Privacy Policy —
How 1stbet Protects Your Personal Data

This Privacy Policy ("Policy") is issued by 1stbet ("we", "us", "our", "the Platform"), the operator of the online gambling and sports betting services accessible at https://1stbet.cam and all associated subdomains and mobile applications. It describes how 1stbet collects, processes, stores, and protects the personal data of individuals ("you", "the User", "the Player") who access or use the Platform.

This Policy applies to all registered and prospective users of the 1stbet Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations in Malaysia from which the Platform is accessed. By registering an account, you confirm that you have read and understood this Policy and consent to the processing of your personal data in accordance with its terms.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the agreement between you and 1stbet.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or in combination with other data, including name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Controller" means the entity that determines the purposes and means of processing personal data — in this context, 1stbet as the Platform operator.
• "Data Subject" means the identifiable natural person to whom personal data relates — in this context, the registered or prospective User of the 1stbet Platform.
• "Consent" means a freely given, specific, informed, and unambiguous indication by which a Data Subject signifies agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity and address verification procedure required under anti-money laundering and responsible gambling compliance obligations.
• "Third Party" means any natural or legal person other than the Data Subject and 1stbet, including payment processors, game content providers, and regulatory authorities.
• "Cookies" means small text files placed on a User's device by the Platform to facilitate session management, analytics, and personalised user experience functions.

1stbet collects personal data from Users through three primary channels: (a) data provided directly by the User, (b) data generated automatically through use of the Platform, and (c) data received from authorised third parties for verification or fraud prevention purposes.

3.1 Data Provided Directly by the User

• Full legal name as it appears on a government-issued identity document;
• Date of birth (for mandatory age verification — 1stbet is a 21+ platform);
• Residential address, including city, state, and postcode within Malaysia;
• Valid email address used as the primary account identifier and communication channel;
• Mobile phone number for account verification and optional two-factor authentication;
• Copies of identity documents submitted during KYC verification (e.g., Malaysian MyKad, passport);
• Proof of payment method ownership submitted during withdrawal verification;
• Any correspondence sent to our support team, including live chat transcripts and email communications.

3.2 Data Generated Automatically Through Platform Use

• IP address and approximate geolocation data at the time of each login and transaction;
• Device type, operating system, browser type, and screen resolution;
• Session duration, pages visited, and interaction patterns within the Platform;
• Transaction records including deposit amounts, withdrawal requests, and wagering history;
• Login timestamps and authentication events;
• Cookie identifiers and similar tracking technology data as described in Section 8.

3.3 Data Received from Third Parties

• Identity verification results from licensed KYC and anti-fraud service providers;
• Transaction confirmation data from payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, and CIMB Clicks;
• Responsible gambling self-exclusion status from recognised gambling exclusion registries where applicable.

All processing of personal data by 1stbet is grounded in one or more of the following lawful bases:

1stbet uses the personal data it collects for the following specific and documented purposes:

• Account Management: Creating, maintaining, and verifying your account, including processing login requests, password resets, and account security alerts;
• Financial Transactions: Processing MYR deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank transfers; executing withdrawal requests to verified Malaysian bank accounts and e-wallets; and maintaining transaction records;
• Identity Verification (KYC): Confirming that you meet the minimum age requirement of 21 years and verifying that your identity, address, and payment methods are legitimate and match registered account details;
• Regulatory Compliance: Meeting obligations under applicable anti-money laundering, counter-terrorism financing, and responsible gambling laws;
• Customer Support: Responding to your queries, resolving complaints, processing refunds, and providing technical assistance across live chat, email, and WhatsApp channels;
• Promotional Communications: Sending you information about promotions, bonuses, and platform updates — but only where you have provided consent to receive marketing communications. You may withdraw this consent at any time;
• Fraud Prevention and Platform Security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct;
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the Platform's features, performance, and user experience — including the betting markets, slot library, and payment flow.

1stbet does not sell, rent, or transfer your personal data to third parties for their own marketing or commercial purposes. Data sharing is limited to the following specific circumstances:

• Payment Processors: We share transaction data with our authorised payment partners — including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong — solely to the extent necessary to complete your deposit or withdrawal request;
• Identity Verification Providers: We share identity document data with licensed KYC service providers to fulfil our age and identity verification obligations. These providers are contractually bound to process data only for the specified verification purpose;
• Game Content Providers: Session data and account reference numbers may be shared with our certified game providers to facilitate gameplay, resolve disputes, and verify RNG audit trails. Game providers do not receive your full personal profile;
• Regulatory and Law Enforcement Authorities: We will disclose personal data to regulatory authorities, law enforcement agencies, or financial intelligence units where we are legally required to do so, including under anti-money laundering legislation or pursuant to a court order;
• Professional Advisers: We may share limited data with legal counsel, auditors, and professional advisers under strict confidentiality obligations where necessary to obtain professional advice or manage legal proceedings.

1stbet handles payment data with a heightened level of care given its sensitive nature. All financial transactions are processed over encrypted channels. Full payment card numbers and full bank account credentials are never stored on 1stbet's servers — payment processing is handled by our PCI-DSS compliant payment partners.

Where you submit payment documents for withdrawal verification purposes (such as a bank statement or e-wallet screenshot), these documents are stored securely and accessed only by the verification team. Documents submitted solely for verification are retained only for as long as required under our regulatory obligations and are then securely destroyed.

1stbet uses cookies and similar technologies to operate certain essential platform functions and, where you have provided consent, to improve your experience through analytics and personalisation. The types of cookies used by 1stbet are described below:

You may manage your cookie preferences at any time through the cookie settings panel accessible in the Platform footer. Disabling non-essential cookies will not affect your ability to access core Platform functionality, including deposits, withdrawals, and gameplay.

1stbet retains personal data for only as long as is necessary for the specific purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account data (name, contact information, login records): Retained for the duration of your active account, plus a minimum of five (5) years following account closure to meet anti-money laundering record-keeping requirements;
• Financial transaction records (deposits, withdrawals, wagering history): Retained for a minimum of five (5) years from the date of the transaction, in compliance with applicable financial regulations;
• KYC verification documents: Retained for the duration of your account and for five (5) years following account closure;
• Support correspondence (chat transcripts, emails): Retained for three (3) years from the date of last interaction unless a longer period is required for ongoing dispute resolution;
• Marketing consent records: Retained indefinitely to evidence consent, but the underlying marketing data processing ceases immediately upon withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

1stbet implements a multi-layered security programme to protect the personal data of all registered users from unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and the 1stbet Platform is encrypted using TLS 1.2 or higher. This ensures that data transmitted during login, deposits, withdrawals, and gameplay cannot be intercepted by third parties;
• Encrypted Data Storage: Sensitive data fields including identity document information and authentication credentials are stored in encrypted form on our servers using industry-standard encryption algorithms;
• Access Controls: Internal access to production systems and personal data is restricted to authorised personnel using role-based access controls. All access is logged and subject to periodic audit review;
• Two-Factor Authentication: Users are strongly encouraged to enable two-factor authentication (2FA) on their accounts as an additional layer of protection against unauthorised access;
• Continuous Monitoring: Our security infrastructure is monitored continuously for anomalous activity, potential intrusions, and fraud indicators. Suspected security incidents are escalated immediately to our security response team;
• Third-Party Security Audits: 1stbet commissions periodic third-party security assessments of its infrastructure to identify and remediate vulnerabilities.

As a registered user of the 1stbet Platform, you hold the following rights in respect of your personal data. These rights may be exercised by contacting our support team using the contact details provided in Section 15.

• Right of Access: You have the right to request a copy of the personal data that 1stbet holds about you, including a description of the categories of data, the purposes for which it is processed, and any third parties to whom it has been disclosed;
• Right of Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by 1stbet. You may also update basic account details directly through your account settings panel;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn and no other lawful basis applies, or where the data has been processed unlawfully. This right is subject to overriding legal retention obligations;
• Right to Restriction of Processing: You may request that 1stbet temporarily suspend the processing of your personal data while the accuracy of the data or the lawfulness of processing is being investigated;
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to Object: You have the right to object to processing of your personal data that is carried out on the basis of legitimate interest. You also have the absolute right to object to processing for direct marketing purposes at any time;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The 1stbet Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, process, or store personal data from persons under the age of 21. Date of birth is a mandatory field during account registration and is used specifically to enforce this age restriction.

Where 1stbet has reason to believe that an account is held by or used on behalf of a person under the age of 21, the account will be suspended immediately pending age verification. If a minor's use of the Platform is confirmed, the account will be permanently closed, all associated data will be deleted (subject to any mandatory legal retention obligations), and the matter may be referred to appropriate authorities where required by law.

Parents and guardians are encouraged to make use of parental control software to restrict access to online gambling platforms. If you believe that a minor in your household has registered an account on 1stbet, please contact our support team immediately at [email protected].

As an internationally operating platform, 1stbet may transfer certain personal data to servers or processors located outside Malaysia, including in the jurisdiction of our gaming licence authority. Where such transfers occur, 1stbet ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections afforded under applicable Malaysian data protection legislation.

Safeguards for international data transfers employed by 1stbet include contractual data processing agreements with all third-party processors, compliance with the data transfer requirements of applicable licensing authorities, and, where relevant, the application of standard contractual clauses that obligate the recipient to maintain appropriate data protection standards.

1stbet reserves the right to amend, update, or replace any provision of this Privacy Policy at any time, in response to changes in applicable law, regulatory requirements, business operations, or data processing practices. The updated Policy will be published on this page with a revised effective date.

Where a change to this Policy is material — meaning it significantly alters how your personal data is used or your rights in respect of it — 1stbet will notify registered users via email or through an in-platform notification at least fourteen (14) days before the change takes effect. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a data-related concern, please contact 1stbet using the following channels. All privacy-related enquiries are handled by our dedicated data protection team.

When submitting a data rights request, please include your registered email address and a clear description of your request. We may need to verify your identity before processing certain requests to ensure the security of your account.

All formal data rights requests will be acknowledged within 48 hours and responded to substantively within the timeframes set out in Section 11 of this Policy.