Privacy Policy — How ibc22 Protects Your Data

This Privacy Policy (the "Policy") is issued by ibc22 (hereinafter referred to as "ibc22", "we", "us", or "the Company"), the operator of the online gaming and sports betting platform accessible at https://ibc22.cam. It governs the collection, processing, storage, sharing, and protection of personal data submitted by or collected from users (hereinafter "you", "the User", or "the Player") who access or use the ibc22 Platform.

ibc22 is committed to handling your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. While Malaysia's Personal Data Protection Act 2010 (PDPA) primarily applies to commercial entities operating within Malaysia, ibc22 voluntarily aligns its data handling practices with the spirit of the PDPA and broader international frameworks, including principles derived from the General Data Protection Regulation (GDPR), as a mark of its commitment to player privacy.

By registering an account or using any service on the ibc22 Platform, you acknowledge that you have read, understood, and consented to the data practices described in this Policy. If you do not consent to these practices, you should not proceed with account registration or continued use of the Platform.

For the purposes of this Policy, the following terms carry the meanings assigned below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, device identifiers, and IP address.
• "Processing" — any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" — ibc22, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — any third party that processes Personal Data on ibc22's behalf, including payment processors, KYC verification providers, and analytics platforms.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Platform" — the ibc22 website, mobile-accessible site, and all associated gaming and betting services.
• "KYC" — Know Your Customer identity verification procedures.
• "Cookie" — a small data file placed on your device by the Platform to enable certain functionality and data collection.

ibc22 collects Personal Data through multiple channels: directly from you during registration and account use, automatically via the Platform's technical systems, and from third parties such as payment processors and identity verification services.

3.1 Data Provided Directly by You

• Full legal name and date of birth
• Malaysian IC (MyKad) number, passport number, or other government-issued identification details
• Residential address (including city — e.g., Kuala Lumpur, Petaling Jaya, Johor Bahru, Penang, Shah Alam)
• Email address and mobile phone number
• Payment details (e.g., Touch 'n Go eWallet account reference, bank account identifiers for Maybank, CIMB, Public Bank, Hong Leong; DuitNow registered number; FPX bank details; cryptocurrency wallet addresses for USDT TRC20 or Bitcoin transactions)
• Username and encrypted password
• Any information provided via support correspondence or complaint submissions

3.2 Data Collected Automatically

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session data including login timestamps, pages visited, and duration of sessions
• Betting and gaming activity logs, including game titles played, stakes, outcomes, and transaction history
• Cookie identifiers and similar tracking technologies (see Section 7)

3.3 Data Received from Third Parties

• Identity and address verification data from KYC service providers
• Transaction confirmation and fraud-flag data from payment processors
• Responsible gambling status data where a player is on an external self-exclusion register

ibc22 processes your Personal Data for specific, defined purposes. We do not process data beyond what is reasonably necessary to achieve those purposes. The table below summarises the primary processing activities:

Purpose	Data Processed	Legal Basis
Account registration & management	Name, email, DOB, ID number, address	Contractual necessity
Identity verification (KYC)	Government ID, address proof, selfie verification	Legal obligation; contractual necessity
Payment processing	Bank/e-wallet references, transaction data	Contractual necessity
Anti-money laundering (AML)	Transaction history, source-of-funds data	Legal obligation
Responsible gambling monitoring	Gaming activity, deposit frequency, session data	Legitimate interest; legal obligation
Customer support	Contact details, support correspondence	Contractual necessity
Marketing communications	Email, phone, preferences	Consent (opt-in only)
Platform security & fraud prevention	IP address, device data, login logs	Legitimate interest
Analytics & product improvement	Aggregated usage data, session logs	Legitimate interest

ibc22 processes Personal Data only where a lawful basis exists. The applicable bases are:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you — including account creation, payment processing, and the provision of gaming and betting services.
• Legal Obligation: Processing mandated by applicable law, including KYC/AML obligations imposed by our international gaming licence and relevant financial regulation.
• Legitimate Interest: Processing conducted in pursuit of ibc22's legitimate business interests — such as fraud prevention, platform security, and responsible gambling monitoring — provided such interests are not overridden by your fundamental privacy rights.
• Consent: Processing for optional purposes such as marketing communications, where you have provided explicit opt-in consent. You retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

ibc22 does not sell your Personal Data to third parties. We share Personal Data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process Personal Data on our behalf under contractual obligations of confidentiality and data security. These include:

• Payment processors and e-wallet platforms (including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank transfer transactions)
• KYC and identity verification providers
• Cloud hosting and infrastructure providers
• Fraud detection and cybersecurity services
• Customer support software platforms
• Analytics and product telemetry services (using anonymised or aggregated data where possible)

6.2 Legal and Regulatory Disclosure

ibc22 may disclose Personal Data to competent authorities, licensing bodies, or law enforcement agencies where required to do so by applicable law, court order, or regulatory demand. We will notify you of such disclosure where legally permitted to do so.

6.3 Responsible Gambling Authorities

Where a player has self-excluded or where ibc22 is required under its licensing obligations to share responsible gambling-related data with relevant gambling harm prevention bodies, limited personal data may be disclosed to those organisations.

The ibc22 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. A cookie is a small text file stored on your device by your browser at the instruction of the Platform.

7.1 Types of Cookies Used

• Essential Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Store your preferences such as language selection, preferred currency display (MYR), and game lobby layout settings to personalise your experience across sessions.
• Analytics Cookies: Allow ibc22 to understand how players navigate the Platform, which pages are most visited, and where technical issues occur. Data collected is aggregated and does not identify individual users.
• Responsible Gambling Cookies: Track session duration to support the delivery of reality check reminders and enforce session limits set by you in your Account dashboard.

7.2 Cookie Management

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may reduce the functionality of the Platform, including some personalisation features. Essential cookies cannot be disabled as they are technically necessary for the Platform to operate.

ibc22 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law or our licensing obligations.

• Active Account Data: Retained for the duration of your Account's active status plus a minimum of five (5) years following Account closure, in compliance with AML record-keeping obligations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• KYC Documentation: Retained for a minimum of five (5) years following the end of the business relationship.
• Support Correspondence: Retained for a period of three (3) years from the date of the correspondence.
• Marketing Preferences: Retained until you withdraw consent or close your Account, whichever is earlier.
• Responsible Gambling Records: Self-exclusion records are retained for a minimum of five (5) years to prevent re-registration during the exclusion period.

Upon expiry of applicable retention periods, Personal Data is securely deleted or anonymised in accordance with ibc22's data destruction procedures.

ibc22 implements a multi-layered security architecture designed to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the ibc22 Platform is encrypted in transit using industry-standard TLS 1.2 or higher.
• At-Rest Encryption: Sensitive Personal Data stored in ibc22's databases is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to periodic review.
• Penetration Testing: The Platform undergoes regular third-party security penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Password Security: User passwords are stored in hashed form using industry-standard one-way hashing algorithms. ibc22 does not have access to your plaintext password.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, ibc22 will notify affected users promptly and take all reasonable steps to mitigate harm.

Subject to applicable law and the specific circumstances of your request, you have the following rights with respect to your Personal Data held by ibc22:

1. Right of Access: You may request a copy of the Personal Data ibc22 holds about you, together with information about how it is being processed.
2. Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. You can update many details directly via your Account dashboard.
3. Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (see Section 8).
4. Right to Restriction of Processing: You may request that ibc22 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested.
5. Right to Data Portability: You may request that Personal Data you have provided to ibc22 be transmitted to you or to another controller in a structured, commonly used, machine-readable format.
6. Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gambling monitoring, where you believe your individual circumstances override ibc22's interests.
7. Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting prior lawful processing.

To exercise any of these rights, please contact ibc22's Data Protection team at the email address listed in Section 14. We will respond to all verified requests within 30 days of receipt. We may need to verify your identity before processing any rights request.

The ibc22 Platform is strictly for individuals aged 21 years and above. ibc22 does not knowingly collect Personal Data from persons under the age of 21. Age verification is a mandatory component of the account registration process, and KYC procedures are used to confirm that registered users meet the minimum age requirement.

If ibc22 becomes aware that Personal Data has been collected from a person under the age of 21, that Account will be suspended immediately, all associated balances will be reviewed in accordance with our Terms and Conditions, and the Personal Data will be securely deleted from our systems as soon as reasonably practicable.

As an internationally licensed online gaming operator, ibc22 may transfer your Personal Data to, or process it in, countries outside of Malaysia. Such transfers may occur in the context of our use of cloud hosting infrastructure, third-party service providers, or our licensing obligations.

Where Personal Data is transferred to jurisdictions that may not provide an equivalent level of data protection to that applicable in Malaysia, ibc22 implements appropriate safeguards including contractual data processing agreements that impose obligations on the recipient consistent with the standards described in this Policy.

By using the ibc22 Platform, you consent to the transfer of your Personal Data as described in this Section, subject to the safeguards outlined above.

ibc22 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — such as the introduction of new data processing purposes or the engagement of new categories of third-party processors — ibc22 will notify registered users by email or by displaying a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. You are encouraged to review this Policy periodically to stay informed of how ibc22 handles your Personal Data. Continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy.

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact ibc22's support and data protection team through any of the channels below:

• Support Email: support@ibc22.cam (plain text — not a clickable link)
• Live Chat: Available 24/7 via the chat widget in your Account dashboard — average response 3–5 minutes
• Languages: English, Bahasa Melayu, and Mandarin Chinese

We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 calendar days. Where a request is complex or involves a large volume of data, we will notify you if an extension of the response period is required.

If you are dissatisfied with ibc22's handling of your Personal Data following our internal response, you may have the right to escalate your complaint to the relevant data protection supervisory authority or to the dispute resolution body associated with ibc22's international gaming licence.