Privacy Policy

This Privacy Policy ("Policy") explains how Umibet ("the Platform", "we", "us", "our"), the operator of umibet.cam, collects, processes, stores, and protects personal data relating to individuals ("you", "the User", "the Player") who interact with our website, mobile interface, and associated services.

Umibet is an online sports betting and live casino platform built specifically for the Malaysian market. As part of our operations, we process personal data to enable account management, facilitate deposits and withdrawals via Malaysian payment methods such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay, conduct identity verification (KYC), and comply with our legal obligations under applicable anti-money laundering (AML) and responsible gambling frameworks.

We take your privacy seriously. We collect only what we genuinely need, we do not sell your personal data to third parties for marketing purposes, and we apply technical and organisational safeguards consistent with industry standards for financial services and online gaming platforms.

By registering on or using the Umibet platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing activities described herein, to the extent that such consent is the applicable legal basis. Where we rely on a different legal basis for processing, this is identified in Section 5.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that directly or indirectly identifies a living natural person, including name, identification number, contact details, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, transfer, or deletion.
• "Data Controller" — Umibet, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of Umibet under a contractual arrangement and subject to Umibet's instructions, such as payment gateway providers and cloud hosting services.
• "KYC" — Know Your Customer; the identity and address verification procedure required to activate full account functionality, particularly withdrawal access.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement by which a User signifies their acceptance of particular data processing activities.
• "Sensitive Personal Data" — a special category of personal data that warrants heightened protection, including data revealing racial or ethnic origin, health status, or biometric data used for identification purposes.
• "Data Breach" — a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Umibet collects personal data through multiple channels, including the registration process, ongoing account usage, payment transactions, identity verification, and technical interactions with our platform. The categories of data we collect are as follows:

3.1 Registration and Account Data

• Full legal name as it appears on a government-issued identity document
• Date of birth (to verify the 21+ age requirement)
• Email address
• Malaysian mobile phone number
• Username and encrypted password
• Residential address
• Preferred currency (MYR)

3.2 Identity Verification (KYC) Data

• Copy of valid government-issued identity document (MyKad, Passport, or Driver's Licence)
• Proof of address document (utility bill, bank statement, or official correspondence)
• Selfie photograph holding the identity document
• Additional documentation requested on a risk-assessed basis

3.3 Financial and Transaction Data

• Bank account or e-wallet account details used for deposits and withdrawals (FPX, DuitNow proxy identifiers, Touch 'n Go eWallet number, Boost, GrabPay account reference)
• Transaction history: deposit amounts, withdrawal amounts, bet history, game history
• Cryptocurrency wallet addresses where applicable
• Transaction timestamps and reference numbers

3.4 Technical and Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session duration, pages visited, and navigation behaviour on the Platform
• Cookie identifiers and similar tracking technologies (see Section 8)

3.5 Communications Data

• Content of live chat interactions with our support team
• Email correspondence submitted to our support address
• Feedback, complaint records, and dispute documentation

Umibet processes your personal data for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed below without first seeking your consent or identifying a separate legal basis.

Umibet processes personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you as a registered Player — including account management, payment processing, and game access. Without this processing, we cannot operate your account.
• Legal Obligation: Certain processing is required to comply with applicable laws, including KYC identity verification under AML regulations, transaction record-keeping requirements, and responses to lawful law enforcement or regulatory requests.
• Legitimate Interests: We process certain technical and device data to protect the security of the platform, prevent fraud, and detect prohibited conduct. We have assessed that our legitimate interest in protecting the platform and its users is not overridden by your fundamental rights and freedoms in relation to this specific processing.
• Consent: Where we process data for optional purposes — such as sending you promotional communications about umibet bonuses or new game launches — we rely on your explicit consent. You may withdraw this consent at any time by contacting our support team or updating your notification preferences in Account Settings.

Umibet does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only where it is necessary to operate the platform, comply with our legal obligations, or protect the rights and safety of our users.

The categories of third parties with whom we may share your personal data are as follows:

• Payment Service Providers: We share necessary transaction data with Malaysian payment gateway operators including FPX (via PayNet), DuitNow processors, and e-wallet providers (Touch 'n Go, Boost, GrabPay) solely to facilitate your deposit and withdrawal requests.
• KYC Verification Partners: We may engage licensed identity verification services to assist in processing KYC documentation. These partners act as data processors under contractual data processing agreements and are prohibited from using your data for any purpose beyond the verification service.
• Cloud Infrastructure Providers: Our platform data is hosted on secure cloud infrastructure. Hosting providers process data on our behalf subject to strict data processing agreements.
• Game Content Providers: Licensed game studios integrated into the platform may receive session data such as your Player ID, wager amounts, and game outcomes for game operation and fairness auditing purposes. These providers are prohibited from independently identifying you from this data.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by a lawful order, subpoena, or regulatory direction, or where we have a good-faith belief that disclosure is necessary to protect the legal rights of Umibet or to prevent harm.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of Umibet's assets, personal data held by Umibet may be transferred to the acquiring entity. We will notify registered users of any such transfer via email prior to its completion.

Given the nature of our platform and the payment infrastructure relied upon by Malaysian players, this section provides specific clarification regarding how payment-related personal data is handled within the Umibet ecosystem.

FPX Transactions

When you initiate a deposit via FPX, you are redirected to your bank's own secure internet banking interface (e.g., Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect). Umibet does not collect, view, or store your internet banking login credentials. We receive only a transaction confirmation reference and payment status from the FPX gateway upon completion.

DuitNow Transfers

DuitNow transactions are processed through the PayNet infrastructure. We collect and store your registered DuitNow proxy identifier (typically your mobile number or NRIC) for the purpose of directing withdrawals to the correct account. This data is treated as financial account data and protected accordingly.

e-Wallet Transactions

For deposits and withdrawals via Touch 'n Go eWallet, Boost, and GrabPay, we collect your registered e-wallet mobile number or account reference solely for transaction routing purposes. We do not store your e-wallet PIN or login credentials.

Cryptocurrency Transactions

Deposits and withdrawals in Bitcoin (BTC), Tether (USDT), and Ethereum (ETH) are processed to and from wallet addresses provided by you. Blockchain transactions are by nature pseudonymous and publicly visible. We store wallet addresses in association with your account for transaction matching and AML compliance purposes.

Umibet uses cookies and similar tracking technologies to operate core platform functionality, maintain your session state, and — where you have consented — to analyse usage patterns for platform improvement purposes. We do not deploy third-party advertising cookies or cross-site behavioural tracking cookies.

The categories of cookies used on umibet.cam are as follows:

You may manage optional cookie preferences through your browser settings. Disabling functional or analytics cookies will not prevent you from using the platform but may affect certain personalisation features. Disabling strictly necessary cookies will impair platform functionality and may prevent login.

Umibet retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes or enforce our Terms and Conditions. Specific retention periods are as follows:

• Active Account Data: Retained for the duration of your account's active status and for a period of no less than five (5) years following permanent account closure, in accordance with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years following the completion of the KYC process or the closure of the account, whichever is later, in line with standard AML regulatory requirements.
• Transaction Records: Retained for a minimum of five (5) years following each transaction, in accordance with applicable financial record-keeping standards.
• Customer Support Communications: Retained for up to three (3) years from the date of the last communication, to facilitate dispute resolution.
• Technical and Log Data: Retained for up to twelve (12) months from the date of collection for security monitoring and platform optimisation purposes, after which it is deleted or anonymised.
• Marketing Consent Records: Retained for the duration of the consent period and for up to three (3) years following withdrawal of consent, as evidence of prior consent status.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be attributed to you as an individual. Where anonymisation rather than deletion is applied, the resulting data may be retained indefinitely for aggregate statistical purposes.

Umibet implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. These measures are reviewed and updated on a regular basis and are consistent with the security standards applied in financial services and online gaming environments.

Technical Safeguards

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers
• Encrypted storage for sensitive personal data fields, including identity document copies and financial account references
• Two-factor authentication (2FA) available to all registered accounts
• Strict access controls ensuring that internal staff can only access personal data on a role-based, need-to-know basis
• Automated intrusion detection systems and real-time security monitoring
• Regular penetration testing and vulnerability assessments conducted by qualified security professionals

Organisational Safeguards

• Data protection training required for all staff with access to personal data
• Contractual data processing agreements with all third-party data processors
• Documented incident response procedures, including a Data Breach Notification Protocol

As an individual whose personal data is processed by Umibet, you hold a number of rights in relation to that data. These rights are subject to applicable legal exceptions, particularly where they conflict with our legal obligations under AML, anti-fraud, or regulatory compliance frameworks.

To exercise any of these rights, please contact our support team via live chat or email at [email protected]. We will acknowledge your request within 5 business days and provide a substantive response within 30 days. Complex or high-volume requests may take up to 60 days, and we will notify you if an extension is required.

Please note that certain rights — particularly the right to erasure — may be limited where we are required to retain data under AML legislation or where the data is needed to resolve an open dispute or legal claim.

The Umibet platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals below the minimum age requirement. Our registration process includes a date-of-birth field and our KYC verification procedures include mandatory age confirmation via government-issued identity documents.

If we become aware that personal data has been collected from an individual who has misrepresented their age and is below the age of 21, we will:

• Immediately suspend the account and freeze any pending transactions
• Delete or anonymise the personal data collected from the underage individual to the extent permissible under applicable law
• Return any deposited real-money balance to the original payment method after completing the required AML review
• Void any bonus winnings or game outcomes associated with the underage account

Umibet's primary platform infrastructure is operated to serve Malaysian users. In certain circumstances, personal data may be transferred to or processed by entities located in jurisdictions outside Malaysia — for example, where our cloud hosting provider operates data centres in multiple geographic regions, or where our KYC verification partner processes data in their operating jurisdiction.

Where personal data is transferred outside Malaysia, Umibet ensures that appropriate safeguards are in place to protect the data, including:

• Contractual data protection clauses (standard contractual clauses or equivalent contractual commitments) incorporated into agreements with all international data processors
• Assessment of the adequacy of data protection standards in the destination jurisdiction prior to authorising any transfer
• Encryption of all data in transit and at rest, regardless of geographic location

By using the Umibet platform, you acknowledge that your personal data may be transferred internationally as described above, subject to the safeguards outlined in this section.

Umibet reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or regulatory guidance. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect how we collect or use your personal data or affect your rights — we will notify registered users via email to their registered address or via a prominent in-platform notification at least seven (7) days prior to the changes taking effect.

Minor updates that do not alter the substantive meaning of any clause — such as typographical corrections or formatting improvements — may be made without prior notice. We encourage you to review this Policy periodically to remain informed of how we manage your personal data.

Your continued use of the Umibet platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with the amendments, you may close your account and request a withdrawal of your available balance prior to the effective date.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or to Umibet's personal data processing practices, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform. Type "Privacy Request" at the start of your message to be directed to the relevant team.
• Email: [email protected] — please include "Privacy Policy Enquiry" in the subject line for prompt routing.

We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days. Complex requests involving data access, portability, or erasure may require additional time; we will notify you of any extension within the initial 30-day period.

If you believe that your personal data has been handled in a manner that is inconsistent with this Policy or applicable data protection law, and you are not satisfied with our response to your complaint, you have the right to raise a complaint with the relevant supervisory authority or data protection regulator in your jurisdiction.