Privacy Policy — 1irm

This Privacy Policy ("Policy") is issued by 1irm ("Company", "we", "us", "our"), the operator of the online betting and gaming platform accessible at https://1irm.cam (the "Platform"). This Policy describes how 1irm collects, processes, stores, uses, and protects personal data relating to individuals who access or use the Platform ("Users", "you", "your"), in accordance with applicable data protection legislation including, but not limited to, the Personal Data Protection Act 2010 of Malaysia (PDPA 2010) and internationally recognised data protection principles.

By registering an account, accessing the Platform, or otherwise providing your personal data to 1irm, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your data as described herein. If you do not agree with any aspect of this Policy, you should immediately cease use of the Platform and contact our support team to request account closure.

This Policy applies to all personal data collected through the Platform — whether via web browser, mobile device, email correspondence, customer support interactions, or any other channel through which you communicate with 1irm. It does not govern the data practices of third-party websites that may be referenced on the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information that identifies, or could reasonably be used to identify, a living individual, either alone or in combination with other data.
• "Processing" — Any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — 1irm, being the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — Any third-party entity that processes personal data on behalf of 1irm, pursuant to a written data processing agreement.
• "Data Subject" — The natural person to whom the personal data relates — i.e., you, the User.
• "Consent" — A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Data" — Personal data relating to physical or mental health, financial account details, identity document numbers, or other categories that warrant heightened protection under applicable law.
• "Cookies" — Small text files stored on your device by your web browser when you access the Platform, used to retain session information and enhance functionality.

1irm collects personal data across several categories depending on how you interact with the Platform. The categories and specific data points collected are set out in the table below:

We collect only the minimum data necessary for each specified purpose and do not retain data beyond the periods set out in Section 8 of this Policy.

1irm collects personal data through the following methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated technical collection: Data automatically generated when you access and use the Platform, including server logs, session data, cookie identifiers, and device fingerprinting information.
• Payment providers: Transaction confirmation data and payment status updates received from Malaysian payment providers such as DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, and GrabPay, as well as cryptocurrency network confirmations for BTC, ETH, USDT, and LTC transactions.
• Third-party identity verification services: Identity verification providers used to assist with KYC compliance may return verification outcomes and risk scoring data to 1irm.
• Fraud detection and risk monitoring tools: Automated systems that analyse usage patterns and transaction behaviour to detect suspicious activity or potential policy violations.

1irm processes personal data only where a valid lawful basis exists under applicable data protection law. The primary bases upon which we rely are as follows:

• Contractual necessity: Processing required to create and manage your Account, process deposits and withdrawals, settle bets, and fulfil our contractual obligations to you under the Terms and Conditions.
• Legal obligation: Processing necessary to comply with anti-money laundering (AML) obligations, KYC regulatory requirements, tax reporting duties, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and the improvement of our services — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing of personal data for direct marketing communications, non-essential cookies, and any purposes not covered by the above bases — where you have provided a freely given, informed, and specific consent that you may withdraw at any time.

1irm processes your personal data for the following clearly defined purposes:

• Account creation and management: To register your Account, authenticate your identity at login, maintain your Account preferences and settings, and communicate service updates.
• Payment processing: To process MYR deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and major Malaysian bank transfers, as well as cryptocurrency transactions, and to process withdrawal requests to your verified payment method.
• KYC and regulatory compliance: To verify your identity and age (minimum 21 years), fulfil anti-money laundering obligations, and comply with applicable gaming and financial regulations.
• Betting and gaming services: To accept and settle bets, operate live casino tables, credit game winnings, manage bonus claims and wagering requirements, and administer loyalty programme rewards.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, bonus abuse, collusion, and other policy violations.
• Responsible gambling monitoring: To monitor betting patterns and account activity for signs of problem gambling behaviour, and to facilitate self-exclusion requests, deposit limits, loss limits, and session time controls where requested.
• Customer support: To respond to your enquiries, resolve complaints, and document support interactions for quality assurance and training purposes.
• Platform improvement: To analyse usage data and technical performance metrics to improve the functionality, reliability, and user experience of the Platform.
• Marketing communications: Where you have provided valid consent, to send you promotional offers, bonus notifications, and relevant product updates via email. You may opt out at any time.

1irm does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data with carefully selected third parties only where necessary and only on the following bases:

• Payment service providers: Malaysian payment processors (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay) and cryptocurrency networks receive the minimum data necessary to process your transactions.
• Identity verification partners: KYC service providers receive identity document data solely for the purpose of conducting age and identity checks on 1irm's behalf, under strict data processing agreements.
• Game studio and platform providers: Licensed third-party game studios integrated into the Platform may receive pseudonymous session identifiers and game result data as required to operate their games. No personally identifiable information is shared beyond what is technically necessary.
• Fraud prevention and security services: Anti-fraud analytics providers may receive technical data (IP addresses, device identifiers, behavioural patterns) to assist in detecting and preventing fraudulent activity on the Platform.
• Regulatory and law enforcement authorities: 1irm will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by law, court order, or official regulatory request. We will notify affected Users of such disclosures where legally permitted to do so.
• Professional advisors: Legal counsel, auditors, and compliance consultants who are bound by professional duties of confidentiality may access personal data on a need-to-know basis in connection with their professional services to 1irm.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of 1irm's business, personal data may be transferred to the acquiring entity, subject to the same privacy protections as set out in this Policy.

1irm retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable law, whichever is the longer period. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures. Data that has been fully anonymised (such that you can no longer be identified from it) may be retained for statistical and analytical purposes indefinitely.

1irm implements a comprehensive set of technical and organisational security measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS / SSL encryption: All data transmitted between your device and the 1irm Platform is encrypted using Transport Layer Security (TLS) with 256-bit encryption — the same standard employed by major financial institutions and Malaysian banks.
• Password hashing: Account passwords are never stored in plaintext. We use industry-standard cryptographic hashing algorithms with salting to protect password data at rest.
• Access controls: Personal data is accessible only to 1irm employees and authorised processors who require access to perform their specific job functions. Role-based access control and the principle of least privilege are enforced.
• Infrastructure security: Platform servers and databases are hosted in secured data centre environments with physical access controls, intrusion detection systems, and regular third-party security audits.
• Vulnerability management: Regular penetration testing, vulnerability assessments, and security patch management are conducted to identify and remediate potential risks.
• Incident response: 1irm maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected Users without undue delay in accordance with applicable legal requirements.

1irm uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse how Users interact with the Platform. The categories of cookies used are:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These cookies enable secure login sessions, maintain your account state during an active session, and support core security features. They cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and last-visited sections of the Platform. These improve your browsing experience but are not strictly required for the Platform to operate.
• Analytics Cookies: Used to collect aggregate, anonymised data about how Users navigate the Platform — such as pages visited, session duration, and error encounters. This data is used solely to improve Platform performance and User experience. No personally identifiable information is shared with analytics providers.
• Fraud Prevention Cookies: Used by our security and fraud detection systems to identify abnormal session behaviour, bot activity, and potential account compromise attempts.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent you from accessing certain features of the Platform. Your cookie preferences can also be updated by contacting our support team.

Some of the third-party service providers engaged by 1irm may be located outside of Malaysia. Where your personal data is transferred to processors in jurisdictions outside Malaysia, 1irm ensures that adequate safeguards are in place to protect the data in transit and at the destination, including:

• Executing standard contractual clauses or data processing agreements that impose equivalent data protection standards on the receiving party.
• Transferring data only to jurisdictions that the applicable regulatory authority has determined to provide an adequate level of protection for personal data.
• Applying encryption and pseudonymisation to data before transfer where technically feasible to reduce risk in the event of interception.

By using the Platform, you consent to the transfer of your personal data to third-party processors outside Malaysia where necessary for the provision of our services, subject to the safeguards described above.

As a data subject, you hold a number of rights in respect of your personal data processed by 1irm. These rights are set out below. To exercise any of these rights, please contact us using the details in Section 15. We will respond to all valid requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it.

The 1irm Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21. The collection of data from minors is contrary to our Terms and Conditions and applicable law.

If 1irm becomes aware that personal data has been collected from an individual under the age of 21, we will immediately:

• Suspend the associated Account pending investigation.
• Purge all personal data relating to that individual from our systems as expeditiously as possible.
• Refund any deposits made (excluding any bonus-derived funds) to the payment method of origin.
• Report the matter to the appropriate regulatory authority where required by law.

If you are a parent or guardian and believe that your child has registered an Account on 1irm, please contact us immediately at the address provided in Section 15 so that we can take appropriate action without delay.

1irm reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data we collect, the third parties with whom we share it, or the legal basis for processing — we will notify registered Users by email and by posting a prominent notice on the Platform prior to the amendment taking effect.

Minor amendments (such as typographical corrections or clarifications that do not affect the substance of our data processing activities) may be made without prior notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must cease using the Platform and request account closure. Previous versions of this Policy are archived and available upon written request.

If you have any questions, concerns, or requests in relation to this Privacy Policy or 1irm's data processing practices, please contact our Data Privacy team through the following channels:

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. For users in Malaysia, the relevant body is the Personal Data Protection Commissioner under the jurisdiction of the Ministry of Digital.