Rm40 Privacy Policy – Personal Data Protection for Malaysian Players

Rm40 is an online casino platform operating in Malaysia, built specifically for local players. We understand that your trust in rm40 depends not only on the quality of our games and the speed of withdrawals, but also on the confidence that your personal information is handled responsibly, securely, and transparently.

This rm40 Privacy Policy clearly and comprehensively sets out:

• The types of personal data rm40 collects from members during registration and use of the platform.
• Why that data is collected and how it is used in rm40's day-to-day operations.
• Who your data may be shared with and the circumstances under which such sharing occurs.
• How rm40 safeguards your data against unauthorised access, disclosure or modification.
• Your rights as a data subject and how you may exercise them.

This rm40 Privacy Policy applies to all individuals who access or use the rm40.my platform, including unregistered visitors, active registered members, and former members whose accounts have been closed but whose data is retained as required by law.

Rm40 collects your personal data through several channels — directly from you during registration or when you interact with the platform, automatically when you use rm40's services, and occasionally from legitimate third-party sources for identity verification purposes. The categories of data we collect are as follows:

Rm40 does not collect sensitive data such as health information, religious beliefs, or political views unless specifically required under applicable Malaysian law. If you find that rm40 is requesting data that seems irrelevant or inappropriate, please report it to us immediately.

Rm40 uses your personal data only for lawful, necessary and stated purposes. We never use your data beyond the scope described in this Privacy Policy without obtaining your fresh consent. The following are the primary purposes for which personal data is used at rm40:

• Account Management: To create, maintain and manage your rm40 account, including login, password recovery and profile updates.
• Payment Processing: To securely and efficiently process deposits and withdrawals via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay or FPX (Maybank2u, CIMB Clicks).
• Identity Verification (KYC): To comply with Malaysian legal requirements relating to identity verification, minimum age, and anti-money laundering (AML) obligations.
• Platform Security: To detect and prevent fraud, bot usage, multiple accounts, and other prohibited activities on the rm40 platform.
• Customer Support: To provide effective assistance when you contact the rm40 support team via live chat, email, or WhatsApp.
• Responsible Gaming: To monitor gameplay patterns in order to identify signs of problem gambling and provide appropriate assistance to members who may need it.
• Service Communications: To send you important notifications related to your account, security, promotions you have opted into, and changes to our terms.
• Platform Improvement: To analyse aggregate usage patterns in order to improve the overall user experience and service quality of rm40.

Rm40 does not sell, rent or disclose members' personal data to third parties for commercial purposes. However, there are limited circumstances in which rm40 needs to share your data to keep the platform running properly and to comply with Malaysian law:

• Payment Service Providers: rm40 shares necessary transaction information with payment providers such as Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX-participating banks solely for the purpose of processing your deposits and withdrawals.
• Technical Service Providers: Technology service providers that assist in operating rm40's infrastructure may have limited access to the technical data required to deliver their services. All such providers are bound by strict confidentiality agreements with rm40.
• Malaysian Authorities: rm40 may be required to disclose data to Malaysian government authorities, law enforcement bodies or courts when compelled to do so by law or a valid court order.
• Business Transfers: In the event of a business merger, acquisition, or sale of rm40 assets, user data may be transferred to the successor entity. You will be notified in advance and have the right to request deletion of your data before the transfer takes place.

In all of the above situations, rm40 ensures that only the minimum necessary data is shared and that recipients are bound by data protection obligations of the same rigorous standard as rm40. We never share your data with marketing companies, data brokers, or third-party advertisers.

Rm40 continuously invests in best-in-class security technologies and processes to ensure that every Malaysian member's personal data is protected to the highest standard. Below is an overview of the security layers we have in place:

• All rm40 member passwords are stored in an irreversible hash format using the bcrypt algorithm — not even rm40 itself can view your original password.
• Two-factor authentication (2FA) via SMS OTP is available and strongly recommended for all rm40 accounts as an added layer of security.
• Rm40's threat monitoring system operates 24 hours a day to detect and respond to any suspicious activity involving member data.
• Internal rm40 staff access to member data is restricted on a "need-to-know" basis — only personnel who require access to perform their duties are granted permission.
• All rm40 staff who handle members' personal data have undergone data protection training and are bound by strict confidentiality agreements.

While rm40 takes all reasonable measures to protect your data, no system can guarantee 100% security against every possible threat. In the event of a material data breach involving your personal data, rm40 is committed to notifying you within a reasonable timeframe and taking prompt remedial action.

Rm40 uses cookies and similar tracking technologies to enhance the user experience on our platform. Cookies are small text files stored on your device when you visit rm40.my. The following are the types of cookies we use:

• Essential Cookies: Required for the core functions of the rm40 platform, such as maintaining your login session, remembering your language preference, and enabling payment processes to run correctly. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Helps rm40 understand how members interact with the platform — the most frequently visited pages, time spent on each game, and general navigation patterns. This data is used in aggregate form and is not linked to any specific individual.
• Functional Cookies: Remembering your personal preferences — such as your last bet amount, display settings, and favourite games on rm40 — to deliver a more personalised and comfortable experience.
• Security Cookies: Helps rm40 detect suspicious login attempts, prevent session fraud, and protect your account from unauthorised access.

You can manage your cookie settings through your web browser preferences at any time. However, disabling certain cookies may affect the functionality and gaming experience on the rm40 platform. For guidance on managing cookies in Chrome, Safari, or Firefox, please refer to the help section of the respective browser.

In certain situations, rm40 member personal data may need to be transferred, processed, or stored outside Malaysia — for example, when rm40 utilises cloud server infrastructure operating across multiple locations to ensure high platform availability and fast response times for Malaysian users.

When cross-border data transfers occur, rm40 ensures that:

• The recipient country or region provides an adequate level of data protection comparable to the requirements of Malaysia's PDPA.
• Data recipients are bound by standard data transfer agreements that require a level of protection equivalent to that provided in Malaysia.
• Transfers are carried out only to the extent necessary for the stated purposes and do not exceed the required scope.

Rm40 retains members' personal data only for as long as necessary for the purposes for which it was collected and to meet applicable Malaysian legal requirements. The following are general guidelines for data retention periods at rm40:

• Active Account Data: Retained for the duration your rm40 account is active and for a minimum of 5 years after account closure for legal compliance purposes.
• Financial Transaction Records: Deposit, withdrawal and betting records are retained for a minimum of 7 years in accordance with Malaysian financial and tax legal requirements.
• Security Log Data: Access logs, login attempts and security activity records are retained for 2 years for security investigation purposes if required.
• Communication Records: Support emails and live chat records are retained for 3 years to allow reference to customer service history.
• KYC Verification Data: Identity verification documents are retained for a minimum of 5 years after account closure, in line with Malaysia's AML requirements.

Once the applicable retention period has elapsed, rm40 will securely and irreversibly delete or anonymise your data. If you request early deletion and no legal obligation prevents it, rm40 will process that request within 30 business days.

As an rm40 member and data subject under Malaysia's PDPA, you have the following important rights regarding your personal data, which rm40 is committed to respecting and facilitating:

To exercise any of the above rights, contact rm40's data protection team by emailing [email protected] with the subject line "Data Rights Request" along with your account details. rm40 will acknowledge receipt of your request within 3 business days and resolve it within 21 business days.

Rm40 is a platform intended exclusively for individuals aged 21 and above. We do not knowingly collect, store or process the personal data of anyone under the age of 21. rm40 enforces a strict age verification process at registration to prevent minors from accessing the platform.

Should rm40 discover that personal data belonging to someone under the age of 21 has been collected inadvertently, we will take immediate action to delete that data and close the relevant account. Parents or guardians who find that their child has registered an rm40 account without authorisation are encouraged to contact us at [email protected] as soon as possible.

Rm40 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, the latest legal requirements, or new rm40 platform features. We are committed to keeping you informed about how your data is managed.

When material changes are made to rm40's Privacy Policy, we will:

• Publishing a clear notice on the rm40.my homepage at least 14 days before the changes take effect.
• Sending email notifications to all registered rm40 members outlining the key changes made.
• Updating the "Updated" date at the top of this document to reflect the date of the latest revision.

Your continued use of the rm40 platform after changes take effect constitutes your acceptance of the amended Privacy Policy. If you do not agree with any of the changes, you have the right to close your rm40 account and request data deletion in accordance with the procedure described in Section 9.

Rm40 has appointed a Data Protection Officer responsible for ensuring compliance with this Privacy Policy. For any enquiries, concerns, or requests relating to your data privacy on the rm40 platform, please reach us through the following channels:

• Privacy Email: [email protected] – please use the subject line "Privacy Policy Enquiry" to ensure your message reaches the right team.
• rm40 Live Chat: Available 24 hours a day, 7 days a week within the rm40 platform for immediate assistance.
• WhatsApp: Via rm40's official WhatsApp number listed in the platform's support section.

Rm40 is committed to responding to all data privacy enquiries within 5 business days. If you are not satisfied that rm40 has adequately addressed your privacy concerns, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia in accordance with the PDPA 2010.