Privacy Policy — Kirabet

Kirabet ("we", "us", "our", or "the Platform") is committed to protecting the privacy and personal data of every individual who interacts with our online betting and gaming services at kirabet.cam. This Privacy Policy sets out, in clear and structured terms, exactly what personal information we collect, the purposes for which we process it, the legal grounds on which we rely, with whom we may share it, and how long we retain it.

This document constitutes the entire Privacy Policy of the Kirabet platform and supersedes all prior versions. It applies equally to all users of the platform, including registered Members, casual visitors, and individuals who have submitted an account registration that is pending verification.

Kirabet operates as an internationally licensed online gambling operator. We take our data protection obligations seriously and have implemented organisational and technical measures designed to safeguard your information against unauthorised access, loss, or misuse. Where you have provided us with personal information about a third party — for example, a payment account holder — you confirm that you have that person's consent to provide us with their information and for us to process it in accordance with this policy.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers such as IP addresses.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — Kirabet, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — a third party engaged by Kirabet to process Personal Data on Kirabet's behalf and under Kirabet's documented instructions.
• "Member" / "User" — any natural person who has registered or attempted to register an account on the Kirabet Platform.
• "KYC Data" — identity verification documents and information collected as part of Kirabet's Know Your Customer (KYC) process, including copies of government-issued identification such as MyKad or passport.
• "Sensitive Data" — a subset of Personal Data that warrants heightened protection, including financial account information, identification document details, and data relating to problem gambling indicators.
• "Cookies" — small text files placed on your device by the Kirabet Platform to facilitate session management, analytics, and functional preferences.

Kirabet collects Personal Data through several channels: directly from you when you register an account, make a deposit or withdrawal, contact our support team, or participate in a promotion; automatically through your use of the Platform (such as device and usage data); and, in limited circumstances, from third-party verification providers.

The categories of data we collect are set out in the table below:

Kirabet processes your Personal Data for the following purposes:

1. Account Management — to create, maintain, and administer your Kirabet member account; to verify your identity and age (minimum 21 years); to process deposits and withdrawals in MYR; and to communicate account-related notifications.
2. Service Delivery — to provide access to sports betting markets (including EPL, Liga Super Malaysia, UFC, and other sports), live casino products, and slot games available on the Platform.
3. KYC & AML Compliance — to verify your identity and prevent fraud, money laundering, and terrorist financing in accordance with our operating licence obligations and applicable anti-money-laundering standards.
4. Responsible Gambling — to monitor gameplay patterns for indicators of problem gambling behaviour; to apply self-exclusion, deposit limits, or cool-off periods at your request or as required by our responsible gambling obligations.
5. Customer Support — to respond to your queries, complaints, and support requests submitted via live chat or email ([email protected]).
6. Security & Fraud Prevention — to detect, investigate, and prevent suspicious activity, multi-account violations, bonus abuse, and other prohibited conduct described in our Terms & Conditions.
7. Marketing Communications — where you have provided explicit consent, to send you promotional offers, bonus notifications, and platform updates by email or push notification. You may withdraw consent at any time via your account settings.
8. Platform Improvement — to analyse anonymised usage data and technical logs to improve the performance, stability, and user experience of the Kirabet Platform.
9. Legal & Regulatory Obligations — to comply with court orders, regulatory directives, licensing authority requirements, and any other applicable legal obligations.

Kirabet relies on one or more of the following legal grounds when processing your Personal Data. The applicable basis depends on the specific purpose for which the data is being processed:

• Contractual Necessity — processing is necessary to perform the contract between you and Kirabet (i.e., to operate your account and provide the services you have requested), including account registration, payment processing, and game access.
• Legal Obligation — processing is necessary for Kirabet to comply with its legal and regulatory obligations, including KYC identity verification, anti-money-laundering checks, and record-keeping requirements under our operating licence.
• Legitimate Interests — processing is necessary for Kirabet's legitimate interests in operating a safe, fraud-free, and commercially sustainable platform, including fraud detection, security monitoring, and product analytics — provided those interests are not overridden by your rights and interests.
• Consent — where we rely on your explicit consent, such as for the sending of direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Kirabet does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We may share your data only in the following limited circumstances, and only to the extent necessary for the relevant purpose:

• Payment Service Providers — your financial transaction data is shared with licensed payment processors (DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, Maybank, CIMB, Public Bank, Hong Leong Bank) solely to facilitate deposits and withdrawals in MYR.
• Identity Verification Providers — KYC documents and identity data may be shared with licensed third-party verification service providers to confirm your age and identity as required by our operating licence.
• Technology Service Providers — we engage cloud hosting, cybersecurity, analytics, and customer support technology providers who process data on our behalf under contractual data processing agreements that prohibit use of your data for any purpose other than providing services to Kirabet.
• Game Content Providers — aggregated, non-personally-identifiable gameplay data may be shared with our game content licensing partners for RNG audit and technical compliance purposes.
• Regulatory & Law Enforcement Authorities — we will disclose Personal Data to licensing authorities, financial intelligence units, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory directive.
• Business Transfers — in the event of a merger, acquisition, or sale of all or part of Kirabet's business, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections.

The Kirabet Platform uses cookies and similar tracking technologies to operate core platform functionality, maintain your session state, and gather anonymised analytics data that helps us improve the product. We do not use third-party advertising cookies or behavioural retargeting trackers.

The cookies used on kirabet.cam fall into the following categories:

• Strictly Necessary Cookies — essential for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing cookies. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies — used to remember your preferences such as language selection, odds format, and display settings. Disabling these cookies will not prevent access to the Platform but may affect your personalised experience.
• Analytics Cookies — first-party analytics cookies that collect anonymised data about how users navigate and interact with the Platform. This data is used exclusively to improve Platform performance and is not shared with third-party advertising networks.

You can manage or disable cookies via your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. For full cookie management instructions, refer to your browser's help documentation.

Kirabet retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligation, or legitimate business need. The following retention guidelines apply:

• Active Account Data — retained for the duration of your active membership and for a period of at least five (5) years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• KYC & Identity Documents — retained for a minimum of five (5) years from the date of the last transaction or account closure, whichever is later, as required by AML obligations.
• Transaction Records — deposit, withdrawal, and betting history records retained for a minimum of five (5) years to satisfy financial record-keeping and audit requirements.
• Customer Support Communications — live chat transcripts and email correspondence retained for three (3) years following resolution of the relevant inquiry or complaint.
• Marketing Data — if you have opted out of marketing communications, a suppression record of your opt-out preference is retained indefinitely to ensure we do not re-contact you without fresh consent.
• Technical & Usage Logs — anonymised platform analytics data retained for up to twenty-four (24) months. Server access logs retained for twelve (12) months for security purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual.

Kirabet employs a comprehensive suite of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS/SSL Encryption — all data transmitted between your browser or app and the Kirabet Platform is protected using TLS 1.2 or higher. Our platform operates exclusively over HTTPS.
• At-Rest Encryption — sensitive data stored in our databases is encrypted using AES-256 encryption.
• Access Controls — access to Personal Data within Kirabet's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Two-Factor Authentication — Kirabet offers two-factor authentication (2FA) for Member accounts. We strongly encourage all Members to enable 2FA to protect their account from unauthorised access.
• Penetration Testing — the Platform undergoes regular security assessments and vulnerability testing by independent cybersecurity professionals.
• Incident Response — in the event of a data breach that is likely to result in a risk to your rights, Kirabet will notify affected Members and the relevant regulatory authority within the timeframe required by applicable law.

As a data subject, you hold a number of rights in relation to the Personal Data Kirabet holds about you. These rights are described below, along with the procedure for exercising them:

To exercise any of the above rights, please submit a written request to our support team at [email protected] with the subject line "Data Rights Request". We may ask you to verify your identity before processing your request. There is no fee for submitting a rights request under normal circumstances.

The Kirabet Platform is strictly intended for use by adults aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. Age verification is conducted as part of the account registration process and is further validated during KYC verification.

If Kirabet discovers or has reason to believe that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the associated account, notify the relevant individual (or their parent or guardian where the individual is a minor), delete all associated data, and report the matter to our licensing authority where required.

Parents and guardians who have reason to believe that a person under 21 in their care has registered an account on the Kirabet Platform should contact us immediately at [email protected].

As an internationally licensed online gambling operator, Kirabet may process or store Personal Data on servers or with service providers located outside of Malaysia. In such cases, we take appropriate steps to ensure that adequate safeguards are in place to protect your data in a manner consistent with the standards described in this Privacy Policy.

Safeguards we employ for cross-border transfers include:

• Entering into data processing agreements with overseas processors that include legally binding data protection obligations.
• Using only processors located in jurisdictions that offer an adequate level of data protection, or requiring such processors to adhere to equivalent contractual standards.
• Conducting due diligence on the data protection practices of all international service providers before engagement.

By using the Kirabet Platform, you consent to the transfer of your Personal Data to international servers and processors where required for the operation of the Platform, subject to the safeguards described above.

The Kirabet Platform does not contain links to external third-party websites. All content, tools, and resources available on kirabet.cam are hosted and operated within the Kirabet platform environment.

Where Kirabet integrates third-party payment gateways (such as DuitNow, FPX, Touch 'n Go eWallet, GrabPay, and Boost), you will be directed to the secure payment environment of those providers to complete your transaction. Once redirected to a third-party payment interface, your data is subject to that provider's own privacy policy. Kirabet has no control over third-party data practices and accepts no responsibility for the privacy practices of payment service providers beyond the contractual data processing obligations described in Section 6 of this Policy.

Kirabet reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes to the Platform's features and services.

Where a material change is made to this Privacy Policy — meaning a change that significantly affects your rights or our obligations — Kirabet will notify registered Members via the email address associated with their account, with a minimum of seven (7) calendar days' notice prior to the change taking effect. For non-material updates (such as minor clarifications, typographic corrections, or administrative changes), Kirabet may update the policy without prior notification.

The current version of this Privacy Policy is always available at kirabet.cam/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or Kirabet's data processing practices, or if you wish to exercise any of your data rights as described in Section 10, please contact our support team through one of the following channels:

• Email: [email protected] — please use the subject line "Privacy Inquiry" or "Data Rights Request" as appropriate. We aim to respond within 2 business hours.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. For data rights requests, please follow up your live chat inquiry with a written email to create a documented record.

Our team serves members across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam. All formal data rights requests and privacy complaints should be submitted in writing via email to ensure a traceable record. Kirabet will acknowledge all data-related inquiries within 48 hours and endeavour to resolve them within 30 calendar days.