Privacy Policy

iDompey ("Company", "Platform", "we", "us", "our") operates the online gaming platform accessible at https://idompey.cam (the "Platform"). We respect the privacy of every individual who accesses our Platform, and we are committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles.

This Privacy Policy ("Policy") describes how iDompey collects, receives, stores, uses, shares, and safeguards personal information relating to you as a user, visitor, or registered Player of the Platform ("you", "your", "Data Subject"). It also sets out your rights in relation to your personal data and how you may exercise those rights.

This Policy is incorporated by reference into iDompey's Terms & Conditions and forms part of the overall agreement governing your use of the Platform. By registering an Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. In respect of data collected through this Platform, iDompey is the Data Controller.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement — for example, payment service providers and KYC verification partners.
• "KYC" means Know Your Customer — the identity and age verification process conducted to satisfy anti-money-laundering (AML) and responsible gambling compliance obligations.
• "Cookies" means small text files stored on a user's device by a browser at the request of a website, used to retain session information, preferences, and analytics data.

iDompey is the Data Controller for all Personal Data collected through the Platform at https://idompey.cam. The Company determines the purposes for which Personal Data is collected and the means by which it is processed, and bears responsibility for ensuring that processing activities are conducted in accordance with applicable data protection principles.

For all data protection enquiries, please contact us using the details provided in Section 15 (Contact Us) of this Policy.

iDompey collects Personal Data from you in the following circumstances and categories:

4.1 Data You Provide Directly

• Account registration details: full name, date of birth, email address, phone number, and chosen username;
• Residential address (used for KYC verification and fraud prevention);
• Identity documents submitted during KYC: government-issued photo ID (e.g., MyKad, passport), proof of address (utility bill or bank statement), and payment method ownership documentation;
• Financial information relevant to processing deposits and withdrawals, including bank account details, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), and cryptocurrency wallet addresses;
• Communications sent to our support team, including live chat transcripts and email correspondence.

4.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution;
• Session and usage data: pages visited, time spent on each page, game sessions initiated, wagers placed, and navigation paths through the Platform;
• Transaction logs: deposit amounts, withdrawal requests, payment method used, and timestamps;
• Geolocation data: derived from IP address to assist with fraud prevention and jurisdiction screening (not precise GPS-level location).

4.3 Data Received from Third Parties

• Identity verification results from third-party KYC and AML screening providers;
• Fraud risk signals from payment processors including FPX, DuitNow, and e-wallet providers;
• Publicly available information used to enhance fraud detection or comply with sanctions screening obligations.

The table below summarises the primary purposes for which iDompey processes Personal Data and the categories of data involved in each processing activity:

iDompey relies on the following legal bases when processing Personal Data:

• Contractual Necessity: Processing required to perform our contract with you — including Account management, payment processing, and the delivery of gaming services — is necessary for the performance of the agreement between you and iDompey.
• Legal Obligation: Certain processing activities, including KYC verification, AML screening, transaction record-keeping, and age enforcement, are required to comply with applicable legal and regulatory obligations.
• Legitimate Interests: We process certain data categories (such as usage analytics, fraud detection signals, and IP-based geolocation) on the basis of our legitimate interest in operating a secure, fair, and commercially sustainable platform, provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on consent as a legal basis (for example, for direct marketing communications), you may withdraw that consent at any time by contacting us or updating your communication preferences within your Account settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

iDompey does not sell, rent, or commercially exploit your Personal Data. We share Personal Data with third parties only in the limited circumstances described below:

• Payment Service Providers: We share payment-related data with FPX-participating banks (Maybank, CIMB, Public Bank, Hong Leong Bank and others), e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), DuitNow, and cryptocurrency processing services, solely for the purpose of executing your requested transactions.
• KYC and AML Screening Providers: We engage third-party identity verification and sanctions screening services to fulfil our compliance obligations. These providers process identity document data as Data Processors under strict contractual data protection terms.
• Game Software Providers: Third-party game providers whose titles are hosted on the Platform may receive anonymised session data (such as game round IDs and bet amounts) for game integrity and RTP auditing purposes. No personally identifiable Account information is shared with game providers for marketing or profiling purposes.
• Fraud Prevention and Cybersecurity Services: We share technical data (IP addresses, device fingerprints, and session anomaly signals) with fraud prevention service providers to protect the Platform and its players from unauthorised access, fraud, and money laundering.
• Legal and Regulatory Authorities: We may disclose Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where we are legally required to do so, or where such disclosure is necessary to protect the rights, property, or safety of iDompey, our players, or the public.

All third-party processors engaged by iDompey are contractually required to maintain appropriate technical and organisational security measures and to process Personal Data solely on iDompey's documented instructions.

iDompey retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The retention periods applicable to each processing category are set out in the table in Section 5.

Following the expiry of the applicable retention period, Personal Data is securely deleted, anonymised, or pseudonymised so that it can no longer be associated with an identifiable individual. Certain categories of financial transaction data must be retained for a minimum period of seven years to satisfy financial record-keeping obligations, regardless of Account status.

Where you request erasure of your Personal Data (see Section 11 — Your Rights), iDompey will fulfil that request subject to any overriding legal obligation to retain the data. In such cases, we will inform you of the relevant legal basis for continued retention.

iDompey uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that enable the Platform to recognise your browser, maintain your session state, and remember your preferences.

The categories of cookies used by iDompey are as follows:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including maintaining your authenticated session, processing transactions, and preventing fraudulent activity. These cookies cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: Used to remember your preferences (such as language settings, display options, and previously selected payment methods) to provide a more personalised experience.
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how visitors interact with the Platform, including pages visited, time spent, and navigation paths. This data helps us identify and fix usability issues and improve Platform performance.
• Security and Fraud Prevention Cookies: Used to detect and prevent unauthorised access, bot activity, and suspicious session behaviour on the Platform.

You may adjust your browser settings to refuse or delete cookies. However, disabling certain cookie categories may affect the functionality of the Platform, particularly session management and payment processing features.

iDompey implements appropriate technical and organisational security measures to protect Personal Data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit Secure Sockets Layer (SSL) encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive Personal Data (including identity document images and financial details) at rest within our secure database infrastructure;
• Role-based access controls limiting internal access to Personal Data to staff who require it for legitimate operational purposes;
• Regular independent security audits and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for administrative access to systems holding Personal Data;
• Incident response procedures, including data breach notification processes in line with applicable legal requirements.

No transmission of data over the internet can be guaranteed to be completely secure. While iDompey takes all reasonable steps to protect your Personal Data, we cannot warrant absolute security against all possible threats. You are also responsible for maintaining the security of your Account credentials and for logging out of the Platform when using shared or public devices.

Subject to applicable law and any overriding legal obligations on iDompey's part, you have the following rights in relation to your Personal Data:

To exercise any of the rights listed above, please contact iDompey's data protection team at the email address provided in Section 15. We will respond to all valid requests within 30 days of receipt. In cases of complexity or high volume, we reserve the right to extend this period by a further 60 days with prior notification to you.

iDompey strictly prohibits participation in gambling activities by individuals under the age of 21. The Platform does not knowingly collect Personal Data from persons under 21 years of age. Age verification is conducted as a mandatory step of the KYC process and is required before any withdrawal is processed.

If iDompey becomes aware that Personal Data has been collected from an individual who is under 21, the relevant Account will be immediately suspended, the Personal Data will be deleted (to the extent permitted by legal obligations), and any deposits will be returned in accordance with our Terms & Conditions.

If you have reason to believe that an individual under 21 has accessed the Platform, please contact our support team immediately via the details in Section 15.

iDompey operates under international online gaming licensing and may engage Data Processors located in jurisdictions outside of Malaysia. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applicable in the Player's country of residence, iDompey ensures that appropriate safeguards are in place, including:

• Contractual clauses requiring the recipient to process data to a standard equivalent to applicable data protection principles;
• Assessment of the recipient's information security practices prior to engagement;
• Ongoing monitoring of Data Processor compliance with contractual data protection obligations.

By using the Platform, you acknowledge that your Personal Data may be processed in jurisdictions outside Malaysia as described in this Policy. iDompey takes all reasonable steps to ensure that such processing is carried out securely and in a manner consistent with this Privacy Policy.

iDompey reserves the right to amend or update this Privacy Policy at any time. Material changes will be communicated to registered Players via a notice on the Platform or by email to the address associated with their Account prior to the change taking effect. The "Last updated" date at the top of this page will be revised accordingly.

Continued use of the Platform following the notification of a material change constitutes your acceptance of the revised Policy. If you do not agree with any changes, you are entitled to request Account closure and the return of any real-money balance in accordance with our Terms & Conditions.

For any enquiries, requests, or concerns relating to this Privacy Policy or iDompey's processing of your Personal Data — including data subject access requests, erasure requests, and consent withdrawal — please contact us through the following channels. All privacy-related communications are handled by our data protection team.

• Email: [email protected]
• Subject line (recommended): "Privacy Request — [Your Account Username]"
• Live Chat: Available 24/7 on the Platform for general support queries and to be directed to the appropriate data protection contact.

We aim to acknowledge all privacy requests within 5 business days and to provide a full substantive response within 30 days. In complex cases, we may extend this period by up to 60 additional days, with prior notice to you.