Privacy Policy

01Introduction

This Privacy Policy ("Policy") describes how SpotBet ("SpotBet", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at https://spotbet.casa (the "Platform"), collects, uses, discloses, and protects the personal data of registered players and website visitors ("you" or "the Player").

SpotBet operates as an English-language online gaming platform serving players across Malaysia, including those located in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other regions of the country. All financial transactions are denominated in Malaysian Ringgit (MYR / RM) as the primary currency unless cryptocurrency equivalent is expressly confirmed at the time of a transaction.

By accessing the Platform, creating an account, or submitting any personal information to SpotBet, you acknowledge that you have read this Policy and consent to the collection, use, and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which form part of the overall agreement between you and SpotBet.

02Data Controller

For the purposes of applicable data protection legislation, SpotBet is the data controller in respect of all personal data collected through the Platform. This means SpotBet determines the purposes for which, and the manner in which, your personal data is processed.

Where SpotBet engages third-party service providers — such as payment processors, identity verification services, or analytics providers — those parties act asdata processors on SpotBet's behalf, bound by written data processing agreements that prohibit them from using your data for any purpose other than the provision of their contracted service to SpotBet.

All enquiries relating to this Policy or to your personal data should be addressed to SpotBet's data team. Contact details are provided in Clause 15 of this Policy.

03Data We Collect

SpotBet collects the following categories of personal data, depending on your interaction with the Platform:

3.1 Data You Provide Directly

3.2 Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage data: Pages visited on the Platform, game sessions accessed, betting activity, deposit and withdrawal history, login timestamps, and session duration.
• Cookie data: Session cookies, preference, and analytics cookies as described in Clause 10 of this Policy.
• Geolocation data: Approximate location derived from your IP address, used to verify that you are accessing the Platform from a permitted jurisdiction and not a Restricted Territory.

3.3 Data from Third Parties

SpotBet may receive personal data about you from third-party identity verification providers engaged to fulfil KYC obligations. This may include confirmation of your identity, age, and address status from official databases. SpotBet may also receive limited information from payment processors — such as DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch'n Go eWallet, Boost, and GrabPay — to confirm the ownership and status of the payment method associated with your account.

3.4 Special Category Data

SpotBet does not intentionally collect sensitive personal data (such as data concerning health, ethnicity, religious beliefs, or biometric data) as part of its standard account management process. Where a Player voluntarily discloses health-related information in the context of a responsible gambling self-exclusion request, such data is processed solely for the purpose of applying the requested protective measures and is stored with heightened access restrictions.

04How We Use Your Data

SpotBet processes personal data for the following specific purposes:

• Account creation and management: To register your account, verify your identity, process deposits and withdrawals, and maintain your account in accordance with our Terms & Conditions.
• KYC and regulatory compliance: To verify your age (minimum 21 years), confirm the legitimacy of your payment methods, and comply with applicable anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Transaction processing: To facilitate deposits and withdrawals via all supported Malaysian payment methods, including DuitNow, FPX, and e-wallets, and to maintain accurate financial records of all account activity.
• Customer support: To respond to your enquiries, process complaints, resolve disputes, and deliver the multilingual (English, Bahasa Melayu, and Chinese) support service that SpotBet provides around the clock.
• Platform security and fraud prevention: To detect and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and any other activity that violates our Terms or applicable law.
• Responsible gambling compliance: To apply and monitor deposit limits, session time limits, self-exclusion elections, and reality checks requested by Players pursuant to our Responsible Gambling Policy.
• Platform improvement and analytics: To analyse aggregated, anonymised usage data to improve the functionality, game selection, payment performance, and overall user experience of the Platform.
• Marketing communications: To send you promotional offers, bonus notifications, and news about SpotBet where you have provided explicit consent. See Clause 13 for details on how to manage your marketing preferences.
• Legal obligations: To comply with any applicable court order, regulatory directive, or law enforcement request requiring the disclosure or retention of personal data.

05Legal Basis for Processing

SpotBet processes your personal data on the following legal grounds, as applicable to each processing activity:

• Contractual necessity: Processing that is required to perform the contract between you and SpotBet — including account creation, deposit and withdrawal processing, and the delivery of gaming services.
• Legal obligation: Processing required to comply with applicable law, including KYC identity verification, AML transaction monitoring, and the retention of financial records.
• Legitimate interests: Processing carried out to pursue SpotBet's legitimate business interests in platform security, fraud prevention, and service improvement, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your explicit, freely given consent — primarily in the context of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

06Data Sharing & Third Parties

SpotBet does not sell, rent, or otherwise transfer your personal data to third parties for commercial purposes. SpotBet shares personal data only with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Payment service providers: Including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing services. Shared data is limited to the information required to authenticate and complete a financial transaction.
• Identity verification providers: Third-party KYC service providers that assist SpotBet in verifying player identity and age as part of regulatory compliance. Data shared is limited to the documents and information required for verification and is not retained by the provider beyond the verification process.
• Technology and hosting providers: Cloud infrastructure, server hosting, and content delivery network (CDN) providers that support the technical operation of the Platform. These providers act as data processors under contractual data processing agreements.
• Customer support platforms: Third-party live chat and email support systems used to deliver SpotBet's multilingual support service. Correspondence and basic account identifiers may be accessible to the system.
• Legal and regulatory authorities: Government agencies, regulators, law enforcement bodies, or courts where disclosure is required or authorised by applicable law, including in relation to AML and CTF obligations or in response to a valid legal process.
• Auditors and professional advisers: Legal, financial, and security auditors engaged to provide services to SpotBet, subject to binding professional confidentiality obligations.

07International Data Transfers

SpotBet's primary player base is in Malaysia, and the Platform is operated for Malaysian users. In the course of delivering its services, SpotBet may transfer personal data to service providers or infrastructure partners located outside of Malaysia. Where such transfers occur, SpotBet takes all reasonable steps to ensure that the receiving party provides an equivalent level of data protection through one or more of the following safeguards:

• Contractual clauses imposing data protection obligations on the receiving party that are equivalent to those applied by SpotBet;
• The receiving jurisdiction having been assessed as providing an adequate level of data protection; or
• Binding corporate rules or other recognised transfer mechanisms applicable to the relevant transfer.

If you have specific questions about international data transfers that affect your personal data, you may contact SpotBet's data team using the contact details set out in Clause 15.

08Data Retention

SpotBet retains personal data only for as long as is necessary for the purposes described in this Policy, subject to any overiding legal obligations to retain data for longer periods. The following table sets out SpotBet's standard retention periods by data category:

Data Category	Standard Retention Period	Basis for Retention
Account registration data	Duration of account + 5 years after closure	Legal obligation (AML / financial records)
KYC identity documents	Duration of account + 5 years after closure	Legal obligation (KYC / AML compliance)
Transaction records	7 years from transaction date	Legal obligation (financial reporting)
Betting and game history	Duration of account + 3 years after closure	Contractual / legitimate interest
Support correspondence	3 years from last interaction	Legitimate interest (dispute resolution)
Marketing consent records	Until consent is withdrawn + 1 year	Legal obligation (consent audit trail)
Self-exclusion records	Permanent (for permanent exclusions); exclusion period + 1 year for temporary exclusions	Responsible gambling obligations
Analytics and usage data (anonymised)	3 years	Legitimate interest (product improvement)

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data has been anonymised, it may be retained indefinitely in aggregated form for statistical and research purposes without identifying any individual.

09Security Measures

SpotBet implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the Platform;
• Encrypted storage of sensitive fields including passwords (stored as irreversible hashes), payment method details, and identity documents;
• Role-based access controls ensuring that internal personnel can access personal data only to the extent required for their specific job function;
• Two-factor authentication (2FA) available to all Players for login security, and applied by default to all administrative access;
• Regular security audits and penetration testing conducted by qualified third-party specialists;
• Incident response procedures in place to detect, contain, and report data security incidents within the timeframes required by applicable law.

While SpotBet takes all reasonable and technically practicable steps to protect your data, no internet-based service can guarantee absolute security. You are responsible for maintaining the confidentiality of your account login credentials. If you suspect that your account has been accessed without your authorisation, you must notify SpotBet immediately via live chat or email.

10Cookies & Tracking Technologies

SpotBet uses cookies and similar technologies on the Platform. A cookie is a small text file placed on your device by a website when you visit it. Cookies allow the website to recognise your device on subsequent visits and to store preferences and session state.

SpotBet uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled as they are essential to the service.
• Functional cookies: Used to remember your language preference, display settings, and responsible gambling tool configurations between sessions.
• Analytics cookies: Used to collect anonymised, aggregated data on how Players use the Platform — such as which pages are visited most frequently and at what times — to help SpotBet improve the Platform. Analytics data is not linked to any identified individual.
• Security cookies: Used to detect fraudulent activity, bot access, and unusual login patterns to protect the integrity of your account and the Platform.

SpotBet does not use third-party advertising or cross-site tracking cookies. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may affect the functionality of the Platform.

11Your Data Rights

Subject to applicable data protection law, you have the following rights in respect of the personal data that SpotBet holds about you. SpotBet will respond to all valid rights requests within30 calendar days at no charge, unless the request is manifestly unfounded or excessive.