Privacy Policy ArenaPlus – Malaysia Member Personal Data Protection

ArenaPlus ("we", "platform") respects the privacy of all users and members who use our services. This Privacy Policy explains in detail how ArenaPlus collect, store, use, protect and disclose your personal data when you register, access or use any part of our platform — including the website, games, Sports Betting, and all other features offered.

We developed this Privacy Policy in accordance with the requirements of the Personal Data Protection Act 2010 (PDPA) Malaysia and international best-practice data protection standards. The seven core principles of the PDPA — the General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle, and Access Principle — serve as the primary guide for all our data handling practices.

Privacy is more than just a word in a document for ArenaPlus. It is a principle we uphold in every technical and operational decision involving user data — from the way we design our databases and select technical service providers, to how we train our support team. Every aspect of our operations is guided by our commitment to protecting your personal information.

This document applies to all individuals who interact with the ArenaPlus, whether as a visitor, registered member, or VIP member. If you are using the platform on behalf of an organisation, you confirm that you have the authority to accept this Privacy Policy on that organisation's behalf.

ArenaPlus only collects data that is strictly necessary to provide our services and maintain platform security. The following are the categories of data we collect:

Identity & Registration Data:

• Full name as stated in your official identification document
• Malaysian identity card number (MyKad) — collected during the KYC process
• Date of birth (for minimum age verification of 18 years)
• Gender
• An active email address
• Malaysian mobile phone number
• Password (stored in hashed form — unreadable by anyone, including arenaplus staff)

Financial & Transaction Data:

• Records of all deposits and withdrawals, including amounts, dates, and payment methods (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX)
• Bank account or e-wallet details used for transactions (account numbers partially masked)
• Complete transaction history within your account
• Payment processing data required for AML (Anti-Money Laundering) compliance

Gaming Activity Data:

• Betting and gaming history across all sections — Live Casino, slots, sports, badminton, poker
• Accumulated VIP points and VIP tier history
• Bonuses and promotions received and used
• Self-set deposit limits and game limits

Technical & Usage Data:

• IP address and network information when accessing the platform
• Device type, operating system and browser version
• Cookie data and similar tracking technologies
• Login session times and durations
• Pages visited and features used within the platform

Communication Data:

• Records of conversations with the support team via live chat
• Emails sent to and received from ArenaPlus
• Feedback and complaints submitted

Personal data collected by ArenaPlus is used solely for the legitimate purposes stated below. We will not use your data for any other purpose without first obtaining fresh consent from you:

For marketing communications — including promotional information, exclusive VIP offers, and platform notifications — ArenaPlus will only send such communications if you have given your consent during registration or through your account settings. You may withdraw this consent at any time by updating your notification preferences in your account or by contacting our support team.

ArenaPlus does not sell, rent or disclose your personal data to third parties for their own commercial purposes. However, in the course of operating the platform, certain parties may be granted limited access to your data for legitimate and necessary reasons:

Technical Service Providers (Data Processors):

• Payment gateway providers: Providers that process transactions via DuitNow, FPX, Touch 'n Go, GrabPay, Boost and ShopeePay receive only the transaction data necessary to process payments.
• Cloud & hosting service providers: ArenaPlus servers are managed by cloud infrastructure providers bound by strict data processing agreements.
• Game providers: Providers such as Pragmatic Play, PG Soft and others receive the game session data necessary to run the games, but do not receive your financial information or full identity details.
• Analytics services: Anonymised usage data is used to understand user behaviour and improve the platform. No information that can personally identify you is shared for this purpose.

Legally Required Disclosures:

In the following situations, ArenaPlus may be required by law to disclose your data without your consent:

• By court order or directive from a legitimate Malaysian judicial authority
• To law enforcement authorities in the course of legitimate criminal investigations
• To the Malaysian Anti-Corruption Commission (MACC) or Bank Negara Malaysia in investigations related to money laundering
• In emergency situations involving a threat to life

In all such cases, ArenaPlus will only disclose the minimum data necessary and will notify you of such disclosure where permitted by law.

All third-party service providers working with arenaplus are bound by:

• Data processing agreements obligating them to protect your data
• Prohibition on using your data for their own purposes
• Obligation to delete data upon termination of services
• Technical security standards on par with ArenaPlus

ArenaPlus implement comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration or unintended disclosure.

• Encryption in Transit: All data transmitted between your device and ArenaPlus servers is protected by the latest version of TLS (Transport Layer Security) encryption — equivalent to 256-bit SSL.
• Encryption at Rest: Sensitive data stored in the ArenaPlus database is encrypted using AES-256 standards.
• Hashed Passwords: Your password is never stored in plain text — it is secured using a one-way cryptographic hashing algorithm that cannot be decrypted.
• Access Controls: Access to user data on our end is restricted to staff who require it solely to perform their duties (principle of least privilege).
• 24/7 Monitoring: Our security monitoring system operates around the clock to detect anomalies, intrusion attempts, or suspicious activity.
• Penetration Testing: ArenaPlus conducts regular security testing to identify and patch vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): You are encouraged to enable 2FA on your account for a significant additional layer of protection.
• Data Backup: Data is regularly backed up to a secure, separate location to ensure recovery is possible in the event of an incident.

While we take all reasonable precautions, no security system can be guaranteed 100% safe. You also play an important role in keeping your data secure — protect your password, do not share it, and contact us immediately if you suspect any unauthorised access to your account ArenaPlus you.

ArenaPlus retain your personal data only for as long as necessary for the stated purposes or as required by Malaysian law. The following are general data retention guidelines:

• Active Account Data: For as long as your account remains active and you are using ArenaPlus services.
• Financial Transaction Data: A minimum of 7 years after the transaction occurs, in accordance with Malaysia's accounting and AML legal requirements.
• KYC (Identity Verification) Data: Minimum 5 years after the business relationship ends, in accordance with AML legal requirements.
• Support Communication Records: 3 years after the conversation takes place, for reference and dispute resolution purposes.
• Technical Log Data: 12 months, after which it is anonymised or deleted.
• Marketing Data (with consent): Until you withdraw your consent or close your account.

Once the retention period expires, your data will be securely deleted or fully anonymised so that it can no longer be linked back to your identity. In cases where the law requires a longer retention period, ArenaPlus will comply with such requirements while ensuring that access to the relevant data is strictly limited.

ArenaPlus use cookies and similar tracking technologies to keep the platform running properly and to understand how users interact with our website. The following are the types of cookies we use:

• Essential Cookies (Required): These cookies are required for the platform's core functions — including maintaining your login session, saving language preferences, and ensuring session security. Without them, the platform cannot operate properly and cannot be disabled.
• Performance & Analytics Cookies: We use analytics tools to understand which pages are visited most frequently, how users navigate the platform, and where they encounter difficulties. This data is collected in aggregate and does not contain any information that could personally identify you.
• Functional Cookies: These cookies remember your preferences — such as text size, display settings and game preferences — to deliver a more personalised experience.
• Security Cookies: Used to identify suspicious access attempts, track devices used to log in, and protect your account from fraud.

You can manage or delete cookies through your browser settings at any time. However, disabling essential cookies may affect the functionality of the platform ArenaPlus. For more information on managing cookies in your browser, refer to your browser's help documentation.

In addition to cookies, ArenaPlus also uses technologies such as web beacons in emails to track whether an email has been opened and which links were clicked, helping us evaluate the effectiveness of our communications. You can prevent this by disabling automatic image loading in your email settings.

Under Malaysia's PDPA 2010, you have the following rights in relation to your personal data held by ArenaPlus. We are committed to processing all requests promptly and transparently:

• Right to Access: You may request a copy of all personal data we hold about you. We will provide this within 21 days of receiving a valid request.
• Right to Rectification: If any of your data is inaccurate or outdated, you may request a correction. Accurate data is essential to ensuring you receive the right level of service.
• Right to Withdraw Consent: For data processed based on your consent (such as marketing emails), you may withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing carried out prior to the withdrawal.
• Right to Object: You may object to the processing of your data for direct marketing purposes. Once we receive your objection, we will stop using your data for that purpose.
• Right to Erasure: Under certain circumstances, you may request the deletion of your data. This right is subject to our legal obligations to retain specific data (such as transaction records for AML purposes).

To exercise any of the above rights, contact us by email at support@arenaplus-jit.com with the subject line "Personal Data Rights Request" or via live chat on the platform. Please include your ArenaPlus username and clearly describe your request. We may need to verify your identity before processing the request to safeguard your account security.

Platform ArenaPlus is intended for individuals aged 18 and above only. We do not knowingly collect, store or process personal data from anyone under the age of 18.

During the registration process, prospective members are required to confirm that they are at least 18 years of age. ArenaPlus reserves the right to request age verification in the form of official documents at any time if we have reason to doubt a member's eligibility.

Should we discover that personal data belonging to an individual under the age of 18 has been collected inadvertently, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered an account with ArenaPlus are requested to contact us immediately at support@arenaplus-jit.com so that prompt action can be taken.

ArenaPlus reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new technologies adopted, or changes in relevant Malaysian law. We are committed to notifying you of any significant changes.

Notifications of significant changes will be provided via:

• A clear notice on the ArenaPlus platform's main page
• Email to the address registered to your account
• In-account notification upon your next login

Changes will take effect on the date stated in the notice, which is typically at least 14 days after the notification is sent, except for changes required immediately due to legal or security reasons. Continued use of the platform ArenaPlus after the effective date will be considered your acceptance of the updated Privacy Policy.

The last updated date is always displayed at the top of this document. We encourage you to review this Privacy Policy periodically to stay informed about our data protection practices.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way ArenaPlus handling your personal data, please reach out to us through the following channels:

• Email: support@arenaplus-jit.com (please include the subject line "Pertanyaan Privasi / Privacy Enquiry")
• Live Chat: Available 24/7 within the arenaplus platform — the fastest way to get a response
• For Platinum & Diamond VIP Members: Contact your personal account manager directly via WhatsApp

We aim to respond to all privacy-related enquiries within 5 business days. For more formal data rights requests, processing may take longer as described in Section 8.

If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia Personal Data Protection Department operating under the Ministry of Communications. Their contact details are available on the ministry's official website.