Privacy Policy visa89 – Malaysian Player Data Protection

When you register and use the visa89 platform, you are trusting us with your personal information. We take that trust seriously. This Privacy Policy is written in plain, straightforward language — not convoluted legal jargon — because we want every Malaysian player to genuinely understand how their data is handled.

Visa89 operates as a data controller under Malaysia's Personal Data Protection Act 2010 (PDPA). This means we are responsible for determining the purposes and means of processing the personal data you provide to us, and we are legally accountable for ensuring that such data is handled in compliance with the PDPA and other applicable laws.

1. Personal Information We Collect

Visa89 only collects information that is strictly necessary to provide our services to you. We do not collect excessive information unrelated to platform operations. The information we collect falls into several categories:

We do not collect sensitive information such as biometric data, health records, or information relating to religious beliefs or political views. Information you provide during the KYC process — such as a copy of your MyKad — is stored with full encryption and accessed only by authorised staff for identity verification purposes.

2. How We Use Your Personal Data

Visa89 uses the personal data it collects for specific, legitimate, and transparent purposes. We do not use your data for purposes unrelated to the provision of platform services without first obtaining your consent. The primary purposes for which your data is used are as follows:

• Verifying your identity during registration and the KYC process to meet legal requirements
• Processing deposits, withdrawals, and financial transactions in Malaysian Ringgit (RM) via TnG, GrabPay, DuitNow, FPX, and other available methods
• Managing and maintaining your player account, including responsible gambling limit settings
• Providing Sports Betting, Live Casino, blackjack, roulette, e-sports, jackpot slots, and Virtual Sports services
• Detecting and preventing fraud, money laundering, and platform abuse
• Comply with legal obligations under PDPA 2010 and other applicable Malaysian laws
• Providing 24/7 customer support in Bahasa Malaysia and English via live chat, email, and WhatsApp
• Sending important operational communications such as transaction confirmations, security notifications, and policy updates
• Sending marketing communications such as bonus offers and promotions — only where you have given your consent
• Improving the platform, user interface, and gaming experience based on anonymised, aggregated usage patterns

The legal bases we rely on to process your data under PDPA 2010 are: performance of a contract (to provide the services you requested), legal obligation (to comply with applicable regulations), legitimate interests (for fraud detection and platform security), and your consent (for optional marketing communications).

3. Sharing Information with Third Parties

Visa89 does not sell, rent, or share players' personal information with third parties for their own commercial or marketing purposes. This is a non-negotiable commitment. That said, in the course of operating the platform, certain third parties require limited access to your data for specific technical purposes:

• Payment Gateway Providers: Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and FPX providers require the necessary transaction information to process your payments. They comply with PCI-DSS security standards and their own strict privacy policies.
• Game Software Providers: Live casino and slots game providers working with visa89 may receive the minimum technical data required to operate games correctly within a secure environment.
• Cloud & IT Infrastructure Service Providers: Our servers and technical infrastructure are managed by certified cloud service providers, under strict data processing agreements to safeguard your information.
• Anti-Fraud Agencies: In cases of suspected fraud or money laundering, required data may be shared with relevant agencies in accordance with legal obligations.
• Malaysian Government Authorities: Where required by law, court order, or direction from a lawful authority, visa89 will disclose the necessary information to the relevant law enforcement agency.

If visa89 ever needs to share your data with third parties beyond the categories stated above, we will obtain your explicit consent beforehand, unless we are required to do so by law.

4. Data Security – How We Protect Your Information

Protecting player personal data is a responsibility we take very seriously at visa89. We have implemented multiple layers of technical and organisational security controls to keep your data safe at all times:

• 256-bit SSL/TLS encryption for all communications between your browser and the visa89 platform
• Encryption at rest for all sensitive records, including personal identification information and financial records
• Two-factor authentication (2FA) is available and strongly encouraged for all player accounts
• 24/7 real-time monitoring of security threats and suspicious activity by automated security systems
• Principle of least privilege access controls — staff can only access the data they need to perform their specific duties
• Regular security audits by independent third parties to identify and address vulnerabilities
• Mandatory data protection training for all staff with access to player data
• A comprehensive data breach response procedure to minimise impact in the event of an incident

While we take all reasonable precautions, no security system can be guaranteed 100% secure. You also play a vital role in protecting your account — by using a strong password, enabling 2FA, and never sharing your login credentials with anyone.

5. Cookies, Tracking Technologies & Analytics

The visa89 platform uses cookies and similar tracking technologies to ensure core platform functionality, enhance the user experience, and analyse usage patterns on an aggregated basis. The following are the types of cookies we use:

Essential cookies cannot be disabled as they are required for the core functionality of the platform. For all other cookies, you can manage your preferences through your browser settings. Please note that disabling certain cookies may affect the functionality or your overall experience on the visa89 platform.

Visa89 does not use third-party tracking cookies for advertising on external websites. The analytics we use are strictly for internal purposes — to understand how players interact with the platform so we can keep improving it. This analytics data is anonymised and cannot be used to identify you as an individual.

6. Your Privacy Rights under PDPA 2010

As a visa89 player and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 14 working days.
• Right to Rectification: If any personal data we hold about you is inaccurate or out of date, you have the right to request a correction. Simple updates can be made directly through your account profile settings.
• Right to Withdraw Consent: For data processed on the basis of your consent (such as marketing), you may withdraw that consent at any time without affecting any processing that took place prior to the withdrawal.
• Right to Object: In certain circumstances, you have the right to object to the processing of your data, particularly where it is used for direct marketing purposes.
• Right to Erasure (in limited circumstances): You may request the deletion of your personal data under certain circumstances, subject to our legal obligations to retain specific records for periods prescribed by law.
• Right to Complain: If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Personal Data Protection Department (PDPD) of Malaysia.

7. Data Retention & Deletion

Visa89 does not retain your personal data for longer than is necessary for the purposes for which it was collected, or longer than required by Malaysian law. The following are our data retention policies:

• Active Account Data: Retained for as long as your visa89 account remains active, as it is necessary to provide our services to you.
• Financial & Transaction Records: Retained for a minimum of 7 years from the date of the transaction, in line with Malaysian tax and financial regulatory requirements.
• KYC Records (Identity Verification): Retained for a minimum of 5 years following account closure, as required under anti-money laundering (AML) compliance obligations.
• Support Communication Logs: Retained for 2 years after case resolution for reference and service improvement purposes.
• Marketing Data (with consent): Retained until you withdraw consent or request deletion, subject to any other applicable minimum retention periods.

Once the retention period has lapsed and there is no legal obligation or legitimate interest to continue holding the data, visa89 will securely delete or anonymise it using appropriate methods, ensuring the data cannot be recovered by any unauthorised party.

If you close your visa89 account, your financial records and KYC records will be retained for the legally prescribed periods as outlined above. Once those periods expire, your data will be deleted or anonymised in accordance with our standard procedures.

8. Privacy Policy Amendments & Contact Us

Visa89 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, changes in law, or feedback from players. When we make material changes to this policy, we will:

• Updating the "Last Updated" date at the top of this document
• Notifying all registered players via email or in-platform notifications
• Providing at least 14 days' notice before material changes take effect, unless changes are required immediately for security or legal reasons
• Providing a summary of key changes to help players understand what has been updated

Continued use of the visa89 platform after the effective date of an updated policy will be considered acceptance of those changes. If you do not agree with the amendments, you may close your account and request deletion of your data before the effective date.

If you are dissatisfied with our response to your privacy complaint, you have the right to file a formal complaint with Malaysia's Department of Personal Data Protection (JPDP), the statutory body responsible for enforcing the PDPA 2010.