Privacy Policy — How ikaya28 Protects Your Personal Data

1 Introduction

This Privacy Policy ("Policy") describes how ikaya28 ("Platform", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "User", "Player", "Member") who access or use the ikaya28 online gaming platform at https://ikaya28.cam ("the Website") and any associated services.

ikaya28 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection laws and regulations. This Policy is intended to give you a clear and complete picture of your data rights and our obligations as a data processor.

This Policy should be read alongside our Terms & Conditions, which govern your use of the platform and together constitute the full agreement between you and ikaya28.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, residential address, payment details, and device identifiers.
• "Processing" means any operation performed on personal data — including collection, recording, storage, use, disclosure, erasure, and destruction — whether or not by automated means.
• "Data Controller" means ikaya28, the entity that determines the purposes and means by which your personal data is processed.
• "Data Processor" means any third-party entity that processes personal data on behalf of ikaya28 under a contractual and confidentiality obligation.
• "Consent" means any freely given, specific, informed, and unambiguous indication by which you signify your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" means identity and address verification documents collected as part of the Know Your Customer compliance process, including copies of government-issued identification and proof of address.
• "Cookies" means small data files placed on your device by the platform to facilitate session management, functionality, and analytics.

3 Data We Collect

ikaya28 collects personal data from you through several channels and in several categories. The following table summarises the primary categories of data we collect, along with the context in which they are gathered:

We collect only the minimum data necessary for each stated purpose. We do not collect special category data (such as health information or biometric data) unless strictly required by applicable law or expressly consented to by you.

4 How We Use Your Data

ikaya28 uses your personal data for the following specific purposes:

• Account Management: To create, maintain, and administer your registered account, including processing login requests, managing account settings, and facilitating password recovery.
• KYC & Age Verification: To verify that you are at least 21 years of age and to confirm your identity in compliance with applicable anti-money laundering and responsible gambling obligations.
• Payment Processing: To process deposits via Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and RHB) and to execute withdrawal requests to verified accounts.
• Platform Delivery: To deliver the online casino, live casino, sports betting, and all other gaming services available on the platform.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account compromise, multi-accounting, bonus abuse, and other activities prohibited under our Terms & Conditions.
• Responsible Gambling: To monitor gaming activity for indicators of problem gambling and to apply responsible gambling tools (deposit limits, cooling-off periods, self-exclusion) where activated by you or required by our responsible gambling obligations.
• Legal Compliance: To comply with applicable laws, regulatory requirements, court orders, and law enforcement requests — including anti-money laundering reporting obligations.
• Customer Support: To respond to your support enquiries, resolve disputes, and improve the quality of our customer service.
• Platform Analytics & Improvement: To analyse aggregated and anonymised usage data to improve platform performance, game selection, user experience, and reliability.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have opted in to receive marketing communications. See Section 13 for full details on how to manage your marketing preferences.

5 Legal Basis for Processing

Every instance of personal data processing by ikaya28 is grounded in one or more lawful bases as recognised under applicable data protection legislation. The primary legal bases we rely upon are:

• Contractual Necessity: Processing required to perform the contract between you and ikaya28 — specifically the account registration agreement and service delivery obligations under our Terms & Conditions. This covers account management, payment processing, game delivery, and withdrawal execution.
• Legal Obligation: Processing required to comply with our legal obligations under applicable law, including KYC verification, anti-money laundering reporting, age verification, and data retention requirements imposed by regulatory authorities.
• Legitimate Interests: Processing that serves our legitimate business interests — including fraud prevention, security monitoring, platform analytics, and responsible gambling monitoring — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given consent, including the sending of optional marketing communications and the setting of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

6 Data Sharing & Disclosure

ikaya28 does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment Service Providers: Licensed payment processors and e-wallet providers (including the Malaysian payment brands referenced above) that facilitate deposits and withdrawals on the platform. These providers receive only the data necessary to process the relevant transaction.
• KYC & Identity Verification Partners: Regulated third-party identity verification services that assist with document authentication and database checks during the KYC process. These partners operate under strict confidentiality agreements and are prohibited from using your data for any other purpose.
• Fraud Prevention & Security Services: Specialist fraud detection and anti-abuse service providers that help ikaya28 identify and prevent fraudulent activity, multi-accounting, and bonus abuse.
• Game Content Providers: Licensed game studio partners whose titles are available on the ikaya28 platform. These providers may receive pseudonymised session and gameplay data required to deliver their games. No identifiable personal data is shared beyond what is technically necessary.
• IT Infrastructure & Cloud Services: Data hosting, cloud infrastructure, and cybersecurity service providers that support the technical operation of the platform, all operating under binding data processing agreements.
• Regulatory Authorities & Law Enforcement: Competent authorities, regulators, and law enforcement agencies where we are legally required to disclose information — for example, in connection with AML reporting obligations, court orders, or regulatory investigations.
• Professional Advisors: Legal counsel, auditors, and accountants who provide professional services to ikaya28 subject to professional privilege and confidentiality obligations.

7 Data Retention

ikaya28 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active account is retained for the duration of the account relationship and for a period following account closure as required by applicable legal and regulatory obligations.
• KYC & Identity Documents: Identity verification documents are retained for a minimum of five (5) years following the end of the account relationship, in compliance with anti-money laundering legislation. After the mandatory retention period, documents are securely deleted.
• Financial Transaction Records: Records of deposits, withdrawals, and betting transactions are retained for a minimum of seven (7) years to comply with financial record-keeping regulations.
• Communication Records: Support correspondence and live chat transcripts are retained for a maximum of three (3) years following the date of interaction, unless a longer period is required in connection with an ongoing dispute or regulatory matter.
• Technical Logs: Server and access logs are retained for up to twelve (12) months for security and fraud prevention purposes, after which they are anonymised or deleted.
• Marketing Preference Data: Records of your marketing opt-in and opt-out choices are retained indefinitely to ensure compliance with your stated preferences and to manage any future consent-related queries.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our internal data destruction procedures.

8 Cookies & Tracking Technologies

ikaya28 uses cookies and similar technologies (including local storage and session storage) on the platform for the following purposes:

• Essential Cookies: Strictly necessary for the operation of the platform — including maintaining your login session, remembering your preferences during a session, and ensuring security features function correctly. These cookies cannot be disabled without affecting core platform functionality.
• Functional Cookies: Remember your settings and preferences across sessions (such as language preference and responsible gambling settings) so you do not need to reconfigure them each time you visit.
• Analytics Cookies: Collect anonymised data about how users navigate the platform — including pages visited, features used, and session durations. This data is used in aggregate to improve platform performance and user experience. We do not use third-party advertising analytics networks.

ikaya28 does not use third-party advertising or retargeting cookies. We do not participate in cross-site behavioural advertising networks.

9 Data Security

ikaya28 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, and disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and ikaya28 servers is encrypted using TLS 1.3 with 256-bit AES cipher suites. All pages are served exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data stored in our databases — including identity documents and payment method details — is encrypted at rest using AES-256 encryption.
• Password Security: Account passwords are never stored in plaintext. All passwords are hashed using industry-standard cryptographic hashing algorithms with salting to prevent rainbow table attacks.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Two-Factor Authentication: Optional two-factor authentication is available to all registered players. We strongly recommend enabling this feature for enhanced account security.
• Security Monitoring: Our security team monitors platform infrastructure 24/7 for anomalous activity, unauthorised access attempts, and potential data breaches using automated intrusion detection systems.
• Incident Response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, ikaya28 will notify affected individuals and relevant authorities within the timeframe required by applicable law.

10 International Data Transfers

In the course of providing our services, your personal data may be transferred to and processed in countries outside of Malaysia. This may occur, for example, where our cloud infrastructure providers or KYC partners operate data centres in other jurisdictions.

Where personal data is transferred internationally, ikaya28 ensures that such transfers are subject to appropriate safeguards to protect your data to a standard equivalent to that applicable in the originating jurisdiction. Safeguards used include:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into agreements with receiving entities.
• Binding corporate rules where data is transferred within a corporate group subject to group-wide data protection policies.
• Transfers to jurisdictions that have received an adequacy determination by relevant data protection authorities, indicating a sufficient level of data protection.

You may request information about the specific safeguards in place for any international transfer of your data by contacting our Data Protection team at the email address provided in Section 16.

11 Your Data Rights

As a data subject, you hold the following rights in respect of your personal data held by ikaya28. These rights are subject to applicable legal exceptions and may be limited where compliance with a legal obligation requires us to retain certain data regardless of your request:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will provide this data in a commonly used, machine-readable format where technically feasible.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. Where correction is made, we will notify relevant third parties where appropriate.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where the processing has no other lawful basis. This right is subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being resolved or where you have objected to processing pending verification of legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another data controller.
• Right to Object: You have the right to object to processing based on our legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights, or where processing is required for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us using the details in Section 16. We will respond to all valid requests within 30 days of receipt. For complex or high-volume requests, we may extend this period by a further 60 days with prior notification and explanation.

12 Children & Minors

The ikaya28 platform is strictly intended for use by persons aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21.

Age verification is a mandatory step during account registration. Where an account is found, at any time, to belong to a person under the age of 21, the account will be immediately suspended, all data associated with that account reviewed, and appropriate action taken in accordance with our Terms & Conditions and legal obligations.

If you are a parent or guardian and have reason to believe that a minor has accessed or registered on ikaya28 without your knowledge, please contact us immediately at the email address provided in Section 16 so that we can investigate and take appropriate corrective action.

13 Marketing Communications

ikaya28 may send you promotional communications, bonus notifications, and platform updates by email, SMS, or in-platform notification, subject to the following conditions:

• Marketing communications are sent only to players who have affirmatively opted in to receive them during registration or through account settings.
• Each marketing email or SMS will include a clear and functional unsubscribe mechanism, allowing you to opt out of that category of communication at any time.
• Unsubscribe requests will be processed within five (5) business days. Following confirmation of unsubscription, no further marketing communications of that type will be sent.
• Opting out of marketing communications will not affect the receipt of transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, or KYC-related correspondence — which are sent as part of the contractual service relationship.
• You may update your communication preferences at any time through your account dashboard under "Notification Settings".

ikaya28 does not share your contact details with third parties for the purpose of their own direct marketing activities.

14 Third-Party Links & Services

The ikaya28 platform may reference or interact with third-party services — such as payment gateways and game content delivery networks — in the course of delivering our services. These third parties operate their own privacy practices, which are governed by their respective privacy policies.

ikaya28 is not responsible for the privacy practices, data handling procedures, or content of any third-party services. We encourage you to review the privacy policy of any external service you interact with when using payment methods or accessing live game streams on the platform.

We conduct due diligence on all third-party service providers before engaging them and require contractual commitments to data protection standards as a condition of our working relationships.

15 Amendments to This Policy

ikaya28 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or regulatory guidance. The date of the most recent revision is displayed at the top of this page.

Where amendments are material — meaning they affect the nature of the data we collect, the purposes for which it is used, or your rights as a data subject — we will notify registered players by email and/or a prominent on-platform notice at least 7 days before the changes take effect.

Minor amendments, such as clarifications or editorial corrections that do not affect your rights or our data practices, may be made without advance notice. Your continued use of the platform following the effective date of any revision constitutes your acknowledgement of the updated Policy.

We encourage you to review this Policy periodically. Previous versions of this Policy are available on request.

16 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the ikaya28 Data Protection team through the following channels:

• Live Chat: Available 24/7 on the ikaya28 platform in English, Bahasa Melayu, and Mandarin Chinese. For data-related enquiries, please identify your query as a "Data Privacy Request" at the start of the conversation.
• Email (plain text — not a link): [email protected] — please include "Privacy Request" in the subject line to ensure your enquiry is directed to the appropriate team.

All data subject requests will receive an initial acknowledgement within 3 business days. We will respond substantively to all valid requests within 30 days of receipt. Where an extension is required, you will be notified with an explanation of the reason and the anticipated response date.

If you are dissatisfied with our response to a data-related concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances.