Privacy Policy i2malaysia – How We Protect Your Personal Data

Welcome to the i2malaysia Privacy Policy page. At i2malaysia, we understand that your trust is the most valuable asset we hold. When you register an account, make a deposit via Touch 'n Go eWallet or DuitNow, or simply browse our platform, you are entrusting us with your personal information. This document clearly and transparently explains how we fulfil that responsibility.

This Privacy Policy applies to all personal information collected through the i2malaysia website at https://i2malaysia.click, related mobile applications, and all services we offer. By using the i2malaysia platform, you consent to the collection and use of your personal information as described in this policy.

I2malaysia collects several categories of personal information depending on how you interact with our platform. We only collect data that is strictly necessary for the stated purposes – nothing more.

Data You Provide Directly:

• Your full name as it appears on your Malaysian identity card or passport.
• National identity card number (MyKad) or passport number for identity verification purposes.
• The email address used as your username and primary communication channel.
• Mobile phone number for two-factor authentication and important notifications.
• Date of birth to verify that you meet the minimum age requirement of 21 years.
• Residential address for anti-money laundering (AML) regulatory compliance purposes.
• Payment method details – Touch 'n Go phone number, DuitNow ID, or bank account number used for deposits and withdrawals.

Automatically Collected Data:

• The IP address of the device used to access the i2malaysia platform.
• Your web browser type and device operating system.
• Pages visited, time of visit and actions taken within the platform.
• Cookie data and similar tracking technologies to enhance the user experience.
• Approximate location data based on IP address – not precise GPS coordinates.
• Gaming activity logs, including bets placed, winnings and losses, are retained for regulatory compliance purposes.

Every piece of data we collect has a specific and legitimate purpose. i2malaysia does not use members' personal data for any purpose unrelated to platform operations or legal compliance.

• Identity Verification: To verify that you meet the age and eligibility requirements to use the i2malaysia platform.
• Account Management: To create, maintain and process your member account, including transaction history and gaming activity.
• Payment Processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, or CIMB Clicks, as well as your winnings withdrawals.
• Service Communications: To send important account-related information, transaction updates, policy changes and security notifications.
• Legal Compliance: To fulfil anti-money laundering (AML), counter-terrorism financing (CTF), and other regulatory reporting obligations.
• Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, and platform abuse.
• Platform Improvements: To analyse usage patterns for the purpose of improving platform features, user experience and customer support services.
• Marketing Communications: To send information about promotions, bonuses, and new offers – only if you have consented to receive them.
• Responsible Gaming: To monitor playing patterns and reach out to members who may need support related to problem gambling.

I2malaysia does not make any automated decisions that materially affect members based solely on automated data processing without human involvement.

I2malaysia does not sell, rent, or trade members' personal data to any party for marketing purposes. However, in operating our platform, there are situations where we need to share certain information with selected third parties.

We may share data with:

• Payment Service Providers: E-wallet and internet banking providers such as Touch 'n Go, DuitNow and GrabPay receive only the information necessary to process your financial transactions.
• Game Providers: Providers such as Pragmatic Play, PG Soft and Evolution Gaming receive the data necessary to operate the games you play, subject to their own privacy policies.
• Identity Verification Services: Third-party providers conducting identity verification and AML/CTF checks are bound by strict confidentiality agreements.
• Legal Authorities: i2malaysia will disclose the required information to the relevant authorities when mandated by law, court order, or regulatory directive.
• Technical Infrastructure Services: Hosting providers, cloud storage and cybersecurity services that support the safe operation of the i2malaysia platform.

All third parties we work with are bound by strict data protection agreements and are not permitted to use your data for any purpose other than what is specified in those agreements.

I2malaysia continuously invests in security technologies and processes to ensure members' personal data remains protected at all times. We employ a defence-in-depth approach encompassing technical, operational and physical controls.

• 256-bit SSL Encryption: All data transmitted between your browser and i2malaysia's servers is encrypted using TLS 1.3 with the strongest available cipher suites.
• Data-at-Rest Encryption: Sensitive data stored in our databases is encrypted using the AES-256 standard – meaning even if someone gains physical access to our servers, the data cannot be read without the encryption key.
• Two-Factor Authentication (2FA): 2FA is available for all i2malaysia member accounts and is strongly recommended as an additional layer of security.
• 24/7 Monitoring: Our security monitoring systems operate around the clock to detect and respond to cyber threats or unauthorised access attempts.
• Regular Penetration Testing: i2malaysia conducts regular security penetration testing by independent third-party security experts to identify and address any vulnerabilities.
• Internal Access Controls: Only staff with a legitimate business need are permitted to access members' personal data, and all access is logged and regularly audited.
• Staff Training: All i2malaysia staff undergo regular data protection training to ensure they understand and adhere to privacy best practices.

While we take all reasonable precautions, no security system is infallible. In the event of a material data breach, i2malaysia is committed to notifying affected members within the timeframe required by applicable law.

I2malaysia uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use:

• Essential Cookies: Required for the platform to function properly – including login session verification and security preferences. These cookies cannot be disabled.
• Functional Cookies: Allows the platform to remember your preferences such as language, region and display settings, providing a more personalised experience.
• Analytics Cookies: They help us understand how members use the i2malaysia platform so we can improve the user experience. This data is collected in aggregate and anonymised form.
• Performance Cookies: Measures page load times and platform performance to ensure i2malaysia operates at peak levels for all members.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the i2malaysia platform. For more information on managing cookies in your browser, please refer to your browser's help documentation.

As an i2malaysia member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data. i2malaysia is committed to helping you exercise these rights promptly and without unnecessary barriers.

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will fulfil this request within 30 business days.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request a correction. You can update basic information directly through your account settings.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data. Please note that we may need to retain some data to fulfil our legal obligations.
• Right to Restrict Processing: You may request that we restrict how we use your data in certain circumstances, such as during a dispute over the accuracy of your data.
• Data Portability Rights: You may request your personal data in a machine-readable format for transfer to another platform.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time, and we will honour your preference.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the validity of any processing carried out prior to withdrawal.

To exercise any of the rights listed above, contact the i2malaysia privacy team at support@i2malaysia.click with the email subject "Data Privacy Request". We will acknowledge receipt within 3 business days and fulfil your request within 30 business days.

I2malaysia does not retain members' personal data for longer than necessary for the stated purpose or as required by law. Below are our general data retention guidelines:

• Active Account Data: Retained for as long as your i2malaysia account remains active. You may request account closure and data deletion at any time.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of the transaction, as required under Malaysian accounting and anti-money laundering laws.
• Gaming Activity Logs: Retained for 5 years for regulatory compliance purposes and to resolve any disputes that may arise.
• Support Communication Records: Retained for 2 years after resolution for quality control and compliance purposes.
• Cookie Data: Session cookies are deleted when you close your browser. Persistent cookies are stored for the duration specified in each cookie, typically between 30 days and 1 year.
• Data After Account Closure: After account closure, personal data not required for legal purposes will be deleted or anonymised within 90 days.

When data is no longer required, i2malaysia will securely delete it or anonymise it so that it can no longer be associated with you.

I2malaysia has appointed a Data Protection Officer responsible for ensuring our platform complies with all applicable data protection requirements. If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Privacy Email: support@i2malaysia.click (subject: "Data Privacy Enquiry")
• Live Chat: Available 24/7 via the i2malaysia platform – select the "Privacy & Data" category
• Response Time: We aim to respond to all privacy enquiries within 3 business days
• Frequently Asked Questions: Visit the Frequently Asked Questions page for quick answers on privacy and account security

If you are not satisfied with our response to your privacy enquiry, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant regulatory authority in your jurisdiction.