Privacy Policy

This Privacy Policy ("Policy") describes how BabaWin ("BabaWin", "we", "us", "our"), the operator of the online gaming platform accessible at https://babawin.casa ("Platform"), collects, processes, stores, and protects personal data submitted by or otherwise obtained in relation to individuals ("Data Subjects", "Players", "Users", "you") who access or use the Platform.

BabaWin operates primarily in service of players located across Malaysia, including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other states and territories throughout the country. We process personal data in connection with the provision of online casino games, sports betting, live dealer services, account management, payment processing, and customer support.

BabaWin takes data privacy seriously. We collect only the personal data that is necessary for the purposes described in this Policy, and we apply appropriate technical and organisational safeguards to protect that data against unauthorised access, loss, or misuse. This Policy should be read alongside our Terms & Conditions, which together form the binding framework governing your use of the BabaWin Platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned to them:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" — Any operation performed on personal data, whether automated or not, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — BabaWin, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — Third parties engaged by BabaWin to process personal data on BabaWin's behalf and under BabaWin's instructions, such as payment gateway providers and IT infrastructure suppliers.
• "Cookies" — Small text files placed on a User's device by the Platform to enable functionality, analytics, and personalisation.
• "KYC" — Know Your Customer — the identity and address verification process required of all Players before withdrawal privileges are activated.
• "Sensitive Personal Data" — A subset of personal data warranting heightened protection, including identity document data, financial details, and data concerning health or vulnerability (e.g., self-exclusion records).

BabaWin collects personal data through several channels: directly from you during account registration and use, automatically through your interaction with the Platform, and from third parties including payment service providers and identity verification agencies. The categories of data we collect are as follows:

3.1 Registration & Identity Data

• Full legal name and date of birth
• Email address and mobile phone number
• Residential address (including city, state, and postcode)
• Government-issued identification — Malaysian MyKad (IC) number, driver's licence number, or passport number and expiry date
• Selfie photographs submitted for identity verification

3.2 Financial & Payment Data

• E-wallet identifiers for Touch 'n Go eWallet, Boost, and GrabPay transactions
• Bank account details associated with Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and FPX transfers
• Cryptocurrency wallet addresses for BTC, ETH, USDT (TRC20), and BNB deposits and withdrawals
• Transaction history, deposit amounts, withdrawal amounts, and account balance records
• Records of bonus awards, wagering activity, and cashback calculations

3.3 Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, browser type and version
• Session start and end times, pages visited, features accessed
• Game activity logs, betting history, wager amounts, and outcomes
• Login timestamps and authentication records

3.4 Communication Data

• Content of live chat and email support interactions
• Records of complaints, disputes, and their resolutions
• Feedback and survey responses where provided voluntarily

3.5 Responsible Gambling Data

• Self-imposed deposit limits, loss limits, and session time restrictions
• Cool-off period and self-exclusion records
• Patterns of play that may indicate problem gambling behaviour, assessed in accordance with our responsible gambling obligations

BabaWin processes personal data for the following purposes:

BabaWin processes personal data on the basis of one or more of the following legal grounds:

1. Contractual Necessity: Processing is necessary for the performance of the contract between you and BabaWin — namely, the provision of the BabaWin gaming Platform as governed by our Terms & Conditions. This covers account management, payment processing, game delivery, and customer support.
2. Legal Obligation: Processing is required to comply with applicable legal obligations, including KYC and AML requirements, age verification mandates, and responses to lawful regulatory or judicial requests.
3. Legitimate Interests: Processing serves BabaWin's legitimate business interests — including fraud prevention, security monitoring, Platform improvement, and responsible gambling monitoring — provided those interests are not overridden by your rights and freedoms.
4. Consent: Where processing is not covered by the above bases — for example, in relation to certain marketing communications or optional profiling features — BabaWin will seek your explicit consent. You may withdraw consent at any time without prejudice to the lawfulness of prior processing.

BabaWin does not sell your personal data to third parties. We share personal data only in the circumstances described below, and only to the extent necessary for the relevant purpose:

6.1 Payment Service Providers

To process your deposits and withdrawals, BabaWin shares relevant financial and identity data with our payment partners. These include the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank online banking, Hong Leong Connect, and cryptocurrency transaction processors. All payment partners are contractually bound to process data only for the specific payment purpose and in accordance with applicable data protection standards.

6.2 Identity Verification Providers

BabaWin engages third-party KYC and identity verification services to confirm the authenticity of identity documents, verify player age, and screen against regulatory watchlists as part of AML compliance. These providers process only the minimum identity data required to perform verification.

6.3 Game Software Providers

Third-party game software providers whose products are integrated into the BabaWin Platform may receive technical data (such as Player ID and game session data) necessary to deliver game functionality and settle game outcomes. These providers do not receive financial or identity data beyond what is strictly required for game operation.

6.4 Regulatory & Law Enforcement Authorities

BabaWin may disclose personal data to competent authorities — including financial intelligence units, regulators, and law enforcement agencies — where required to do so by applicable law, court order, or in connection with the prevention or investigation of financial crime, fraud, or other unlawful activity.

6.5 IT Infrastructure & Cloud Service Providers

BabaWin engages reputable third-party providers for hosting, data storage, cybersecurity, and platform infrastructure. These providers act as Data Processors under data processing agreements that impose strict obligations regarding data security and prohibit use of your data for any purpose beyond providing services to BabaWin.

BabaWin uses cookies and similar tracking technologies on its Platform to deliver functionality, maintain session state, analyse usage, and improve the player experience. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function — these cookies enable login sessions, maintain account security, and process transactions. They cannot be disabled without rendering core Platform features unavailable.
• Functional Cookies: Remember your preferences such as language settings, game display options, and lobby configurations to personalise your experience.
• Analytical Cookies: Collect aggregated, anonymised data about how users interact with the Platform — including page visit frequency, time on page, and feature usage — to help us understand and improve Platform performance.
• Security Cookies: Support fraud detection and account security functions, including detecting unusual login patterns and verifying session integrity.

You may adjust cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies may prevent you from accessing certain Platform features. For full details on managing cookies, refer to your browser's help documentation.

BabaWin implements a comprehensive range of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and BabaWin servers is encrypted using industry-standard TLS 1.2 or higher protocols.
• Data Encryption at Rest: Sensitive personal and financial data stored on BabaWin systems is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within BabaWin is restricted on a need-to-know basis, with role-based access permissions and multi-factor authentication for administrative systems.
• Tokenised Payment Processing: BabaWin does not store raw payment credentials. All payment data is tokenised through our PCI-compliant payment partners, meaning your bank details and e-wallet identifiers are never stored on BabaWin systems in plain text.
• Security Monitoring: Real-time intrusion detection, anomaly detection, and transaction monitoring systems operate continuously to identify and respond to security threats.
• Third-Party Audits: BabaWin engages independent security professionals to conduct periodic penetration testing and security assessments of Platform infrastructure.

Notwithstanding the above measures, no data transmission over the internet or storage system can be guaranteed to be completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, BabaWin will notify you and relevant authorities as required by applicable law.

BabaWin retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal retention requirements. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with BabaWin's data disposal procedures. Anonymised data may be retained for analytical and statistical purposes indefinitely, as it no longer constitutes personal data.

Subject to applicable law and certain limitations, you have the following rights in relation to your personal data held by BabaWin. To exercise any of these rights, please contact us using the details in the Contact section of this Policy.

BabaWin will respond to data subject requests within thirty (30) days of receipt. We may need to verify your identity before processing your request and may extend the response period by a further two months for complex or multiple requests, with prior notification.

BabaWin strictly prohibits access to and use of its Platform by any person under the age of twenty-one (21). We do not knowingly collect personal data from individuals under the age of 21. Our Platform implements mandatory KYC age verification for all Players, and any Account found to be registered by or used by a minor will be immediately closed and all associated data handled in accordance with applicable legal requirements.

If you become aware that a minor has provided personal data to BabaWin, please contact us immediately at [email protected]. We will take prompt steps to delete that data and close the relevant Account.

BabaWin operates as an international online gaming platform, and some of the third-party service providers engaged by BabaWin — including game software providers, cloud infrastructure suppliers, and identity verification partners — may be located in jurisdictions outside Malaysia.

Where personal data is transferred to countries outside Malaysia, BabaWin ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that applicable within Malaysia. Such safeguards may include contractual clauses, data processing agreements incorporating internationally recognised data protection standards, and transfers to jurisdictions with adequate data protection frameworks.

You may request further information about the safeguards applicable to any specific international transfer by contacting BabaWin's data protection contact using the details provided in the Contact section below.

BabaWin reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Where amendments are material — that is, where they significantly affect how your personal data is processed or your rights in relation to it — BabaWin will notify you by email to your registered address and/or by a prominent notice on the Platform prior to the effective date of the change.

Minor amendments — such as corrections of typographical errors or clarifications that do not alter the substantive rights or obligations of either party — may be made without prior notice. The date of last revision is displayed at the top of this Policy and is updated each time any amendment is made.

Continued use of the BabaWin Platform following the publication of an amended Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept a material amendment, you should close your Account and cease using the Platform before the amendment takes effect, and contact us to exercise your data subject rights as applicable.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by BabaWin, please contact us through the following channels. We are committed to responding to all privacy-related enquiries promptly and in good faith.