IRoyal Privacy Policy – Wagering Platform Member Data Protection

01 Introduction & Privacy Commitment

IRoyal understands that privacy is more than a legal obligation — it is the foundation of trust between the platform and its members. We know that when you share personal information with us, you are placing significant trust in us. That is why we take data protection seriously, not merely as a regulatory requirement, but as a core value of the iRoyal platform.

The iRoyal platform operates according to the following privacy principles:

• Data minimisation — we only collect information that is genuinely necessary
• Transparency — we are always transparent about what we collect and why
• Security — your data is protected to the highest technical standards
• User controls — you have the right to access and manage your data
• No data sales — your personal information is not sold to any third party

This document is written in English to ensure all members in Malaysia can read and understand it clearly.

02 Types of Personal Data Collected

IRoyal collects various types of information depending on how you interact with our platform. The following are the main categories of data we collect:

Registration & Identity Data

• Full name as shown on identity card or passport
• Date of birth for age verification
• Active email address
• Mobile phone number
• Identity card or passport number (for KYC process)
• Current residential address

Financial & Transaction Data

• Bank account details for withdrawal processing
• E-wallet account numbers (Touch 'n Go, GrabPay, Boost, ShopeePay)
• Deposit and withdrawal history
• Transaction records and account statements

Usage & Technical Data

• IP address and device information
• Web browser type and version
• Geolocation data (country and region only)
• Game history and wagering activity
• Platform access time and navigation logs
• Cookie and session token data

03 How We Use Your Data

All data collected by iRoyal is used for legitimate and transparent purposes. We do not use your data for any purpose outside the scope stated below:

• Account management — creates, verifies, and maintains your member account
• Transaction processing — processes deposits, wagering, and withdrawals securely
• Identity verification (KYC) — ensures you meet the age and membership eligibility requirements
• Legal compliance — fulfils financial reporting and anti-money laundering requirements
• Platform Security — detects fraudulent activity, abuse, and security threats
• Customer Support — resolves enquiries and issues reported by members
• Service improvement — analyses usage patterns to improve the user experience
• Marketing communications — sends offers, promotions, and updates (opt-out available)
• Responsible gaming — monitors betting patterns to identify members who may need support

IRoyal does not use any automated decision-making systems that materially affect your rights or access without appropriate human review.

04 Data Sharing & Disclosure

IRoyal does not sell, rent, or trade your personal data to any third party for their own marketing purposes. However, there are limited situations where we may need to share your information:

All third parties involved are required to sign a strict data protection agreement and may only use your data for purposes mutually agreed upon with iRoyal.

05 Security & Data Protection

The security of your personal data is a core technical priority for iRoyal. We implement multiple layers of protection to keep your information safe at all times:

• 256-bit SSL/TLS Encryption — all data transmitted between your browser and iRoyal servers is fully encrypted
• At-rest data encryption — data stored in our databases is encrypted using AES-256
• Two-factor authentication (2FA) — an additional security layer for login and high-value transactions
• Strict access controls — only authorised personnel may access members' personal data, with a full audit trail
• 24/7 Monitoring — an intrusion detection system (IDS) operates around the clock
• Regular penetration testing — security infrastructure is tested by independent security experts every quarter
• Multi-location data backup — data is backed up across geographically separate data centres

While we take every reasonable precaution, no online system can be guaranteed 100% secure. We encourage you to also protect your account by using a strong password and never sharing your login credentials with anyone.

06 Your Rights as a Data Subject

As an iRoyal member, you have the following rights regarding your personal data. We fully respect and facilitate the exercise of these rights:

• Right of Access — you may request a copy of all personal data we hold about you
• Right to Rectification — you may request correction of inaccurate or incomplete data
• Right to Erasure — you may request the deletion of your personal data ("right to be forgotten") subject to legal obligations
• Right to Restriction of Processing — you may request that we restrict data processing under certain circumstances
• Right to Data Portability — you may request your data in a machine-readable format
• Right to Object — you may object to data processing for direct marketing purposes at any time
• Right to Withdraw Consent — you may withdraw consent previously given at any time

To exercise any of the above rights, please contact the iRoyal privacy team via in-platform customer support. We will process your request within 30 business days.

07 Cookie Policy

IRoyal uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

We use four main categories of cookies:

• Essential Cookies — required for core platform functions such as login session verification and security. These cookies cannot be disabled.
• Performance Cookies — collects information about how you use the platform (pages visited, time spent) to help us improve our service.
• Functional Cookies — saves your preferences such as language, display settings, and login information for your convenience.
• Marketing Cookies — used to display promotions relevant to your interests. You may opt out of this type of cookie.

You can manage or delete cookies through your browser settings at any time. However, please note that disabling essential cookies may affect the functionality of the iRoyal platform.

08 Data Retention Period

IRoyal retains your personal data only for as long as necessary to fulfil the original purpose of collection or to comply with applicable legal requirements. Our retention guidelines are as follows:

• Active account data is retained for the duration your account is active plus 5 years after closure
• Financial transaction records are retained for a minimum of 7 years for tax compliance and AML purposes
• Customer support communication logs are retained for 3 years
• Technical and security log data is retained for 12 months
• Marketing and communication preference data is retained until you withdraw consent

Once the retention period expires, your data will be securely deleted or anonymized so it can no longer be linked to your identity.

09 International Data Transfer

To ensure the iRoyal platform operates quickly and reliably for members in Malaysia, some data may be stored or processed on servers located outside Malaysia. This includes the use of cloud computing services based in the Asia Pacific region.

For every international data transfer, iRoyal ensures:

• The recipient country or party maintains an equivalent or higher level of data protection
• Data transfer agreements compliant with international standards are signed
• End-to-end encryption is applied when transferring data across borders
• Access to data is restricted to personnel who genuinely require it

10 Contact Our Privacy Team

If you have any questions, concerns, or wish to exercise your data rights, the iRoyal privacy team is ready to assist you. You may reach us through the following channels:

• Live Chat — 24/7 support via the live chat icon within the iRoyal platform
• Privacy Email — [email protected] (include "Privacy Request" in the email subject line)
• Account Settings Section — you may manage most privacy preferences directly from your account settings

All privacy enquiries will be responded to within 3 business days. For formal requests requiring action such as data deletion or data export, the processing period is up to 30 business days.

This Privacy Policy may be updated from time to time to reflect changes in our practices or legal requirements. Any material changes will be communicated via in-platform notifications. The "Updated" date at the top of this document will always reflect the latest version.