Privacy Policy

This Privacy Policy ("Policy") is published by vpbet ("we", "us", "the Operator"), the operator of the online casino and sports betting platform accessible at vpbet.casa (the "Platform" or "Website"). This Policy applies to all individuals who access, register on, or interact with the Platform in any capacity ("you", "the Player", "the Data Subject").

vpbet is operated primarily to serve players in Malaysia. We understand the importance Malaysian players place on the security and responsible handling of their personal information, and this Policy reflects our commitment to maintaining the highest practical standards of data privacy in the online gaming industry.

This Policy describes:

• The categories of personal data we collect and the circumstances under which we collect them
• The legal bases on which we process your personal data
• The purposes for which your personal data is used
• The circumstances under which your data may be shared with third parties
• The rights you hold in relation to your personal data and how to exercise them
• How long we retain your data and the security measures we employ to protect it

This Policy is to be read together with our Terms & Conditions and our Responsible Gambling Policy. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of this Privacy Policy, the following definitions apply:

vpbet collects personal data across several categories, depending on the nature of your interaction with the Platform. The following table summarises the primary categories of data we collect and the contexts in which they arise.

We do not intentionally collect sensitive special categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) unless it is directly relevant to a responsible gambling assessment or is provided voluntarily by the Player in a support context.

vpbet collects personal data through the following channels and mechanisms:

4.1 Direct Collection

You provide data directly to us when you:

• Complete the account registration form on the Platform
• Submit KYC verification documents (MyKad, Driver's Licence, Passport, proof of address)
• Make a deposit or initiate a withdrawal using methods such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Bitcoin, or USDT
• Contact our customer support team via live chat or email
• Respond to surveys or promotional campaigns
• Update your account profile or settings

4.2 Automated Collection

We automatically collect certain technical and usage data each time you access the Platform, including:

• Your IP address and approximate geographic location (country and region level)
• Device identifiers, browser type, and operating system
• Pages and features you access, and the sequence of navigation
• Time and duration of sessions
• Referral source (the URL or search engine that directed you to the Platform)

4.3 Third-Party Sources

In limited circumstances, vpbet may receive personal data from third-party sources, including:

• Payment processors who confirm transaction status and provide fraud signals
• Identity verification service providers who assist with KYC document authentication
• Fraud prevention and anti-money laundering screening services
• Responsible gambling self-exclusion registers, where applicable

vpbet processes your personal data only where a valid legal basis exists. The principal legal bases we rely on are as follows:

• Contractual Necessity: Processing that is necessary for the performance of the agreement between you and vpbet — for example, processing your deposit, verifying your identity to facilitate a withdrawal, or managing your account.
• Legal Obligation: Processing required for compliance with applicable laws and regulations — including anti-money laundering (AML) obligations, KYC requirements, and record-keeping obligations imposed by applicable regulatory frameworks.
• Legitimate Interests: Processing undertaken in pursuit of vpbet's legitimate business interests, where those interests are not overridden by your fundamental rights — including fraud prevention, platform security monitoring, and improvement of our services. We conduct a balancing assessment before relying on this basis.
• Consent: Where we process data for purposes such as direct marketing communications or optional analytics tracking, we will seek your explicit consent and will provide a straightforward mechanism for you to withdraw it at any time.

vpbet uses the personal data we collect for the following purposes:

6.1 Account Management and Service Delivery

• Creating, maintaining, and administering your player account
• Processing deposits and withdrawals via your chosen payment method
• Verifying your identity to satisfy KYC and regulatory requirements
• Applying bonuses and promotional credits to your account
• Providing access to games, sports betting markets, and platform features

6.2 Legal and Regulatory Compliance

• Fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) screening obligations
• Maintaining records required by applicable laws and any regulatory authority with jurisdiction over our operations
• Responding to lawful requests from law enforcement or regulatory authorities
• Conducting responsible gambling assessments and enforcing self-exclusion decisions

6.3 Security and Fraud Prevention

• Detecting and investigating suspected fraudulent activity, account abuse, or bonus exploitation
• Monitoring for unusual transaction patterns that may indicate financial crime
• Identifying and blocking access from prohibited jurisdictions or devices
• Ensuring the integrity of games and sports betting markets

6.4 Customer Support

• Responding to account queries, withdrawal issues, and general enquiries submitted via live chat or email
• Maintaining records of support interactions to ensure consistency and quality of service
• Training and quality assurance for our support team

6.5 Platform Improvement

• Analysing usage patterns to identify and resolve technical issues
• Assessing the performance of games and features to guide product development decisions
• Conducting internal research and statistical analysis on an aggregated, anonymised basis

6.6 Marketing Communications (Consent-Based)

Where you have given explicit consent, we may use your contact information to send you information about promotions, bonuses, and platform updates. You may withdraw your consent and opt out of marketing communications at any time by updating your account preferences or contacting our support team.

vpbet does not sell your personal data. We share personal data with third parties only in the circumstances set out below, and only to the extent necessary for the stated purpose.

7.1 Payment Service Providers

To process your deposits and withdrawals, we share relevant financial and identity data with our authorised payment partners, including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking integrations (Maybank, CIMB, Public Bank, Hong Leong). These providers are contractually bound to process your data only for the purposes of executing your payment instructions.

7.2 Identity Verification and KYC Providers

To fulfil our KYC obligations, we may share your identity document data with contracted identity verification service providers. These providers process your data under data processing agreements that require them to maintain equivalent data security standards to our own.

7.3 Fraud Prevention and AML Screening

We may share relevant transaction and identity data with fraud detection and AML screening services to identify and investigate suspicious activity. This processing is necessary for the protection of our players and the integrity of the platform.

7.4 Technology and Infrastructure Providers

Our platform relies on third-party cloud hosting, database, and security infrastructure providers. These providers have access only to the data necessary to deliver their contracted services and are required to maintain appropriate technical and organisational security measures.

7.5 Law Enforcement and Regulatory Authorities

vpbet may disclose personal data to law enforcement agencies, regulatory bodies, or other public authorities where we are legally required to do so, or where we believe in good faith that disclosure is necessary to prevent serious harm, fraud, or financial crime.

7.6 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of the Operator's business, player data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any material change in the identity of the Data Controller arising from such a transaction.

vpbet retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active Account Data: Data collected during registration, KYC, and ongoing account activity is retained for the duration of the active account relationship.
• Closed Account Data: Following account closure — whether voluntary or otherwise — personal data is retained for a minimum period of five (5) years to satisfy AML, fraud prevention, and regulatory record-keeping obligations. This period may be extended where a legal hold or active investigation requires it.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following the end of the account relationship, in accordance with applicable anti-money laundering regulations.
• Financial Transaction Records: Deposit and withdrawal records are retained for a minimum of seven (7) years for accounting and regulatory compliance purposes.
• Support Communications: Customer support records are retained for a minimum of two (2) years following the date of the interaction.
• Marketing Consent Records: Records of consent to marketing communications are retained for the period during which consent remains active, plus a reasonable period thereafter to demonstrate compliance.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

The vpbet Platform uses cookies and similar tracking technologies to enhance your user experience, maintain session security, and collect analytical data about platform usage.

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Platform, including maintaining your authenticated session and enforcing security settings. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Store your preferences, such as language selection, responsible gambling settings, and display preferences, to personalise your experience on return visits.
• Analytics Cookies: Collect anonymised or pseudonymised data about how visitors interact with the Platform — including pages visited, session duration, and navigation paths. This data is used to improve platform performance and user experience.
• Security Cookies: Used to detect fraudulent activity, identify unusual login patterns, and protect the integrity of player accounts.

9.2 Cookie Consent and Management

Non-essential cookies (including analytics cookies) are deployed only with your consent, which you may provide or withdraw at any time via your browser settings or the cookie preference panel on the Platform. Please note that disabling certain cookies may limit the functionality of some Platform features.

The vpbet platform operates with technology and service provider infrastructure that may be located outside of Malaysia. As a result, your personal data may be transferred to, stored in, or processed in countries other than your country of residence.

Where such international transfers occur, vpbet takes reasonable steps to ensure that your personal data receives an equivalent level of protection to that which it would receive in Malaysia. This includes:

• Entering into contractual arrangements with Data Processors that impose data protection obligations consistent with applicable standards
• Conducting due diligence on the security practices and data governance frameworks of third-party providers before engagement
• Monitoring the ongoing compliance of Data Processors with their contractual data protection obligations

By using the vpbet Platform, you acknowledge that your personal data may be transferred internationally as described in this section.

As a Data Subject, you hold the following rights in relation to the personal data that vpbet holds about you. vpbet is committed to facilitating the exercise of these rights promptly and without unnecessary barriers.

To exercise any of the above rights, please contact our Data Protection team via live chat or by emailing [email protected] (plain text — not a clickable link). We will acknowledge your request within five (5) business days and endeavour to respond in full within thirty (30) calendar days. Where requests are complex or numerous, we may extend this period by a further thirty (30) days with notification to you.

vpbet will not charge a fee for the processing of reasonable data subject requests. However, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

The vpbet Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If you are under 21 years of age, you are not permitted to access or use the Platform and must not submit any personal information to us.

If vpbet becomes aware, or has reasonable grounds to believe, that personal data has been collected from a person under the age of 21, we will take immediate steps to:

• Suspend and close the associated account
• Delete the personal data of the underage individual from our systems, to the extent permitted by applicable regulatory record-keeping obligations
• Refund any deposits made, minus any losses incurred, where applicable law and our Terms & Conditions permit

Parents or guardians who have reason to believe that a minor under their care has registered on the Platform are encouraged to contact us immediately via live chat so that we can investigate and take appropriate action.

vpbet implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security programme includes, but is not limited to:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3. Personal data stored on our servers is encrypted at rest using AES-256.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All internal access is authenticated, logged, and subject to regular review.
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation services. Regular vulnerability assessments and penetration tests are conducted.
• Incident Response: vpbet maintains a documented data breach response plan. In the event of a security incident affecting your personal data, we will notify affected Players promptly in accordance with applicable regulatory requirements.
• Staff Training: All personnel who handle personal data receive regular training on data protection obligations, phishing awareness, and secure data handling procedures.
• Third-Party Security Audits: Our security practices and the security of critical third-party service providers are reviewed on a periodic basis.

vpbet reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

Where amendments are material — meaning they involve a significant change to how we process your personal data or to your rights as a Data Subject — we will provide advance notice to registered Players via email or a prominent on-Platform notification, with a minimum notice period of fourteen (14) days before the changes take effect.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the amended Policy, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

We encourage you to review this Privacy Policy periodically to remain informed of how vpbet collects, uses, and protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or vpbet's data processing practices, please contact us using the following methods:

• Live Chat: Available 24 hours a day, 7 days a week through the Platform. This is the fastest method to reach our team, with an average response time of 3–5 minutes.
• Email: [email protected] — Please note this address is displayed as plain text and is not a clickable link. Use it for written correspondence regarding data protection matters.

Our support team provides assistance in English, Bahasa Melayu, and Mandarin Chinese, and operates in MYT (UTC+8) timezone. For data protection enquiries submitted by email, we aim to acknowledge receipt within two (2) business days and to respond substantively within thirty (30) calendar days.

If you are not satisfied with our response to a data protection concern, you have the right to escalate the matter to the relevant data protection supervisory authority with jurisdiction over your circumstances. vpbet is committed to cooperating constructively with supervisory authorities in the resolution of player data protection complaints.