ori44 Privacy Policy

1. Data Controller

ori44 is the data controller for the personal data processed in connection with the Platform. As data controller, ori44 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently. All data protection enquiries should be directed to the ori44 compliance team via the contact details set out in Section 14 of this Policy.

2. Data We Collect

ori44 collects the following categories of personal data from or about you:

2.1 Identity Data

• Full legal name (as per MyKad, passport, or equivalent identity document)
• Date of birth
• Gender (where provided voluntarily)
• Photographs or scans of identity documents submitted for KYC verification

2.2 Contact Data

• Email address
• Mobile phone number (where provided)
• Residential address (for KYC and fraud prevention purposes)

2.3 Account & Transaction Data

• Username and hashed password credentials
• Account balance history in Malaysian Ringgit (MYR)
• Deposit and withdrawal records including payment method identifiers
• Betting and gaming history across all Platform products
• Bonus and promotion usage records

2.4 Technical Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser information
• Session timestamps and login event logs
• Cookies and similar tracking technology data (see Section 9)

2.5 Communications Data

• Records of communications between you and ori44 support, including live chat logs and emails
• Survey responses or feedback submitted voluntarily

2.6 Responsible Gaming Data

• Deposit limit settings, self-exclusion elections, and session time limit preferences
• Any self-reported responsible gaming information provided to ori44 support

3. How We Collect Data

ori44 collects personal data through the following means:

• Direct collection — data you provide during Account registration, KYC submission, deposit or withdrawal requests, support interactions, or survey participation.
• Automated collection — data collected automatically when you access the Platform, including through cookies, web beacons, log files, and analytics technologies.
• Third-party sources — data received from payment processors (such as Touch n Go eWallet, Boost, Maybank, CIMB, and Public Bank), identity verification service providers, fraud detection partners, and, where applicable, publicly available sources for KYC and sanctions screening purposes.

4. How We Use Your Data

ori44 processes your personal data for the following purposes:

• Account management — to create, maintain, and administer your ori44 Account, including processing deposits, withdrawals, and bet settlements.
• Identity and age verification — to verify that you meet the 21+ age requirement and to fulfil KYC obligations under ori44's gaming licence.
• Legal and regulatory compliance — to comply with anti-money laundering (AML) obligations, sanctions screening requirements, responsible gaming regulations, and any other applicable legal obligations.
• Fraud and security — to detect, prevent, and investigate fraud, unauthorised account access, money laundering, and other prohibited conduct.
• Platform improvement — to analyse usage patterns and performance data to improve Platform functionality, game selection, and user experience.
• Customer support — to respond to your queries, complaints, and dispute submissions.
• Marketing communications — to send you promotional offers, bonus notifications, and relevant Platform updates, subject to your communication preferences and applicable consent requirements. You may opt out of marketing communications at any time.
• Responsible gaming — to apply deposit limits, self-exclusion measures, and other responsible gaming tools you have requested.

5. Legal Basis for Processing

ori44 processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform our contract with you, including providing Platform access, settling bets, and processing payments.
• Legal obligation — processing necessary to comply with AML laws, gaming licence conditions, KYC regulations, and other applicable legal requirements.
• Legitimate interests — processing for fraud prevention, Platform security, service improvement, and responsible gaming purposes, where such interests are not overridden by your data protection rights.
• Consent — processing for direct marketing communications, where consent is required under applicable law. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

ori44 does not sell your personal data to third parties. We may share your data in the following circumstances:

• Payment processors — sharing necessary transaction data with Touch n Go, Boost, Maybank, CIMB, Public Bank, and other payment service providers to process deposits and withdrawals.
• Identity and KYC verification providers — sharing identity documents and relevant data with third-party KYC and AML screening service providers acting as data processors on our behalf.
• Game and technology providers — sharing session and game data with licensed game studios and platform technology providers necessary for game delivery and fairness certification.
• Regulatory and law enforcement authorities — disclosing data to licensing authorities, law enforcement agencies, or courts where required by law or where ori44 is under a legal obligation to do so.
• Fraud prevention agencies — sharing data with fraud prevention networks and industry bodies where necessary to prevent financial crime.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of ori44's business, personal data may be transferred to the relevant counterparty, subject to equivalent data protection standards.

All third-party data processors engaged by ori44 are contractually required to process personal data only in accordance with ori44's instructions and applicable data protection law.

7. International Data Transfers

ori44 operates internationally, and your personal data may be transferred to and processed in countries outside Malaysia. Where personal data is transferred outside of Malaysia, ori44 takes appropriate safeguards to ensure that the data receives a level of protection consistent with applicable data protection standards. These safeguards may include contractual data protection clauses with the recipient entity or reliance on adequacy determinations where applicable. By using the Platform, you acknowledge and consent to such international transfers in connection with ori44's gaming and payment operations.

8. Data Retention

ori44 retains your personal data for as long as necessary to fulfil the purposes set out in this Policy, subject to the following minimum retention periods:

• Account and transaction data — retained for a minimum of five (5) years from the date of Account closure, in accordance with AML record-keeping obligations.
• KYC documentation — retained for a minimum of five (5) years from the date of verification, or longer where required by applicable law or licensing conditions.
• Support communications — retained for a minimum of two (2) years from the date of the communication.
• Technical and log data — retained for up to twelve (12) months from the date of collection, unless a longer retention period is required for security investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with ori44's data disposal procedures.

9. Cookies & Tracking Technologies

ori44 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies — strictly necessary for Platform functionality, including maintaining your authenticated session and security settings. These cannot be disabled.
• Analytics cookies — used to measure Platform usage and performance, enabling ori44 to improve the Member experience. These are deployed using industry-standard analytics tools.
• Preference cookies — used to remember your language, game display settings, and other platform preferences between sessions.
• Fraud prevention cookies — used to identify and flag potentially fraudulent or suspicious session behaviour.

You may manage non-essential cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. ori44 does not use cookies to serve third-party advertising.

10. Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ori44:

• Right of access — the right to request a copy of the personal data ori44 holds about you.
• Right to rectification — the right to request correction of inaccurate or incomplete personal data.
• Right to erasure — the right to request deletion of your personal data, subject to ori44's legal retention obligations and legitimate interests in maintaining data for fraud prevention and regulatory compliance.
• Right to restriction — the right to request that ori44 restrict the processing of your personal data in certain circumstances.
• Right to data portability — the right to receive personal data you have provided to ori44 in a structured, commonly used, machine-readable format.
• Right to object — the right to object to processing based on ori44's legitimate interests, including direct marketing.
• Right to withdraw consent — where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the ori44 compliance team using the details in Section 14. ori44 will respond to verifiable requests within the timeframe required by applicable law. Identity verification may be required before processing a request.

11. Data Security

ori44 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the ori44 Platform
• Encrypted storage for sensitive personal data including passwords and payment instrument identifiers
• Access controls limiting personal data access to authorised personnel with a legitimate business need
• Real-time login monitoring and anomaly detection to identify potentially compromised accounts
• Regular security assessments and penetration testing of Platform infrastructure

In the event of a personal data breach that poses a risk to your rights and freedoms, ori44 will notify you and the relevant regulatory authority in accordance with applicable breach notification obligations.

12. Children and Minors

The ori44 Platform is strictly intended for persons aged 21 years and above. ori44 does not knowingly collect or process personal data from persons under the age of 21. If ori44 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the associated Account closed immediately. If you have reason to believe that a person under 21 has provided personal data to ori44 through your Account or otherwise, please contact us immediately.

13. Amendments to This Policy

ori44 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or ori44's data processing practices. Material changes will be communicated to registered Members via email or in-Platform notification prior to taking effect. The date of the most recent amendment is shown at the top of this Policy. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept an amended Policy, you may request Account closure in accordance with the ori44 Terms & Conditions.

14. Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or ori44's data processing practices, please contact the ori44 compliance and data protection team. Our support team is available 24 hours a day, 7 days a week via live chat on the Platform. Written data protection enquiries should be submitted by email; our support email address is displayed in the footer of every ori44 page.

ori44 aims to acknowledge all data protection enquiries within five (5) business days and to resolve requests within the timeframe required by applicable law. Where your enquiry relates to a potential data breach or urgent security matter, please mark it as urgent and ori44 will prioritise its review accordingly.