wbox6 Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is published by wbox6 and governs the collection, use, storage, disclosure, and protection of personal data in connection with the online gaming platform operated at https://wbox6.cam (the "Platform"). wbox6 and its affiliated entities are collectively referred to in this Policy as "wbox6", "we", "us", or "our".

This Policy applies to all individuals who access, register on, or interact with the wbox6 Platform, including registered players, visitors who browse without registering, and individuals who contact our customer support team (collectively, "you", "your", or "Data Subject"). By using the wbox6 Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the data processing activities described herein to the extent permitted by applicable law.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and another document, this Policy shall prevail with respect to data protection matters.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, email address, phone number, financial account details, IP address, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means wbox6, which determines the purposes and means of the Processing of your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of wbox6 under a data processing agreement, such as payment service providers and KYC verification partners.
• "KYC" means Know Your Customer — the identity verification process required under our licensing framework to authenticate player identities and prevent financial crime.
• "Cookies" means small text files placed on your device by the Platform that collect and store information about your browsing activity, preferences, and session data.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the Processing of your Personal Data for a stated purpose.
• "Data Breach" means a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

wbox6 collects Personal Data across several categories, depending on your relationship with the Platform. The table below summarises the categories of data we collect and the primary context in which each is gathered.

wbox6 collects your Personal Data through the following primary channels:

• Direct Provision: Information you voluntarily provide when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to surveys or promotions.
• Automated Technical Collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, log files, and similar tracking technologies. See Section 8 (Cookies & Tracking) for full details.
• Third-Party Sources: Identity and fraud-check data received from licensed KYC verification service providers and payment processing partners, where necessary to verify your identity or investigate suspected fraud.
• Public Sources: Publicly available information where legitimately used for fraud prevention or AML compliance purposes, such as sanctions screening databases.

wbox6 processes your Personal Data for the following specific, legitimate purposes:

5.1 Account Management & Service Delivery

To create, verify, and manage your Account; to process deposits and withdrawals in MYR via your nominated payment methods (including Touch 'n Go eWallet, DuitNow, FPX, and bank transfer); to deliver access to the gaming products available on the Platform; and to provide customer support.

5.2 Identity Verification & KYC Compliance

To verify your identity, age (21+), and payment method ownership as required under our licensing framework. We are obligated to conduct identity checks on all players before processing their first withdrawal, and may conduct enhanced due diligence in certain circumstances as required by our AML programme.

5.3 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity money laundering, multi-accounting, bonus abuse, identity theft, and other security threats to the Platform and to our players. This includes the use of automated fraud detection systems that analyse Technical Data and Gaming Activity Data.

5.4 Responsible Gambling Monitoring

To identify players who may be exhibiting signs of problem gambling through analysis of Gaming Activity Data, and to offer appropriate interventions such as deposit limits, cooling-off periods, or referral to support resources. This is a mandatory obligation under our licensing conditions and reflects our genuine commitment to player welfare.

5.5 Marketing & Communications (with Consent)

Where you have expressly consented, we may use your Contact Data to send you promotional communications about bonuses, new games, and special offers. You may withdraw your marketing consent at any time by contacting us at [email protected] or updating your Account preferences. Withdrawal of marketing consent does not affect the lawfulness of processing that occurred prior to withdrawal.

5.6 Legal & Regulatory Compliance

To comply with applicable legal obligations, including our obligations under our licensing framework's AML requirements, responding to lawful requests from competent authorities, and maintaining the financial and gaming records required by our operating licence.

wbox6 processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions, including Account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including AML obligations, KYC mandates, and licensing conditions under our operating licence.
• Legitimate Interests: Processing conducted in pursuit of legitimate business interests — including fraud prevention, security monitoring, and platform improvement — where such interests do not override your fundamental privacy rights.
• Consent: Processing based on your freely given consent, including for the purpose of sending marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

wbox6 does not sell, rent, or commercially share your Personal Data with third parties. We may share your data with the following categories of recipients only to the extent necessary and under appropriate legal and contractual safeguards:

• Payment Service Providers: Including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency processing services — for the purpose of executing deposits and withdrawals.
• KYC & Identity Verification Partners: Licensed third-party providers that conduct identity and document verification on our behalf under strict data processing agreements.
• Fraud Prevention & AML Services: Third-party providers that assist with sanctions screening, transaction monitoring, and fraud detection.
• IT & Infrastructure Providers: Cloud hosting and data storage providers who process data on our behalf under binding data processing agreements with appropriate security obligations.
• Legal & Regulatory Authorities: We may disclose Personal Data to competent legal authorities, regulators, or law enforcement agencies where required to do so by law, court order, or under our licensing obligations.
• Professional Advisors: Legal counsel, auditors, and accountants, where necessary for the conduct of legal proceedings or regulatory compliance, under strict confidentiality obligations.

The wbox6 Platform uses cookies and similar tracking technologies to enable core functionality, improve your user experience, and support our security and fraud prevention systems. By continuing to use the Platform, you consent to the use of cookies as described in this section.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the basic operation of the Platform, including session authentication, account login persistence, and security functions. These cannot be disabled without impairing core functionality.
• Functional Cookies: Store your preferences such as language selection, game settings, and layout choices to provide a personalised experience across sessions.
• Analytical Cookies: Collect anonymised usage statistics about how players interact with the Platform — which pages are visited, how long sessions last, and where navigation issues occur — to help us improve the service.
• Security Cookies: Used to detect and prevent fraudulent activity, including multi-accounting, bot activity, and suspicious access patterns.

8.2 Managing Cookies

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies; however, disabling Strictly Necessary Cookies may prevent you from accessing certain features of the Platform. Please note that wbox6 does not use third-party advertising cookies or cross-site tracking technologies.

wbox6 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention guidelines apply:

• Active Account Data: Retained for the duration of your Account's active status and for minimum period of five (5) years following Account closure, as required under our licensing framework's AML record-keeping obligations.
• Transaction & Financial Records: Retained for a minimum of five (5) years following the date of each transaction, in accordance with standard AML and financial record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years following the completion of verification, or such longer period as may be required by applicable regulation.
• Customer Support Communications: Retained for a period of three (3) years from the date of the last communication, unless relevant to an ongoing dispute or regulatory matter.
• Marketing Consent Records: Retained for the duration of your marketing consent and for three (3) years following its withdrawal, as evidence of the original consent.
• Anonymised Analytics Data: May be retained indefinitely in fully anonymised form for the purpose of platform performance analysis.

wbox6 implements a comprehensive programme of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key components of our security programme include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 encryption for all data in transit between your browser and our servers.
• Access Controls: Role-based access control (RBAC) ensures that only authorised personnel with a legitimate business need can access Personal Data. All access is logged and audited.
• Two-Factor Authentication: Available to all players and mandatory for administrative access to systems containing Personal Data.
• Regular Security Audits: We conduct periodic internal and independent external security audits, penetration testing, and vulnerability assessments of our Platform and data infrastructure.
• Incident Response: A documented incident response plan is in place, covering detection, containment, investigation, notification, and post-incident review for any Data Breach.
• Staff Training: All wbox6 personnel who handle Personal Data receive regular data protection and security awareness training.

Despite these measures, no online platform can guarantee absolute security. We encourage you to protect your Account by using a strong, unique password and enabling two-factor authentication. If you suspect your Account has been compromised, contact us immediately.

As a Data Subject, you have the following rights with respect to your Personal Data held by wbox6. To exercise any of these rights, please submit a written request to [email protected]. We will respond to all valid requests within thirty (30) days of receipt.

• Right of Access: You have the right to request confirmation of whether wbox6 processes your Personal Data and, if so, to receive a copy of that data along with information about how it is used.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete Personal Data held about you. Where feasible, you may also update certain information directly through your Account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent. This right may be limited by our legal obligations to retain certain data under our licensing framework.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in specified circumstances, such as where you contest the accuracy of the data or object to our processing on grounds of legitimate interests.
• Right to Data Portability: You have the right to receive a copy of the Personal Data you have provided to us in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another controller where technically feasible.
• Right to Object: You may object to the processing of your Personal Data where that processing is based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The wbox6 Platform is strictly intended for adults aged21 years and above. We do not knowingly collect, process, or retain Personal Data belonging to individuals under the age of 21. If you are under 21 years of age, you must not register for or use the wbox6 Platform under any circumstances.

If wbox6 becomes aware that Personal Data has been collected from an individual who is under 21 years of age, we will immediately suspend that Account, delete the associated Personal Data, and, where required, report the matter to the appropriate authorities. If you are a parent or guardian and believe your child may have registered an Account on our Platform, please contact us immediately at [email protected].

wbox6 operates under international licensing and may engage Data Processors — including cloud infrastructure providers, KYC verification services, and payment processing partners — whose servers or operations are located outside Malaysia. As a consequence, your Personal Data may be transferred to, and processed in, countries other than Malaysia.

Where such transfers occur, wbox6 ensures that appropriate safeguards are in place to protect your Personal Data, including contractual data processing agreements with our service providers that require them to maintain security standards and privacy protections consistent with those described in this Policy. We do not transfer Personal Data to parties who cannot demonstrate adequate data protection standards.

wbox6 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

Where we make material changes to this Policy — particularly changes that affect how we process your Personal Data or your rights as a Data Subject — we will notify you by posting a prominent notice on the Platform and/or by sending a notification to your registered email address. Your continued use of the wbox6 Platform following the effective date of a revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you should cease using the Platform and close your Account.

If you have any questions, concerns, or formal complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 11, please contact our Data Protection team using the details below. All privacy-related communications must be submitted in writing.