Privacy Policy — iwang

This Privacy Policy ("Policy") describes how iwang ("Company", "Platform", "we", "us", "our"), the operator of the online casino and sports betting website located at https://iwang.cam, collects, processes, stores and protects personal data relating to individuals ("User", "Player", "you") who access or use our services.

iwang is committed to handling personal information responsibly, transparently and in accordance with applicable data protection legislation. This Policy applies to all personal data collected through the Platform — including via the website, any associated mobile interface and all communications between you and the Company's support team.

By registering an account, making a deposit, placing a wager, or otherwise accessing the Platform, you confirm that you have read, understood and consented to the data practices described in this Policy. This Policy should be read alongside the Terms & Conditions and the Responsible Gambling Policy.

For the purposes of this Policy, the following terms carry the meanings set out below:

iwang collects Personal Data through several channels, including account registration, account activity, KYC verification, payment processing and customer support interactions. The categories of data we collect include:

3.1 Registration & Identity Data

• Full legal name as stated on your MyKad or valid passport;
• Date of birth (to verify you are aged 21 or above);
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam);
• Email address and contact telephone number;
• Username and encrypted account credentials.

3.2 KYC Verification Documents

• Copy of national identity card (MyKad — front and reverse) or valid passport;
• Proof of residential address (utility bill or bank statement dated within three months);
• Proof of payment method ownership (screenshot of registered e-wallet account or bank account showing your name).

3.3 Financial & Transaction Data

• Deposit and withdrawal records, including amounts in MYR and cryptocurrency equivalents;
• Payment method references for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong Connect;
• Transaction timestamps and processing status records;
• Cryptocurrency wallet addresses where applicable (BTC, USDT).

3.4 Usage & Technical Data

• IP address, device type, browser type and operating system;
• Session duration, pages visited and features accessed within the Platform;
• Game activity logs, bet history and wagering patterns;
• Login timestamps and geolocation data at the country or region level.

3.5 Support & Communications Data

• Content of live chat sessions, email correspondence and support tickets;
• Records of complaints, disputes and resolutions;
• Language preference and communication history.

iwang processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to operate your account, fulfil deposits and withdrawals, settle bets and provide the services described in our Terms and Conditions;
• Legal obligation: Processing required to comply with anti-money laundering (AML) obligations, KYC regulatory requirements and any lawful direction from regulatory or law enforcement authorities;
• Legitimate interests: Processing necessary for fraud detection, platform security monitoring, responsible gambling monitoring, and improvement of Platform services where such interests are not overridden by your data protection rights;
• Consent: Processing for optional communications such as promotional email notifications, where you have provided clear opt-in consent that may be withdrawn at any time.

Personal Data collected by iwang is used exclusively for the following purposes:

• Creating, operating and maintaining your Account, including processing deposits, withdrawals and bet settlements;
• Verifying your identity and age (21+) in compliance with our KYC obligations;
• Detecting, investigating and preventing fraud, money laundering, prohibited multi-accounting or other policy violations;
• Providing timely and relevant customer support via live chat, email and other approved channels;
• Administering the Loyalty and Rewards Programme, including accurate tracking of points, tier status and benefit eligibility;
• Monitoring account activity to identify signs of problem gambling and apply responsible gaming tools where appropriate;
• Sending transactional notifications (deposit confirmations, withdrawal approvals, KYC status updates);
• Sending promotional communications where you have opted in, and ceasing such communications promptly upon opt-out;
• Improving Platform functionality, game performance and user experience based on anonymised behavioural analytics.

The iwang Platform uses cookies and similar tracking technologies to deliver a functional and personalised experience. The categories of cookies used are as follows:

• Strictly necessary cookies: Required for core Platform functionality, including session authentication, account security and the proper operation of the cashier and game interfaces. These cannot be disabled without impairing the Platform's basic operation;
• Functional cookies: Store your preferences such as language settings, display options and previously visited game categories to improve navigation;
• Analytics cookies: Collect anonymised data on page visits, session duration and feature usage to help us understand how the Platform is used and identify areas for improvement. No personally identifiable information is included in analytics data;
• Security cookies: Help detect and prevent fraudulent or suspicious login activity by tracking device fingerprints and session anomalies.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. Strictly necessary cookies cannot be disabled without disrupting your ability to log in and use the service.

iwang shares Personal Data only where strictly necessary and only with the following categories of recipient, each bound by confidentiality obligations or legal requirements:

7.1 Payment Service Providers

Processing your financial transactions requires sharing relevant payment and identity data with approved Malaysian payment partners, including providers facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong Connect transactions, as well as cryptocurrency processing partners where applicable. Data shared is limited to what is necessary to execute and verify each transaction.

7.2 KYC & Identity Verification Partners

To comply with our age verification and anti-money laundering obligations, we may share identity documents and supporting materials with specialist KYC verification service providers. These providers are contractually prohibited from using your data for any purpose other than completing the verification requested by iwang.

7.3 Legal & Regulatory Authorities

iwang may disclose Personal Data to relevant regulatory bodies, law enforcement agencies or courts where required to do so by applicable law, court order, or in connection with the investigation of fraud, money laundering or other criminal activity. Such disclosures are made only to the extent required and will be recorded.

7.4 Technology & Infrastructure Providers

Certain technical service providers — including cloud hosting providers, cybersecurity services and Platform maintenance vendors — may have access to Personal Data in the course of delivering their contracted services. All such providers operate under strict data processing agreements and are not permitted to use your data independently.

iwang retains Personal Data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable legal obligations. The following general retention principles apply:

• Active account data: Retained for the duration of your active account relationship with iwang plus a reasonable period thereafter to facilitate dispute resolution;
• KYC documents: Retained for a minimum period required under applicable AML and financial regulation, typically five years from the date of the last transaction;
• Transaction records: Financial and bet settlement records are retained for a minimum of five years to support audit, regulatory and dispute resolution requirements;
• Support communications: Chat logs and email correspondence are retained for a period sufficient to resolve any related complaint or dispute;
• Closed or suspended accounts: Data is retained following closure to the extent required to fulfil legal obligations. Unnecessary data is deleted or anonymised once retention obligations are satisfied.

When Personal Data is no longer required and retention obligations have been met, it is securely deleted or anonymised so that it can no longer be associated with you.

iwang implements appropriate technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration or destruction. These measures include, but are not limited to:

• AES-256 encryption for data stored at rest on Platform servers;
• TLS/SSL transport layer encryption for all data transmitted between your device and the Platform;
• Two-factor authentication options for account access;
• Role-based access controls ensuring that only authorised personnel can access specific categories of Personal Data;
• Regular security audits, vulnerability assessments and penetration testing of Platform infrastructure;
• Dedicated security monitoring to detect and respond to suspicious activity or potential data breaches in a timely manner.

While iwang maintains robust security practices, no digital platform can guarantee absolute security. You play an important role in protecting your account by maintaining strong, unique credentials and not sharing login information with any third party.

Subject to applicable data protection legislation, you hold the following rights in relation to Personal Data that iwang holds about you:

• Right of access: You may request confirmation of whether we hold Personal Data about you and, if so, obtain a copy of that data along with details of how it is being processed;
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. You may update certain account details directly through your Account settings;
• Right to erasure: You may request deletion of your Personal Data where processing is no longer necessary, consent has been withdrawn, or processing was unlawful. This right is subject to overriding legal retention obligations;
• Right to restrict processing: You may request that we limit the processing of your Personal Data in certain circumstances, such as where you contest its accuracy;
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, commonly used and machine-readable format;
• Right to object: You may object to processing based on legitimate interests and to the use of your data for direct marketing purposes;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact the iwang support team via live chat or by email at [email protected]. We will respond to verified requests within 30 days. We may require identity verification before processing a request to protect against unauthorised access to account data.

The iwang Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21, and we do not permit anyone below that age to register an account or access any service on the Platform.

Where iwang discovers or reasonably suspects that Personal Data belonging to a person under 21 has been submitted — whether through misrepresentation of age during registration or any other means — the associated account will be closed immediately, any held funds will be reviewed in accordance with our Terms and Conditions, and all data collected in connection with that account will be deleted in accordance with our data retention practices.

The Platform does not contain links to external third-party websites in its navigation or primary content. Where any reference to a third-party service provider is made for informational purposes — such as the names of Malaysian payment services (Maybank, CIMB, Touch 'n Go eWallet, DuitNow) — this constitutes factual identification of a service only and does not imply endorsement by or a formal partnership with that entity.

iwang is not responsible for the privacy practices of any third-party payment service providers, banking institutions or technology partners. We encourage you to review the privacy policies of any external service through which you interact in connection with your use of our Platform.

iwang reserves the right to update, modify or replace any provision of this Privacy Policy at any time. Where amendments are material in nature — for example, where new categories of data are collected, new purposes are introduced or your rights are materially affected — we will take reasonable steps to notify registered users via email or an on-Platform notification prior to the changes taking effect.

The effective date at the top of this Policy will be updated upon each revision. Your continued use of the Platform following the publication of an updated Policy constitutes your acknowledgement of the amended terms. We recommend reviewing this Policy periodically to remain informed of how your data is being managed.

If you have questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data by iwang, please contact our Data Protection team using the details below:

• Email: [email protected] (plain text only — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the in-Platform chat widget. Our multilingual support team handles English, Bahasa Melayu and Chinese enquiries. Average response time is 3–5 minutes.

When submitting a data-related request, please include your registered email address, Account username and a clear description of your request or concern. This helps us locate your records accurately and respond in a timely manner.