Privacy Policy —GBOWin
GBOWin Group ("gbowin", "we", "us") is committed to protecting the privacy and personal data of every player who uses our platform. This Privacy Policy explains in plain terms what information we collect, why we collect it, how we use and protect it, and what rights you have over your data.
Last Updated: 1 January 2026 | Language: English | Applies to: All gbowin players
How We Protect Your Privacy
Six core privacy principles that guide everything we do with your personal data at gbowin.
End-to-End Encryption
All data in transit is protected with256-bit SSL/TLS encryption. Data stored on our servers uses AES-256 encryption at rest. Your personal and financial information cannot be read in plaintext at any point in our infrastructure.
No Third-Party Marketing Sales
We do not sell, rent, or trade your personal data to any third-party marketing companies, advertisers, or data brokers — ever. Your email address, phone number, and identity details stay within gbowin's controlled environment.
You Control Your Data
You have the right to access, correct, export, and request deletion of your personal data at any time. We make these requests straightforward to submit through your account settings or via our support team at [email protected].
Minimal Data Collection
We follow a data minimisation principle: we collect only the personal data strictly necessary to operate your account, process transactions, verify identity (KYC), and comply with regulatory requirements. Nothing superfluous is collected.
Regulatory Compliance
Our data processing practices are designed to comply with applicable data protection laws. We conduct periodic internal audits to ensure our handling of player data remains aligned with evolving regulatory standards, including anti-money laundering (AML) requirements.
Breach Notification
In the unlikely event of a data security breach that affects your personal data, gbowin will notify affected players promptly and take immediate remedial action. We maintain an incident response plan reviewed and updated annually.
- 1. Introduction
- 2. Definitions
- 3. Data We Collect
- 4. How We Collect Data
- 5. Legal Basis for Processing
- 6. How We Use Your Data
- 7. Data Sharing & Disclosure
- 8. Cookies & Tracking
- 9. Data Retention
- 10. Data Security
- 11. Your Data Rights
- 12. Children's Privacy
- 13. International Transfers
- 14. Third-Party Links
- 15. Policy Updates
- 16. Contact & DPO
Introduction
GBOWin Group ("gbowin", "the Company", "we", "us", "our") operates the online gaming and sports betting platform accessible at gbowin.asia. We are committed to handling your personal data responsibly, transparently, and in full compliance with applicable data protection laws.
This Privacy Policy ("Policy") describes in detail what personal data we collect from players and visitors to the gbowin platform, the purposes for which we use that data, the conditions under which it may be shared with third parties, how we protect it, how long we retain it, and what rights you have in relation to your personal data.
This Policy applies to all personal data processed by gbowin in connection with your use of the platform — including data collected during account registration, identity verification (KYC), deposits and withdrawals via Maybank, CIMB, DuitNow, Touch 'n Go eWallet, FPX, and other Malaysian payment channels, gameplay activity, and communications with our support team.
By registering an account on gbowin, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please do not register an account or use the platform.
This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference.
Definitions
The following terms have the meanings set out below throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers such as IP addresses. |
| Processing | Any operation performed on personal data, including collection, storage, use, disclosure, erasure, and destruction. |
| Data Controller | GBOWin Group, which determines the purposes and means of processing your personal data. |
| Data Processor | A third party that processes personal data on behalf of gbowin under contractual instruction (e.g., payment processors, KYC verification providers). |
| Consent | A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose. |
| KYC | Know Your Customer — the identity and document verification process required before processing withdrawals and for regulatory compliance. |
| Cookie | A small text file placed on your device by a website to store information about your browsing session, preferences, or activity. |
Personal Data We Collect
gbowin collects personal data across several categories depending on how you interact with the platform. The categories and specific data points we collect are set out below:
When you create a gbowin account, we collect: full legal name, date of birth, email address, mobile phone number, username, and preferred currency (Malaysian Ringgit / MYR). This data is required to create and maintain your account and cannot be omitted.
To comply with anti-money laundering (AML) regulations and to process withdrawals above specified thresholds, we collect: a copy of a government-issued photo identification document (Malaysian NRIC / MyKad, driver's licence, or passport), proof of current residential address (utility bill or bank statement dated within three months), a selfie or video of you holding your identity document, and in some cases, source-of-funds documentation.
We collect information necessary to process deposits and withdrawals: bank account details (account holder name, bank name, account number for Malaysian banks including Maybank, CIMB, Public Bank, Hong Leong), e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), DuitNow registered mobile number, and cryptocurrency wallet addresses where applicable. We do not store full credit or debit card numbers on our servers.
We collect records of your platform activity including: game sessions played (slots, live casino, sports betting, live football, lottery, arcade), wager amounts and outcomes, bonus claims and wagering progress, deposit and withdrawal history, and account balance changes.
When you access the gbowin platform, we automatically collect: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), session timestamps, referring URL, and pages visited. This data is used for security monitoring, fraud detection, and platform optimisation.
If you contact gbowin's support team via live chat, email, or any other channel, we retain records of those communications including the content of messages, timestamps, and any attachments or documents shared, for quality assurance, dispute resolution, and audit purposes.
Data Minimisation: We collect only the personal data that is necessary for the specific purpose for which it is collected. We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data unless required by law or directly relevant to a responsible gambling assessment.
How We Collect Your Data
gbowin collects personal data through the following methods:
- Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you provide personal data directly to us.
- Automatically through the platform: When you browse or use the gbowin website, we automatically collect technical data through server logs, cookies, and similar tracking technologies as described in Section 8of this Policy.
- From third-party service providers: We may receive data about you from identity verification service providers used in the KYC process, payment processors who handle your deposit and withdrawal transactions, and fraud detection and security monitoring services.
- From publicly available sources: In certain circumstances required by AML regulations, we may verify information you provide against publicly available databases or official records.
Legal Basis for Processing
gbowin processes your personal data on the following legal bases, depending on the nature and purpose of the processing activity:
| Legal Basis | Processing Activity |
|---|---|
| Contractual Necessity | Account creation and management, processing deposits and withdrawals, providing access to games and betting markets, operating the loyalty programme. |
| Legal Obligation | KYC identity verification, AML transaction monitoring, age verification (21+ enforcement), regulatory reporting, and fraud prevention required by applicable law. |
| Legitimate Interests | Fraud detection and prevention, platform security monitoring, improving user experience, analysing platform usage patterns, and managing responsible gambling interventions. |
| Consent | Sending promotional emails or SMS notifications about bonuses, new games, and special offers. You may withdraw this consent at any time via your account settings or by contacting our support team. |
How We Use Your Personal Data
gbowin uses the personal data we collect for the following purposes:
To create and manage your player account, authenticate your identity at login, maintain your account balance and transaction history, and communicate with you about your account status, including security alerts and transaction confirmations.
To process your deposits and withdrawals via Malaysian banking channels including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and supported cryptocurrency networks. To verify that payment accounts are registered in your own name and to detect and prevent fraudulent payment activity.
To comply with Know Your Customer (KYC) requirements, anti-money laundering (AML) obligations, and age verification mandates. To screen against international sanctions lists and politically exposed persons (PEP) databases as required by applicable law. To report suspicious activity to competent authorities where legally required.
To analyse how players use the platform in order to improve game selection, user interface design, loading performance, and overall experience. To personalise the content, promotions, and bonus offers displayed to you based on your gaming preferences and activity history.
To monitor gameplay patterns that may indicate problem gambling behaviour and to apply responsible gambling interventions in accordance with ourResponsible Gambling Policy, including proactive outreach, temporary deposit limits, and self-exclusion processing where requested or required.
Where you have consented, to send you promotional emails and SMS notifications about upcoming bonuses, new game launches, Liga Super Malaysia and EPL season promotions, and special events. You may opt out of marketing communications at any time by updating your preferences in account settings or by emailing [email protected]. Opting out does not affect transactional or security communications.
Data Sharing & Disclosure
gbowin does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your personal data only in the following limited and controlled circumstances:
We engage third-party service providers who process personal data on our behalf, strictly under our instruction and bound by data processing agreements that prohibit them from using your data for any purpose other than providing the service to gbowin. These include:
- Payment processors and banking partners for transaction processing (DuitNow, FPX, Touch 'n Go, Boost, GrabPay, and cryptocurrency processing services).
- KYC and identity verification technology providers.
- Fraud detection and cybersecurity service providers.
- Cloud infrastructure and hosting providers that store platform data.
- Licensed game studios that operate games on the gbowin platform (limited to data necessary to provide the game service).
We may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or other public bodies where we are legally required to do so — for example, in response to a court order, a regulatory investigation, or a statutory AML reporting obligation. We will notify you of such disclosure where we are legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of GBOWin Group, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the Privacy Policy of the acquiring entity before transfer takes effect.
What We Never Do: We never sell your personal data to advertising networks, data brokers, or marketing companies. We never share your data with other gambling operators for the purpose of cross-marketing. We never share your identity documents with unauthorised parties.
Cookies & Tracking Technologies
gbowin uses cookies and similar tracking technologies to operate the platform, improve user experience, maintain session security, and analyse platform performance. The types of cookies we use are described in the table below:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Required for the platform to function, including session authentication, login state, and security tokens. Cannot be disabled without breaking core functionality. | Session |
| Functional | Store your preferences such as language settings, display preferences, and remembered form fields to improve your experience on return visits. | Up to 12 months |
| Analytical | Track aggregate, anonymised usage statistics — pages visited, navigation paths, time on page — to help us understand how the platform is used and where improvements can be made. | Up to 24 months |
| Security | Fraud detection tokens and device fingerprinting data used to identify and block unauthorised access attempts and bot activity. | Up to 90 days |
You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will prevent you from logging in to or using the gbowin platform. Disabling analytical and functional cookies will not affect your ability to use core platform features but may reduce the quality of your experience.
Data Retention
gbowin retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account Registration Data | Duration of account + 5 years | Regulatory AML requirements and dispute resolution |
| KYC / Identity Documents | Duration of account + 5 years | Anti-money laundering statutory retention requirement |
| Financial Transaction Records | Duration of account + 7 years | Tax, AML, and regulatory audit trail obligations |
| Gameplay Activity Logs | 3 years from date of activity | Responsible gambling monitoring and dispute resolution |
| Support Communications | 3 years from date of communication | Quality assurance and dispute evidence |
| Technical / Device Logs | 12 months | Security monitoring and fraud prevention |
| Marketing Consent Records | Until consent withdrawn + 2 years | Evidence of consent for regulatory purposes |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures. Anonymised statistical data may be retained indefinitely for platform analytics.
Data Security
gbowin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:
- Encryption: All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256. KYC documents are stored in an isolated, access-controlled environment separate from the main application database.
- Access Controls: Access to personal data within gbowin is restricted on a strict need-to-know basis. All employee access is authenticated via multi-factor authentication (MFA) and logged. Access rights are reviewed quarterly.
- Infrastructure Security: Our platform is hosted on enterprise-grade cloud infrastructure with DoS protection, web application firewalls (WAF), intrusion detection systems (IDS), and 24/7 security monitoring.
- Penetration Testing: We conduct annual penetration tests by independent third-party security firms to identify and remediate vulnerabilities proactively.
- Incident Response: We maintain a documented incident response plan. In the event of a data breach, affected players will be notified within a reasonable timeframe as required by applicable law.
Player Responsibility: While we invest heavily in platform security, you also play a role. Use a strong, unique password for your gbowin account. Enable two-factor authentication (2FA) in your account settings. Never share your login credentials. If you suspect unauthorised access, contact our support team immediately at [email protected].
Your Data Rights
Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by gbowin. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request".
Right of Access
You may request a copy of all personal data we hold about you. We will respond within 30 days of a verified request with a structured data export.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Some data changes (e.g., name) may require updated KYC documentation.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes collected. Note that regulatory retention obligations (AML, tax) may prevent full erasure of certain data categories.
Right to Restrict Processing
You may request that we restrict the processing of your data in certain circumstances, for example while you contest the accuracy of data we hold or object to our processing on legitimate interest grounds.
Right to Data Portability
Where processing is based on your consent or contractual necessity, you may request a structured machine-readable export of your personal data to transfer to another service provider.
Right to Object
You may object to processing based on our legitimate interests at any time. You also have an absolute right to object to the use of your data for direct marketing purposes, which we will honour immediately upon receipt.
We will respond to all data rights requests within 30 calendar days of receipt and verification. Where a request is complex or involves a high volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.
Children's Privacy
21+ Only: The gbowin platform is strictly for persons aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not use this platform, attempt to register an account, or provide any personal data to gbowin.
If we become aware that we have inadvertently collected personal data from a person under 21 years of age, we will immediately suspend the associated account, delete the collected data without retention, and where appropriate, refer the matter to relevant authorities. If you are a parent or guardian who believes your child may have accessed gbowin, please contact us immediately at [email protected].
International Data Transfers
gbowin's primary infrastructure is operated to serve players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other major cities. However, some of our third-party service providers — including cloud infrastructure, KYC verification, and fraud detection providers — may process data in jurisdictions outside Malaysia.
Where personal data is transferred internationally, we ensure that such transfers are subject to appropriate safeguards including contractual data protection clauses that impose standards equivalent to or greater than those required by applicable Malaysian data protection law. We only engage third-party processors that can demonstrate adequate data protection standards.
Third-Party Links
The gbowin platform may, in certain contexts, display references to third-party services (such as payment providers or responsible gambling organisations). Where such links are present, clicking them will direct you to an external website governed by that party's own privacy policy, which gbowin has no control over.
We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any external site you visit before providing personal data.
Updates to This Privacy Policy
gbowin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via email notification to the address on their account at least 14 days before the changes take effect, and a prominent notice will be displayed on the platform.
The effective date of the current version of this Policy is displayed at the top of this page. We recommend that you review this Policy periodically. Continued use of the platform after the effective date of an updated Policy constitutes your acceptance of the revised terms.
Archived versions of previous Privacy Policies are available upon request by contacting our support team.
Contact Us & Data Protection
If you have any questions, concerns, or requests regarding this Privacy Policy or the way gbowin handles your personal data, please contact us through the following channels:
For responsible gambling support resources available to Malaysian players, including Talian Kasih (15999) and international organisations such as GamCare, please visit our dedicatedResponsible Gambling page.
Play at Platform That Respects Your Privacy
gbowin protects your personal data with enterprise-grade encryption, a strict no-sale policy, and full transparency about how your information is used. Join over 500,000 Malaysian players who trust gbowin with their gaming experience.
For players aged 21 and above only. Play responsibly. Gambling involves financial risk and is for entertainment purposes only.