Nagawin Privacy Policy

This Privacy Policy ("Policy") sets out the practices of Nagawin ("Company", "we", "us", "our") in relation to the collection, use, storage, disclosure, and protection of personal data belonging to individuals ("you", "User", "Player") who access or use the Nagawin platform at nagawin.cam (the "Website") and any associated services.

Nagawin operates an online casino and sports betting platform serving players across Malaysia, including in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout all Malaysian states. In the course of providing our services — which include live dealer casino games, slot, sports betting on Liga Super Malaysia and EPL markets, crash games, and esports betting — we necessarily collect and process personal data.

We are committed to processing personal data lawfully, fairly, and transparently in accordance with applicable data protection legislation. By creating an account on the Nagawin platform, you acknowledge that you have read this Policy and consent to the data practices described herein.

In this Policy, the following terms carry the meanings set out below:

• Personal Data: Any information relating to an identified or identifiable natural person, including name, contact details, financial information, and account activity records.
• Processing: Any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, or deletion.
• Data Controller: Nagawin, as the entity that determines the purposes and means of processing personal data collected through the platform.
• Data Processor: A third party that processes personal data on behalf of Nagawin under a binding data processing agreement, such as payment service providers and KYC verification partners.
• Consent: A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• KYC: Know Your Customer — the identity verification process applied to all Nagawin accounts prior to withdrawal processing.
• Cookie: A small data file placed on your device by the Website for the purposes of session management, functionality, analytics, or preference storage.

Nagawin collects personal data in the categories set out in the table below. We collect only the data that is necessary for the specific purpose for which it is collected.

Nagawin collects personal data through the following channels and mechanisms:

• Direct Collection: Data you provide directly when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or updating your account profile.
• Automated Technologies: Data collected automatically when you access the platform, including IP address, device identifiers, browser data, and session activity logs captured through server logs and analytics tools.
• Payment Providers: Confirmation and transaction reference data received from Malaysian banking and e-wallet partners including Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay when you initiate a deposit or withdrawal.
• KYC Verification Partners: Identity verification data returned by third-party KYC service providers who assist us in authenticating the documents you submit during the verification process.
• Cookies and Similar Technologies: Data collected through cookies placed on your device as described in Section 10 of this Policy.
• Fraud Prevention Services: Risk signals and data indicators provided by third-party fraud detection services that help us identify and prevent fraudulent account activity.

Nagawin processes personal data for the following purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected without obtaining fresh consent.

1. Account Management: To create, maintain, and administer your player account, including processing login requests and managing account settings.
2. Service Delivery: To provide access to the Nagawin platform including casino games, sports betting markets, bonus offers, and VIP membership features.
3. Payment Processing: To facilitate deposits and withdrawals via supported Malaysian payment channels and to maintain accurate transaction records.
4. Identity Verification: To comply with KYC obligations and confirm that all players meet the 21-years-minimum age requirement before accounts are fully activated.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions account takeover attempts, bonus abuse, and other forms of dishonest conduct.
6. Regulatory Compliance: To fulfil anti-money laundering (AML), counter-terrorism financing (CTF), and other legal obligations imposed by applicable laws and our operating licence conditions.
7. Responsible Gambling: To monitor gaming activity and identify patterns that may indicate problem gambling behaviour, enabling us to apply responsible gambling interventions where warranted.
8. Customer Support: To respond to your support queries, resolve disputes, and improve the quality of our service based on interaction records.
9. Platform Improvement: To analyse usage patterns and technical performance data in order to improve the platform experience for all users.
10. Marketing Communications (opt-in only): To send promotional communications about bonuses, new games, and platform updates to players who have opted in to receive them. You may opt out at any time.

We process your personal data one or more of the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Nagawin Terms and Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, AML, and data retention obligations under our operating licence.
• Legitimate Interests: Processing necessary for the purposes of our legitimate business interests, including fraud prevention, platform security, and analytics — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Nagawin does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only in the following circumstances, and only to the extent strictly necessary for the stated purpose:

• Payment Service Providers: We share transaction data with Malaysian banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX) and e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay) solely for the purpose of processing your deposits and withdrawals.
• KYC and Identity Verification Partners: We share identity document images and personal details with licensed KYC service providers for the purpose of verifying your identity. These providers are contractually bound to process your data only as instructed by Nagawin and to maintain appropriate security standards.
• Fraud and Risk Management Services: We share technical and behavioural data with fraud detection service providers to help identify and prevent account fraud, payment fraud, and bonus abuse.
• Regulatory and Legal Authorities: We may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts when required by law, court order, or binding regulatory direction. We will notify you of any such disclosure where legally permitted to do so.
• Group Companies and Service Providers: We may share data with affiliated entities and contracted service providers (such as cloud hosting and IT infrastructure providers) who process data on our behalf under binding data processing agreements that impose obligations equivalent to those in this Policy.

Nagawin retains personal data for as long as is necessary to fulfil the purpose for which it was collected and to comply with applicable legal, regulatory, and accounting obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account relationship with Nagawin and for a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations.
• Financial and Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, as required by financial regulatory requirements.
• KYC Documents: Retained for the minimum period required by our operating licence conditions, typically five (5) years following the end of the account relationship.
• Communication Records (Support Logs): Retained for three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing Data (opted-in users): Retained until you withdraw consent or opt out of marketing communications, plus a brief suppression period to honour your opt-out preference.
• Technical and Log Data: Retained for up to twelve (12) months for security and fraud investigation purposes, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to you as an individual.

Nagawin implements a multi-layered security framework to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• TLS/SSL Encryption: All data transmitted between your device and the Nagawin platform is encrypted using industry-standard Transport Layer Security (TLS 1.3) with 256-bit encryption.
• At-Rest Encryption: Personal data stored in our databases is encrypted at rest using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted to authorised Nagawin personnel on a need-to-know basis. All internal access is logged and audited regularly.
• Two-Factor Authentication: All player accounts support two-factor authentication (2FA). We strongly recommend enabling 2FA to protect your account from unauthorised access.
• Regular Security Audits: We conduct regular penetration testing and security assessments of our platform infrastructure to identify and address vulnerabilities.
• Incident Response: In the event of a data security incident that is likely to result in a high risk to your rights and freedoms, Nagawin will notify you without undue delay via the email address registered to your account.

Nagawin uses cookies and similar tracking technologies to operate and improve the platform. When you first visit nagawin.cam, you will be presented with a cookie consent notice. By continuing to use the platform after acknowledging the notice, you consent to the use of cookies as described in this section.

• Strictly Necessary Cookies: Required for core platform functionality including session management, authentication, and security. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and responsible gambling limits. These improve the convenience of your platform experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the platform — including pages visited, time spent, and error encounters — to help us improve performance and usability.
• Security Cookies: Used to detect and prevent fraudulent activity, bot interactions, and account abuse attempts.

Nagawin does not use third-party advertising or retargeting cookies. You can manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies may impair platform functionality.

Subject to applicable law and certain limited exceptions (such as legal retention obligations), you have the following rights with respect to your personal data held by Nagawin:

• Right of Access: You may request a copy of all personal data we hold about you. We will provide this in a structured format within 30 days of receiving a valid request.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data. Minor corrections (such as email address or phone number updates) can be made directly in Account Settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected and no legal obligation requires retention. Note that AML and financial regulatory obligations may prevent full deletion of transaction-related records.
• Right to Restriction: You may request that we temporarily restrict processing of your data pending the outcome of a rectification or objection request.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format (such as CSV or JSON) suitable for transfer to another service.
• Right to Object: You may object to processing of your data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though Nagawin may override this objection where compelling legitimate grounds exist.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact our Data Privacy team via our24/7 live chat or by email at [email protected] (plain text — not a clickable link). We may request proof of identity before processing data subject requests to protect your privacy.

Nagawin is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of 21 years. All account registrations require confirmation that the applicant is at least 21 years old, and this is verified through our KYC process.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately suspend the associated account, delete all personal data collected, and refund any deposits to the originating payment method pending investigation.

If you are a parent or guardian and believe that a minor in your care has registered an account on Nagawin, please contact our support team immediately at [email protected] (plain text). We treat all such reports with urgency and complete confidentiality.

In the course of providing our services, your personal data may be processed in countries outside of Malaysia. This occurs primarily where our third-party service providers — including KYC verification partners, cloud infrastructure providers, and fraud detection services — operate their systems in other jurisdictions.

Where personal data is transferred internationally, Nagawin ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applicable in Malaysia. Safeguards may include contractual clauses that bind the recipient to data protection standards consistent with this Policy.

By accepting this Privacy Policy, you consent to international transfers of your personal data in the circumstances and with the safeguards described above.

Nagawin reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this document;
• Send a notification email to all registered players at their account email address; and
• Display a prominent notice on the Nagawin platform homepage for a minimum of 14 days following the change.

Continued use of the Nagawin platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the amended Policy, you must cease using the platform and contact our support team to request account closure and data deletion where applicable.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Nagawin, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week within the Nagawin platform. Most privacy queries are acknowledged and responded to within 30 minutes during business hours.
• Email: [email protected] — please note this is displayed as plain text and is not a clickable link. Include "Privacy Request" in the subject line and specify clearly the nature of your query or the right you wish to exercise.

If you are not satisfied with our response to a privacy concern or data subject request, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. We encourage you to contact us first, as we are committed to resolving all privacy-related concerns promptly and fairly.

We serve players across Malaysia — from Kuala Lumpur, Penang, Johor Bahru, and Petaling Jaya to every corner of the country — and our support team is experienced in handling privacy queries from Malaysian users in the context of online gaming and financial services.