Privacy Policy — How Jilibet Protects Your Data

This Privacy Policy ("Policy") describes how Jilibet ("we", "us", "the Platform", or "Jilibet"), operating the website at jilibet.casa, collects, processes, stores, discloses, and protects the personal data of individuals who register accounts, make transactions, or otherwise interact with our services.

Jilibet is an English-language online gambling platform designed specifically for Malaysian players, offering sports betting, live casino, slot games, and instant games in Malaysian Ringgit (MYR). In the course of providing these services, we are required to collect and process certain categories of personal information.

This Policy is incorporated by reference into our Terms & Conditions and should be read alongside those Terms. By registering an account or using the Jilibet Platform, you acknowledge that you have read and understood this Policy and consent to the processing activities described herein.

If you do not agree with this Policy, you should not register for or continue using the Jilibet Platform. You may close your account at any time and request deletion of your data subject to the retention requirements described in Section 9.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, identification number, financial details, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, disclosure, or deletion.
• "Data Subject" means the individual to whom the Personal Data relates — in the context of this Policy, this is the registered Account Holder or platform visitor.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — Jilibet is the Data Controller in respect of all data collected through jilibet.casa.
• "Data Processor" means a third party that processes Personal Data on behalf of Jilibet under a contractual arrangement and according to Jilibet's instructions.
• "KYC Data" means identity verification documentation including government-issued ID (e.g., Malaysian MyKad or passport), proof of address, and payment instrument verification.
• "Cookies" means small data files stored on your device by a web browser for the purposes of remembering session state, preferences, or tracking usage patterns.
• "PDPA" means the Malaysian Personal Data Protection Act 2010, the primary data protection legislation applicable to the collection and processing of personal data in Malaysia.

Jilibet collects the following categories of personal data from Account Holders and Platform visitors:

We do not collect sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) unless specifically required for responsible gambling compliance purposes and with your explicit consent.

Jilibet collects personal data through the following mechanisms:

• Direct provision by you: When you complete our registration form, submit KYC documents, initiate a deposit or withdrawal, contact customer support, or update your account profile, you provide data directly to us.
• Automated collection via the Platform: When you access jilibet.casa, our servers automatically record technical data including your IP address, browser fingerprint, device identifiers, and session activity. This occurs on every visit regardless of whether you are logged into an account.
• Payment processors: When you deposit or withdraw funds using Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank) or cryptocurrency networks, our payment partners transmit transaction reference data to us for reconciliation purposes.
• Identity verification partners: During the KYC process, we may engage a third-party document verification service to authenticate government-issued ID documents. These partners transmit a verification result and relevant extracted identity fields to us.
• Cookies and similar technologies: Our Platform uses first-party cookies and similar tracking technologies as described in Section 10 below.

Jilibet processes your personal data for the following defined purposes:

• Account creation and management: To register your account, verify your identity, maintain your profile, and enable access to the Platform's features.
• Transaction processing: To facilitate deposits and withdrawals in MYR through supported Malaysian payment channels and cryptocurrency networks.
• KYC and age verification: To confirm that you meet the minimum age requirement of 21 years and that your identity matches the payment methods registered on your account.
• Fraud prevention and security: To detect and prevent unauthorised access, identity theft, bonus abuse, money laundering, and other fraudulent or criminal activity on the Platform.
• Regulatory compliance: To meet our obligations under applicable anti-money laundering (AML) regulations, financial reporting requirements, and any directions issued by competent regulatory authorities.
• Customer support: To respond to your enquiries, resolve complaints, and maintain records of support interactions for quality assurance.
• Responsible gambling: To monitor betting patterns for signs of problem gambling behaviour, enforce self-exclusion decisions, and administer deposit and loss limit tools.
• Platform improvement: To analyse aggregated usage data and improve the performance, design, and content of the Jilibet Platform.
• Marketing communications: With your explicit opt-in consent, to send you promotional offers, bonus notifications, and platform updates relevant to your interests. You may opt out at any time.

Jilibet does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review.

Every processing activity conducted by Jilibet is grounded in one of the following lawful bases:

• Contractual necessity: Processing required to fulfil the contract between you and Jilibet when you register an account and use our services — including account management, transaction processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, financial reporting obligations, and directions from competent regulatory authorities.
• Legitimate interests: Processing conducted in pursuit of Jilibet's legitimate business interests — including fraud prevention, platform security, and service improvement — where these interests are not overridden by your fundamental rights.
• Your consent: Processing for marketing communications and certain cookie categories, where we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without penalty by updating your account preferences or contacting us.

Jilibet does not sell, rent, or trade your personal data. We share your data only in the following limited and defined circumstances:

• Service providers and Data Processors: We engage third-party companies to provide specific operational functions on our behalf, including payment processing (e.g., FPX gateway operators, DuitNow service providers), identity verification services, cloud infrastructure providers, and customer support software. These processors are contractually bound to process your data only as instructed by Jilibet and to maintain appropriate security standards.
• Regulatory and legal authorities: Where required by applicable law, court order, or direction from a competent regulatory body, we will disclose personal data to the relevant authority. This includes disclosures to Malaysian financial intelligence authorities in connection with AML obligations.
• Fraud prevention networks: In the event of suspected fraud, chargebacks, or financial crime, we may share relevant data with fraud prevention services or financial institutions involved in the investigation.
• Business transfers: In the event that Jilibet or its parent entity undergoes a merger, acquisition, or sale of material assets, personal data held by Jilibet may be transferred as part of that transaction, subject to appropriate confidentiality obligations and notification to affected data subjects.

In all cases of third-party data sharing, Jilibet ensures that appropriate contractual and technical safeguards are in place to protect the security and confidentiality of your personal data.

Jilibet's primary platform infrastructure is hosted on servers in secure data centre facilities. In the course of providing certain services — including cloud storage, identity verification, and game content delivery — your personal data may be transferred to and processed in jurisdictions outside Malaysia.

Where such international transfers occur, Jilibet ensures that adequate safeguards are in place, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules where applicable to intra-group transfers;
• Transfer to jurisdictions recognised as providing an adequate level of data protection.

You may request information about the safeguards applicable to a specific cross-border transfer by contacting us at [email protected]. We will respond within a reasonable timeframe consistent with our obligations.

Jilibet retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with a specific individual. Where anonymised data is retained for analytical purposes, it no longer constitutes personal data under applicable law.

Jilibet uses cookies and similar tracking technologies on jilibet.casa for the following purposes:

• Strictly necessary cookies: Required to operate the Platform's core functionality, including session management, login state maintenance, and security token validation. These cannot be disabled without rendering the Platform non-functional.
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gambling tool configurations to improve your experience across sessions.
• Performance / analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform — which pages are visited most, where users encounter errors, and how navigation flows can be improved. No individual player is identified through these cookies.
• Marketing cookies (opt-in only): Used to track whether you have viewed or engaged with promotional content within the Platform. These are only activated with your explicit consent and can be disabled in your account preferences.

You may manage your cookie preferences through your browser settings. Disabling certain categories of cookies may affect Platform functionality. Jilibet does not use third-party advertising cookies or tracking pixels from social media platforms.

As a data subject and Jilibet Account Holder, you have the following rights in respect of your personal data:

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Subject Request". We will acknowledge your request within 5 business days and aim to resolve it within 30 days. Complex or multiple requests may take up to 60 days, in which case we will notify you of the extension and the reason for it.

Please note that certain rights are subject to limitations where processing is required by law or for the establishment, exercise, or defence of legal claims. For example, transaction records subject to AML retention requirements cannot be erased prior to the end of the applicable retention period.

Jilibet's services are strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals below the age of 21.

Our registration process includes a date-of-birth declaration, and all accounts are subject to KYC age verification using government-issued identification documents. Accounts identified as belonging to persons under 21 will be immediately suspended, their funds returned to the originating payment source, and all associated personal data processed in accordance with our AML retention obligations before deletion.

If you believe that a minor has registered an account on Jilibet or that personal data of a person under 21 is being processed by our Platform, please contact us immediately at [email protected]. We take such reports seriously and will investigate and act promptly.

Jilibet implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption in transit: All data exchanged between your device and our servers is encrypted using TLS 1.3 with 256-bit symmetric encryption — the same standard employed by major Malaysian banking institutions.
• Encryption at rest: Personal data and financial records stored in our databases are encrypted using AES-256 before being written to disk.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. All staff with access to production data undergo background screening and are bound by confidentiality obligations.
• Intrusion detection: Our infrastructure is monitored continuously for anomalous activity by an automated security operations system, with escalation to our security team for human review of high-severity alerts.
• Penetration testing: We conduct periodic independent security assessments of our Platform to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: In the event of a security incident involving personal data, we have a documented incident response procedure that includes notification to affected data subjects and, where required, to relevant regulatory authorities within legally prescribed timeframes.

While we implement industry-standard security measures, no system is entirely immune to attack. We encourage you to protect your own account by using a strong, unique password and enabling any available authentication features on your account.

Jilibet reviews this Privacy Policy periodically and updates it to reflect changes in our data processing practices, applicable law, or regulatory guidance. The "Last Updated" date at the top of this page indicates when the most recent revision took effect.

When material changes are made — meaning changes that affect the nature of data collected, the purposes for which it is used, or your rights as a data subject — we will:

• Update the "Last Updated" date at the top of this page;
• Display a prominent notification banner on the Platform for at least 14 days;
• Send a notification to your registered email address summarising the key changes.

Where a material change involves processing your data in a new way that requires fresh consent, we will request that consent explicitly before the new processing begins. Your continued use of the Platform after the effective date of an amendment constitutes acceptance of the updated Policy, except where consent is required.

Minor administrative updates — such as corrections of typographical errors, clarification of existing provisions without substantive change, or updates to contact details — will be made without formal notification, though the "Last Updated" date will be revised.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by Jilibet, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — Subject line: "Privacy Enquiry" or "Data Subject Request" as appropriate. Plain text only — this address is not a clickable link.
• Live Chat: Available directly on jilibet.casa, 24 hours a day, 7 days a week. For privacy-related matters, agents will escalate your enquiry to the relevant data protection team member.
• Response time: We aim to acknowledge all privacy-related correspondence within 2 business days and to provide a substantive response within 14 business days. Complex Data Subject Requests may take up to 30 days.

We take privacy concerns seriously and are committed to resolving them fairly and transparently. If you remain dissatisfied with our response to a privacy complaint after following our internal resolution process, you may refer the matter to the relevant data protection authority in your jurisdiction.

For responsible gambling-related enquiries — including self-exclusion, account restrictions, or mental health support — please refer to our Responsible Gambling page for the appropriate contacts and resources available to Malaysian players.