ikaya Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by ikaya (hereinafter "ikaya", "we", "us", or "the Company") and governs the collection, use, storage, disclosure, and protection of personal data in connection with your access to and use of the ikaya online casino and sports betting platform, accessible at https://ikaya.cam (the "Platform").

ikaya is committed to protecting the privacy of every individual who interacts with our Platform. This Policy is intended to give you a clear, complete, and honest account of how we handle your personal data — not just to satisfy regulatory requirements, but because we believe transparency about data practices is a fundamental part of earning and maintaining your trust.

By registering an account on the Platform, or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood the terms of this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must immediately cease using the Platform.

For the purposes of this Policy, the following terms have the meanings given below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, government identification number, payment details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, whether by automated means or otherwise — including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" refers to ikaya as the entity that determines the purposes and means of processing Personal Data.
• "Data Subject" means the individual to whom the Personal Data relates — in most cases, you as the registered user.
• "Third Party" means any natural or legal person other than the Data Subject, ikaya, and ikaya's directly engaged processors acting under ikaya's instructions.
• "KYC" means Know Your Customer — the identity verification process required under our anti-money-laundering and responsible gambling obligations.
• "Cookie" means a small data file placed on your device by the Platform for the purposes described in Section 8 of this Policy.

ikaya collects the following categories of Personal Data from users of the Platform:

We do not intentionally collect any special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) unless this is strictly required by a specific regulatory obligation and only with appropriate safeguards in place.

ikaya collects Personal Data through the following means:

• Direct provision: Information you provide voluntarily when registering an account, completing a KYC verification request, submitting a deposit or withdrawal request, contacting customer support, or participating in any promotion or survey on the Platform.
• Automated technical collection: Technical Data is collected automatically when you access the Platform, through server logs, cookies, web beacons, and similar tracking technologies as described in Section 8.
• Payment service providers: We may receive transaction confirmation data from third-party payment processors including Touch 'n Go, Boost, GrabPay, DuitNow, FPX-participating banks (Maybank, CIMB, Public Bank, Hong Leong Bank, and others), and blockchain networks in the case of USDT TRC20 transactions.
• Third-party verification services: During KYC processing, we may receive identity verification results from third-party identity verification providers contracted by ikaya for this purpose.
• Fraud prevention and AML screening: We may receive risk signals and compliance data from specialist third-party fraud prevention and anti-money-laundering screening services.

ikaya processes your Personal Data for the following clearly defined purposes:

• Account creation and management: To register, verify, and maintain your ikaya account, including managing your account credentials, settings, and responsible gaming preferences.
• Service delivery: To provide you with access to casino games, sports betting markets, live dealer tables, promotional offers, and all other features of the Platform.
• Financial transaction processing: To process deposits and withdrawals via Malaysian payment methods (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, bank transfer, USDT TRC20) and to maintain accurate transaction records.
• Identity and age verification (KYC): To verify that you are who you say you are and that you meet the minimum age requirement of 21 years, as required by our licensing obligations and responsible gaming programme.
• Anti-money-laundering (AML) and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, and any other financial crime in connection with your use of the Platform.
• Regulatory and legal compliance: To comply with applicable licensing conditions, legal obligations, regulatory directives, and lawful requests from competent authorities.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance in connection with your account or any aspect of the Platform.
• Platform security and integrity: To protect the Platform against unauthorised access, cyberattacks, collusion, bot activity, and other threats to platform integrity.
• Responsible gambling monitoring: To monitor gaming activity patterns for indicators of problem gambling and, where appropriate, to intervene with support resources or account controls.
• Service improvement and analytics: To analyse aggregated usage patterns, test new features, and improve the overall performance and user experience of the Platform. Analytics are conducted on anonymised or aggregated data wherever possible.
• Marketing communications (where consented): To send you promotional offers, bonus notifications, and platform updates via email or in-platform messaging, where you have opted in to receive such communications. You may withdraw this consent at any time.

ikaya processes your Personal Data on one or more of the following legal bases, depending on the purpose of processing:

• Performance of a contract: Processing necessary to perform our obligations under the Terms and Conditions you accepted upon registration — including account management, game access, and payment processing.
• Compliance with a legal obligation: Processing required to fulfil our obligations under applicable licensing conditions, AML regulations, KYC requirements, and any lawful instructions from regulatory or law enforcement authorities.
• Legitimate interests: Processing necessary for ikaya's legitimate business interests — including fraud prevention, platform security, service improvement, and responsible gambling monitoring — where those interests are not overridden by your rights and interests.
• Consent: Processing conducted on the basis of your specific, informed, and freely given consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ikaya does not sell, rent, or trade your Personal Data to third parties for their own independent commercial purposes. We may disclose your Personal Data to the following categories of recipient, solely for the purposes described in this Policy:

• Payment service providers: To facilitate deposit and withdrawal transactions — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-participating Malaysian banks, and cryptocurrency network operators. These parties receive only the transaction data necessary to process your payment.
• Identity verification and KYC providers: Third-party services engaged by ikaya to verify your identity, age, and compliance status. These providers are bound by confidentiality obligations and data processing agreements.
• Fraud prevention and AML screening services: Specialist providers that assist ikaya in detecting and preventing financial crime. Sharing is limited to the minimum data necessary for screening purposes.
• Game content providers: Some game providers may receive anonymised or pseudonymised session data necessary to deliver and maintain the games on our Platform. No personally identifiable information is shared with game providers beyond what is strictly required for technical integration.
• IT infrastructure and hosting providers: Cloud hosting and technical infrastructure providers who process data on our behalf under strict data processing agreements and security requirements.
• Regulatory authorities and law enforcement: Where we are legally required or lawfully compelled to disclose Personal Data to licensing regulators, law enforcement agencies, or courts of competent jurisdiction.

ikaya uses cookies and similar tracking technologies to operate the Platform, enhance user experience, maintain session state, and analyse usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be disabled. They are used to maintain your logged-in session, remember your security settings, and ensure the Platform operates correctly. No personal data is shared via these cookies beyond what is required for session management.
• Functional cookies: These cookies remember your preferences (such as language and game settings) to provide a personalised experience. They do not track activity across third-party websites.
• Analytics cookies: We use aggregated, anonymised analytics data to understand how players interact with the Platform and to identify areas for improvement. Analytics data does not identify individual users.
• Fraud prevention and security cookies: Some cookies are used to help detect and prevent fraudulent activity, bot traffic, and account takeover attempts.

You may configure your browser to refuse or delete cookies. However, disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing core features including logging in or placing bets.

ikaya retains your Personal Data for as long as is necessary to fulfil the purposes described in this Policy, including any retention periods required by applicable law, licensing conditions, or anti-money-laundering regulations. In general:

• Active account data is retained for the duration of your account's existence on the Platform.
• Transaction and financial records are retained for a minimum of five (5) years following the date of the transaction, or longer where required by applicable AML or regulatory obligations.
• KYC and identity verification documents are retained for a minimum of five (5) years following account closure, or for such longer period as is mandated by our licensing jurisdiction.
• Customer support communications are retained for a minimum of two (2) years following the close of the relevant support interaction.
• Gaming activity logs are retained for a minimum of three (3) years to support responsible gambling monitoring and dispute resolution.
• Inactive accounts: Where an account has been inactive for 12 consecutive months, ikaya may commence a data minimisation review and may archive or delete non-essential data associated with that account.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be linked to any identifiable individual.

ikaya implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and ikaya's servers.
• Encryption-at-rest for sensitive stored data including payment credentials and identity documents.
• Multi-factor authentication options for all player accounts.
• Role-based access controls ensuring that staff can access Personal Data only to the extent required for their specific job function.
• Regular security audits, penetration testing, and vulnerability assessments of the Platform infrastructure.
• Incident response procedures and breach notification protocols aligned with applicable data protection standards.
• Secure, access-controlled hosting environments with continuous monitoring.

ikaya operates under international licensing and uses infrastructure and third-party service providers located in various jurisdictions. As a result, your Personal Data may be transferred to and processed in countries outside of Malaysia, including within the European Economic Area and other locations where our hosting providers, payment processors, or compliance vendors operate.

Where Personal Data is transferred internationally, ikaya ensures that appropriate safeguards are in place to protect that data — including contractual data processing agreements that impose equivalent data protection obligations on the recipient. We do not transfer your Personal Data to any jurisdiction in a manner that would leave it without adequate protection.

As a Data Subject, you hold the following rights in relation to your Personal Data processed by ikaya. To exercise any of these rights, please contact us using the details in Section 15.

The ikaya Platform is intended exclusively for individuals who are at least 21 years of age. ikaya does not knowingly collect, process, or store Personal Data relating to individuals under the age of 21.

If ikaya becomes aware that Personal Data relating to an individual under 21 has been collected — whether through a fraudulent registration, inaccurate age declaration, or any other means — we will immediately suspend the relevant account, delete the associated data to the extent not required for legal compliance, and return any real-money deposits made.

If you believe that Personal Data relating to a minor may have been submitted to the Platform, please contact us immediately using the details in Section 15.

ikaya reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Platform functionality, or our data processing practices.

Material changes to this Policy will be communicated to registered Users via the email address associated with their account and/or by means of a prominent notice on the Platform, prior to the change taking effect. The "Last Updated" date at the top of this page will reflect the date on which the most recent version took effect.

Your continued use of the Platform following notification of a material change constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to remain informed about how we protect your Personal Data.

If you have any questions, concerns, or requests relating to this Privacy Policy or your Personal Data, please contact ikaya using the following channels:

• Live Chat: Available 24/7 directly through the Platform. This is the fastest channel for data subject requests and privacy enquiries.
• Email: [email protected] — please include "Privacy" or "Data Request" in your subject line so that your message is directed to the appropriate team. Responses within 1 hour for live chat; up to 24 hours for email during peak periods.

For formal data subject access requests, erasure requests, or rectification requests, we ask that you submit your request in writing via email for record-keeping purposes. You will be asked to verify your identity before your request is actioned, to ensure that your data is disclosed or modified only at the instruction of the correct individual.