MrSpin Privacy Policy – Personal Data Protection for Malaysian Members

Introduction & Scope of MrSpin's Privacy Policy

This Privacy Policy is published by MrSpin and applies to all registered members, visitors to mrspin.xyz, and any party that interacts with our platform in any capacity. This document outlines our practices regarding the collection, processing, storage, and protection of your personal data.

By registering an account or using any mrspin service, you agree that MrSpin will process your personal data in accordance with the terms set out in this policy. We encourage you to read this document carefully and to contact us at support@mrspin.xyz if you have any questions.

MrSpin respects your privacy. We believe you have the right to know exactly what data we collect, why we collect it, who can access it, and how long it is retained. Transparency is not just a word to us — it is how we approach every aspect of member data protection.

Personal Data We Collect

MrSpin collects various categories of personal data as you interact with our platform. Below is a detailed explanation of each category of data we collect:

We only collect data that is strictly necessary for the stated purposes. This "minimum collection" principle means we do not gather data simply to have it — every piece of information we collect has a clear and legitimate purpose.

How MrSpin Uses Your Data

MrSpin uses the personal data we collect solely for legitimate operational purposes and in the interests of our members. The following are the primary purposes for which your data is used:

• Identity verification and KYC: Ensures every member is a verified individual aged 18 and above before processing any withdrawal. This is a mandatory legal requirement.
• Financial transaction processing: Handles deposits via FPX, DuitNow, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, and securely processes withdrawal of winnings to your Malaysian bank account.
• Account security and fraud prevention: To detect and prevent suspicious activity, unauthorised logins, multiple account ownership, and any form of fraud that could harm other members or MrSpin.
• Personalising your gaming experience: Provides relevant game recommendations based on your gaming history, displays promotions suited to your profile, and tailors the interface to your preferences.
• Service communications: Sending important account notifications, verifying transactions, informing you of promotions, and delivering policy updates you need to be aware of.
• Customer support: Enables our support team to resolve your issues and enquiries quickly and accurately based on your previous interaction history.
• Responsible gaming: Monitoring gameplay patterns to identify signs of potential problem gambling and suggesting protective tools to members who may need them.
• Legal compliance: Fulfil reporting obligations required by relevant authorities, including anti-money laundering (AML) and counter-terrorism financing (CTF) requirements.

Data Sharing with Third Parties

MrSpin understands that your trust is our most valuable asset. We are therefore very careful about when and with whom your data is shared. Below are the categories of third parties who may receive your data and the reasons why:

• Payment processors: Financial institutions and payment service providers — including the FPX network, DuitNow, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay — require minimum transaction data to process your deposits and withdrawals. Data shared is strictly limited to what is necessary.
• Game providers: Game providers (such as Pragmatic Play, NetEnt and others) that partner with MrSpin may process minimal game session data to ensure games function correctly and for RNG auditing purposes.
• KYC service provider: Accredited third-party identity verification companies assist MrSpin in conducting KYC checks. Only the minimum identification data required for verification is shared.
• Regulatory bodies and legal authorities: MrSpin may be required to disclose certain data to Malaysian authorities in the event of a valid court order, warrant, or legal requirement. We will make every reasonable effort to notify the affected member in advance, unless prohibited from doing so by law.
• IT infrastructure services: Cloud computing and server infrastructure providers that store and process data on the MrSpin platform. All such providers are bound by strict data processing agreements and must adhere to security standards equivalent to or higher than those of MrSpin.

In all of the above cases, MrSpin shares only the minimum data necessary and ensures that all receiving parties are bound by appropriate confidentiality obligations. We never sell or rent member data to advertisers or third-party companies for independent marketing purposes.

Technical & Organisational Security Measures

MrSpin continuously invests in security infrastructure to protect members' personal data. The protective measures we have in place include:

• Data encryption during transmission: All communications between your browser and MrSpin's servers are protected by TLS 1.3 with 256-bit SSL encryption. This means your data cannot be read by anyone who may intercept the transmission.
• Data encryption at rest: Sensitive member data – including identification details and financial information – is stored in encrypted format using AES-256 encryption. Even in the event of unauthorised access to our database, the stored data remains unreadable.
• Two-factor authentication (2FA): MrSpin supports and encourages the use of 2FA for all member accounts. This additional layer of security ensures that only you can access your account, even if your password falls into the wrong hands.
• 24/7 account activity monitoring: Our automated anomaly detection system monitors every login and transaction for suspicious patterns. Any unusual activity triggers an immediate security review.
• Internal access controls: MrSpin employees only have access to member data that is necessary for their specific roles. Access to sensitive data requires multi-level approval, and every access is logged for audit purposes.
• Regular penetration testing: MrSpin conducts penetration testing by independent security experts every quarter to identify and patch any vulnerabilities before they can be exploited.

Data Retention Period

MrSpin does not retain member personal data indefinitely. We have a clear data retention policy based on operational and legal requirements:

• Active account data: For as long as your account remains active, we retain all data necessary for the operation of your account.
• Following account closure: Identification data and financial transaction records are retained for a minimum of 7 years after account closure to comply with Malaysian legal requirements relating to anti-money laundering and financial record-keeping.
• Technical log data: Server logs, access logs, and technical diagnostic data are retained for 12 months before being automatically deleted.
• Marketing data: If you have given consent to receive marketing communications and subsequently withdraw that consent, any data used solely for marketing purposes will be deleted within 30 days.
• Responsible gambling data: Deposit limit, loss limit and self-exclusion records are retained for an extended period to ensure ongoing member protection, even after an account is closed.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. The data deletion process is audited on a regular basis to ensure compliance.

Cookie Policy

MrSpin uses cookies and similar tracking technologies to enhance website functionality and user experience. The following are the types of cookies we use:

You can manage your cookie preferences through your web browser settings. However, disabling essential cookies may affect platform functionality and your gaming experience. By continuing to use mrspin.xyz without changing your cookie settings, you consent to the use of cookies as described here.

Your Rights as a Data Subject

As a MrSpin member and data subject under applicable data protection laws, you have a range of rights regarding your personal data. We respect and facilitate the exercise of these rights:

Marketing Communications & Your Choices

MrSpin sends various types of communications to members, including transaction notifications, security updates, promotional information and new game announcements. These communications are delivered via email, SMS and in-platform notifications.

You have full control over the communications you wish to receive:

• Mandatory communications: Transaction notifications, security alerts and important policy updates are mandatory communications that cannot be disabled, as they are essential to account security and service operations.
• Optional communications: Promotional emails, new game notifications, bonus offers and other marketing communications can be disabled at any time via the notification settings in your account, or by clicking the "Unsubscribe" link in any email we send.
• Promotional SMS: You can opt out of receiving promotional SMS by replying "STOP" to any promotional SMS from MrSpin, or through your account settings.

Requests to opt out of marketing communications will be processed within 5 working days. Please note that it may take up to 2 email send cycles before you stop receiving promotional communications entirely.

Privacy Policy Amendments & How to Contact Us

MrSpin reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new technologies we adopt. Members will be notified of any significant changes through:

• In-platform notifications displayed upon your next login
• An email to your registered address summarising the key changes
• Updates the "Last Updated" date at the top of this document

Your continued use of the MrSpin platform after any amendments take effect constitutes your acceptance of the latest version of the Privacy Policy. We recommend reviewing this page periodically.

MrSpin Data Protection Officer: If you have any questions, concerns, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us:

• Email: support@mrspin.xyz (subject: "Privacy Enquiry")
• Response time: Within 5 working days of receipt
• Live Chat: Available on the platform 24 hours a day, 7 days a week