Terms & Conditions, including account management, deposit processing, withdrawal fulfilment, and bonus administration.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC requirements, fraud prevention duties, and regulatory reporting.
• Legitimate Interests: Processing necessary for the legitimate interests of MambaWin, including platform security, fraud detection, responsible gambling monitoring, and service improvement — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where consent is the legal basis, such as for the sending of direct marketing communications, we will obtain your explicit consent before processing and you may withdraw consent at any time without affecting prior processing.

6. How We Use Your Personal Data

MambaWin uses your personal data for the following purposes:

• To create, verify, and manage your MambaWin Account, including processing deposits and withdrawals in Malaysian Ringgit (MYR);
• To conduct identity and age verification (KYC) as required by our operating obligations — confirming that all players are 21 years of age or older;
• To process gambling transactions, settle bets, credit bonuses, and maintain accurate account records;
• To detect, prevent, and investigate fraud, money laundering, bonus abuse, and other prohibited conduct on the platform;
• To comply with applicable legal obligations, including reporting requirements to regulatory authorities;
• To provide customer support, respond to enquiries, and resolve account disputes;
• To send transactional communications, including deposit confirmations, withdrawal notifications, and security alerts;
• To monitor responsible gambling indicators, enforce player-set deposit and loss limits, and action self-exclusion requests;
• To improve and develop the MambaWin platform through analysis of aggregated usage data and performance metrics;
• To send marketing communications where you have provided consent, including promotional offers, VIP tier updates, and event notifications.

7. Data Sharing & Disclosure

MambaWin does not sell, rent, or trade your personal data to third parties for commercial gain. We share personal data only in the following limited circumstances:

• Payment Processors: We share financial data with payment service providers — including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and USDT TRC20 transactions — solely for the purpose of processing deposits and withdrawals. These providers are bound by their own privacy and security obligations.
• Identity Verification Providers: KYC documentation is shared with accredited third-party identity verification agencies to confirm the identity and age of Members. These agencies operate under strict data processing agreements with MambaWin.
• Fraud Prevention Services: We share data with fraud screening and anti-money laundering (AML) service providers to identify and prevent financial crime on the platform.
• Regulatory Authorities: We may be legally required to disclose personal data to regulatory bodies, law enforcement agencies, or financial intelligence units where mandated by applicable law or a court order. MambaWin will, where legally permissible, notify you of any such disclosure.
• IT and Infrastructure Providers: Data is hosted on secure cloud infrastructure operated by third-party technology providers under strict data processing agreements that require them to protect your data to the same standard as MambaWin.
• Business Transfers: In the event of a merger, acquisition, or sale of business assets, your personal data may be transferred to the successor entity, subject to the same privacy protections as described in this Policy.

All third parties with whom MambaWin shares personal data are required to maintain appropriate security measures and to process that data only for the purposes for which it was shared.

8. Data Retention

MambaWin retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention periods are as follows:

• Account and Identity Data: Retained for the duration of the active account and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with applicable financial regulations.
• KYC Documentation: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later.
• Gambling Activity Logs: Retained for a minimum of three (3) years for responsible gambling monitoring and dispute resolution purposes.
• Marketing Consent Records: Retained until consent is withdrawn or for up to three (3) years from the last interaction where no formal withdrawal is received.
• Support Communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents its reconstruction. Where anonymisation is used in place of deletion, the resulting dataset no longer constitutes personal data and is retained for statistical analysis purposes only.

9. International Data Transfers

MambaWin's platform infrastructure and some of our third-party service providers may be located outside of Malaysia. Where personal data is transferred to jurisdictions outside Malaysia, MambaWin ensures that appropriate safeguards are in place to maintain an equivalent level of data protection, including:

• Standard contractual clauses and data processing agreements with all third-party recipients;
• Transfer only to jurisdictions with an adequate level of data protection recognised under applicable law;
• Technical and organisational security measures commensurate with the sensitivity of the data being transferred.

By using MambaWin, you acknowledge and consent to the potential international transfer of your personal data as described above, subject to the safeguards stated in this section.

10. Cookies & Tracking Technologies

MambaWin uses cookies and similar tracking technologies to operate and improve the platform, to maintain session security, and to analyse usage patterns. The types of cookies used by MambaWin are as follows:

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies, security tokens, and preference storage. These cookies cannot be disabled without preventing normal platform use.
• Analytical Cookies: Used to understand how Members interact with the platform, including which pages are most frequently visited and where users encounter difficulties. Data collected via analytical cookies is aggregated and anonymised wherever possible.
• Functional Cookies: Used to remember your preferences and settings, such as language, display preferences, and responsible gambling limit configurations.

You may manage cookie preferences through your web browser settings. Note that disabling certain cookies may affect the functionality of the MambaWin platform. For further information on managing cookies, please refer to the help documentation of your browser.

11. Protection of Minors

MambaWin strictly prohibits the use of the platform by individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age. Where we have reasonable grounds to believe that a Member is under the minimum age, we will immediately suspend the account and delete all associated personal data, subject to any legal retention obligations that may apply.

If you are a parent or guardian and believe your child has registered an account on MambaWin, please contact us immediately at [email protected]. We will take prompt action to investigate and, where confirmed, close the account and erase the associated data.

12. Data Security

MambaWin implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the MambaWin platform;
• Encryption of sensitive personal data stored on our servers, including KYC documents and financial records;
• Role-based access controls ensuring that personal data is accessible only to personnel with a legitimate business need;
• Two-factor authentication requirements for administrative access to systems containing personal data;
• Regular security audits, penetration testing, and vulnerability assessments carried out by qualified security professionals;
• Incident response procedures to detect, respond to, and notify affected individuals of any data security breach in a timely manner.

While MambaWin takes all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. You are also responsible for maintaining the security of your account credentials and should notify us immediately if you suspect any unauthorised access to your account.

13. Your Rights as a Data Subject

Subject to applicable data protection law, you hold the following rights in respect of your personal data held by MambaWin. All requests should be submitted in writing to [email protected] with the subject line "Data Subject Request". We will respond within 30 calendar days of receipt.

• Right of Access: You may request confirmation of whether MambaWin holds personal data about you and, if so, request a copy of that data along with information about how it is used.
• Right to Rectification: You may request the correction of any inaccurate or incomplete personal data we hold about you. Updates to account details can also be made directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing was unlawful. Note that this right is subject to overriding legal retention obligations.
• Right to Restrict Processing: In certain circumstances, you may request that we limit the processing of your personal data — for example, while the accuracy of data is under dispute.
• Right to Data Portability: Where processing is based on consent or contractual necessity, and carried out by automated means, you may request receipt of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing of your personal data where it is based on legitimate interests or for direct marketing purposes. Where you object to marketing, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

14. Marketing Communications

MambaWin may send you promotional emails, push notifications, and SMS communications relating to new games, VIP tier promotions, reload bonuses, and special events — but only where you have provided your explicit consent to receive such communications at registration or subsequently through your account settings.

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email;
• Updating your communication preferences in your MambaWin account settings;
• Contacting our support team at [email protected] with a request to opt out of marketing.

Opting out of marketing communications will not affect the delivery of transactional messages, such as deposit confirmations, withdrawal notifications, security alerts, and KYC status updates, which form part of the account management service.

15. Third-Party Links & Services

The MambaWin platform may contain references to third-party payment providers and financial institutions including Maybank, CIMB Bank, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, and GrabPay. MambaWin is not responsible for the privacy practices or content of these third-party entities.

When you interact with a third-party payment provider as part of a deposit or withdrawal transaction, that provider's own privacy policy and terms of service govern the handling of your data in that context. We encourage you to review the privacy policies of any third-party service provider you engage with in connection with your MambaWin account.

16. Policy Amendments

MambaWin reserves the right to amend, update, or replace this Privacy Policy at any time. Where amendments are material, we will notify Members via email or an on-platform notification before the changes take effect. The effective date at the top of this Policy will be updated accordingly.

Continued use of the MambaWin platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept any changes to this Policy, you should discontinue use of the platform and may request account closure.

The most current version of this Privacy Policy is always available at https://mambawin.cam/privacy-policy. We recommend reviewing this page periodically.

17. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way MambaWin handles your personal data, please contact our privacy team through the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request"
• Live Chat: Available through the MambaWin platform, 08:00 – 00:00 MYT (Monday to Sunday)
• Response Time: Privacy and data subject requests will be acknowledged within 5 business days and fully resolved within 30 calendar days.

If you are not satisfied with MambaWin's response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In Malaysia, data protection matters may be directed to the Personal Data Protection Department (JPDP) under the Personal Data Protection Act 2010 (PDPA).