Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by Penidabet ("we", "us", "our", "the Company"), operator of the online gaming and sports betting platform accessible at penidabet.cam. It applies to all personal data collected from users ("you", "the Player", "your") who access, browse, register on, or use any feature of the Penidabet platform, whether via desktop browser or mobile device.

Penidabet takes the privacy of its players seriously. We understand that Malaysian players entrust us with sensitive personal and financial information when creating an account, completing identity verification, and making deposits or withdrawals via local payment methods such as Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, and Public Bank. This Policy explains clearly what data we collect, why we collect it, how it is used, and how it is protected.

This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy. By accessing or using the Penidabet platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing activities described herein. If you do not agree with any part of this Policy, you should not use the platform.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means Penidabet, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of Penidabet under written agreement, including payment processors and KYC verification services.
• "KYC Data" means identity and address verification documents submitted by a Player in connection with the Know Your Customer process, including NRIC/MyKad, Passport, Driver's License, utility bills, and selfie photographs.
• "Sensitive Data" means a subset of Personal Data that warrants heightened protection, including identity document numbers, financial account details, and authentication credentials.
• "Cookies" means small text files placed on your device by the Penidabet platform to enable session management, analytics, and user experience optimisation.
• "Platform" means the Penidabet website, all associated pages, gaming features, account services, and any mobile-optimised interfaces accessible at penidabet.cam.

3. Data We Collect

Penidabet collects the following categories of Personal Data from players:

3.1 Registration Data

Information you provide when creating your Penidabet account:

• Full legal name (as it appears on your Malaysian identity document)
• Date of birth (for age verification — 21+ requirement)
• Email address
• Mobile phone number
• Residential address (including city, state, and postcode in Malaysia)
• Username and encrypted password
• Preferred currency (MYR)

3.2 KYC Verification Data

Documents submitted as part of the identity verification process:

• Copy of Malaysian NRIC (MyKad), Driver's License, or International Passport
• Proof of residential address (utility bill, bank statement, or government correspondence issued within 3 months)
• Selfie photograph holding photo ID
• Proof of payment method ownership (e-wallet screenshot, bank statement)

3.3 Financial Transaction Data

• Deposit and withdrawal transaction records (amounts, dates, payment methods)
• Payment method identifiers (e.g., last four digits of bank account, e-wallet account reference)
• Account balance history
• Bonus and promotion redemption records

3.4 Platform Usage Data

• Game play history (games played, bet amounts, win/loss records, session durations)
• Sports betting history (events bet on, bet types, odds, outcomes)
• Login timestamps and session activity logs
• Responsible gambling tool usage (deposit limits set, self-exclusion requests)
• Customer support interactions (chat transcripts, email correspondence)

3.5 Technical & Device Data

• IP address and approximate geographic location (country/city level)
• Device type, operating system, and browser version
• Session cookies and analytics identifiers
• Referring URL and navigation path within the platform

4. How We Collect Your Data

Penidabet collects Personal Data through the following means:

• Directly from you: When you complete the registration form, submit KYC documents, contact customer support, update account settings, or communicate with us via email or live chat.
• Automatically through platform use: Via session cookies, server logs, and analytics tools that capture device and usage data when you access and interact with the platform.
• From payment processors: Transaction confirmation data from third-party payment intermediaries including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateways, and cryptocurrency processing services. Note that Penidabet does not receive or store your full payment credentials from these providers.
• From KYC service providers: Where automated identity verification services are used, these providers may return verification status and identity confidence scores to Penidabet on the basis of documents you submit.
• From fraud prevention and AML screening services: Where required by our regulatory obligations, we may cross-reference submitted data against publicly available watchlists or sanctions databases.

5. Data Processing & Use

Penidabet uses your Personal Data solely for the purposes described in this Policy. The table below sets out each processing purpose and the data categories involved:

Penidabet does not use your Personal Data for automated decision-making that produces legal or similarly significant effects, except where required for fraud detection or regulatory compliance, and in such cases you retain the right to request human review of any automated decision affecting your account.

6. Legal Basis for Processing

Penidabet processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to perform the agreement between you and Penidabet — including account management, game delivery, and payment processing — is conducted on the basis that it is necessary to fulfil the contract you have entered into by accepting our Terms & Conditions.
• Legal Obligation: We are required by our regulatory licence, anti-money laundering obligations, and internationally applicable gaming regulations to collect and retain certain data, including KYC documents and transaction history.
• Legitimate Interests: We process certain technical and usage data on the basis of our legitimate interests in operating a secure, fair, and commercially viable platform — including fraud prevention, platform security monitoring, and responsible gambling compliance.
• Consent: Where we send you optional promotional communications or use non-essential analytics cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

7. Data Sharing & Disclosure

Penidabet does not sell, rent, or commercially transfer your Personal Data to any third party for marketing or commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and only to the extent required for the stated purpose:

• Payment Processors: Malaysian e-wallet and banking gateway providers (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and banking partners including Maybank, CIMB, Public Bank, Hong Leong) receive transaction data necessary to process your deposits and withdrawals. These providers are bound by their own data protection obligations.
• KYC Verification Services: Identity document verification may be processed by third-party KYC providers under strict data processing agreements that prohibit use of your data for any purpose other than identity verification.
• Game Studio Partners: Our partner game studios may receive anonymised session and gameplay data for RNG auditing, game performance monitoring, and regulatory certification purposes. No personally identifiable data is shared for these purposes.
• Fraud and AML Screening Services: Where legally required, we may submit limited data to fraud prevention databases or sanctions screening services to fulfil our AML obligations.
• Regulatory Authorities and Law Enforcement: Penidabet will disclose Personal Data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure where legally permitted to do so.
• Professional Advisers: Lawyers, auditors, and compliance consultants retained by Penidabet may access limited Personal Data in the course of providing professional services, under obligations of confidentiality.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of the Penidabet business, your Personal Data may be transferred to the acquiring entity, subject to the same level of data protection as described in this Policy. You will be notified of any such change of control.

8. International Data Transfers

Penidabet operates as an internationally licensed gaming platform. Your Personal Data may be transferred to, stored in, and processed in jurisdictions outside Malaysia — including the jurisdiction in which Penidabet holds its gaming licence, and jurisdictions where our technology infrastructure, payment processors, or KYC providers operate.

Where your data is transferred internationally, Penidabet takes reasonable steps to ensure that appropriate safeguards are in place to protect it — including contractual data protection clauses with third-party processors that impose obligations equivalent to those described in this Policy.

9. Data Retention

Penidabet retains your Personal Data for as long as necessary to fulfil the purposes described in this Policy, and thereafter for as long as required by applicable legal, regulatory, tax, or accounting obligations. The general retention periods applicable are as follows:

• Account Registration Data: Retained for the duration of your account, and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure (whichever is later), as required under international gaming regulatory and AML frameworks.
• Financial Transaction Records: Retained for a minimum of five (5) years to comply with financial record-keeping obligations.
• Gameplay and Betting History: Retained for a minimum of three (3) years for compliance, dispute resolution, and responsible gambling monitoring purposes.
• Customer Support Records: Retained for three (3) years from the date of the last interaction.
• Technical and Analytics Data: Retained in aggregate or anonymised form for up to twelve (12) months for platform improvement purposes.

When Personal Data is no longer required for any of the above purposes and no legal obligation requires its retention, Penidabet will securely delete or irreversibly anonymise it.

10. Cookies & Tracking Technologies

Penidabet uses cookies and similar tracking technologies to enable essential platform functionality, maintain your logged-in session, and analyse platform usage to improve the player experience. The categories of cookies we use are:

• Essential Cookies: Required for the platform to function. These include session authentication cookies, load balancing cookies, and security tokens. They cannot be disabled without breaking core platform functionality.
• Analytics Cookies: Used to collect anonymised information about how players navigate the platform — including pages visited, session duration, and device type — to help us identify areas for improvement. This data is aggregated and is not linked to your personal identity.
• Preference Cookies: Store your platform preferences such as language settings and notification choices to improve your experience on subsequent visits.

Penidabet does not use third-party advertising cookies, retargeting pixels, or tracking technologies that share your browsing behaviour with external advertising networks. You may manage cookie preferences through your browser settings. Disabling essential cookies will impair or prevent your use of the platform.

11. Data Security

Penidabet implements a range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data exchanged between your browser or device and Penidabet's servers is encrypted using 256-bit SSL/TLS encryption. The padlock icon in your browser's address bar confirms an active secure connection.
• Encryption at Rest: Sensitive stored data — including KYC documents, financial records, and authentication credentials — is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to Personal Data within Penidabet's systems is restricted on a need-to-know basis. Internal access is protected by role-based permissions, multi-factor authentication, and audit logging.
• Server Security: Platform infrastructure is hosted in secured data centres with physical and logical access controls, regular security patching, and intrusion detection systems.
• Password Security: Account passwords are stored using cryptographic hashing. Penidabet staff cannot see your password in plain text. If you forget your password, it must be reset — not retrieved.
• Incident Response: In the event of a data security incident that poses a risk to your rights, Penidabet will take prompt remedial action and notify affected players and relevant authorities in accordance with applicable obligations.

12. Your Rights

You have the following rights in relation to the Personal Data that Penidabet holds about you. To exercise any of these rights, please contact our support team via live chat or email at [email protected] (plain text — not a link). We will acknowledge your request within 5 business days and respond in full within 30 calendar days.

• Right of Access: You have the right to request confirmation of whether Penidabet holds Personal Data about you, and to receive a copy of that data in a commonly used format.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data held about you. You can update certain registration details directly from your account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent on which processing was based. This right is subject to overriding legal retention obligations (e.g., AML record-keeping requirements).
• Right to Restriction of Processing: You may request that Penidabet temporarily restrict processing of your data in certain circumstances, such as while the accuracy of data is being verified.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that your Personal Data be provided to you in a structured, machine-readable format.
• Right to Object: You may object to processing of your Personal Data carried out on the basis of legitimate interests, including profiling, where your individual rights and freedoms override those interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., optional marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.
• Right Not to Be Subject to Automated Decisions: You have the right to request human review of any decision made solely by automated means that produces a legal or significant effect on you, such as account suspension triggered by automated fraud detection.

13. Minors & Under-21s

Penidabet is a strictly 21+ platform. We do not knowingly collect Personal Data from any person under the age of 21. The registration process requires confirmation of date of birth, and age is verified as part of the mandatory KYC process before any withdrawal is processed.

If Penidabet discovers or is notified that an account has been created by a person under the age of 21, that account will be immediately suspended, all transactions voided, and the relevant Personal Data will be quarantined pending investigation before deletion in accordance with applicable law.

If you are a parent or guardian and believe that a minor in your care has created an account on Penidabet, please contact our support team immediately via live chat or email at [email protected] (plain text — not a link).

14. Third-Party Links & Services

The Penidabet platform may contain references to or integrations with third-party services, including payment processors (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banking services) and game studio software providers. These third-party services operate under their own privacy policies, which Penidabet does not control.

Penidabet is not responsible for the privacy practices of third-party service providers. When you interact with a third-party payment gateway or e-wallet provider as part of a deposit or withdrawal transaction, your interaction with that provider is governed by their terms and privacy policy. We recommend reviewing the privacy policies of any third-party services you use in connection with your Penidabet account.

15. Policy Amendments

Penidabet reserves the right to update or amend this Privacy Policy at any time. When material changes are made, the revised Policy will be published on this page with an updated effective date. Where changes significantly affect your rights or the way we handle your Personal Data, we will endeavour to notify you via the email address registered to your account before the changes take effect.

Your continued use of the Penidabet platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how we handle your data.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the Penidabet support team using the channels below. All data-related enquiries will be treated with the highest level of confidentiality.