Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how WarungPlay ("Company", "we", "us", "our"), the operator of the website located at warungplay.click ("Platform"), collects, uses, discloses, stores, and protects the personal data of individuals ("User", "you", "your") who access or use our online casino, sports betting, and related services ("Services").

WarungPlay operates in compliance with the Malaysian Personal Data Protection Act 2010 ("PDPA") and other applicable data protection legislation. By registering an Account on the Platform or using the Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions, which form part of the binding agreement between you and WarungPlay.

2 Definitions

"Personal Data"

Any information that identifies or can reasonably identify a living individual, including name, identification number, contact details, financial information, and online identifiers, as defined under the Malaysian PDPA 2010.

"Processing"

Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction, whether by automated means or otherwise.

"Data Controller"

WarungPlay, as the entity that determines the purposes and means by which your personal data is processed.

"Data Processor"

Any third-party service provider that processes personal data on behalf of WarungPlay, acting solely on our documented instructions.

"Consent"

A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

"KYC Documentation"

Identity verification documents submitted in accordance with our Know Your Customer requirements, including government-issued identification and proof of address.

"Sensitive Data"

A subset of personal data warranting heightened protection, including financial account details, identity document numbers, and data relating to health or gambling behaviour.

3 Data We Collect

WarungPlay collects personal data through various means, including directly from you during registration and use of the Services, automatically through your use of the Platform, and from third-party sources where lawfully permitted.

3.1 Data Provided Directly by You

3.2 Data Collected Automatically

When you access the Platform, we may automatically collect the following technical and usage data:

• IP address, device type, operating system, and browser type;
• Pages visited, session duration, game activity, and betting history;
• Cookies, session tokens, and similar tracking technologies (see Section 7);
• Geolocation data at the country or city level (e.g., Kuala Lumpur, Penang, Johor Bahru) derived from your IP address.

3.3 Data from Third Parties

We may receive personal data about you from third-party payment processors (including FPX network banks, e-wallet providers, and cryptocurrency exchange services), identity verification service providers, and fraud prevention agencies. Data received from these sources is handled in accordance with this Policy.

4 How We Use Your Data

WarungPlay processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your Account, verify your identity, and authenticate your access to the Services;
• Transaction Processing: To facilitate deposits via Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency channels, and to process withdrawal requests to your nominated accounts;
• Regulatory Compliance: To fulfil our obligations under the PDPA, anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and any other applicable law or regulatory directive;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised access, money laundering, and other prohibited conduct;
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance through our live chat, email, and other support channels;
• Service Improvement: To analyse usage patterns, diagnose technical issues, and develop improvements to the Platform and our game offerings;
• Marketing Communications: Where you have provided explicit consent, to send you promotional offers, bonus notifications, and updates relevant to your account activity. You may withdraw this consent at any time;
• Responsible Gambling: To monitor account activity for indicators of problem gambling behaviour and to facilitate the application of responsible gambling tools including deposit limits and self-exclusion.

5 Legal Basis for Processing

WarungPlay processes your personal data on one or more of the following legal bases, as applicable under the PDPA 2010 and associated data protection principles:

• Contractual Necessity: Processing is necessary for the performance of our agreement with you, including Account registration, transaction processing, and delivery of the Services;
• Legal Obligation: Processing is required to comply with applicable laws, including AML regulations, KYC obligations, and lawful orders from competent authorities;
• Legitimate Interests: Processing is necessary for purposes of fraud prevention, platform security, and service optimisation, provided that such interests do not override your fundamental rights and freedoms;
• Consent: For certain non-essential processing activities, including direct marketing communications, we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

WarungPlay does not sell your personal data to third parties. We may disclose your personal data to the following categories of recipients only to the extent necessary and in accordance with this Policy:

• Payment Service Providers: Banks, e-wallet operators (Touch 'n Go, Boost, GrabPay), FPX network participants (Maybank, CIMB, Public Bank, Hong Leong), DuitNow infrastructure providers, and cryptocurrency processing services — solely to facilitate payment transactions;
• Identity Verification Providers: Third-party KYC and fraud detection service providers engaged to verify your identity and screen for prohibited activity;
• Game Software Providers: Licensed game content providers whose games are hosted on the Platform may receive anonymised session data necessary for game delivery and RNG verification. Such providers are contractually prohibited from using this data for independent marketing purposes;
• Professional Advisers: Legal, accounting, audit, and regulatory compliance advisers engaged by WarungPlay, subject to professional confidentiality obligations;
• Regulatory and Law Enforcement Authorities: Where required or permitted by applicable law, including in response to valid court orders, regulatory investigations, or national security requirements;
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of WarungPlay's business assets, your personal data may be transferred to the relevant successor entity, provided such entity agrees to honour this Policy.

7 Cookies & Tracking Technologies

The WarungPlay Platform uses cookies and similar tracking technologies (including session tokens, local storage, and pixel tags) to provide essential functionality, analyse usage, and where applicable, deliver relevant communications.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling essential cookies may prevent you from accessing certain features of the Platform. As we do not integrate third-party advertising networks, you will not receive behavioural advertising from WarungPlay on external websites.

8 Data Retention

WarungPlay retains personal data for no longer than is necessary to fulfil the purposes set out in this Policy, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your Account relationship with WarungPlay and for a period of seven (7) years following Account closure, in accordance with AML record-keeping requirements;
• Transaction records: Retained for seven (7) years from the date of each transaction, as required under financial record-keeping regulations;
• KYC documentation: Retained for the period required by applicable law, typically five (5) to seven (7) years from the date of verification;
• Customer support communications: Retained for three (3) years from the date of the last interaction;
• Marketing consent records: Retained for the duration of the consent period and for three (3) years thereafter to evidence compliance;
• Technical / log data: Retained for up to twelve (12) months unless longer retention is required for security or legal investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

9 Data Security

WarungPlay implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
• Encryption of sensitive data fields at rest, including financial account identifiers and identity document data;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure;
• Multi-factor authentication options for Account access;
• Incident response procedures, including notification protocols in the event of a data breach affecting your rights and freedoms.

10 Your Data Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by WarungPlay:

• Right of Access: You may request a copy of the personal data we hold about you and information about how it is being processed;
• Right to Correction: You may request that inaccurate or incomplete personal data be corrected. You can update most Account information directly within your Account settings;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to WarungPlay's legal retention obligations;
• Right to Object to Processing: You may object to processing based on legitimate interests, including direct marketing communications;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing;
• Right to Data Portability: Where technically feasible and legally applicable, you may request a machine-readable copy of personal data you have provided to us.

To exercise any of the above rights, please contact our Data Protection team via the support email listed in Section 14. We will respond to verified requests within thirty (30) days. We may require identity verification before processing your request to prevent unauthorised disclosure.

11 Minors and Age Restriction

The WarungPlay Platform and its Services are strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from persons under the age of 21. If we become aware that a user under the age of 21 has registered an Account or provided personal data, we will take immediate steps to close the Account, void any activity associated with it, and securely delete all personal data collected.

If you are a parent or guardian and believe that a minor under your care has registered on the Platform, please contact us immediately at the address provided in Section 14.

12 International Data Transfers

WarungPlay primarily stores and processes personal data within systems located in Malaysia and the broader Asia-Pacific region. In certain circumstances, data may be transferred to or accessed by our third-party service providers located in other jurisdictions, including for payment processing, identity verification, and cloud infrastructure services.

Where personal data is transferred outside Malaysia, WarungPlay takes steps to ensure that an adequate level of protection is in place, including through the use of contractual safeguards consistent with the requirements of the PDPA 2010 and applicable regulatory guidance.

13 Policy Amendments

WarungPlay reserves the right to amend this Privacy Policy at any time to reflect changes in our practices, applicable law, or regulatory requirements. Where amendments are material, we will provide notice by prominently displaying a notification on the Platform and, where feasible, by sending an email to your registered address.

The "Last Updated" date at the top of this page will be revised to reflect the date of any amendment. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms.

14 Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the WarungPlay Data Protection team. Our support team is available 24 hours a day, 7 days a week via live chat on the Platform.

You may also contact us by email at: [email protected] (plain text — not a clickable link). Please include your full name, Account username, and a clear description of your query or request to ensure a timely response. All times are in Malaysia Standard Time (MYT, UTC+8).

If you are not satisfied with our response to a data privacy concern, you have the right to lodge a complaint with the relevant data protection authority in Malaysia, the Personal Data Protection Commissioner, in accordance with the PDPA 2010.