Privacy Policy — koin50

This Privacy Policy ("Policy") sets out the basis on which koin50 ("koin50", "we", "us", "our") collects, processes, stores, and protects personal data provided by or collected about users ("you", "User", "Player") of the koin50 online gaming platform, accessible at https://koin50.click (the "Platform").

koin50 is committed to protecting the privacy and security of all personal data entrusted to us. We process personal data only for lawful, clearly defined purposes, and we implement appropriate technical and organisational measures to safeguard that data against unauthorised access, loss, or misuse.

This Policy applies to all personal data collected through your use of the Platform, including data provided during account registration, identity verification, payment transactions, customer support interactions, and general platform use. It should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy.

By registering a koin50 account or using the Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with this Policy, you must not use the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

koin50 collects the following categories of personal data, depending on how you interact with the Platform:

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for the purpose of verifying that you meet the 21+ age requirement).
• Email address and, where provided, mobile phone number.
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam) and postcode.
• Username and hashed password credentials.
• Communication and marketing preferences.

3.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents, such as Malaysian MyKad, passport, or driving licence.
• Proof of address documentation, such as a recent utility bill or bank statement.
• Source-of-funds documentation where required for high-value transactions or pursuant to our AML obligations.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction histories, amounts, and timestamps denominated in MYR.
• Payment method identifiers (e.g., the last four digits of a bank account, e-wallet account reference for Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or RHB).
• Cryptocurrency wallet addresses used for deposits and withdrawals.
• Account balance history and bonus transaction records.

3.4 Gaming & Betting Activity Data

• Game session records, including game type, duration, wager amounts, and outcomes.
• Sports betting history, including markets wagered on (e.g., Liga Super Malaysia, EPL, UFC), bet types, and settlement records.
• Responsible gambling tool usage, including deposit limit settings and self-exclusion requests.

3.5 Technical & Usage Data

• IP address, device type, browser type and version, and operating system.
• Session timestamps, pages visited, and navigation patterns within the Platform.
• Cookies and similar tracking technology data, as described in Section 10.

3.6 Communication Data

• Records of your interactions with koin50's customer support team via live chat, email, or any other channel.
• Feedback, complaints, and dispute correspondence.

koin50 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make deposits or withdrawals, placeagers, contact customer support, or engage with promotional features on the Platform.
• Automatically through the Platform: Via cookies, server logs, and analytics tools that record your technical interaction with the Platform as you browse and play.
• From payment processors: Transaction confirmation data from third-party payment processors including DuitNow, FPX, Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency network confirmations.
• From identity verification providers: Where we engage third-party KYC or AML screening services to verify identity documents or screen against sanctions databases.
• From fraud prevention services: Risk signals and flaging data from third-party fraud detection providers used to protect the integrity of the Platform and its users.

koin50 processes personal data for the following clearly defined purposes. The table below maps each processing purpose to the relevant data categories and legal basis:

koin50 will not process your personal data for any purpose incompatible with those listed above without providing prior notice and, where required, obtaining your consent.

koin50 processes personal data one or more of the following lawful bases:

• Contract Performance: Processing is necessary to perform the contract between koin50 and you — i.e., to operate your account, process transactions, and deliver gaming services as described in our Terms & Conditions.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including anti-money laundering regulations, KYC requirements under our gaming licence, and tax reporting obligations.
• Legitimate Interests: Processing is necessary for koin50's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and analytics — provided these interests do not override your fundamental privacy rights.
• Consent: Where you have provided explicit, freely given, specific, and informed consent to processing for a particular purpose (such as receiving promotional communications), we will process your data on that basis. You may withdraw consent at any time by contacting our support team or updating your account communication preferences.

koin50 does not sell, rent, or otherwise transfer your personal data to third parties for their independent marketing or commercial use. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• Payment Processors: Including DuitNow, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), and cryptocurrency network infrastructure, as necessary to process deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and AML screening services engaged to verify the identity and eligibility of registered Players and to screen against relevant sanctions lists.
• Fraud Prevention Services: Providers of risk assessment and fraud detection services engaged to protect the security and integrity of the Platform.
• Game Content Providers: Licenced game studios and platform providers that supply casino games and betting markets accessible through koin50. These providers may receive limited technical data (such as session identifiers) necessary to deliver their services.
• IT and Cloud Infrastructure Providers: Hosting, database, and security service providers who process data on koin50's behalf under strict data processing agreements.
• Regulatory and Law Enforcement Authorities: Where koin50 is legally required to disclose personal data to regulatory bodies, gaming licensing authorities, law enforcement agencies, or courts of competent jurisdiction.

koin50 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's existence on the Platform and for a period offive (5) years following account closure, in accordance with standard anti-money laundering record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission or account closure (whichever is later), as required by our gaming licence and AML obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years for regulatory compliance and audit purposes.
• Customer Support Records: Retained forthree (3) years from the date of the last interaction, to enable us to reference previous correspondence in the event of subsequent disputes or enquiries.
• Technical and Usage Data: Typically retained for no more than thirteen (13) months, after which it is aggregated or deleted.
• Marketing Consent Records: Retained for the period of your consent and for a furtherthree (3) years from the date of withdrawal, to demonstrate prior compliance.

Where data is no longer required for any legitimate purpose, koin50 will securely delete or anonymise it in accordance with industry best practices.

koin50 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and koin50's servers is encrypted in transit using industry-standard transport layer security protocols.
• Encrypted Data Storage: Sensitive personal data, including identity documents and payment method details, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• Multi-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication to prevent unauthorised access.
• Regular Security Audits: koin50 conducts regular penetration testing and security vulnerability assessments to identify and remediate potential weaknesses in our infrastructure.
• Incident Response: koin50 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.

While koin50 takes all reasonable steps to protect your personal data, no system is entirely immune to security risks. You also have an important role to play — please ensure that your account credentials are kept confidential and that you use a strong, unique password for your koin50 account.

koin50 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for core Platform functionality, including maintaining your login session, remembering your preferences, and ensuring the security of your account. These cookies cannot be disabled without significantly impairing your use of the Platform.
• Performance and Analytics Cookies: Used to collect anonymised information about how visitors use the Platform, including which pages are visited most frequently and how users navigate between pages. This data is used solely to improve the Platform's performance and user experience.
• Functional Cookies: Used to remember your preferences and settings, such as your preferred language, currency display (MYR), and game history, to personalise your experience on subsequent visits.

koin50 does not use third-party advertising or behavioural tracking cookies. We do not permit advertising networks to place tracking cookies on the Platform.

You may control cookie settings through your browser's privacy or settings menu. Please note that disabling strictly necessary cookies may impair core Platform functionality. For further information on managing cookies in your browser, refer to your browser's official documentation.

Subject to applicable law and any overiding legal obligations that may require us to retain your data, you hold the following rights with respect to your personal data held by koin50: