1irm Privacy Policy – Your Personal Data Protection

When you interact with the 1irm, we may collect several categories of personal data. Below is a detailed explanation of the types of data we collect and the reasons for doing so:

We do not collect data considered sensitive — such as health information, religious beliefs, political views, or biometric data — unless it is specifically required for identity verification purposes permitted by law.

1irm collecting your personal data through several different channels. It's important that you understand each of these channels so you are fully aware of your digital footprint on our platform:

• Account Registration: When you register a new account at 1irm, you voluntarily provide basic information such as your name, email, phone number, and date of birth.
• KYC (Identity Verification) Process: To meet legal compliance requirements, we may request a copy of your MyKad or other supporting documents during the verification process.
• Financial Transactions: Every time you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, your transaction details are automatically recorded.
• Gaming Activity: Data related to the games you play, bets placed, and wins or losses is collected automatically as you use the platform.
• Support Communications: When you contact our customer support team via live chat or email, the conversation is recorded for quality control purposes and future reference.
• Cookies and Tracking Technologies: Our platform uses cookies to enhance user experience, analyse usage patterns, and maintain the security of your login session. Further details on cookies are outlined in Section 6.

The personal data we collect is used responsibly for specific and legitimate purposes. 1irm will not use your data beyond the scope stated below without first obtaining your additional consent:

• Account Management: Creating and maintaining your account, processing login requests, updating profile information, and handling password reset requests.
• Transaction Processing: Verifying and processing all deposits and withdrawals through approved Malaysian payment channels, including FPX, DuitNow, and digital wallets.
• Legal Compliance: To fulfil reporting obligations and identity verification requirements under applicable anti-money laundering (AML) and counter-terrorism financing (CFT) laws.
• Fraud Prevention: Detecting and investigating any suspicious activity, duplicate accounts, or attempted misuse of the platform.
• Service Improvement: Analysing aggregated usage patterns (not individual behaviour) to improve platform design, game performance, and the overall user experience.
• Service Communications: Sending transaction notifications, account security alerts, and important policy updates via email or SMS.
• Customer Support: Helping you resolve any technical issues, account enquiries, or transaction disputes more efficiently.

If 1irm intends to use your data for other purposes — such as marketing communications or new loyalty programmes — you will be informed and given the option to consent or opt out, with no negative impact on your account.

1irm understands that your trust depends on how we handle data sharing. We do not share your personal data for commercial gain. However, there are limited situations where sharing is necessary:

• Payment Provider: Minimal transaction information necessary to be shared with providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, and FPX banks to process your deposits and withdrawals.
• Identity Verification Provider: KYC information may be shared with recognised third-party verification services to authenticate your documents.
• Game Providers: Usernames and game session data are shared with gaming software providers to enable games to function properly.
• Legal Authorities: We may be required to disclose your data to Malaysian authorities such as Bank Negara Malaysia or law enforcement agencies when mandated by a court order or other lawful request.

All third parties we work with are required to meet data protection standards equal to or higher than our own privacy policy. A formal Data Protection Agreement (DPA) is signed with each partner before any data sharing takes place.

Protecting your personal data from unauthorised access, use, or disclosure is our highest priority 1irm. We continually invest in our security infrastructure to ensure your data remains protected at all times:

• SSL/TLS Encryption: All communications between your browser and our servers 1irm is protected with 256-bit encryption, meaning all transmitted data remains unreadable to unauthorised parties.
• Database Encryption: Sensitive data such as financial information and identity documents are stored in encrypted format in our database.
• Internal Access Controls: Only staff with a legitimate business need are permitted to access members' personal data. All access is logged and monitored on a regular basis.
• Two-Factor Authentication (2FA): We encourage all members to enable 2FA for an added layer of protection on their accounts.
• Regular Security Audits: Platform 1irm undergoes regular penetration testing and security audits conducted by independent third parties.
• Incident Response Plan: In the event of a data breach, we have detailed response procedures to notify affected members and the relevant authorities within the required timeframe.

While we take all reasonable steps to protect your data, no system is completely secure. You also play an important role in keeping your account safe by using a strong password and never sharing your login credentials with anyone.

Platform 1irm uses cookies and similar tracking technologies to enhance your experience. Here is an overview of the types of cookies we use:

• Essential Cookies: Required for core platform functions such as maintaining your login session and ensuring transactions run securely. These cookies cannot be disabled.
• Performance Cookies: Helps us understand how users interact with the platform – which pages are visited most, time spent on site, and any technical issues encountered. This data is collected in aggregate and anonymised form.
• Functional Cookies: Remembering your preferences such as language, time zone, and display settings so you do not have to update them each time you log in.
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser. They are used to maintain session security while you are active on the platform.

You can manage or delete cookies through your browser settings at any time. However, disabling certain cookies may affect platform functionality and cause some features to not work properly.

1irm does not store your personal data indefinitely. We have a clear retention policy based on operational needs and legal obligations:

• Active Account Data: For as long as your account remains active, we retain all relevant information to ensure uninterrupted service.
• After Account Closure: Basic personal data is retained for 7 years following account closure to comply with AML regulations and accounting requirements.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysian laws governing financial and tax records.
• Support Communication Logs: Customer support chat records are retained for 2 years for quality control purposes and future reference in the event of a dispute.
• Cookie Data: Session cookies are deleted when the browser is closed. Persistent cookies expire between 30 days and 12 months, depending on the cookie type.

Once the retention period expires, data will be securely deleted or anonymised so it can no longer be linked to any individual. The deletion process follows procedures that comply with international information security standards.

As a member of 1irm and individuals protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data:

To exercise any of the above rights, please contact our Data Protection Officer team via email privacy@1irm.net stating the nature of your request. We will process your request within 14 working days and provide a written response.

Please note that in certain situations, we may not be able to fully fulfil your request if it conflicts with legal obligations binding on us, such as AML record-keeping requirements.

Platform 1irm is exclusively for individuals aged 18 years and above. We do not knowingly collect, store, or process any personal data from individuals under the age of 18.

Should we discover that we have inadvertently collected data from someone under the age of 18, we will take immediate steps to:

• Delete all data relating to that individual from our systems.
• Immediately closing the account in question.
• Returns any remaining balance in accordance with the relevant procedures.

1irm reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Our amendment notification procedure is as follows:

• Significant changes will be communicated to all members via in-platform notifications and their registered email address at least 14 days before the changes take effect.
• The "Last Updated" date at the top of this page will be updated whenever any changes are made.
• Previous versions of the Privacy Policy are archived and available upon request by contacting our team.
• Continued use of the platform 1irm after the amendment's effective date constitutes your acceptance of the updated terms.

We encourage you to review this page periodically. If you disagree with any changes, you have the right to close your account before they take effect and request a withdrawal of your remaining balance.

If you have any questions, concerns, or complaints regarding how 1irm handles your personal data, you may reach us through the following channels:

• Privacy Email: privacy@1irm.net – specifically for enquiries related to our privacy policy and data protection rights.
• General Support: support@1irm.net – for general account and platform enquiries.
• Live Chat: Available 24/7 directly within the platform 1irm for a prompt response.

For more information about your rights under Malaysia's Personal Data Protection Act 2010, you may refer to the official website of the Department of Personal Data Protection Malaysia. Any complaints that cannot be resolved through us may be submitted to the relevant authority.