Corporate Privacy Policy

Welcome to sureWin (“the Company”, “we”, “us”, or “our”). We are committed to protecting your privacy and safeguarding your personal data through institutional-grade encryption and strict internal governance.

sureWin operates under a sovereign gaming license issued by the Anjouan Licensing Authority, Union of the Comoros. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information in accordance with applicable international data protection principles (GDPR-aligned) and the Malaysian Personal Data Protection Act (PDPA).

By registering and using our platform, you agree to the terms outlined in this Privacy Policy. If you do not agree with these practices, you must immediately cease use of our services.

1. Comprehensive Information Collection

We collect personal data through your direct interactions with the platform, automated telemetry, and, where necessary, third-party verification services. This data is categorized as follows:

A. Identity & KYC Data: This includes your legal full name, date of birth, gender, nationality, and government-issued identification (Passport, MyKad, or National ID). We also collect high-resolution biometric "selfie" imagery solely for the purpose of liveness detection and identity synchronization.

B. Contact & Residential Data: Includes your primary email address, verified mobile phone number, and physical residential address for billing and regulatory compliance.

C. Financial & Transactional Data: We maintain records of your bank account details, e-wallet identifiers (Touch 'n Go, DuitNow), deposit/withdrawal histories, and wagering telemetry. We do not store full credit card numbers; these are handled by PCI-DSS compliant third-party gateways.

D. Technical & Network Telemetry: Includes your unique IP address, device hardware identifiers (MAC address, IMEI), browser type, time-zone settings, and operating system version. This is utilized by our ThreatMetrix AI for fraud prevention and geofencing.

2. Lawful Basis for Processing

Under international data protection standards, sureWin only processes your data when we have a valid legal basis to do so:

• Contractual Necessity: To fulfill our agreement to provide gaming services and process your winnings.
• Legal Obligation: To comply with sovereign Anjouan Licensing requirements, Anti-Money Laundering (AML) statutes, and Counter-Terrorist Financing (CTF) regulations.
• Legitimate Interest: To protect our platform from cyber-attacks, detect bonus abuse, and ensure the mathematical integrity of our games.
• Consent: When you voluntarily opt-in to receive promotional offers or participate in VIP loyalty programs.

3. Anti-Money Laundering (AML) & KYC Integrity

sureWin maintains an uncompromising Anti-Money Laundering (AML) framework. We are legally mandated to verify the source of funds and the true identity of our user base.

Identity Verification: All players must undergo a mandatory KYC check. We reserve the right to cross-reference your data with international PEP (Politically Exposed Persons) and Sanction lists. Failure to provide authentic documentation will result in the immediate and permanent freezing of account balances.

Transaction Monitoring: Our systems utilize automated behavioral analysis to identify "structuring," "smurfing," or irregular betting patterns indicative of money laundering. We reserve the right to report suspicious financial activity to the relevant Anjouan or international regulatory bodies without prior notice to the user.

4. Responsible Gaming & Player Protection

sureWin is committed to fostering a secure and ethical gaming environment. We recognize that for a small minority, gaming can cease to be entertainment and become a financial or psychological burden.

Age Restriction & Verification: Our services are strictly prohibited to individuals under the legal age of 18. We utilize automated age-verification filters during the KYC process. Any account found to be operated by a minor will be immediately terminated, and all deposits and winnings will be forfeited.

Proactive Intervention: Our platform utilizes Behavioral AI Systems to monitor session duration, deposit frequency, and wagering intensity. We provide native tools for self-exclusion, cooling-off periods (24 hours to 6 months), and hard deposit limits. We reserve the right to unilaterally suspend or restrict accounts where our risk-control algorithms identify signs of compulsive gambling behavior.

Global Support: Players experiencing gambling-related harm are encouraged to seek assistance from professional support organizations such as GamCare or BeGambleAware.

5. Disclosure of Information to Third Parties

We do not sell, rent, or trade your personal data to third-party marketing agencies. Your information is shared only with vetted "Data Processors" who are essential for our operations, including:

• Financial Institutions: Payment gateways, DuitNow/TNG API providers, and banks to facilitate your deposits and extractions.
• Verification Agencies: Identity and document verification services used to fulfill our KYC and AML mandates.
• Technical Infrastructure: IT hosting (AWS), CDN providers (Cloudflare), and cybersecurity vendors (ThreatMetrix).
• Sovereign Regulators: The Anjouan Gaming Board and international law enforcement agencies, but only when legally compelled by a valid subpoena or regulatory directive.

All third-party partners are bound by strict Non-Disclosure Agreements (NDAs) and must maintain security standards equivalent to our own.

6. Institutional Cybersecurity Infrastructure

The security of your personal and financial telemetry is our highest operational priority. We implement a Zero-Trust Architecture, which assumes that no internal or external entity is trusted by default. Our defenses include:

• Cryptographic Encryption: All data in transit is shielded by 256-bit SSL/TLS 1.3 encryption. Data at rest is stored on isolated, high-security servers utilizing AES-256 block-level encryption.
• Network Integrity: Our infrastructure is protected by Enterprise-grade firewalls, DDoS mitigation through Cloudflare, and real-time Intrusion Detection Systems (IDS).
• Staff Access Control: Access to your personal data is restricted to a limited number of "Need-to-Know" compliance officers who are subject to background checks and periodic security audits.

7. Data Retention & Mandatory Storage Periods

We retain your personal data for as long as you maintain an active account with sureWin. However, even upon account closure, we are legally required by Anjouan Anti-Money Laundering (AML) Laws to maintain your records for a minimum period of five (5) to seven (7) years.

This retention is necessary to comply with financial auditing, resolve historical wagering disputes, and prevent fraudulent re-registration. Once this statutory period has elapsed, your data will be securely and permanently purged or anonymized using cryptographic shredding.

8. Cookies & Session Telemetry Policy

We utilize cookies—small data files stored on your device—to optimize the performance of the sureWin platform. We categorize our cookies as follows:

• Essential Cookies: Critical for your login session persistence, transaction security, and navigation. Disabling these will break platform functionality.
• Analytical Cookies: Utilized by our internal AI to analyze traffic patterns and identify software bugs. This data is generally aggregated and anonymized.
• Security Cookies: Deployed by ThreatMetrix to identify device fingerprints and detect if multiple accounts are being accessed from a single terminal (Multi-Accounting Detection).

9. Your Rights & Data Subject Access Requests (DSAR)

Subject to the regulatory limitations of our gaming license, you possess the following rights regarding your data:

• Right to Access: You may request a digital copy of the personal data we hold about you.
• Right to Rectification: You may request the correction of inaccurate or outdated data, subject to a new KYC verification check.
• Right to Withdraw Consent: You may opt-out of all marketing communications at any time through your account settings.

Please note: Requests for total data erasure (the "Right to be Forgotten") may be denied if we have an overriding legal obligation under AML statutes to retain that data for regulatory purposes.

10. Cross-Border Data Transfers

To ensure 99.99% uptime, your information may be processed on servers located outside of Malaysia. By using our services, you consent to the transfer of your data to our secure international data centers, which operate under strict localized data protection safeguards.

11. Amendments & Policy Updates

sureWin reserves the right to amend this Corporate Privacy Policy at its sole discretion to reflect changes in global data protection laws or gaming regulations. Updated versions will be posted immediately to this page. Continued use of the platform after an update constitutes your explicit acceptance of the revised terms.

Corporate Compliance & Contact

For all privacy-related inquiries or to exercise your data rights, please contact our Data Protection Officer (DPO):