Privacy Policy Phtaya – Personal Data Protection for Malaysian Players

§1Introduction & Scope of Phtaya's Privacy Policy

Phtaya ("we", "platform", or "Phtaya") is committed to protecting and respecting the privacy of every individual who uses our platform. This Privacy Policy outlines our practices regarding the collection, use, storage, and protection of personal data belonging to players who access the Phtaya website and services.

This document is prepared in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010, which governs how organisations handle personal data in Malaysia. By registering for or using any part of the Phtaya platform, you agree to be bound by the terms of this Privacy Policy.

§2Personal Data We Collect

Phtaya collects various categories of personal data based on your interactions with our platform. The table below describes the types of data, the purposes for collection and their legal basis:

2.1 Data We Do Not Collect

Phtaya does not collect information beyond what is necessary to operate the platform. We do not store PINs, plaintext passwords, or credit/debit card details directly — all financial transactions are processed through registered, secure third-party payment gateways.

§3How Phtaya Uses Your Data

We use the personal data collected for the following purposes, all of which are lawful under Malaysia's PDPA 2010:

• Account Management – registering, verifying, and managing your Phtaya account, including identity verification (KYC) required for compliance with anti-money laundering (AML) laws.
• Transaction Processing – processing deposits via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay and FPX, as well as cash withdrawals to your registered payment method.
• Platform Security – detecting and preventing fraud, unauthorised access, bonus abuse, and other unlawful activities that may harm other players or the integrity of the platform.
• Customer Support – assisting you with enquiries, complaints and disputes submitted via live chat, email or other communication channels.
• Service Improvement – analysing usage patterns (in aggregate and anonymised form) to improve the user experience, introduce new games, and refine the platform interface.
• Marketing Communications – sending you relevant information about Phtaya promotions, bonuses and offers. You may opt out at any time.
• Legal Compliance – fulfilling applicable Malaysian legal and regulatory obligations, including lawful requests from competent authorities.

§4Data Sharing & Disclosure

Phtaya does not sell, rent, or trade your personal data to third parties. However, we may share data in limited circumstances as follows:

• Trusted Service Providers – payment processors (to facilitate transactions via Touch 'n Go, GrabPay, DuitNow, and others), identity verification service providers, and cloud service providers that support platform operations. All such providers are bound by strict confidentiality agreements.
• Legal Requirements – when required by Malaysian law, court order, or relevant authorities (such as Bank Negara Malaysia or the Royal Malaysia Police in the course of a lawful investigation).
• Business Transfer – in the context of a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction, subject to ongoing privacy notice and commitments.

§5Data Security at Phtaya

Phtaya continually invests in cybersecurity to protect your personal data. The technical and organisational security measures we maintain include:

• Data encrypted in transit using TLS 1.3 protocol with 256-bit SSL certificates
• Data encrypted at rest on servers and databases
• Intrusion detection and prevention systems (IDS/IPS) operating 24/7
• Two-factor authentication (2FA) is available for all member accounts
• Role-based access control — only authorised staff may access player data
• Continuous security monitoring and rapid incident response
• Periodic penetration testing conducted by independent security experts
• Mandatory cybersecurity training for all Phtaya staff

While we take all reasonable precautions, no system can be guaranteed 100% secure. We encourage you to play your part in protecting your account by using a strong, unique password and never sharing your login credentials with anyone.

§6Cookies & Tracking Technologies

6.1 Types of Cookies Used

The Phtaya platform uses several types of cookies to enhance your experience:

• Essential Cookies – required for core platform functions such as login session management and security. These cookies cannot be disabled without affecting platform functionality.
• Preference Cookies – saves your preferences such as language, display settings, and game preferences for a better experience on your next visit.
• Analytics Cookies – collects information on how players use the platform (pages visited, session duration) to help us improve Phtaya. This data is aggregated and cannot be used to identify any individual.

6.2 Cookie Controls

You can manage and delete cookies through your web browser settings. Please note, however, that disabling essential cookies may affect the functionality of the Phtaya platform, including your ability to remain logged in.

§7Data Retention Period

Phtaya retains your personal data for as long as necessary to fulfil the purposes outlined in this policy, subject to any legal retention requirements that may require a longer period:

• Active Account Data – retained for the duration of your active account and used to deliver ongoing services.
• Financial Transaction Data – retained for a minimum of 7 years in accordance with Malaysian legal requirements (Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001).
• KYC Data (Identity Verification) – retained for 5 years after account closure.
• Communication Records – retained for 2 years for dispute resolution purposes.
• Technical Data (Logs) – retained for 12 months for security and investigation purposes.

When data is no longer needed, Phtaya will securely delete or anonymise it using methods that ensure it cannot be recovered.

§8Your Rights Under Malaysia's PDPA 2010

Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding your personal data held by Phtaya:

• Right of Access – you have the right to request a copy of the personal data we hold about you. We will fulfil such requests within 21 days.
• Right to Rectification – you have the right to request correction of any inaccurate or incomplete personal data.
• Right to Withdraw Consent – you may withdraw your consent for us to process your data at any time, subject to our ongoing legal obligations.
• Right to Erasure – under certain circumstances, you may request the deletion of your personal data.
• Right to Object to Direct Marketing – you may opt out of Phtaya marketing communications at any time.

§9Child Protection

The Phtaya platform is for individuals aged 21 and above only. We do not knowingly collect or process personal data of individuals under the age of 21. If you believe someone under 21 has registered an account on Phtaya, please contact us immediately so we can take appropriate action, including closing the account and deleting the associated data.

§10Contact Phtaya's Privacy Officer

For any enquiries, concerns, or requests regarding this Privacy Policy or the management of your personal data at Phtaya, please contact us via:

• Privacy Email: support@phtaya-bangla.com (please include "Privacy Enquiry" in the email subject line)
• Live Chat: Available 24/7 on the Phtaya platform — select the "Privacy & Data" category
• Response Time: We are committed to responding to all privacy enquiries within 48 business hours

Phtaya reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or technological developments. You will be notified of material changes via a notice on the platform or by email.