Privacy Policy

01 Introduction

This Privacy Policy (hereinafter referred to as "Policy") describes how PlayAja (hereinafter referred to as "PlayAja", "we", "us", or "our") collects, uses, stores, shares, and protects personal data relating to users (hereinafter "User", "Data Subject", "you") of the online gaming and sports betting platform accessible at https://playaja.cam.

PlayAja is committed to handling personal data responsibly and in accordance with internationally recognised data protection standards. We operate within the framework of the jurisdictions in which we hold our gaming licences, and we apply data processing practices consistent with the principles of data minimisation, purpose limitation, and storage limitation.

By registering an account with PlayAja or by continuing to use any service offered through the platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein. If you do not agree to this Policy, please discontinue use of the platform immediately.

02 Definitions

For the purposes of this Privacy Policy, the following definitions shall apply:

• "Personal Data" — any information relating to an identified or identifiable natural person. This includes name, identification number, email address, device identifiers, and payment information.
• "Processing" — any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, combination, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In the context of this Policy, that entity is PlayAja.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a contractual obligation.
• "KYC" — Know Your Customer: the identity verification process requiring submission of government-issued identification and supporting documentation.
• "Cookie" — a small file placed on your device by a website, used to store information about your visit or preferences.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "Data Breach" — a security incident in which personal data is accessed, disclosed, altered, or destroyed without authorisation.

03 Data Controller Information

PlayAja acts as the Data Controller for all personal data processed in connection with your use of the platform. PlayAja operates the website at https://playaja.cam and is responsible for determining how and why your personal data is processed.

For all data protection queries, requests, or complaints, you may contact the PlayAja Data Protection team using the contact information provided in Section 15 of this Policy.

04 Data We Collect

PlayAja collects personal data through several touchpoints across your interaction with the platform. The categories of data we collect are as follows:

4.1 Registration Data

When you create a PlayAja account, we collect: full legal name, date of birth, email address, phone number (optional at registration, required at KYC stage), country of residence, and the password you create (stored in hashed form — never in plain text).

4.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and responsible gambling requirements, we collect: a copy of your government-issued ID (Malaysian MyKad or passport), a selfie or live photo for liveness verification, proof of address (utility bill or bank statement), and where required, source of funds documentation.

4.3 Financial Data

We collect transaction records including deposit amounts, withdrawal requests, payment method references (e-wallet IDs, masked bank account numbers, masked card details), and currency (MYR). Full card numbers are never stored on PlayAja servers — they are processed directly by PCI-DSS compliant payment processors.

4.4 Technical & Device Data

We automatically collect: IP address, browser type and version, device type and operating system, session timestamps, pages visited, game history, and error logs. This data is used for security, fraud prevention, and platform analytics.

4.5 Communication Data

Records of your communications with PlayAja customer support — including live chat transcripts, email correspondence, and submitted support tickets — are retained for quality assurance and dispute resolution purposes.

4.6 Behavioural & Responsible Gambling Data

To fulfil our responsible gambling obligations, we monitor and retain data on wagering patterns, session durations, deposit frequency, and self-imposed limit settings. This data is used exclusively to identify and support at-risk players.

05 How We Use Your Data

PlayAja processes personal data for the following specific purposes:

06 Legal Basis for Processing

PlayAja relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing required to provide you with the services you have contracted for — account management, payment processing, game access, and customer support.
• Legal Obligation: Processing required to comply with applicable laws including anti-money laundering (AML) regulations, responsible gambling requirements, and licensing conditions imposed by our international gaming regulator.
• Legitimate Interests: Processing for purposes including fraud prevention, platform security, abuse detection, and anonymised analytics — where these interests are not overridden by your fundamental rights.
• Consent: Processing for optional purposes such as marketing communications and non-essential cookies — which you may withdraw at any time without affecting the legal basis for any prior processing.

07 Data Sharing & Third Parties

7.1 Service Providers (Data Processors)

PlayAja shares personal data with third-party service providers who assist in delivering the platform. All such providers act as Data Processors under data processing agreements that prohibit them from using your data for any purpose beyond the agreed service delivery. These providers include:

• Payment processors and e-wallet providers (for MYR transaction processing via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Connect, Visa, and Mastercard)
• KYC and identity verification service providers
• Cloud hosting and infrastructure providers
• Customer support platform providers
• Fraud detection and cybersecurity service providers
• Licensed game studio content delivery networks

7.2 Regulatory and Legal Disclosure

PlayAja may disclose personal data to relevant regulatory authorities, law enforcement bodies, or courts of competent jurisdiction where required to do so by applicable law, valid legal process, or as necessary to protect the rights, property, or safety of PlayAja, its users, or the public.

7.3 No Sale of Personal Data

PlayAja does not sell, rent, lease, or otherwise transfer your personal data to unaffiliated third parties for their own marketing, advertising, or commercial use. Any commercial arrangement with third parties is restricted to service delivery contexts covered by formal data processing agreements.

08 Data Retention

PlayAja retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, and audit obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of the account relationship and for a period of five (5) years following account closure, in accordance with AML regulatory requirements.
• KYC Documents: Retained for a minimum of five (5) years following the conclusion of the business relationship, as required under international AML frameworks applicable to our licensing jurisdiction.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, unless relevant to an ongoing dispute.
• Marketing Communication Preferences: Retained until consent is withdrawn, at which point promotional communications will cease within 10 business days.
• Technical and Log Data: Retained for up to twelve (12) months unless required for an ongoing security investigation.

09 Data Security

PlayAja implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS 1.2/1.3 encryption for all data transmitted between your device and PlayAja servers
• AES-256 encryption for data stored at rest, including sensitive user records
• Bcrypt password hashing — plaintext passwords are never stored
• Two-factor authentication (2FA) available for all account holders
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis
• Regular penetration testing and security audits by independent third-party firms
• 24/7 intrusion detection and anomaly monitoring systems
• PCI-DSS compliant payment processing infrastructure

10 Cookies & Tracking Technologies

PlayAja uses cookies and similar tracking technologies to operate the platform effectively and to improve user experience. The following categories of cookies are used:

PlayAja does not use third-party advertising cookies, cross-site tracking technologies, or social media pixel trackers. You may manage optional cookies through your browser settings at any time. Disabling essential or security cookies may impair the functionality of the platform.

11 Your Rights as a Data Subject

As a data subject, you hold the following rights with respect to your personal data processed by PlayAja. To exercise any of these rights, please contact us using the details in Section 15.

12 Children & Minors

PlayAja is strictly prohibited for individuals under the age of 21. We do not knowingly collect personal data from anyone under 21 years of age. If we become aware that personal data has been submitted by a minor, we will immediately suspend the associated account, delete all personal data collected, and take appropriate action in accordance with applicable law and our responsible gambling obligations.

If you are a parent or guardian and believe your child has registered an account on PlayAja, please contact us immediately at the address provided in Section 15 so that we may take prompt corrective action.

13 International Data Transfers

As an internationally operating platform, PlayAja may transfer personal data to countries outside of Malaysia where our service providers, data processors, or infrastructure providers are located. When such transfers occur, PlayAja ensures that adequate safeguards are in place, which may include:

• Standard contractual clauses approved by recognised data protection authorities
• Data processing agreements incorporating equivalent data protection standards
• Transfers only to jurisdictions that provide an adequate level of data protection as determined by our licensing authority

Users in Malaysia should note that their personal data may be processed in jurisdictions with data protection regimes that differ from Malaysia's Personal Data Protection Act 2010. By using PlayAja, you consent to such transfers occurring under the safeguards described above.

14 Changes to This Policy

PlayAja reserves the right to amend this Privacy Policy at any time. Where changes are material — meaning they affect your rights or how we use your data in a significant way — we will notify registered users via email or a prominent notice on the platform at least 14 days before the changes take effect.

Minor updates (such as clarifications of existing practices, correction of typographical errors, or administrative changes) may be made without advance notice. The "Last Updated" date at the top of this page will always reflect when the policy was most recently revised.

Continued use of the PlayAja platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should close your account and withdraw any remaining balance before the revision takes effect.

15 Contact Us

For all data protection matters, including subject access requests, rectification requests, erasure requests, or complaints regarding PlayAja's privacy practices, please contact our Data Protection team using the following details:

Our full Terms & Conditions and Responsible Gambling Policy are available on their respective pages. These documents are incorporated by reference into this Privacy Policy and should be read together.