Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by Penaslot ("Company", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://penaslot.cam ("the Platform"). This Policy applies to all individuals who access or use the Platform, register a Member Account, or interact with our services in any capacity ("you", "User", "Member").

Penaslot serves players across Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, Ipoh, and beyond — and we take our obligation to handle personal data responsibly with the utmost seriousness. We are committed to complying with all applicable data protection legislation and to maintaining transparent, accountable data handling practices.

This Policy explains: what categories of personal data we collect; the purposes for which we process it; the legal basis on which we rely; how long we retain it; with whom we share it; and the rights you hold in relation to your personal information.

Definitions

The following definitions apply throughout this Policy:

• "Personal Data" means any information that relates to an identified or identifiable natural person — including name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, Penaslot.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller, under a binding data processing agreement.
• "Consent" means freely given, specific, informed, and unambiguous indication of a Data Subject's agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity verification process required under applicable anti-money laundering and counter-terrorism financing regulations.
• "Cookies" means small text files stored on your device by your web browser when you visit the Platform, used to remember preferences and analyse usage patterns.
• "Sensitive Personal Data" means a special category of personal data that warrants heightened protection, such as biometric data, health information, or government-issued identification details.

Data Controller

For the purposes of applicable data protection law, Penaslot is the Data Controller responsible for the personal data collected through the Platform. All data processing activities carried out on the Platform are performed either directly by Penaslot or by approved Data Processors acting under written agreement with the Company.

If you have any questions or concerns about how your personal data is handled, or if you wish to exercise any of your data rights set out in Section 13 of this Policy, please contact our Data Protection point of contact at:

Personal Data We Collect

Penaslot collects the following categories of personal data in the ordinary course of operating the Platform:

4.1 Identity and Contact Data

• ID Full legal name, date of birth, nationality, and gender;
• ID Malaysian National Identity Card (MyKad) number, or passport number for non-citizens;
• CONTACT Email address, mobile phone number, and residential address (including postcode and city — e.g., Kuala Lumpur, Penang, Johor Bahru).

4.2 Financial and Payment Data

• FINANCIAL Bank account details sufficient to process deposits and withdrawals via Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, FPX, and DuitNow;
• FINANCIAL E-wallet account reference for Touch 'n Go eWallet, Boost, and GrabPay transactions;
• FINANCIAL Transaction history, deposit amounts (in MYR/RM), withdrawal requests, and bonus redemptions.

4.3 Account and Behavioural Data

• ACCOUNT Username, hashed password, account creation date, and last login timestamp;
• BEHAVIOUR Game history, wagering activity, session duration, sports betting markets accessed (e.g., Liga Super Malaysia, EPL, UFC), and platform feature usage.

4.4 Technical and Device Data

• TECHNICAL IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution;
• TECHNICAL Referring URLs, pages visited, time on page, and click-path data collected via cookies and analytics tools.

4.5 Communications Data

• COMMS Records of correspondence between you and Penaslot's support team, including live chat transcripts, email exchanges, and any written complaints or feedback submitted.

How We Collect Your Data

We collect personal data through the following channels:

• Direct collection: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion;
• Automated collection: Technical and behavioural data collected automatically when you access the Platform through cookies, server logs, and analytics tools;
• Third-party sources: Identity and fraud verification data from KYC/AML service providers; device and IP intelligence data from security partners; payment data from Malaysian banking and e-wallet partners.

Legal Basis for Processing

Penaslot processes personal data on the following legal bases, as appropriate to each processing activity:

• Contractual necessity: Processing required to perform our obligations under the Member Account agreement — including account setup, payment processing, withdrawal fulfilment, and bonus administration;
• Legal obligation: Processing required to comply with applicable law — including KYC identity verification, AML transaction monitoring, and regulatory reporting obligations;
• Legitimate interests: Processing for fraud prevention, platform security, product improvement, responsible gambling monitoring, and customer support quality assurance — where such processing does not override your fundamental rights;
• Consent: Processing for optional marketing communications, where you have expressly opted in. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

How We Use Your Data

Penaslot uses the personal data we collect for the following purposes:

7.1 Account and Service Management

To create, manage, and maintain your Member Account; to process deposits and withdrawals in MYR via your selected Malaysian payment method; to administer bonuses, promotions, and VIP Programme benefits; and to provide 24/7 customer support.

7.2 Identity Verification and Compliance

To verify your identity and age (you must be at least 21 years of age) as part of our KYC process; to screen against applicable sanctions lists and politically exposed persons (PEP) databases; to monitor transactions for indicators of money laundering or fraud in compliance with applicable AML/CTF legislation.

7.3 Responsible Gambling

To monitor your gaming behaviour for indicators of problem gambling; to administer any deposit limits, cool-off periods, or self-exclusion requests you make; and to prevent access by self-excluded individuals during active exclusion periods.

7.4 Security and Fraud Prevention

To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, unauthorised account access, and other prohibited conduct on the Platform.

7.5 Platform Improvement and Analytics

To analyse aggregate usage patterns and player behaviour to improve the Platform's functionality, game library, and user experience — for example, understanding how players in Kuala Lumpur use live dealer tables versus how players in Johor Bahru engage with sports betting markets.

7.6 Marketing Communications

Subject to your consent, to send you personalised promotional offers, bonus notifications, and product updates by email or in-platform notification. You may withdraw consent or adjust your communication preferences at any time via your Account settings or by contacting support.

Data Sharing & Disclosure

Penaslot does not sell or commercially transfer your personal data. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: Malaysian banking and e-wallet partners — including Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — receive the minimum payment data necessary to process transactions;
• KYC/AML service providers: Identity verification and anti-fraud partners receive identity and document data to complete regulatory compliance checks;
• Game providers and technology platforms: Receive anonymised session and game data necessary to deliver gaming services;
• Regulatory and law enforcement authorities: We may be required by law, court order, or regulatory directive to disclose personal data to competent authorities. We will comply with such obligations while seeking to minimise the scope of any mandatory disclosure;
• Corporate transactions: In the event of a merger, acquisition, or asset sale, personal data held by Penaslot may be transferred to the relevant successor entity, subject to equivalent privacy protections.

All third-party Data Processors engaged by Penaslot are subject to binding data processing agreements that impose data security and confidentiality obligations equivalent to those that apply to Penaslot itself.

Cookies & Tracking Technologies

Penaslot uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly necessary cookies: Essential for the Platform to function — including session authentication, security tokens, and server load balancing. These cannot be disabled without impairing core functionality;
• Functional cookies: Remember your preferences such as language settings, game display options, and previously selected payment methods;
• Analytics cookies: Collect anonymised usage data to help us understand how players navigate the Platform, which features are most used, and where technical issues arise;
• Marketing cookies: Used, with your consent, to deliver relevant promotional content within the Platform. These cookies do not track your activity across third-party websites.

You may manage your cookie preferences through your web browser settings. Note that disabling certain categories of cookies may affect your ability to use some Platform features.

Data Security

Penaslot implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

• AES-256 encryption for all personal data stored at rest;
• TLS 1.3 encryption for all data transmitted between your browser and our servers;
• Multi-factor authentication for all administrative and staff access to systems holding personal data;
• Regular penetration testing and security audits conducted by independent security specialists;
• Network intrusion detection and 24/7 security operations monitoring;
• Strict role-based access controls ensuring data access is limited to personnel with a legitimate operational need.

Data Retention

We retain your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account data: Retained for the duration of your Account's active status plus six months following Account closure;
• KYC and identity verification records: Retained for a minimum of five years following the end of the customer relationship, in accordance with anti-money laundering record-keeping requirements;
• Financial transaction records: Retained for a minimum of five years for regulatory and audit purposes;
• Customer support correspondence: Retained for two years following the close of the relevant interaction;
• Marketing consent records: Retained for three years following your last marketing interaction or until consent is withdrawn, whichever is earlier.

Following the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

International Data Transfers

Some of Penaslot's Data Processors and technology partners may operate infrastructure or processing facilities outside of Malaysia. Where personal data is transferred to jurisdictions that may not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place, including contractual data transfer agreements with data importers that impose obligations consistent with applicable data protection law.

Penaslot will not transfer your personal data to a third country or international organisation unless an adequate level of protection is guaranteed, whether through a formal adequacy determination, standard contractual clauses, or another recognised legal mechanism.

Your Data Rights

Subject to applicable data protection law, you hold the following rights in relation to your personal data held by Penaslot:

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within five business days and respond substantively within 30 calendar days.

Please note that certain rights may be subject to limitations where their exercise would conflict with our legal obligations — for example, retention of KYC records required under anti-money laundering law cannot be overridden by an erasure request.

Children's Privacy

The Penaslot Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21.

If we become aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated Account. If you believe that a minor has registered an Account on the Platform, please notify us immediately at [email protected].

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. We also recommend the use of website blocking tools available through organisations focused on responsible gambling.

Third-Party Links

The Penaslot Platform may contain references to or integrations with third-party services, including payment providers such as Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, and DuitNow. Interactions with those services are governed by the respective third party's own privacy policy, not by this Policy.

Penaslot accepts no responsibility or liability for the privacy practices of any third-party service. We encourage you to review the privacy policies of any third party before sharing your personal data with them.

Policy Updates

Penaslot reserves the right to update or revise this Privacy Policy at any time. Any changes will be published on this page with an updated "Last Updated" date. Where amendments are material, we will provide reasonable notice to registered Members via email or in-platform notification prior to the changes taking effect.

Your continued use of the Platform following the effective date of any revision constitutes your acknowledgement of and agreement to the updated Policy. If you do not agree to the revised Policy, you should discontinue use of the Platform and may request closure of your Account by contacting support.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Penaslot handles your personal data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the Platform interface. Average response time under 90 seconds.
• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" for expedited handling. Target response: within 4 hours for general enquiries; within 30 days for formal data rights requests.

For questions relating to your Account terms and conditions, please refer to our Terms & Conditions. For information about responsible gambling tools and player protection resources, please visit our Responsible Gambling page.